Conditional access dropdown and copy

[getvictor]

Related issue: Resolves #37305

Resolves issue that conditional access modal was not visible for self-hosted and contained wrong copy.

Testing

• QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

• Confirmed that the fix is not expected to adversely impact load test results

Summary by CodeRabbit

• Improvements
  • "Conditional access" automation option is now available to all users without license restrictions.
  • Enhanced conditional access detection for both Okta and Microsoft Entra identity providers.
  • Improved conditional access setup process with clearer provider information display based on your configuration.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[codecov]

Codecov Report

❌ Patch coverage is 52.17391% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.98%. Comparing base (cb0fb18) to head (887ff58).
⚠️ Report is 7 commits behind head on main.

Files with missing lines	Patch %	Lines
frontend/interfaces/config.ts	58.82%	7 Missing ⚠️
...policies/ManagePoliciesPage/ManagePoliciesPage.tsx	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #37338      +/-   ##
==========================================
+ Coverage   65.95%   65.98%   +0.02%     
==========================================
  Files        2352     2353       +1     
  Lines      186473   185750     -723     
  Branches     7784     7770      -14     
==========================================
- Hits       122995   122569     -426     
+ Misses      52230    51990     -240     
+ Partials    11248    11191      -57     

Flag	Coverage Δ
frontend	54.38% <52.17%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[getvictor]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.

[coderabbitai]

Walkthrough

This PR adds utility functions to check if conditional access is configured for Okta and Microsoft Entra, updates components to use these utilities, and makes the conditional access feature available on all Fleet instances regardless of managed cloud status. The provider text displayed in the modal now varies based on deployment type.

Changes

Cohort / File(s)	Summary
Config Utilities frontend/interfaces/config.ts	Added three public utility functions: isOktaConditionalAccessConfigured() validates presence of four Okta fields; isEntraConditionalAccessConfigured() checks Microsoft Entra status; isConditionalAccessConfigured() returns true if either provider is configured.
Component Updates frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx	Replaced inline manual Okta field validation with isOktaConditionalAccessConfigured() call.
Policy Automations frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx	Uses isConditionalAccessConfigured() utility; added dynamic providerText logic (displays "Okta or Microsoft Entra" for managed cloud, "Okta" for self-hosted); unconditionally includes conditional access option in automations dropdown (previously gated by managed_cloud license).
Modal Component frontend/pages/policies/ManagePoliciesPage/components/ConditionalAccessModal/ConditionalAccessModal.tsx	Added new providerText: string prop to enable dynamic provider name display in the not-configured message.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Verify utility functions correctly validate all required Okta fields
• Review conditional logic for provider text assignment based on managed cloud status
• Confirm removal of managed cloud gate for conditional access availability does not introduce unintended side effects
• Cross-check prop drilling of providerText through modal component hierarchy

Possibly related PRs

• #35204: Adds Okta-specific fields and UI in config and ConditionalAccess components; main PR extracts checks into utilities and consolidates usage.
• #34566: Implements server-side conditional access settings and validation for Okta; main PR adds corresponding frontend utilities and UI wiring.

Suggested reviewers

• jacobshandling
• lukeheath
• rachaelshaw

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is incomplete. While it references the related issue and includes some testing checkboxes, it lacks proper structure and detail required by the template.	Complete the PR description by filling out the full checklist template, including changes file documentation, testing details, database migration checks, and other required sections that apply to this frontend refactoring.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR addresses all requirements from issue #37305: showing conditional access for all instances and supporting dynamic provider text for Okta/Entra.
Out of Scope Changes check	✅ Passed	All changes directly support the stated objective of making conditional access available on self-hosted instances with appropriate provider text.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title 'Conditional access dropdown and copy' directly relates to the main changes: unconditionally showing the conditional access dropdown in Policies automations and updating modal copy to support both Okta and Microsoft Entra providers.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch victor/37305-okta-cond-access

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx (1)

28-28: LGTM! Good refactoring to use centralized utility.

Replacing the manual Okta field checks with isOktaConditionalAccessConfigured(config) reduces code duplication and improves maintainability.

Also applies to: 250-250

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between cb0fb18 and 4c3ceb7.

📒 Files selected for processing (4)

• frontend/interfaces/config.ts (1 hunks)
• frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx (2 hunks)
• frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx (4 hunks)
• frontend/pages/policies/ManagePoliciesPage/components/ConditionalAccessModal/ConditionalAccessModal.tsx (3 hunks)

🧰 Additional context used

🧠 Learnings (2)

📓 Common learnings

Learnt from: getvictor
Repo: fleetdm/fleet PR: 34566
File: server/service/integration_core_test.go:7500-7511
Timestamp: 2025-10-21T16:04:18.069Z
Learning: Okta conditional access app config in Fleet is Premium-gated and supported both on-prem and in Fleet Cloud; the Cloud-only enforcement applies to the Microsoft compliance partner endpoints, not to the Okta settings.

📚 Learning: 2025-10-21T16:04:18.069Z

Learnt from: getvictor
Repo: fleetdm/fleet PR: 34566
File: server/service/integration_core_test.go:7500-7511
Timestamp: 2025-10-21T16:04:18.069Z
Learning: Okta conditional access app config in Fleet is Premium-gated and supported both on-prem and in Fleet Cloud; the Cloud-only enforcement applies to the Microsoft compliance partner endpoints, not to the Okta settings.

Applied to files:

• frontend/interfaces/config.ts
• frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx

🧬 Code graph analysis (2)

frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx (1)

frontend/interfaces/config.ts (1)

• isConditionalAccessConfigured (299-306)

frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx (1)

frontend/interfaces/config.ts (1)

• isOktaConditionalAccessConfigured (277-287)

🔇 Additional comments (6)

frontend/interfaces/config.ts (1)

276-306: LGTM! Well-designed utility functions.

These utility functions properly centralize conditional access configuration checks with appropriate null-safety handling. The boolean coercion correctly treats empty strings as unconfigured.

frontend/pages/policies/ManagePoliciesPage/components/ConditionalAccessModal/ConditionalAccessModal.tsx (2)

33-33: LGTM! Clean interface extension.

Adding the providerText prop enables dynamic messaging based on deployment type (self-hosted vs managed cloud).

---

135-135: LGTM! Dynamic provider text implementation.

The interpolation correctly displays provider-specific guidance based on the deployment type passed from the parent component.

frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx (3)

128-132: LGTM! Correct provider text derivation.

The provider text logic appropriately reflects available conditional access providers based on deployment type: "Okta" for self-hosted instances, "Okta or Microsoft Entra" for managed cloud instances.

Based on learnings, Okta is supported on both self-hosted and managed cloud, while Microsoft Entra requires proxy infrastructure only available in managed cloud.

---

1206-1212: LGTM! Achieves the PR objective.

The conditional access option is now unconditionally included in the automations dropdown, making it visible on all Fleet instances (both self-hosted and managed cloud). The option is still appropriately disabled when Premium tier is not available or when "All teams" is selected.

This successfully addresses issue #37305 where conditional access was not available on self-hosted instances.

---

1396-1401: Implementation correctly uses dynamic provider text based on deployment type.

The modal configuration correctly uses isConditionalAccessConfigured(globalConfig) and passes the dynamic providerText derived from the isManagedCloud flag ("Okta or Microsoft Entra" for managed cloud, "Okta" otherwise). The ConditionalAccessModal component properly receives and displays this text.

Verify that the displayed text and modal behavior match the Figma designs in the referenced issue.