47701 abm errors UI

changes/47700-abm-token-invalid-dep-error

@@ -0,0 +1 @@
+- Added `token_invalid` to the ABM token API responses and `dep_error` to `GET /hosts/:id/dep_assignment`, to help identify why a host's Apple Business Manager device lookup or ABM token isn't returning expected data (e.g. a rejected or invalid-signature token, unsigned terms, a server-side error, or the device no longer being assigned to Fleet).

cmd/fleetctl/fleetctl/apply_deprecated_test.go

@@ -216,6 +216,9 @@ func TestApplyAsGitOpsDeprecatedKeys(t *testing.T) {
 	ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
 		return 0, nil
 	}
+	ds.SetABMTokenInvalidForOrgNameFunc = func(ctx context.Context, orgName string, invalid bool) (bool, error) {
+		return false, nil
+	}
 
 	ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
 		return []string{"foobar"}, nil
@@ -768,6 +771,9 @@ func TestApplyMacosSetupDeprecatedKeys(t *testing.T) {
 		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
 			return 0, nil
 		}
+		ds.SetABMTokenInvalidForOrgNameFunc = func(ctx context.Context, orgName string, invalid bool) (bool, error) {
+			return false, nil
+		}
 
 		ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
 			return []string{"foobar"}, nil

cmd/fleetctl/fleetctl/apply_test.go

@@ -1528,6 +1528,9 @@ func TestApplyAsGitOps(t *testing.T) {
 	ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
 		return 0, nil
 	}
+	ds.SetABMTokenInvalidForOrgNameFunc = func(ctx context.Context, orgName string, invalid bool) (bool, error) {
+		return false, nil
+	}
 
 	ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
 		return []string{"foobar"}, nil
@@ -2378,6 +2381,9 @@ func TestApplyMacosSetup(t *testing.T) {
 		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
 			return 0, nil
 		}
+		ds.SetABMTokenInvalidForOrgNameFunc = func(ctx context.Context, orgName string, invalid bool) (bool, error) {
+			return false, nil
+		}
 
 		ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
 			return []string{"foobar"}, nil

ee/server/service/apple_mdm_test.go

@@ -649,9 +649,10 @@ func setupReleaseABTest(t *testing.T) (*Service, *mock.Store, *nanodep_mock.Stor
 	svc.logger = slog.New(slog.NewTextHandler(io.Discard, nil))
 	base.NewActivityFunc = func(context.Context, *fleet.User, fleet.ActivityDetails) error { return nil }
 
-	// Short-circuit the DEP client's terms-expired after-hook.
+	// Short-circuit the DEP client's terms-expired and token-invalid after-hooks.
 	ds.CountABMTokensWithTermsExpiredFunc = func(context.Context) (int, error) { return 0, nil }
 	ds.AppConfigFunc = func(context.Context) (*fleet.AppConfig, error) { return &fleet.AppConfig{}, nil }
+	ds.SetABMTokenInvalidForOrgNameFunc = func(context.Context, string, bool) (bool, error) { return false, nil }
 	ds.DeleteHostDEPAssignmentsFunc = func(context.Context, uint, []string) error { return nil }
 
 	dep := &nanodep_mock.Storage{}

ee/server/service/mdm_external_test.go

@@ -286,6 +286,9 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
 			return 0, nil
 		}
+		ds.SetABMTokenInvalidForOrgNameFunc = func(ctx context.Context, orgName string, invalid bool) (bool, error) {
+			return false, nil
+		}
 		ds.ConditionalAccessMicrosoftGetFunc = func(ctx context.Context) (*fleet.ConditionalAccessMicrosoftIntegration, error) {
 			return nil, &eeservice.NotFoundError{}
 		}

frontend/components/App/App.tsx

@@ -137,6 +137,10 @@ const App = ({ children, location, router }: IAppProps): JSX.Element => {
             needsAbmTermsRenewal: ab_tokens.some(
               (token) => token.terms_expired
             ),
+            hasAbmTokenInvalid: ab_tokens.some((token) => token.token_invalid),
+            invalidAbmTokenOrgNames: ab_tokens
+              .filter((token) => token.token_invalid)
+              .map((token) => token.org_name),
           });
       },
       // TODO: Do we need to catch and check for a 400 status code? The old
@@ -146,6 +150,8 @@ const App = ({ children, location, router }: IAppProps): JSX.Element => {
           setABMExpiry({
             earliestExpiry: GUARANTEED_PAST_DATE,
             needsAbmTermsRenewal: true, // TODO: if order of precedence for banners changes, we may need to upate this
+            hasAbmTokenInvalid: false,
+            invalidAbmTokenOrgNames: [],
           });
         }
       },

frontend/components/MDM/AppleBMTokenInvalidMessage/AppleBMTokenInvalidMessage.tests.tsx

@@ -0,0 +1,42 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+
+import AppleBMTokenInvalidMessage from "./AppleBMTokenInvalidMessage";
+
+describe("AppleBMTokenInvalidMessage", () => {
+  it("renders singular copy for a single org name", () => {
+    render(<AppleBMTokenInvalidMessage orgNames={["Acme Inc."]} />);
+
+    expect(
+      screen.getByText(
+        "Your Apple Business (AB) token for Acme Inc. is invalid. macOS, iOS, and iPadOS hosts won’t automatically enroll into Fleet. Users with the admin role in Fleet can renew the token."
+      )
+    ).toBeInTheDocument();
+  });
+
+  it("joins two org names with 'and' and uses plural copy", () => {
+    render(
+      <AppleBMTokenInvalidMessage orgNames={["Acme Inc.", "Globex Corp."]} />
+    );
+
+    expect(
+      screen.getByText(
+        "Your Apple Business (AB) tokens for Acme Inc. and Globex Corp. are invalid. macOS, iOS, and iPadOS hosts won’t automatically enroll into Fleet. Users with the admin role in Fleet can renew the tokens."
+      )
+    ).toBeInTheDocument();
+  });
+
+  it("joins three or more org names with an Oxford comma", () => {
+    render(
+      <AppleBMTokenInvalidMessage
+        orgNames={["Acme Inc.", "Globex Corp.", "Initech"]}
+      />
+    );
+
+    expect(
+      screen.getByText(
+        "Your Apple Business (AB) tokens for Acme Inc., Globex Corp., and Initech are invalid. macOS, iOS, and iPadOS hosts won’t automatically enroll into Fleet. Users with the admin role in Fleet can renew the tokens."
+      )
+    ).toBeInTheDocument();
+  });
+});

frontend/components/MDM/AppleBMTokenInvalidMessage/AppleBMTokenInvalidMessage.tsx

@@ -0,0 +1,36 @@
+import React from "react";
+
+import InfoBanner from "components/InfoBanner";
+
+const baseClass = "apple-bm-token-invalid-message";
+
+const orgNameList = (orgNames: string[]) => {
+  if (orgNames.length <= 2) {
+    return orgNames.join(" and ");
+  }
+  return `${orgNames.slice(0, -1).join(", ")}, and ${
+    orgNames[orgNames.length - 1]
+  }`;
+};
+
+interface IAppleBMTokenInvalidMessageProps {
+  /** Organization names of the invalid AB tokens */
+  orgNames: string[];
+}
+
+const AppleBMTokenInvalidMessage = ({
+  orgNames,
+}: IAppleBMTokenInvalidMessageProps) => {
+  const isPlural = orgNames.length > 1;
+
+  return (
+    <InfoBanner className={baseClass} color="yellow">
+      Your Apple Business (AB) {isPlural ? "tokens" : "token"} for{" "}
+      {orgNameList(orgNames)} {isPlural ? "are" : "is"} invalid. macOS, iOS, and
+      iPadOS hosts won’t automatically enroll into Fleet. Users with the admin
+      role in Fleet can renew the {isPlural ? "tokens" : "token"}.
+    </InfoBanner>
+  );
+};
+
+export default AppleBMTokenInvalidMessage;

frontend/components/MDM/AppleBMTokenInvalidMessage/index.ts

@@ -0,0 +1 @@
+export { default } from "./AppleBMTokenInvalidMessage";

frontend/components/MainContent/MainContent.tsx

@@ -5,6 +5,7 @@ import { hasLicenseExpired } from "utilities/helpers";
 import { AppContext } from "context/app";
 
 import AppleBMTermsMessage from "components/MDM/AppleBMTermsMessage";
+import AppleBMTokenInvalidMessage from "components/MDM/AppleBMTokenInvalidMessage";
 import LicenseExpirationBanner from "components/LicenseExpirationBanner";
 import ApplePNCertRenewalMessage from "components/MDM/ApplePNCertRenewalMessage";
 import AppleBMRenewalMessage from "components/MDM/AppleBMRenewalMessage";
@@ -43,6 +44,8 @@ const MainContent = ({
     isAppleBmExpired,
     isVppExpired,
     needsAbmTermsRenewal,
+    hasAbmTokenInvalid,
+    invalidAbmTokenOrgNames,
     willAppleBmExpire,
     willApplePnsExpire,
     willVppExpire,
@@ -68,6 +71,10 @@ const MainContent = ({
         banner = <AppleBMRenewalMessage expired={isAppleBmExpired} />;
       } else if (needsAbmTermsRenewal) {
         banner = <AppleBMTermsMessage />;
+      } else if (hasAbmTokenInvalid) {
+        banner = (
+          <AppleBMTokenInvalidMessage orgNames={invalidAbmTokenOrgNames} />
+        );
       } else if (isVppExpired || willVppExpire) {
         banner = <VppRenewalMessage expired={isVppExpired} />;
       } else if (isFleetLicenseExpired) {

frontend/components/MainContent/_styles.scss

@@ -18,6 +18,12 @@
     // TODO: figure out if sticky styling is needed?
     position: sticky; // Needed for settings page scroll
     z-index: 4; // Needed for settings page scroll
+
+    // The AB token invalid banner sits directly above page content that
+    // already provides its own top spacing, so it doesn't need this margin.
+    &:has(.apple-bm-token-invalid-message) {
+      margin-bottom: 0;
+    }
   }
 
   &.manage-hosts,

frontend/context/app.tests.tsx

@@ -0,0 +1,113 @@
+import React, { useContext } from "react";
+
+import { screen } from "@testing-library/react";
+import { renderWithSetup } from "test/test-utils";
+import createMockUser from "__mocks__/userMock";
+
+import AppProvider, { AppContext, sortAvailableTeams } from "./app";
+
+describe("sortAvailableTeams", () => {
+  it("places Unassigned last for global team users", () => {
+    const teams = [
+      { id: 0, name: "Unassigned" },
+      { id: 2, name: "Zebra" },
+      { id: 1, name: "Alpha" },
+      { id: -1, name: "All fleets" },
+    ];
+    const result = sortAvailableTeams(teams, createMockUser());
+    expect(result.map((t) => t.name)).toEqual([
+      "All fleets",
+      "Alpha",
+      "Zebra",
+      "Unassigned",
+    ]);
+  });
+
+  it("does not include All fleets or Unassigned for non-global users", () => {
+    const teams = [
+      { id: 0, name: "Unassigned" },
+      { id: 2, name: "Zebra" },
+      { id: 1, name: "Alpha" },
+      { id: -1, name: "All fleets" },
+    ];
+    const result = sortAvailableTeams(
+      teams,
+      createMockUser({ global_role: null })
+    );
+    expect(result.map((t) => t.name)).toEqual(["Alpha", "Zebra"]);
+  });
+
+  it("sorts named teams alphabetically (case-insensitive)", () => {
+    const teams = [
+      { id: 3, name: "charlie" },
+      { id: 1, name: "Alpha" },
+      { id: 2, name: "Bravo" },
+    ];
+    const result = sortAvailableTeams(
+      teams,
+      createMockUser({ global_role: null })
+    );
+    expect(result.map((t) => t.name)).toEqual(["Alpha", "Bravo", "charlie"]);
+  });
+});
+
+const AbmExpiryConsumer = () => {
+  const {
+    hasAbmTokenInvalid,
+    invalidAbmTokenOrgNames,
+    setABMExpiry,
+  } = useContext(AppContext);
+
+  return (
+    <div>
+      <button
+        type="button"
+        onClick={() =>
+          setABMExpiry({
+            earliestExpiry: "",
+            needsAbmTermsRenewal: false,
+            hasAbmTokenInvalid: true,
+            invalidAbmTokenOrgNames: [
+              "Acme Inc.",
+              "Fleet Device Management Inc.",
+            ],
+          })
+        }
+      >
+        Set invalid tokens
+      </button>
+      <div data-testid="has-invalid">{String(hasAbmTokenInvalid)}</div>
+      <div data-testid="org-names">{invalidAbmTokenOrgNames.join(", ")}</div>
+    </div>
+  );
+};
+
+describe("AppProvider - setABMExpiry", () => {
+  it("defaults hasAbmTokenInvalid to false and invalidAbmTokenOrgNames to an empty list", () => {
+    renderWithSetup(
+      <AppProvider>
+        <AbmExpiryConsumer />
+      </AppProvider>
+    );
+
+    expect(screen.getByTestId("has-invalid")).toHaveTextContent("false");
+    expect(screen.getByTestId("org-names")).toHaveTextContent("");
+  });
+
+  it("updates hasAbmTokenInvalid and invalidAbmTokenOrgNames when setABMExpiry is called", async () => {
+    const { user } = renderWithSetup(
+      <AppProvider>
+        <AbmExpiryConsumer />
+      </AppProvider>
+    );
+
+    await user.click(
+      screen.getByRole("button", { name: "Set invalid tokens" })
+    );
+
+    expect(screen.getByTestId("has-invalid")).toHaveTextContent("true");
+    expect(screen.getByTestId("org-names")).toHaveTextContent(
+      "Acme Inc., Fleet Device Management Inc."
+    );
+  });
+});