Add "No Team" integration configurations for Jira and Zendesk

[getvictor]

• Added Jira and Zendesk integrations for "No team". (These are not supported by GitOps for teams)

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

New Fleet configuration settings

• Setting(s) is/are explicitly excluded from GitOps

Summary by CodeRabbit

• New Features

  • Default (No Team) responses now include limited integrations (Jira, Zendesk).
  • You can configure or clear Jira/Zendesk integrations for the Default (No Team) settings.

• Bug Fixes

  • More consistent handling of the Default (No Team) when fetching team details.
  • Improved validation to prevent conflicting automation settings between webhooks and integrations.

• Documentation

  • Clarified that Jira/Zendesk integrations aren’t supported via GitOps or at the team level (including No Team).
  • Noted that certain options (e.g., Google Calendar, Conditional Access) aren’t supported for the Default (No Team).

[codecov]

Codecov Report

❌ Patch coverage is 67.10526% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.13%. Comparing base (e44b1bc) to head (0f56b51).
⚠️ Report is 20 commits behind head on main.

Files with missing lines	Patch %	Lines
ee/server/service/teams.go	26.47%	23 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #32387      +/-   ##
==========================================
- Coverage   64.02%   62.13%   -1.89%     
==========================================
  Files        1986     1985       -1     
  Lines      195474   195521      +47     
  Branches     6467     6467              
==========================================
- Hits       125144   121482    -3662     
- Misses      60535    64363    +3828     
+ Partials     9795     9676     -119     

Flag	Coverage Δ
backend	63.14% <67.10%> (-2.11%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Walkthrough

Updates add default team integrations (Jira/Zendesk) types and wiring, extend default team service logic to accept/validate integrations and automation constraints, adjust GetTeam/ModifyTeam endpoint flows for ID 0 handling, tweak gitops generation for team integrations output, and add clarifying comments in gitops spec and CLI generation.

Changes

Cohort / File(s)	Summary of changes
CLI GitOps generation cmd/fleetctl/fleetctl/generate_gitops.go	For team_integrations path, remove jira/zendesk keys and return early; stop secret obfuscation in that branch. Updated No Team settings handling to use map[string]any and comments referencing issue 20287.
EE default team service logic ee/server/service/teams.go	In default/no-team config modification: process Integrations payload, match against global integrations, validate uniqueness, allow clearing via nil, and enforce mutual-exclusivity constraints with webhook automations. Note that GoogleCalendar and ConditionalAccessEnabled aren’t supported for No Team.
GitOps spec notes pkg/spec/gitops.go	Added comment stating Jira/Zendesk integrations aren’t supported in gitops for No Team (issue 20287). No functional changes.
Fleet types for default team server/fleet/teams.go	Added DefaultTeam.Integrations field and new DefaultTeamIntegrations type with Jira and Zendesk slices for team 0 serialization.
Team endpoints flow server/service/teams.go	getTeamEndpoint: unify to single GetTeam call; if returned team has ID 0, respond with DefaultTeam including Integrations; otherwise return regular team. modifyTeamEndpoint: removed success-path conversion to DefaultTeam for ID 0; only error handling remains special for ID 0.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant C as Client
  participant S as Service (API)
  participant DS as Datastore

  Note over S: GetTeam (ID may be 0 or non-zero)
  C->>S: GET /api/latest/fleet/teams/{id}
  S->>DS: GetTeam(ctx, id)
  DS-->>S: Team {ID, Config.Integrations, ...} or error
  alt error
    S-->>C: getTeamResponse{Err}
  else team.ID == 0
    Note over S: Construct DefaultTeam with WebhookSettings + Integrations (Jira/Zendesk)
    S-->>C: getDefaultTeamResponse{DefaultTeam}
  else team.ID != 0
    S-->>C: getTeamResponse{Team}
  end

Loading

sequenceDiagram
  autonumber
  participant C as Client
  participant S as EE Service (Default Team)
  participant DS as Datastore
  participant AC as App Config

  Note over S: modifyDefaultTeamConfig (No Team)
  C->>S: PATCH default team config (WebhookSettings/Integrations)
  alt Integrations provided (Jira/Zendesk possibly present)
    S->>DS: GetAppConfig(ctx)
    DS-->>S: AppConfig
    S->>S: MatchWithIntegrations(AppConfig.Integrations)
    S->>S: Validate uniqueness (Integrations.Validate)
    alt invalid
      S-->>C: 400 InvalidArgument("integrations")
    end
  end
  S->>S: Apply webhook/integration updates to config
  S->>S: Validate automations<br/>(ValidateEnabledFailingPoliciesTeamIntegrations)
  alt invalid combo
    S-->>C: 400 error
  else valid
    S->>DS: SaveDefaultTeamConfig(ctx, config)
    DS-->>S: ok
    S-->>C: success
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested reviewers

• sharon-fdm
• lukeheath
• mostlikelee
• georgekarrv

Tip

🔌 Remote MCP (Model Context Protocol) integration is now available!

Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats.

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch victor/31267-no-team-tickets

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

‼️ IMPORTANT
Auto-reply has been disabled for this repository in the CodeRabbit settings. The CodeRabbit bot will not respond to your replies unless it is explicitly tagged.

• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

server/service/teams.go (1)

154-165: Inconsistent response shape for team ID 0 on success (Team vs DefaultTeam).

GET /teams/0 returns DefaultTeam, but PATCH /teams/0 returns Team on success. This breaks response-shape consistency for clients handling No Team.

Apply:

 func modifyTeamEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (fleet.Errorer, error) {
   req := request.(*modifyTeamRequest)
   team, err := svc.ModifyTeam(ctx, req.ID, req.TeamPayload)
   if err != nil {
     // For team ID 0, return appropriate error response
     if req.ID == 0 {
       return getDefaultTeamResponse{Err: err}, nil
     }
     return teamResponse{Err: err}, nil
   }
-  return teamResponse{Team: team}, err
+  if req.ID == 0 {
+    dt := &fleet.DefaultTeam{
+      ID:   team.ID,
+      Name: team.Name,
+      WebhookSettings: fleet.DefaultTeamWebhookSettings{
+        FailingPoliciesWebhook: team.Config.WebhookSettings.FailingPoliciesWebhook,
+      },
+      Integrations: fleet.DefaultTeamIntegrations{
+        Jira:    team.Config.Integrations.Jira,
+        Zendesk: team.Config.Integrations.Zendesk,
+      },
+    }
+    return getDefaultTeamResponse{Team: dt}, nil
+  }
+  return teamResponse{Team: team}, nil
 }

🧹 Nitpick comments (2)

server/fleet/teams.go (1)

189-202: Consider omitting empty integrations in DefaultTeam responses.

Without omitempty, clients will see "integrations": {"jira": null, "zendesk": null} which is noisier and can break strict schemas. Recommend using omitempty on both the field and slice members (or make the field a pointer) to suppress empty/nulls.

Apply:

 type DefaultTeam struct {
   ID              uint                       `json:"id"`
   Name            string                     `json:"name"`
   WebhookSettings DefaultTeamWebhookSettings `json:"webhook_settings"`
-  Integrations    DefaultTeamIntegrations    `json:"integrations"`
+  Integrations    *DefaultTeamIntegrations   `json:"integrations,omitempty"`
 }
 
-// DefaultTeamIntegrations contains only the integrations supported for team ID 0
-type DefaultTeamIntegrations struct {
-  Jira    []*TeamJiraIntegration    `json:"jira"`
-  Zendesk []*TeamZendeskIntegration `json:"zendesk"`
-}
+// DefaultTeamIntegrations contains only the integrations supported for team ID 0
+type DefaultTeamIntegrations struct {
+  Jira    []*TeamJiraIntegration    `json:"jira,omitempty"`
+  Zendesk []*TeamZendeskIntegration `json:"zendesk,omitempty"`
+}

Note: If you adopt this, also update call sites to set Integrations: &fleet.DefaultTeamIntegrations{...}.

server/service/teams.go (1)

80-83: Optional: Align error envelope for GET /teams/0 with DefaultTeam response.

Currently errors for ID 0 return getTeamResponse. Consider returning getDefaultTeamResponse for symmetry.

-  team, err := svc.GetTeam(ctx, req.ID)
-  if err != nil {
-    return getTeamResponse{Err: err}, nil
-  }
+  team, err := svc.GetTeam(ctx, req.ID)
+  if err != nil {
+    if req.ID == 0 {
+      return getDefaultTeamResponse{Err: err}, nil
+    }
+    return getTeamResponse{Err: err}, nil
+  }

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between a23d24b and 9c6e168.

📒 Files selected for processing (5)

• cmd/fleetctl/fleetctl/generate_gitops.go (2 hunks)
• ee/server/service/teams.go (1 hunks)
• pkg/spec/gitops.go (1 hunks)
• server/fleet/teams.go (1 hunks)
• server/service/teams.go (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**/*.go

⚙️ CodeRabbit configuration file

When reviewing SQL queries that are added or modified, ensure that appropriate filtering criteria are applied—especially when a query is intended to return data for a specific entity (e.g., a single host). Check for missing WHERE clauses or incorrect filtering that could lead to incorrect or non-deterministic results (e.g., returning the first row instead of the correct one). Flag any queries that may return unintended results due to lack of precise scoping.

Files:

• pkg/spec/gitops.go
• ee/server/service/teams.go
• server/fleet/teams.go
• cmd/fleetctl/fleetctl/generate_gitops.go
• server/service/teams.go

🔇 Additional comments (4)

pkg/spec/gitops.go (1)

468-468: Comment-only update acknowledged; behavior remains consistent.

The note aligns with the current restriction: No Team GitOps should only allow webhook_settings. No further action.

cmd/fleetctl/fleetctl/generate_gitops.go (1)

865-876: No Team export correctly limits to webhook_settings.

The shape matches parseNoTeamSettings: only failing_policies_webhook is emitted. Good constraint.

ee/server/service/teams.go (1)

1856-1869: Mutual exclusivity validation between webhooks and integrations: LGTM.

This correctly re-validates after applying changes to the working config.

server/service/teams.go (1)

85-99: DefaultTeam payload includes integrations: LGTM.

The mapping from Team.Config to DefaultTeam is correct and mirrors the new DefaultTeam fields.

[sgress454]

Code looks good. Tested 👍 after setting initial integration config via manual PATCH request. Tested error states as well.