Fleet Free - Targeting queries by label is blocked in the UI, but not in the REST API

[ksatter]

Fleet version: v4.73.0

---

💥  Actual behavior

When saving a new query through the UI, I am unable to target a query using labels. This is expected behavior as this is a premium-only feature.

However, I can save a query using the REST API and use custom targeting:

Request

{
  "name": "new_query",
  "description": "This is a new query.",
  "query": "SELECT * FROM osquery_info",
  "interval": 3600, // Once per hour
  "platform": "darwin,windows,linux",
  "min_osquery_version": "",
  "automations_enabled": true,
  "logging": "snapshot",
  "discard_data": false,
  "labels_include_any": [
    "test"
  ]
}

Response

{
    "query": {
        "created_at": "0001-01-01T00:00:00Z",
        "updated_at": "0001-01-01T00:00:00Z",
        "id": 4,
        "team_id": null,
        "interval": 3600,
        "platform": "darwin,windows,linux",
        "min_osquery_version": "",
        "automations_enabled": true,
        "logging": "snapshot",
        "name": "new_query",
        "description": "This is a new query.",
        "query": "SELECT * FROM osquery_info",
        "saved": true,
        "observer_can_run": false,
        "author_id": 1,
        "author_name": "Admin",
        "author_email": "admin@example.com",
        "packs": [],
        "stats": {
            "system_time_p50": null,
            "system_time_p95": null,
            "user_time_p50": null,
            "user_time_p95": null,
            "total_executions": null
        },
        "discard_data": false,
        "labels_include_any": [
            {
                "id": 19,
                "name": "test"
            }
        ]
    }
}

🛠️ To fix

Check license in the API and throw an error if label targeting parameters are used in Fleet Free.

Product designer: @rachaelshaw

🧑‍💻  Steps to reproduce

1. Launch Fleet Free instance
2. Create a label
3. Using the REST API, create a query that uses a label as a custom target

🕯️ More info (optional)

N/A

[iansltx]

Planning poker

[zwass]

How can I tell what is intended to be Free and what is intended to be Premium? There are a number of endpoints that can take labels and it's probably worth addressing all at once.

I see "Labels" as both Free and Premium on the pricing page:

@rachaelshaw are you the right person to go to for this question?

[rachaelshaw]

@zwass labels are available in Free, but scoping queries to specific labels is a Premium feature. The REST API docs and this article get more specific about permissions than the pricing page.