Show Run policy for Observer+ on Unassigned by Prajwal2246 · Pull Request #54726 · fleetdm/fleet

Prajwal2246 · 2026-10-03T10:49:51Z

Related issue: Resolves #54624

Global Observer+ users can run policies from All fleets, but the Run policy action was missing on Unassigned policies. Unassigned has fleet ID 0, which a truthiness check incorrectly treated as no selected fleet. Check whether the ID is defined instead.

Checklist for submitter

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
See Changes files for more information.

Testing

Added/updated automated tests
QA'd all new/changed functionality manually

Automated: the focused useTeamIdParam regression test passes and verifies isObserverPlus for a global Observer+ user on fleet ID 0.

Manual: signed in as the global Observer+ test user, opened a policy on Unassigned, and confirmed Run policy is visible. Did not run the policy.

AI

AI: Codex (unknown)

Frontend

Attached before and after screenshots of the user-visible change.

Before: Original report from #54624 shows the Unassigned policy page without Run policy.

After: As a global Observer+ user, Run policy is visible on the Unassigned policy.

Summary by CodeRabbit

Bug Fixes
- Fixed the missing Run policy action for global Observer+ users on Unassigned policies.

codecov · 2026-10-03T10:56:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.71%. Comparing base (c45de7b) to head (fdde3dd).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #54726   +/-   ##
=======================================
  Coverage   76.71%   76.71%           
=======================================
  Files        4274     4274           
  Lines      262027   262027           
  Branches    15263    15263           
=======================================
+ Hits       201024   201027    +3     
+ Misses      60820    60817    -3     
  Partials      183      183

Flag	Coverage Δ
frontend	`69.72% <100.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai · 2026-10-03T11:07:46Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: fleetdm/fleet/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 84939ab4-7093-4f2d-bc71-07c28e3c7d9f

📥 Commits

Reviewing files that changed from the base of the PR and between c45de7b and fdde3dd.

📒 Files selected for processing (3)

changes/54624-observer-plus-unassigned-run-policy
frontend/hooks/useTeamIdParam.hook.tests.tsx
frontend/hooks/useTeamIdParam.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

useTeamIdParam now evaluates Observer+ permission when the current team ID is defined, including the Unassigned team ID of 0. A hook test checks this case, and a changelog entry records the Run policy action fix for global Observer+ users on Unassigned policies.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to fdde3

The Unassigned policy permission change has no identified merge-blocking issue and is ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to fdde3

The change restores access consistent with existing global Observer+ permissions. Sensitive operations remain subject to server-side authorization and host-scope filtering. No authority expansion was demonstrated, although other affected screens and end-to-end behavior were not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The incremental exposure is frontend actions whose visibility depends on this shared Observer+ result when fleet ID 0 is selected. Run policy is a confirmed consumer; other affected consumers were not exhaustively established. Existing global Observer+ host authority is broader than this restored UI path, while team-scoped authority remains subject to server filtering.

Trust Boundaries and Controls

observed — Client-controlled query and target inputs do not gain execution authority from the frontend boolean. Live-query creation requires an authenticated viewer, authorizes the targeted query, and selects hosts through a viewer-derived TeamFilter before dispatch. The datastore distinguishes global Observer+ authority from matching team-role authority and returns no hosts when applicable role scope is absent.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the change: making the Run policy action available to Observer+ users on Unassigned policies.
Description check	✅ Passed	The description explains the issue and fix, links the related issue, reports automated and manual testing, includes the required AI section, and provides before-and-after screenshots.
Linked Issues check	✅ Passed	Issue `#54624` requires global Observer+ users to see Run policy on Unassigned policies. `useTeamIdParam` now checks whether `currentTeam.id` is defined, so ID `0` reaches the Observer+ permission check…
Out of Scope Changes check	✅ Passed	The permission-check change, regression test, and changelog entry all directly implement or document the fix for issue `#54624`. No unrelated changes appear in the reviewed diff.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

@TraiLynne

**Related issue:** NA Adds Fleet's November 2026 newsletter (`articles/newsletter-2026-11.md`), which covers October 2026. It publishes at `fleetdm.com/newsletters/newsletter-2026-11`. - **Email subject line:** `Fleet news: November 2026` - **Category:** `newsletter`, singular, which the website build accepts (#52120). No website changes are needed. - **Author:** Aube Paul (`robinedev`), matching the September and October issues. ## Open questions for reviewers - **New "📺 Fleet Virtual Summit" section** for the November 10 LinkedIn Live event, placed before workshops. Keep it or fold it into the workshops section. If it stays, it's a new entry in the newsletter's section emoji table. - **The roadmap preview is linked even though November isn't a quarter's first month.** The October preview published October 13, after the October issue went out, so readers haven't seen it in the newsletter yet. - **Article and guide picks are editorial**, not based on traffic numbers. Reorder them if you have analytics. There were no case studies in October. - **The community section has one post, and it's personal.** Henry Stamerjohann's MacSysAdmin talk. Fleet's company-page post about the "Apple in the enterprise" research is another option, but it repeats the research article in "Worth reading." No engagement numbers were available. - **Community contributors with five or more merged PRs in October:** Prajwal Janbandhu (8, in the thank-you line), Michael Alt (6, highlighted), Dhvanit (6, returning, not named), and Shreyash Agare (5, returning, not named). Confirm none of them is a contractor whose account isn't in the org. - **Several first-time contributors only edited the handbook.** None appear in Fleet's Slack, so they stay in the thank-you line. ## How each section was sourced - **Shipped:** the Fleet 4.93.0 and 4.94.0 release articles, cross-checked against tagged releases. The three highlights are macOS patch notifications (Premium), Android zero-touch enrollment (Premium), and self-service configuration profiles (not Premium), so the section isn't all Premium. Patch releases 4.93.1 and 4.93.2 are covered by the "See every release" link. - **Planned:** the release planning board (view 10, filtered to milestone 4.95.0), not the milestone fallback. There are 22 stories, all assigned. 5.0.0 is due December 4, so November holds one release. - **Workshops:** fleetdm.com/workshops, with the next five after the send date. - **Community contributions:** PRs merged in public `fleetdm` repos in October by authors outside the `fleetdm` org, minus bots. ## Left out on purpose - **"Windows: force standard account"** was in the planned section in both September and October and hasn't shipped. It's not on the 4.95.0 board, so it isn't mentioned a third time. - **Multiple versions of the same App Store app** is named in the 4.94.0 release article's title, but the article marks it as moved to 4.95. It's listed under "Also on deck" instead of "shipped." - **Amsterdam workshop (November 3):** past by the time this sends. - **Fleet staff or contractors whose accounts aren't in the org:** @TraiLynne and @thomcrowe. Both are confirmed in Fleet's Slack. - **Other October content:** the warehouse inventory article and Retriever guide, the PHP2Shell and eMudhra pieces, and every `industry news` article. The routine doesn't feature that category. <details> <summary>Suggested <code>~/fleet-newsletters/contributors.tsv</code> lines (append once confirmed)</summary> ``` TraiLynne fleet Trai Lynne Compton, Fleet staff (Slack); not an org member thomcrowe fleet Thom Crowe, Fleet contractor (website); not an org member ``` </details> <details> <summary>Ledger append block: run only after this issue is sent</summary> `~/fleet-newsletters/ledger.jsonl` didn't exist before this issue. Repeats were checked against the September and October issues in the repo instead. This block creates the ledger and records every item in this issue. ```bash mkdir -p ~/fleet-newsletters && cat >> ~/fleet-newsletters/ledger.jsonl <<'EOF' {"issue":"2026-11","section":"shipped","id":"4.93.0"} {"issue":"2026-11","section":"shipped","id":"4.94.0"} {"issue":"2026-11","section":"planned","id":"51599"} {"issue":"2026-11","section":"planned","id":"39176"} {"issue":"2026-11","section":"planned","id":"51979"} {"issue":"2026-11","section":"planned","id":"53284"} {"issue":"2026-11","section":"planned","id":"33062"} {"issue":"2026-11","section":"planned","id":"52534"} {"issue":"2026-11","section":"planned","id":"47904"} {"issue":"2026-11","section":"events","id":"fleet-virtual-summit-2026"} {"issue":"2026-11","section":"events","id":"2003719976388"} {"issue":"2026-11","section":"events","id":"2003716644422"} {"issue":"2026-11","section":"events","id":"2002266719658"} {"issue":"2026-11","section":"events","id":"2002266872114"} {"issue":"2026-11","section":"events","id":"2002267524064"} {"issue":"2026-11","section":"articles","id":"apple-in-the-enterprise-2026"} {"issue":"2026-11","section":"articles","id":"nvidia-gtc-2026"} {"issue":"2026-11","section":"articles","id":"tailworm-what-to-do-about-tailscale-ssh-before-the-fix-ships"} {"issue":"2026-11","section":"articles","id":"revert-a-bad-change-in-gitops"} {"issue":"2026-11","section":"articles","id":"block-chrome-extensions"} {"issue":"2026-11","section":"articles","id":"block-edge-extensions"} {"issue":"2026-11","section":"articles","id":"block-firefox-extensions"} {"issue":"2026-11","section":"articles","id":"block-safari-extensions"} {"issue":"2026-11","section":"articles","id":"use-claude-code-with-fleet"} {"issue":"2026-11","section":"articles","id":"roadmap-preview-october-2026"} {"issue":"2026-11","section":"social","id":"7513481631123394560"} {"issue":"2026-11","section":"community","id":"#50836"} {"issue":"2026-11","section":"community","id":"#53407"} {"issue":"2026-11","section":"community","id":"#53670"} {"issue":"2026-11","section":"community","id":"#53768"} {"issue":"2026-11","section":"community","id":"#53810"} {"issue":"2026-11","section":"community","id":"#53824"} {"issue":"2026-11","section":"community","id":"#54019"} {"issue":"2026-11","section":"community","id":"#54181"} {"issue":"2026-11","section":"community","id":"#54296"} {"issue":"2026-11","section":"community","id":"#54411"} {"issue":"2026-11","section":"community","id":"#54502"} {"issue":"2026-11","section":"community","id":"#54509"} {"issue":"2026-11","section":"community","id":"#54592"} {"issue":"2026-11","section":"community","id":"#54685"} {"issue":"2026-11","section":"community","id":"#54708"} {"issue":"2026-11","section":"community","id":"#54726"} {"issue":"2026-11","section":"community","id":"#54785"} {"issue":"2026-11","section":"community","id":"#55056"} {"issue":"2026-11","section":"community","id":"#55058"} {"issue":"2026-11","section":"community","id":"#55072"} {"issue":"2026-11","section":"community","id":"#55089"} {"issue":"2026-11","section":"community","id":"#55097"} {"issue":"2026-11","section":"community","id":"#55127"} {"issue":"2026-11","section":"community","id":"#55249"} {"issue":"2026-11","section":"community","id":"#55266"} {"issue":"2026-11","section":"community","id":"#55353"} {"issue":"2026-11","section":"community","id":"#55471"} {"issue":"2026-11","section":"community","id":"#55492"} {"issue":"2026-11","section":"community","id":"#55547"} {"issue":"2026-11","section":"community","id":"#55841"} {"issue":"2026-11","section":"community","id":"#55900"} {"issue":"2026-11","section":"community","id":"#55903"} {"issue":"2026-11","section":"community","id":"#55946"} {"issue":"2026-11","section":"community","id":"#56072"} {"issue":"2026-11","section":"community","id":"#56085"} {"issue":"2026-11","section":"community","id":"#56148"} {"issue":"2026-11","section":"community","id":"#56214"} {"issue":"2026-11","section":"community","id":"#56266"} {"issue":"2026-11","section":"community","id":"#56287"} {"issue":"2026-11","section":"community","id":"#56376"} {"issue":"2026-11","section":"community","id":"#56403"} {"issue":"2026-11","section":"community","id":"#56486"} {"issue":"2026-11","section":"community","id":"#56498"} {"issue":"2026-11","section":"community","id":"#56575"} {"issue":"2026-11","section":"community","id":"#56596"} {"issue":"2026-11","section":"community","id":"#56609"} {"issue":"2026-11","section":"community","id":"#56657"} {"issue":"2026-11","section":"community","id":"#56708"} {"issue":"2026-11","section":"community","id":"#56719"} {"issue":"2026-11","section":"community","id":"#56983"} {"issue":"2026-11","section":"community","id":"#56984"} {"issue":"2026-11","section":"community","id":"#56985"} EOF ``` </details> ## Testing - [x] Confirmed the markdown passes the website build's metadata checks: required meta tags, ISO `publishedOn`, description at 139 of 150 characters, `category` set to `newsletter`, H1 matching `articleTitle`, and no Vue-template braces. - [x] Verified all 54 fleetdm.com, GitHub, and Eventbrite links return 200. LinkedIn returns 999 to automated requests, so the profile links come from the handbook and the post link was opened in a browser. - [x] Checked the copy against Fleet's content style: no em dashes, sentence-case headings, Oxford commas, and Fleet Premium labels carried through from the release articles. - [ ] QA'd all new/changed functionality manually ## AI **AI:** Claude Code (claude-opus-5-5) --------- Co-authored-by: robinedev <aubedev@outlook.com>

Fix Observer+ Run policy access on Unassigned

fdde3dd

Prajwal2246 marked this pull request as ready for review October 3, 2026 11:00

Prajwal2246 requested a review from a team as a code owner October 3, 2026 11:00

lucasmrod assigned nulmete Oct 8, 2026

lucasmrod approved these changes Oct 8, 2026

View reviewed changes

nulmete approved these changes Oct 8, 2026

View reviewed changes

lucasmrod merged commit 8959663 into fleetdm:main Oct 8, 2026
28 checks passed

Prajwal2246 deleted the fix/54624-observer-plus-unassigned branch October 23, 2026 19:09

Navigation Menu

Repository navigation

Show Run policy for Observer+ on Unassigned - #54726

Show Run policy for Observer+ on Unassigned#54726
lucasmrod merged 1 commit into
fleetdm:mainfrom
Prajwal2246:fix/54624-observer-plus-unassigned

Prajwal2246 commented Oct 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

codecov Bot commented Oct 3, 2026

Uh oh!

coderabbitai Bot commented Oct 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Prajwal2246 commented Oct 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist for submitter

Testing

AI

Frontend

Summary by CodeRabbit

Uh oh!

codecov Bot commented Oct 3, 2026

Codecov Report

Uh oh!

coderabbitai Bot commented Oct 3, 2026

Walkthrough

Security Architecture Review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Prajwal2246 commented Oct 3, 2026 •

edited by coderabbitai Bot

Loading