Team ID filter should not be required in "List Fleet-maintained apps" endpoint

[rachaelshaw]

Fleet version: 4.60.1

---

💥  Actual behavior

API users are only able to get a list of Fleet-maintained apps if they have a team ID. This makes it so the endpoint can't be used in situations where users may just want to get a complete list of what's available.

🧑‍💻  Steps to reproduce

Attempt to access the GET /fleet_maintained_apps endpoint in the API (the frontend doesn't do this) without team_id set.

🛠️ To fix

Display all available FMAs (regardless of whether they've been added as installers anywhere) when calling the FMA list endpoint with no team param.

Test Plan

No special instance setup required. The associated PR's auth tests may be helpful here.

New functionality:

• GET /api/v1/fleet/software/fleet_maintained_apps works with no query params
• Result of the above doesn't change after adding a FMA to a team
• Pagination works
• Auth succeeds for both global and team-limited maintainers and admins
• Auth fails for onservers/observer+

Regression testing:

• Fleet Maintained Apps list view works for global admins and maintainers
• Fleet Maintained Apps list view works for admins and maintainers on the same team
• GET /api/v1/fleet/software/fleet_maintained_apps with team specified fails auth for a team-specific admin/maintainer on the wrong team
• The above fails auth for an observer/observer+, regardless of global/same team/different team

[iansltx]

Looked at this endpoint while fixing #23305. We need the team here because the list query filters out apps for which an installer already exists for that team, which is what the UI for adding FMAs needs.

The endpoint could be tweaked to skip the "where installer doesn't exist" part of the DB query if team ID isn't specified, though this would require tweaks to auth so team-specific maintainers/owners could hit the endpoint with either no team query or a team query matching a team they're part of.

Either way, this seems like a FR rather than a bug?

[iansltx]

Per design review, this will stay as a bug. Fix is to, when the team ID query parameter is not supplied, drop the "available" filter while maintaining existing functionality when the team ID is supplied. Doing the fix that way ensures the fix respects BC and as a result is backend-only.

[noahtalerman]

Hey @rachaelshaw, I think @eashaw and @mikermcneil are trying to ship Fleet-maintained apps on the website ASAP. Can you please check if this bug is blocking them?

If this is blocking, can you please add a P2, tag Luke (per the priority label process), and include a deploying a patch to dogfood as part of this issue? That way Eric can hit the updated endpoint in dogfood ASAP.

[jmwatts]

QA Notes:

Verified team_id is not longer required. Tested all steps outlined in "New functionality" and "Regression testing" above.

[fleet-release]

Apps list now unfurls,
No team ID, still reveals,
Ease like clouds that swirl.