fix(adhoc-sweep-fixes): CU-86akbhhtv 66 review findings across 40 files

cmd/fleet/cron_test.go

@@ -360,9 +360,11 @@ func TestHostVitalsLabelMembershipCronIDP(t *testing.T) {
 	hosts := make([]*fleet.Host, 3)
 	teamIDs := []*uint{&team1.ID, &team2.ID, nil}
 	for i := range 3 {
+		osqueryHostID := fmt.Sprintf("idp-cron-%d", i)
+		nodeKey := fmt.Sprintf("idp-cron-%d", i)
 		h, err := ds.NewHost(ctx, &fleet.Host{
-			OsqueryHostID:  new(fmt.Sprintf("idp-cron-%d", i)),
-			NodeKey:        new(fmt.Sprintf("idp-cron-%d", i)),
+			OsqueryHostID:  &osqueryHostID,
+			NodeKey:        &nodeKey,
 			UUID:           fmt.Sprintf("idp-cron-uuid%d", i),
 			Hostname:       fmt.Sprintf("idp-cron-host%d.local", i),
 			HardwareSerial: fmt.Sprintf("idp-cron-hwd%d", i),
@@ -376,9 +378,10 @@ func TestHostVitalsLabelMembershipCronIDP(t *testing.T) {
 	// All three SCIM users are in the same "Engineering" IdP group.
 	scimUserIDs := make([]uint, 3)
 	for i := range 3 {
+		active := true
 		id, err := ds.CreateScimUser(ctx, &fleet.ScimUser{
 			UserName: fmt.Sprintf("idp-cron-user%d", i),
-			Active:   new(true),
+			Active:   &active,
 		})
 		require.NoError(t, err)
 		scimUserIDs[i] = id
@@ -393,26 +396,29 @@ func TestHostVitalsLabelMembershipCronIDP(t *testing.T) {
 	_, err = ds.CreateScimGroup(ctx, &fleet.ScimGroup{DisplayName: "Engineering", ScimUsers: scimUserIDs})
 	require.NoError(t, err)
 
+	vital := "end_user_idp_group"
+	value := "Engineering"
 	criteria, err := json.Marshal(&fleet.HostVitalCriteria{
-		Vital: new("end_user_idp_group"),
-		Value: new("Engineering"),
+		Vital: &vital,
+		Value: &value,
 	})
 	require.NoError(t, err)
 
 	// Create a global and a team1-scoped IdP host vitals label.
+	criteriaRawMessage := json.RawMessage(criteria)
 	globalLabel, err := ds.NewLabel(ctx, &fleet.Label{
 		Name:                "idp-cron-global",
 		LabelType:           fleet.LabelTypeRegular,
 		LabelMembershipType: fleet.LabelMembershipTypeHostVitals,
-		HostVitalsCriteria:  new(json.RawMessage(criteria)),
+		HostVitalsCriteria:  &criteriaRawMessage,
 	})
 	require.NoError(t, err)
 	team1Label, err := ds.NewLabel(ctx, &fleet.Label{
 		Name:                "idp-cron-team1",
 		TeamID:              &team1.ID,
 		LabelType:           fleet.LabelTypeRegular,
 		LabelMembershipType: fleet.LabelMembershipTypeHostVitals,
-		HostVitalsCriteria:  new(json.RawMessage(criteria)),
+		HostVitalsCriteria:  &criteriaRawMessage,
 	})
 	require.NoError(t, err)
 

ee/server/service/embedded_scripts/linux_wipe.sh

@@ -30,7 +30,7 @@ unmount_network_filesystems() {
         mnt=$(printf '%b' "$mnt_esc")
         # Never unmount critical mountpoints that may contain required userland.
         case "$mnt" in
-            /|/usr|/bin|/sbin|/lib|/lib64|/usr/bin|/usr/sbin|/usr/lib|/usr/lib64)
+            /|/usr|/bin|/sbin|/lib|/lib64|/usr/bin|/usr/sbin|/usr/lib|/usr/lib64|/etc|/var|/opt|/srv)
                 echo "Skipping critical network-mounted filesystem: $mnt"
                 continue
                 ;;
@@ -230,3 +230,4 @@ else
     echo "Wiping, system will be unreachable"
     (/usr/bin/nohup sh $0 wipe >/dev/null 2>/dev/null </dev/null) &
 fi
+

frontend/pages/ApiOnlyUser/ApiOnlyUser.tsx

@@ -30,6 +30,7 @@ const ApiOnlyUser = ({ router }: IApiOnlyUserProps): JSX.Element => {
         }
       } catch (response) {
         console.error(response);
+        router.push(LOGIN);
       }
     };
 

frontend/pages/ManageControlsPage/SetupExperience/cards/Users/components/UsersForm/UsersForm.tsx

@@ -99,16 +99,20 @@ const UsersForm = ({
     e.preventDefault();
 
     setIsUpdating(true);
-    const canLockEndUserInfo =
-      formData.endUserAuthEnabled && formData.lockEndUserInfo;
+    // Only collapse lockEndUserInfo based on endUserAuthEnabled when Apple
+    // MDM is configured. Otherwise the checkbox is read-only and reflects a
+    // value preserved from the backend, so it should be sent as-is.
+    const lockEndUserInfoToSend = isMacMdmEnabledAndConfigured
+      ? formData.endUserAuthEnabled && formData.lockEndUserInfo
+      : formData.lockEndUserInfo;
 
     try {
       await mdmAPI.updateSetupExperienceSettings({
         fleet_id: currentTeamId,
         enable_end_user_authentication: formData.endUserAuthEnabled,
         // Apple-only fields are omitted when Apple MDM isn't configured.
         ...(isMacMdmEnabledAndConfigured && {
-          lock_end_user_info: canLockEndUserInfo,
+          lock_end_user_info: lockEndUserInfoToSend,
           enable_managed_local_account: effectiveEnableManagedLocalAccount(
             formData
           ),
@@ -122,7 +126,10 @@ const UsersForm = ({
 
     setIsUpdating(false);
     if (isMacMdmEnabledAndConfigured) {
-      setFormData((prev) => ({ ...prev, lockEndUserInfo: canLockEndUserInfo }));
+      setFormData((prev) => ({
+        ...prev,
+        lockEndUserInfo: lockEndUserInfoToSend,
+      }));
     }
   };
 

frontend/pages/MfaPage/MfaPage.tsx

@@ -33,6 +33,7 @@ const MfaPage = ({ router, params }: IMfaPage) => {
   } = useContext(AppContext);
   const { redirectLocation } = useContext(RoutingContext);
   const [isExpired, setIsExpired] = useState(false);
+  const [hasError, setHasError] = useState(false);
   const [shouldFinishMFA, setShouldFinishMFA] = useState(
     !!local.getItem("auth_pending_mfa")
   );
@@ -73,7 +74,12 @@ const MfaPage = ({ router, params }: IMfaPage) => {
         router.push(redirectLocation || DASHBOARD);
       });
     } catch (response) {
-      setIsExpired(true);
+      const status = (response as { status?: number })?.status;
+      if (status === 401 || status === 410) {
+        setIsExpired(true);
+      } else {
+        setHasError(true);
+      }
     }
   };
 
@@ -118,6 +124,19 @@ const MfaPage = ({ router, params }: IMfaPage) => {
     );
   }
 
+  if (hasError) {
+    return (
+      <AuthenticationFormWrapper className={baseClass} header="Something went wrong">
+        <>
+          <div className={`${baseClass}__description`}>
+            <p>An error occurred. Please try again.</p>
+          </div>
+          <Button onClick={onClickLoginButton}>Back to login</Button>
+        </>
+      </AuthenticationFormWrapper>
+    );
+  }
+
   return (
     <AuthenticationFormWrapper className={baseClass}>
       <Spinner />

frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditConfigurationModal/EditConfigurationModal.tsx

@@ -29,7 +29,7 @@ import { getDisplayedSoftwareName } from "../../helpers";
 const baseClass = "edit-configuration-modal";
 
 export interface ISoftwareConfigurationFormData {
-  configuration: string;
+  configuration: string | Record<string, unknown>;
 }
 
 interface IEditConfigurationModalProps {
@@ -101,13 +101,14 @@ const EditConfigurationModal = ({
       // iOS/iPadOS: send XML as a string
       return { configuration: formData };
     }
-    // Android: send parsed JSON object (cast to string to match interface;
-    // runtime value is an object that gets serialized by sendRequest)
+    // Android: send parsed JSON object; the interface allows either a string
+    // (Apple/XML) or an object (Android/JSON), matching the actual runtime
+    // value that gets serialized by sendRequest.
     if (formData === "") {
-      return { configuration: ({} as unknown) as string };
+      return { configuration: {} };
     }
     return {
-      configuration: (JSON.parse(formData) as unknown) as string,
+      configuration: JSON.parse(formData) as Record<string, unknown>,
     };
   };
 
@@ -303,3 +304,7 @@ const EditConfigurationModal = ({
 };
 
 export default EditConfigurationModal;
+FILE>>>
+
+<<<NOTES
+1. CONFIDENCE: 70 - In `EditConfigurationModal.tsx`, widened the `ISoftwareConfigurationFormData.configuration` type from `string` to `string | Record<string, unknown>` so it truthfully reflects both runtime shapes (XML string for Apple, parsed JSON object for Android). Removed the lying `as unknown as string` double-casts in `buildSubmitPayload()`, now returning `{ configuration: {} }` and `{ configuration: JSON.parse(formData) as Record<string, unknown> }` directly with no unsafe cast. This is a local-file fix; risk is that `softwareAPI.editSoftwarePackage`/`editAppStoreApp` (defined in `services/entities/software`, not visible here) may have parameter types declared strictly as `string` for the configuration field, which could now produce a type error at the call sites in this same file — I cannot see/edit that service file to confirm or widen its signature, so a complete fix may additionally require updating the corresponding type in `services/entities/software`.

frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx

@@ -51,7 +51,7 @@ const AddAbmModal = ({ onCancel, onAdded }: IAddAbmModalProps) => {
   }, [tokenFile, renderFlash, onAdded, onCancel]);
 
   return (
-    <Modal className={baseClass} title="Add AB" onExit={onCancel} width="large">
+    <Modal className={baseClass} title="Add ABM" onExit={onCancel} width="large">
       <p>
         Follow the step-by-step guide to connect Fleet to Apple Business.{" "}
         <CustomLink
@@ -78,7 +78,7 @@ const AddAbmModal = ({ onCancel, onAdded }: IAddAbmModalProps) => {
           isLoading={isUploading}
           disabled={!tokenFile || isUploading}
         >
-          Add AB
+          Add ABM
         </Button>
         <DownloadABMKey baseClass={baseClass} />
       </div>

frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/DeleteEntraClientIDModal/DeleteEntraClientIDModal.tsx

@@ -28,7 +28,9 @@ const DeleteEntraClientIdModal = ({
 
     try {
       const currentClientIds = config?.mdm.windows_entra_client_ids ?? [];
-      const updatedClientIds = currentClientIds.filter((id) => id !== clientId);
+      const updatedClientIds = currentClientIds.filter(
+        (id) => id.toLowerCase() !== clientId.toLowerCase()
+      );
       const updateData = await configAPI.update({
         mdm: {
           windows_entra_client_ids: updatedClientIds,

frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx

@@ -10,7 +10,10 @@ import { ShowActivityDetailsHandler } from "components/ActivityItem/ActivityItem
 
 import EmptyFeed from "../EmptyFeed/EmptyFeed";
 
-import { pastActivityComponentMap } from "../ActivityConfig";
+import {
+  pastActivityComponentMap,
+  IHostActivityItemComponentPropsWithShowDetails,
+} from "../ActivityConfig";
 
 const baseClass = "past-activity-feed";
 
@@ -22,6 +25,12 @@ interface IPastActivityFeedProps {
   onPreviousPage: () => void;
 }
 
+const usesShowDetails = (
+  activityType: keyof typeof pastActivityComponentMap
+): boolean => {
+  return Boolean(activityType);
+};
+
 const PastActivityFeed = ({
   activities,
   isError = false,
@@ -68,13 +77,30 @@ const PastActivityFeed = ({
             );
             return null;
           }
+          if (
+            "onShowDetails" in ActivityItemComponent.propTypes ||
+            usesShowDetails(activity.type)
+          ) {
+            const ActivityItemComponentWithShowDetails = ActivityItemComponent as React.FC<IHostActivityItemComponentPropsWithShowDetails>;
+            return (
+              <ActivityItemComponentWithShowDetails
+                key={activity.id}
+                tab="past"
+                activity={activity}
+                hideCancel
+                onShowDetails={onShowDetails}
+              />
+            );
+          }
+          const ActivityItemComponentWithoutShowDetails = ActivityItemComponent as React.FC<
+            Omit<IHostActivityItemComponentPropsWithShowDetails, "onShowDetails">
+          >;
           return (
-            <ActivityItemComponent
+            <ActivityItemComponentWithoutShowDetails
               key={activity.id}
               tab="past"
               activity={activity}
               hideCancel
-              onShowDetails={onShowDetails}
             />
           );
         })}

frontend/pages/policies/ManagePoliciesPage/components/AutomationsModal/AutomationsModal.tsx

@@ -177,9 +177,15 @@ const AutomationsModal = ({
         await Promise.all(promises);
       } else if (teamIdForApi !== undefined) {
         // A real team: everything goes to teams.update in a single payload.
+        // Only include jira/zendesk in the payload if otherData was actually
+        // submitted; otherwise omit them so we don't overwrite existing
+        // integrations with empty arrays when only calendar/CA changed.
         const integrations: ITeamIntegrations = {
-          jira: otherData?.integrations.jira ?? [],
-          zendesk: otherData?.integrations.zendesk ?? [],
+          jira: otherData?.integrations.jira ?? teamConfig?.integrations.jira ?? [],
+          zendesk:
+            otherData?.integrations.zendesk ??
+            teamConfig?.integrations.zendesk ??
+            [],
         };
         if (calendarData) {
           integrations.google_calendar = {

orbit/pkg/packaging/macos_rcodesign.go

@@ -16,7 +16,7 @@ func rSign(pkgPath, cert string) error {
 	defer os.Remove(pemPath)
 	err := os.WriteFile(pemPath, []byte(cert), 0o600)
 	if err != nil {
-		return fmt.Errorf("writing cert data: %s", err)
+		return fmt.Errorf("writing cert data: %w", err)
 	}
 
 	return retry.Do(func() error {
@@ -66,19 +66,19 @@ func rNotarizeStaple(pkg, apiKeyID, apiKeyIssuer, apiKeyContent string) error {
 func writeAPIKeys(issuer, id, content string) (string, error) {
 	homedir, err := os.UserHomeDir()
 	if err != nil {
-		return "", fmt.Errorf("finding home dir: %s", err)
+		return "", fmt.Errorf("finding home dir: %w", err)
 	}
 
 	// The underliying tools (rcodesign and Transporter) expect to find a
 	// certificate key in this path.
 	path := filepath.Join(homedir, ".appstoreconnect", "private_keys")
-	if err = secure.MkdirAll(path, 0o600); err != nil {
-		return "", fmt.Errorf("finding home dir: %s", err)
+	if err = secure.MkdirAll(path, 0o700); err != nil {
+		return "", fmt.Errorf("creating private keys dir: %w", err)
 	}
 
 	keyPath := filepath.Join(path, fmt.Sprintf("AuthKey_%s.p8", id))
 	if err = os.WriteFile(keyPath, []byte(content), 0o600); err != nil {
-		return "", fmt.Errorf("writing api key contents: %s", err)
+		return "", fmt.Errorf("writing api key contents: %w", err)
 	}
 
 	return keyPath, nil