Allow non-admin users to create BitLocker PINs

[melpike]

Goal

User story
As an IT admin that tries to have as many non-admins as possible,
I want to allow non-admin users to create BitLocker PINs
so that I don't have to grant admin permissions just to get non-admins unstuck.

Changes

Product

• Changes:
  • Add a toast when we detect BitLocker PIN needs to be updated:
    • Title: Fleet: Action needed
    • Content: Set your BitLocker PIN to protect this device.
    • Button: Create PIN (The action here opens Fleet Desktop with a new "Create PIN" modal.)
    • Frequency: At each log in
  • Replace the existing "Create PIN" modal with updated version, same trigger, for all users, admin and non-admin.
  • Fleet Desktop's "Create PIN" modal now collects the PIN directly.
  • Client-side complexity validation on the entered PIN.
  • On submission, Fleet Desktop hands the PIN to the privileged component, which applies it. On success, Fleet Desktop reports completion automatically (no refetch). "Successfully set PIN."
  • Failure error (e.g. PIN rejected): "Couldn't set PIN. {error}. Try again or contact your IT admin."
• UI Changes: Figma
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Fleet's agent (fleetd) changes:
  • New privileged component that receives the user-submitted PIN from Fleet Desktop and applies it to the volume, running elevated on behalf of the logged-in user regardless of local admin status. Scoped narrowly to just this action.
  • Hosts on fleetd versions below the minimum supported version continue to see the current instructions-based modal until upgraded.
  • New orbit endpoint: POST /api/fleet/orbit/disk_encryption_pin
• Fleet server configuration changes: TODO Eng to confirm if there are changes needed
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: [Activity] Document created_disk_encryption_pin in audit logs #50335
• Permissions changes: No changes
• Changes to paid features or tiers: Free
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes:
  • Architecture and Article docs: [Docs] Document BitLocker PIN entry process for disk encryption #50463
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Pre-QA load test: TODO
• Load testing/osquery-perf improvements: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: Yes
• Requires load testing: No
• Risk level: High
• Risk description: This feature intentionally allows a non-admin Windows user to perform a privileged system operation (setting a BitLocker pre-boot PIN). Bugs here could enable unauthorized PIN changes, lock a device out at boot, or silently fail to set the PIN while showing success. The permissions model is also being changed, which carries regression risk for the existing admin-initiated PIN flow.

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• Enroll a Windows host into Fleet with disk encryption enforced (BitLocker with PIN required), PIN not yet set.
• Log into the host as a standard (non-admin) local user.
• Confirm the Fleet Desktop banner appears; click Create PIN.
• Confirm the modal now presents a PIN entry field (not instructions), with confirmation and client-side validation.
• Enter a valid PIN and submit. Confirm no Windows admin/UAC elevation prompt is shown to the user.
• Confirm the privileged component applies the PIN and the BitLocker protector (TPM + PIN) is set on the volume.
• Confirm Fleet Desktop reports success automatically — no manual Refetch required.
• Confirm the host's disk encryption status in Fleet UI updates to reflect PIN configured.
• Confirm the recovery key is still escrowed to Fleet as expected (unchanged).
• Confirm the new activity appears in the activity feed.
• Repeat logged in as a local admin user — confirm identical flow (no separate admin path).
• Confirm the admin per-host banner and end-user My Device banner both clear once the PIN is set.

Edge cases

• Non-admin user enters a PIN that is too short or does not meet Windows BitLocker PIN complexity requirements - verify a clear validation error is shown and PIN is not set
• Non-admin user enters mismatched values in the PIN and confirm-PIN fields - verify an error is shown and submission is blocked
• Admin disables the "allow non-admin PIN creation" setting after a non-admin has already set a PIN - verify the option disappears from Fleet Desktop for that user and no further changes can be made
• Non-admin user attempts the flow on a device where BitLocker is not yet enabled (encryption not enforced) - verify appropriate error or guidance is shown, not a silent failure
• Non-admin user attempts the flow on a device that is not MDM-enrolled - verify the option is not available or the action is rejected gracefully
• Non-admin user who already has a BitLocker PIN attempts to change it - verify the change succeeds (or is blocked, per intended behavior) and the new PIN works at boot
• Admin-level user on the same device attempts the flow - verify it still works as expected and doesn't regress the existing admin PIN creation path
• Device loses network connectivity mid-flow (after initiating but before completing PIN creation) - verify the UI handles the failure gracefully and does not leave the device in an ambiguous state
• BitLocker is currently suspended on the device - verify the PIN creation flow handles this state explicitly (error or guidance)

UI

• Verify that all UI changes specified in the Figma wireframes are correctly implemented
• Verify expected UI states (loading, empty, error states if applicable)

Permissions

• Verify that non-admin Windows users can set a BitLocker PIN when the feature is enabled by a Fleet admin
• Verify that non-admin Windows users cannot set a BitLocker PIN when the feature is disabled by a Fleet admin
• Verify role restrictions for Fleet global roles — confirm only admins (or roles with the appropriate permission) can toggle the "allow non-admin PIN creation" setting
• Verify team-level role restrictions if the setting is scoped per team

Premium gating (BitLocker management is a premium feature)

• Verify the non-admin PIN creation option is not available on Fleet Free in the frontend (UI hidden/disabled with appropriate messaging)
• Verify the non-admin PIN creation option is blocked on Fleet Free in the backend (API returns the expected error)

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation":