Activity bounded context: `/api/latest/fleet/activities` (1 of 2) #38115

getvictor · 2026-01-09T19:23:31Z

Related issue: Resolves #37806

This PR creates an activity bounded context and moves the following HTTP endpoint (including the full vertical slice) there: /api/latest/fleet/activities

NONE of the other activity functionality is moved! This is an incremental approach starting with just 1 API/service endpoint.

A significant part of this PR is tests. This feature is now receiving significantly more unit/integration test coverage than before.

Also, this PR does not remove the ListActivities datastore method in the legacy code. That will be done in the follow up PR (part 2 of 2).

This refactoring effort also uncovered an activity/user authorization issue: https://fleetdm.slack.com/archives/C02A8BRABB5/p1768582236611479

Checklist for submitter

If some of the following don't apply, delete the relevant line.

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

Testing

Added/updated automated tests
QA'd all new/changed functionality manually

Summary by CodeRabbit

Release Notes

New Features
- Activity listing API now available with query filtering, date-range filtering, and type-based filtering
- Pagination support for activity results with cursor-based and offset-based options
- Configurable sorting by creation date or activity ID in ascending or descending order
- Automatic enrichment of activity records with actor user details (name, email, avatar)
- Role-based access controls applied to activity visibility based on user permissions

_{✏️ Tip: You can customize this high-level summary in your review settings.}

…-scaffold

- Extract common HTTP error types to server/platform/http package to enable decoupling bounded contexts from the fleet package - Make CommonEndpointer fully generic ([H any]) so handler function types can be defined in their respective packages - Replace deprecated AuthFunc/FleetService fields with pre-built AuthMiddleware for cleaner dependency injection - Remove fleet import from endpoint_utils package (now only imports contexts/*, platform/http, and middleware/*)

…-endpoint_utils # Conflicts: # server/service/endpoint_utils.go

…into victor/37244-refactor-common_mysql # Conflicts: # server/datastore/mysql/common_mysql/common.go # server/datastore/mysql/mysql.go # server/service/middleware/endpoint_utils/endpoint_utils.go

…-common_mysql # Conflicts: # server/contexts/ctxerr/ctxerr.go # server/contexts/ctxerr/ctxerr_otel_test.go # server/contexts/ctxerr/ctxerr_test.go # server/contexts/ctxerr/metadata.go # server/contexts/ctxerr/statistics.go # server/contexts/host/host.go # server/contexts/license/license.go # server/contexts/logging/logging.go # server/contexts/viewer/viewer.go # server/mdm/android/service/endpoint_utils.go # server/platform/http/errors.go # server/service/appconfig.go # server/service/endpoint_middleware.go # server/service/endpoint_utils.go # server/service/middleware/auth/http_auth.go # server/service/middleware/endpoint_utils/endpoint_utils.go # server/service/middleware/endpoint_utils/transport_error.go

iansltx

Review complete!

Asking a bunch of questions here since this is supposed to set new patterns (and there's just a significant volume of code here to look at). The questions are generally detail-level rather than 30k feet; will defer to tech leads on that kind of feedback, though in some cases where functionality landed in files seemed a bit odd to me.

server/activity/internal/mysql/activity.go

iansltx · 2026-01-14T00:00:13Z

server/activity/internal/mysql/activity_test.go

+		{"by username prefix", "john", nil, 1},
+		{"by email prefix", "jane@", nil, 1},
+		{"no match", "nomatch", nil, 0},
+		{"via matching user IDs", "nomatch", []uint{johnUserID}, 1},


Would be really helpful to write down, e.g. in activities.go, why we're doing union rather than intersection here. IIRC it's because we want users searchable by both current and past name/email but maybe @MagnusHJensen has a more firm answer here?

I believe this is to enable search by both the user's current name/email AND their past name/email

That sounds right. Useful to throw a code comment in to indicate as much since normally one would expect filters to be intersection rather than union, so on initial glance this would look like a bug when it isn't.

Sorry didn't see this notification.

I can't seem to find the mentioned UNION code, but I do recall it's there, can you point it out?

We wanted to search for the user details in the activity (which could be old and outdated) as well as match on users new data, in the user table itself.

We don't use an explicit UNION in the query, but the implementation ends up behaving that way.

Glad we're confirmed on why this behavior is here. Definitely should comment that "why" for the next person taking a look at this though.

server/activity/internal/mysql/activity_test.go

server/activity/internal/service/endpoint_utils.go

server/fleet/datastore.go

server/platform/authz/authz.go

server/service/activities_test.go

server/service/integration_mdm_test.go

iansltx · 2026-01-15T06:24:35Z

server/service/testing_utils.go

 	if len(opts) > 0 {
 		opts[0].FeatureRoutes = append(opts[0].FeatureRoutes, android_service.GetRoutes(svc, opts[0].androidModule))
 	}

+	// Add activity routes if DBConns is provided
+	if len(opts) > 0 && opts[0].DBConns != nil {
+		legacyAuthorizer, err := authz.NewAuthorizer()
+		require.NoError(t, err)
+		activityAuthorizer := authz.NewAuthorizerAdapter(legacyAuthorizer)
+		activityUserProvider := activityacl.NewFleetServiceAdapter(svc)
+		_, activityRoutesFn := activity_bootstrap.New(
+			opts[0].DBConns,
+			activityAuthorizer,
+			activityUserProvider,
+			logger,
+		)
+		activityAuthMiddleware := func(next endpoint.Endpoint) endpoint.Endpoint {
+			return auth.AuthenticatedUser(svc, next)
+		}
+		opts[0].FeatureRoutes = append(opts[0].FeatureRoutes, activityRoutesFn(activityAuthMiddleware))
+	}


We have two different ways of adding routes here. While we don't necessarily need to clean this up in this PR, we should settle on an approach here so that there's a standard pattern for bounded contexts, allowing us to know what a well-formed N+1th vertical slice bounded context looks like.

By two different ways, do you mean here and in serve.go?

It would be nice to have a shared method between production and tests. Added a TODO in #38234

More talking about how we have FeatureRoutes above this that does a similar thing in a very different way for Android.

…tivities-1 # Conflicts: # server/service/integration_mdm_test.go

iansltx · 2026-01-16T16:59:30Z

Had a few questions here but we're getting a lot closer here and I'm betting the remaining questions can get answered without code changes (once tests pass).

cdcme

No other questions beyond what's already been discussed here.

getvictor added 30 commits November 30, 2025 14:22

Scaffold for activity bounded context

1d20da5

Code review fix.

b3839a2

Merge remote-tracking branch 'origin/main' into victor/36453-activity…

5ee7815

…-scaffold

Added internal package per Lucas's suggestion.

cdbdeb1

Removed duplicated errors.

4512049

Fix receivers.

1b2a29a

Merge remote-tracking branch 'origin/main' into victor/36453-refactor…

049287f

…-endpoint_utils # Conflicts: # server/service/endpoint_utils.go

Merge with main.

fe04559

Refactored contexts/logging

3c88dfe

Refactored authzcheck

c5e2f3c

Refactored ctxerr, host, and viewer.

3b3ad3c

Refactored license

4d8756e

Refactored user.email out of contexts/logging

fdeb7bc

Refactored authzcheck

aceae3b

Merge main into victor/36453-refactor-endpoint_utils

7bbb9cd

Fixed test dep.

4b23216

Refactor common_mysql (plus previous changes)

a186e06

Fixing lint.

9a4a374

Merge remote-tracking branch 'origin/victor/36453-activity-scaffold' …

b2fd007

…into victor/37244-refactor-common_mysql # Conflicts: # server/datastore/mysql/common_mysql/common.go # server/datastore/mysql/mysql.go # server/service/middleware/endpoint_utils/endpoint_utils.go

Remove unnecessary common_mysql/types.go, use db.DBReadTx directly

c5da58b

Cleanup.

4a3619b

Added arch_test

b8fec54

Moved list options to common_mysql.

5cfc90b

Fixed import cycle

a389eb3

Fixing CI issues.

d007eee

Fixes and changes.

e90eb43

Created activity bounded context with 1 API endpoint.

0f4d6bf

Added tests.

47d0e19

getvictor had a problem deploying to Docker Hub January 13, 2026 19:49 — with GitHub Actions Error

Added explicit no start/end test.

595284e

getvictor temporarily deployed to Docker Hub January 13, 2026 19:52 — with GitHub Actions Inactive

getvictor marked this pull request as draft January 13, 2026 20:01

Refactored tests.

2cd4d1f

getvictor temporarily deployed to Docker Hub January 13, 2026 20:24 — with GitHub Actions Inactive

Addressed one coderabbitai comment, simplifying things.

b718c0b

getvictor temporarily deployed to Docker Hub January 13, 2026 20:37 — with GitHub Actions Inactive

Added a test for system activity.

6a70ff2

getvictor temporarily deployed to Docker Hub January 13, 2026 20:48 — with GitHub Actions Inactive

getvictor marked this pull request as ready for review January 13, 2026 21:04

getvictor requested a review from iansltx January 13, 2026 21:05

iansltx reviewed Jan 15, 2026

View reviewed changes

getvictor added 2 commits January 16, 2026 09:37

Moved fillListOptions to handler file.

96fd33c

Merge remote-tracking branch 'origin/main' into victor/37806-fleet-ac…

bfd5b9d

…tivities-1 # Conflicts: # server/service/integration_mdm_test.go

getvictor temporarily deployed to Docker Hub January 16, 2026 14:39 — with GitHub Actions Inactive

Removed activity graceful degradation.

f6aa5de

getvictor had a problem deploying to Docker Hub January 16, 2026 15:20 — with GitHub Actions Failure

Created new Authz Action type.

78eab80

getvictor had a problem deploying to Docker Hub January 16, 2026 15:28 — with GitHub Actions Failure

Improved/fixed tests.

9709e5e

getvictor temporarily deployed to Docker Hub January 16, 2026 15:49 — with GitHub Actions Inactive

iansltx mentioned this pull request Jan 16, 2026

Activity list created_at end date filtering is inconsistent based on whether start date is provided #38437

Open

Fixed "SELECT *"

e6fc2dc

getvictor temporarily deployed to Docker Hub January 16, 2026 16:53 — with GitHub Actions Inactive

Fixing authz issues. Only admins are allowed to get user details.

95fb621

getvictor temporarily deployed to Docker Hub January 16, 2026 17:12 — with GitHub Actions Inactive

cdcme approved these changes Jan 16, 2026

View reviewed changes

JordanMontgomery approved these changes Jan 16, 2026

View reviewed changes

Activity bounded context: /api/latest/fleet/activities (1 of 2) #38115

Are you sure you want to change the base?

Activity bounded context: /api/latest/fleet/activities (1 of 2) #38115

Uh oh!

Conversation

getvictor commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist for submitter

Testing

Summary by CodeRabbit

Release Notes

Uh oh!

iansltx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iansltx commented Jan 16, 2026

Uh oh!

cdcme left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Activity bounded context: `/api/latest/fleet/activities` (1 of 2) #38115

Activity bounded context: `/api/latest/fleet/activities` (1 of 2) #38115

getvictor commented Jan 9, 2026 •

edited

Loading