Skip to content

Commit 4476173

Browse files
dantecatalfamodantecatalfamo
authored
Cherry pick commits from vpp no fallback branch (#21896)
#21893
1 parent 616523f commit 4476173

File tree

3 files changed

+96
-86
lines changed

3 files changed

+96
-86
lines changed

‎server/datastore/mysql/vpp.go

+31-14
Original file line numberDiff line numberDiff line change
@@ -793,20 +793,6 @@ func (ds *Datastore) UpdateVPPTokenTeams(ctx context.Context, id uint, teams []u
793793
stmtDeleteApps := `DELETE FROM vpp_apps_teams WHERE vpp_token_id = ?`
794794
deleteArgs := []any{id}
795795

796-
if len(teams) > 0 {
797-
// If we're adding a VPP token to one or more teams, delete
798-
// any VPP apps already assigned to those teams (using the All
799-
// teams token)
800-
questions := make([]string, 0, len(teams))
801-
802-
for _, team := range teams {
803-
questions = append(questions, "?")
804-
deleteArgs = append(deleteArgs, team)
805-
}
806-
807-
stmtDeleteApps += fmt.Sprintf(" OR global_or_team_id IN (%s)", strings.Join(questions, ","))
808-
}
809-
810796
var values string
811797
var args []any
812798
// No DB constraint for null_team_type, if no team or all teams
@@ -1112,6 +1098,37 @@ TEAMLOOP:
11121098

11131099
func checkVPPNullTeam(ctx context.Context, tx sqlx.ExtContext, currentID *uint, nullTeam fleet.NullTeamType) error {
11141100
nullTeamStmt := `SELECT vpp_token_id FROM vpp_token_teams WHERE null_team_type = ?`
1101+
anyTeamStmt := `SELECT vpp_token_id FROM vpp_token_teams WHERE null_team_type = 'allteams' OR null_team_type = 'noteam' OR team_id IS NOT NULL`
1102+
1103+
if nullTeam == fleet.NullTeamAllTeams {
1104+
var ids []uint
1105+
if err := sqlx.SelectContext(ctx, tx, &ids, anyTeamStmt); err != nil {
1106+
return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
1107+
}
1108+
1109+
if len(ids) > 0 {
1110+
if len(ids) > 1 {
1111+
return ctxerr.Wrap(ctx, errors.New("Cannot assign token to All teams, other teams have tokens"))
1112+
}
1113+
if currentID == nil || ids[0] != *currentID {
1114+
return ctxerr.Wrap(ctx, errors.New("Cannot assign token to All teams, other teams have tokens"))
1115+
}
1116+
}
1117+
}
1118+
1119+
var id uint
1120+
allTeamsFound := true
1121+
if err := sqlx.GetContext(ctx, tx, &id, nullTeamStmt, fleet.NullTeamAllTeams); err != nil {
1122+
if errors.Is(err, sql.ErrNoRows) {
1123+
allTeamsFound = false
1124+
} else {
1125+
return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
1126+
}
1127+
}
1128+
1129+
if allTeamsFound && currentID != nil && *currentID != id {
1130+
return ctxerr.Wrap(ctx, errors.New("All teams token already exists"))
1131+
}
11151132

11161133
if nullTeam != fleet.NullTeamNone {
11171134
var id uint

‎server/datastore/mysql/vpp_test.go

+59-72
Original file line numberDiff line numberDiff line change
@@ -740,7 +740,7 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
740740
assert.Equal(t, dataToken.Token, tok.Token)
741741
assert.Equal(t, orgName, tok.OrgName)
742742
assert.Equal(t, location, tok.Location)
743-
assert.NotNil(t, tok.Teams) // "All Teams" teamm array is non-nil but empty
743+
assert.NotNil(t, tok.Teams) // "All Teams" teams array is non-nil but empty
744744
assert.Len(t, tok.Teams, 0)
745745

746746
toks, err = ds.ListVPPTokens(ctx)
@@ -775,7 +775,7 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
775775

776776
// Assign to team "No Team"
777777
upTok, err = ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{0})
778-
assert.NoError(t, err)
778+
require.NoError(t, err)
779779
assert.Len(t, upTok.Teams, 1)
780780
assert.Equal(t, tokID, upTok.ID)
781781
assert.Equal(t, uint(0), upTok.Teams[0].ID)
@@ -921,13 +921,33 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
921921
assert.NoError(t, err)
922922
assert.Len(t, toks, 2)
923923

924+
// Remove tokAll from All teams
925+
tokAll, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, nil)
926+
assert.NoError(t, err)
927+
924928
tokTeam, err := ds.InsertVPPToken(ctx, dataToken3)
925929
assert.NoError(t, err)
930+
926931
_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID})
927932
assert.NoError(t, err)
928933
_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID, team.ID})
929934
assert.Error(t, err)
930935

936+
// Cannot move tokAll to all teams now
937+
_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
938+
assert.Error(t, err)
939+
940+
_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{0})
941+
assert.NoError(t, err)
942+
943+
_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
944+
assert.Error(t, err)
945+
946+
_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID})
947+
assert.NoError(t, err)
948+
949+
///
950+
931951
toks, err = ds.ListVPPTokens(ctx)
932952
assert.NoError(t, err)
933953
assert.Len(t, toks, 3)
@@ -968,7 +988,7 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
968988
assert.NoError(t, err)
969989
assert.Len(t, toks, 5)
970990

971-
// Test fallback to all teams
991+
///
972992
tokNil, err := ds.GetVPPTokenByTeamID(ctx, nil)
973993
assert.NoError(t, err)
974994
assert.Equal(t, tokTeams.ID, tokNil.ID)
@@ -993,8 +1013,7 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
9931013
assert.Equal(t, tokTeams.ID, tokNil.ID)
9941014

9951015
tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
996-
assert.NoError(t, err)
997-
assert.Equal(t, tokAll.ID, tokTeam1.ID)
1016+
assert.Error(t, err)
9981017

9991018
tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
10001019
assert.NoError(t, err)
@@ -1005,32 +1024,35 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
10051024
assert.NoError(t, err)
10061025

10071026
tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
1008-
assert.NoError(t, err)
1009-
assert.Equal(t, tokAll.ID, tokNil.ID)
1027+
assert.Error(t, err)
1028+
assert.True(t, fleet.IsNotFound(err))
10101029

10111030
tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
1012-
assert.NoError(t, err)
1013-
assert.Equal(t, tokAll.ID, tokTeam1.ID)
1031+
assert.Error(t, err)
1032+
assert.True(t, fleet.IsNotFound(err))
10141033

10151034
tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
1016-
assert.NoError(t, err)
1017-
assert.Equal(t, tokAll.ID, tokTeam2.ID)
1035+
assert.Error(t, err)
1036+
assert.True(t, fleet.IsNotFound(err))
10181037

10191038
////
1020-
err = ds.DeleteVPPToken(ctx, tokAll.ID)
1039+
tokAll, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
10211040
assert.NoError(t, err)
10221041

10231042
tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
1024-
assert.Error(t, err)
1025-
assert.True(t, fleet.IsNotFound(err))
1043+
assert.NoError(t, err)
1044+
assert.Equal(t, tokAll.ID, tokNil.ID)
10261045

10271046
tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
1028-
assert.Error(t, err)
1029-
assert.True(t, fleet.IsNotFound(err))
1047+
assert.NoError(t, err)
1048+
assert.Equal(t, tokAll.ID, tokTeam1.ID)
10301049

10311050
tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
1032-
assert.Error(t, err)
1033-
assert.True(t, fleet.IsNotFound(err))
1051+
assert.NoError(t, err)
1052+
assert.Equal(t, tokAll.ID, tokTeam2.ID)
1053+
1054+
err = ds.DeleteVPPToken(ctx, tokAll.ID)
1055+
assert.NoError(t, err)
10341056

10351057
////
10361058
_, err = ds.UpdateVPPTokenTeams(ctx, tokNone.ID, []uint{0, team.ID, team2.ID})
@@ -1051,6 +1073,7 @@ func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
10511073
////
10521074
err = ds.DeleteVPPToken(ctx, tokNone.ID)
10531075
assert.NoError(t, err)
1076+
10541077
}
10551078

10561079
func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
@@ -1062,10 +1085,6 @@ func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
10621085
team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "Zingers"})
10631086
assert.NoError(t, err)
10641087

1065-
team3, err := ds.NewTeam(ctx, &fleet.Team{Name: "Kremling"})
1066-
_ = team3
1067-
assert.NoError(t, err)
1068-
10691088
dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
10701089
require.NoError(t, err)
10711090

@@ -1078,10 +1097,10 @@ func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
10781097
tok2, err := ds.InsertVPPToken(ctx, dataToken2)
10791098
assert.NoError(t, err)
10801099

1081-
_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{})
1100+
_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team1.ID})
10821101
assert.NoError(t, err)
10831102

1084-
_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team1.ID})
1103+
_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team2.ID})
10851104
assert.NoError(t, err)
10861105

10871106
app1 := &fleet.VPPApp{
@@ -1094,13 +1113,10 @@ func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
10941113
},
10951114
BundleIdentifier: "app1",
10961115
}
1097-
vppApp1, err := ds.InsertVPPAppWithTeam(ctx, app1, &team1.ID)
1116+
_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team1.ID)
10981117
assert.NoError(t, err)
10991118
_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team2.ID)
11001119
assert.NoError(t, err)
1101-
_ = vppApp1
1102-
_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team3.ID)
1103-
assert.NoError(t, err)
11041120

11051121
app2 := &fleet.VPPApp{
11061122
Name: "app2",
@@ -1116,9 +1132,8 @@ func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
11161132
_ = vppApp2
11171133
assert.NoError(t, err)
11181134

1119-
// team1: token, app1, app2
1120-
// team2: global token, app 1
1121-
// team3: global token, app 1
1135+
// team1: token 1, app1, app2
1136+
// team2: token 2, app 1
11221137

11231138
apps, err := ds.GetAssignedVPPApps(ctx, &team1.ID)
11241139
assert.NoError(t, err)
@@ -1131,68 +1146,45 @@ func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
11311146
assert.Len(t, apps, 1)
11321147
assert.Contains(t, apps, app1.VPPAppID)
11331148

1134-
apps, err = ds.GetAssignedVPPApps(ctx, &team3.ID)
1135-
assert.NoError(t, err)
1136-
assert.Len(t, apps, 1)
1137-
assert.Contains(t, apps, app1.VPPAppID)
1138-
1139-
/// Move team 1 token to team 3
1149+
/// Try to move team 1 token to team 2
11401150

1141-
_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team3.ID})
1142-
assert.NoError(t, err)
1151+
_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team2.ID})
1152+
assert.Error(t, err)
11431153

1144-
// team1: global token, no apps
1145-
// team2: global token, app 1
1146-
// team3: token, no apps
1154+
// team1: token 1, app1, app2
1155+
// team2: token 2, app 1
11471156

11481157
apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
11491158
assert.NoError(t, err)
1150-
assert.Len(t, apps, 0)
1159+
assert.Len(t, apps, 2)
11511160

11521161
apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
11531162
assert.NoError(t, err)
11541163
assert.Len(t, apps, 1)
11551164
assert.Contains(t, apps, app1.VPPAppID)
11561165

1157-
apps, err = ds.GetAssignedVPPApps(ctx, &team3.ID)
1158-
assert.NoError(t, err)
1159-
assert.Len(t, apps, 0)
1160-
1161-
/// Add apps with new token assignments
1162-
1163-
_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team3.ID)
1166+
_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, nil)
11641167
assert.NoError(t, err)
11651168

1166-
_, err = ds.InsertVPPAppWithTeam(ctx, app2, &team1.ID)
1167-
assert.NoError(t, err)
1168-
1169-
// team1: global token, app 2
1170-
// team2: global token, app 1
1171-
// team3: token, app 1
1169+
// team1: no token, no apps
1170+
// team2: token 2, app 1
11721171

11731172
apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
11741173
assert.NoError(t, err)
1175-
assert.Len(t, apps, 1)
1176-
assert.Contains(t, apps, app2.VPPAppID)
1174+
assert.Len(t, apps, 0)
11771175

11781176
apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
11791177
assert.NoError(t, err)
11801178
assert.Len(t, apps, 1)
11811179
assert.Contains(t, apps, app1.VPPAppID)
11821180

1183-
apps, err = ds.GetAssignedVPPApps(ctx, &team3.ID)
1184-
assert.NoError(t, err)
1185-
assert.Len(t, apps, 1)
1186-
assert.Contains(t, apps, app1.VPPAppID)
1181+
// Move team 2 token to team 1
11871182

1188-
/// Move global token to team 1, no global token now
1189-
1190-
_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team1.ID})
1183+
_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team1.ID})
11911184
assert.NoError(t, err)
11921185

1193-
// team1: token, no apps
1186+
// team1: token 2, app 1
11941187
// team2: no token, no apps
1195-
// team3: token, app 1
11961188

11971189
apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
11981190
assert.NoError(t, err)
@@ -1202,11 +1194,6 @@ func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
12021194
assert.NoError(t, err)
12031195
assert.Len(t, apps, 0)
12041196

1205-
apps, err = ds.GetAssignedVPPApps(ctx, &team3.ID)
1206-
assert.NoError(t, err)
1207-
assert.Len(t, apps, 1)
1208-
assert.Contains(t, apps, app1.VPPAppID)
1209-
12101197
/// Can't assaign apps with no token
12111198

12121199
_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team2.ID)

‎server/service/integration_mdm_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -10510,6 +10510,9 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
1051010510
s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", orbitHost.ID, macOSTitleID), &installSoftwareRequest{},
1051110511
http.StatusBadRequest, &installResp)
1051210512

10513+
// Disable all teams token
10514+
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", validToken.Token.ID), patchVPPTokensTeamsRequest{}, http.StatusOK, &resPatchVPP)
10515+
1051310516
// Spoof an expired VPP token and attempt to install VPP app
1051410517
tokenJSONBad := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, "2099-06-24T15:50:50+0000", "badtoken", "Evil Fleet")
1051510518
s.appleVPPConfigSrvConfig.Location = "Spooky Haunted House"
@@ -10531,6 +10534,9 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
1053110534
// Disable the token
1053210535
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{}, http.StatusOK, &resPatchVPP)
1053310536

10537+
// Enable all teams token
10538+
s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", validToken.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
10539+
1053410540
// Attempt to install non-existent app
1053510541
r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, 99999), &installSoftwareRequest{}, http.StatusBadRequest)
1053610542
require.Contains(t, extractServerErrorText(r.Body), "Couldn't install software. Software title is not available for install. Please add software package or App Store app to install.")

0 commit comments

Comments
 (0)