Configuration profiles: Support custom activations (DDM)

[melpike]

Goal

User story
As an IT admin who likes doing advanced setups with DDM profiles,
I want the option to create my own activation (com.apple.activation) with predicates
so that I can activate/scope configurations on specific hosts.

Changes

Product

• UI changes:
  • Figma
• CLI (fleetctl) usage changes: Ensure fleetctl apply now includes/surfaces activation
• YAML changes: [YAML] Update yaml-files.md with new Apple settings #49767
• REST API changes: [API] Enhance REST API documentation for profiles #49768 [API]: add activation param to update profile endpoint #51031
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: Follow same permissions as configuration profiles
• Changes to paid features or tiers: Fleet Premium
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes:
  • [Route] Add route for DDM activations learn more page #50465
  • [Docs] Document custom activation process for configurations #51002
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: No changes
• Database schema migrations: CADDM: Migration #49966
• Load testing/osquery-perf improvements: CADDM: osquery-perf #50282
• This is a premium only feature: Yes

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Risk level: Low

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• Add DDM profile with custom activation via API
• Add DDM profile with custom activation via GitOps YAML
• Batch set profile with activation
• Edit/replace activation on existing profile
• Remove activation from a profile
• Host receives activation + configuration on DDM sync
• Team-scoped activation only applies to team hosts
• Host correctly receives management profiles on DDM sync
• All API endpoints with activations is gated behind a config flag (mdm.allow_custom_activations).
• UI OS settings modal, shows details for a verified profile if any.

One-Profile-Per-Activation Constraint

• Activation referencing exactly one profile succeeds
• Activation referencing multiple profiles returns validation error
• Activation referencing zero profiles or mismatched identifier returns validation error

Validation / Negative

• Error when adding activation to a non-DDM profile (.mobileconfig/Windows XML)
• Error on malformed activation JSON (missing Type, bad Identifier, etc.)
• Error if activation Identifier conflicts with an existing activation
• Management profiles can be uploaded successfully (except server-capabilities)

Permissions

• Admin/Maintainer/GitOps can add/edit/delete activations
• Technician can view but not modify
• Observer/Observer+ cannot view or modify

Premium

• Feature requires Fleet Premium license (except management profiles)

Edge cases

• Can management declarations be delivered on the user-channel?
  • YES, they deliver fine on the user-channel.

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation":