CADDM: Validation + Upload API

[MagnusHJensen]

Related user story

#48222

Task

This task covers the single-profile upload, delete, edit paths. Batch via gitops and fleetctl is covered by another sub-task.

• Add activation argument to API endpoints request objects and validate according to spec.
  • New config profile and edit config profile
• Editing activation only for a DDM profile, should emit ActivityTypeEditedDeclarationProfile (no duplicate emissions)
• Add datastore CRUD that also sets the configuration reference column (the 1:1 link)
  (server/datastore/mysql/apple_mdm.go, following the insertOrUpsertMDMAppleDeclaration pattern).
  • The activation should always be handled together with the declaration, however edits for DDM profiles should support only updating activation without other updates.
  • Associate fleet variables in activation via mdm_configuration_profile_variables.apple_ddm_activation_uuid
• Activation validation should not follow or relax the original declaration (configuration) validation.
• List profiles endpoint should return the activation raw JSON for DDM profiles.
• Validate Custom variables and Fleet variables on upload
  • Supported Fleet variables: FleetVarHostEndUserIDPUsername,
    FleetVarHostEndUserIDPUsernameLocalPart,
    FleetVarHostEndUserIDPFullname,
    FleetVarHostEndUserIDPGroups,
    FleetVarHostEndUserIDPDepartment,
    FleetVarHostHardwareSerial,
    FleetVarHostUUID,
    FleetVarHostPlatform.
• Allow uploading to the normal profile upload flow, and store alongside declarations:
  • https://developer.apple.com/documentation/devicemanagement/managementproperties
  • https://developer.apple.com/documentation/devicemanagement/managementorganizationinformation

Condition of satisfaction

• Possible to send activation alongside create new profile
  • Fails if supplied next to profile that is not DDM.
  • Fails if non-premium instance
• Activation content is validated and forces a Type, Identifier and StandardConfigurations (which is limited to the uploaded declaration identifier)
  • If predicate is supplied we never validate it, and just send it as is to the device to let it validate.
• Activation content is returned on List profiles endpoint for DDM profiles. If no custom activation is defined, do not return anything.
• Correct validation for Host Variables and Custom variables
• Maintainer and Admin only
• Can upload two management DDM profiles