Gate all policy label inclusions/exclusions as premium-only

[nulmete]

Related issue: Resolves #47677

Updating code so that it matches the docs (all label inclusions and exclusions for policies should be premium-only):

• Fix policy labels_include_any documentation #47643
• Update rest-api.md #46353

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

Bug Fixes

• Global and team policy label scoping now consistently enforces premium licensing for labels_include_any and labels_exclude_any (in addition to existing any/all restrictions).
• Non-premium requests that include these label filter fields are rejected earlier with the appropriate license error.
• GitOps policy export/validation now omits or disallows labels_include_any/labels_exclude_any on non-premium instances.

Tests

• Expanded coverage to verify premium gating behavior across global policy create/modify and spec-based policy application, including GitOps validation paths.

[Copilot]

Pull request overview

This PR aligns policy label-scoping behavior with the docs by making all policy label inclusion/exclusion fields (labels_include_any, labels_include_all, labels_exclude_any, labels_exclude_all) Fleet Premium-only across API endpoints, service-layer policy creation/modification/spec apply, and fleetctl GitOps workflows.

Changes:

• Gate labels_include_any and labels_exclude_any as Premium-only alongside the existing *_include_all / *_exclude_all gates in global/team policy creation, modification, and spec application.
• Mark labels_include_any / labels_exclude_any request fields as premium:"true" in API request structs and ModifyPolicyPayload.
• Update fleetctl GitOps validation and generation to treat policy label scoping as Premium-only.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/service/team_policies.go	Extends Premium gating for team policy create/modify to include *_include_any and *_exclude_any.
server/service/global_policies.go	Extends Premium gating for global policy create + policy spec apply to include *_include_any and *_exclude_any.
server/service/global_policies_test.go	Adjusts a unit test to run under Premium so label validation still executes after the new gate.
server/fleet/policies.go	Marks ModifyPolicyPayload’s labels_include_any/labels_exclude_any as premium-only.
server/fleet/api_policies.go	Marks GlobalPolicyRequest and TeamPolicyRequest labels_include_any/labels_exclude_any as premium-only.
cmd/fleetctl/fleetctl/gitops.go	Adds free-tier GitOps validation errors for policy labels_include_any/labels_exclude_any.
cmd/fleetctl/fleetctl/generate_gitops.go	Stops emitting policy labels_include_any/labels_exclude_any in generated GitOps output unless Premium.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d60df9fd-7f8e-4054-8ce2-da92c2fde82c

📥 Commits

Reviewing files that changed from the base of the PR and between ad0d604 and 6fc2285.

📒 Files selected for processing (3)

• cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_free/default.yml
• server/service/global_policies_test.go
• server/service/integration_core_test.go

💤 Files with no reviewable changes (1)

• cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_free/default.yml

---

Walkthrough

This PR extends the premium-only license gating to cover labels_include_any and labels_exclude_any policy label-scope fields, which were previously unrestricted. The changes span four areas: GlobalPolicyRequest, TeamPolicyRequest, and ModifyPolicyPayload structs gain premium:"true" tags on those fields; NewGlobalPolicy, ApplyPolicySpecs, NewTeamPolicy, and ModifyTeamPolicy expand their license.IsPremium() checks to return fleet.ErrMissingLicense when either "Any" field is set on a non-premium license; the fleetctl gitops validation loop is extended to reject those fields on non-premium instances; and generate_gitops gates their YAML emission behind the premium check. Tests are updated to enforce premium requirements and verify free-tier rejection.

Possibly related PRs

• fleetdm/fleet#47505: Modifies cmd/fleetctl/fleetctl/gitops.go policy label-scope validation to enforce premium restrictions on labels_include_all/labels_exclude_all, which this PR extends to cover labels_include_any/labels_exclude_any.
• fleetdm/fleet#47213: Adds UI support for sending labels_exclude_any and related label-targeting fields from the policy create/edit modal, directly connected to the backend payload structs this PR gates as premium-only.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: gating all policy label inclusions/exclusions as premium-only, which is the primary focus of the entire changeset.
Description check	✅ Passed	The description includes the related issue (#47677), explains the purpose (aligning code with docs), references relevant PRs, and confirms both automated testing and manual QA completion.
Linked Issues check	✅ Passed	All code changes directly implement the requirements from #47677: premium-only gating for labels_include_any, labels_exclude_any, labels_include_all, and labels_exclude_all across policy structs and conditional checks.
Out of Scope Changes check	✅ Passed	All changes are in-scope: they consistently apply premium gating to the four targeted label fields across API structs, business logic, GitOps generation, CLI validation, and tests without introducing unrelated modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 47677-update-all-label-inclusions-and

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 20.00000% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.19%. Comparing base (b3e81f3) to head (6fc2285).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/fleetctl/fleetctl/gitops.go	0.00%	2 Missing and 2 partials ⚠️
server/service/team_policies.go	0.00%	0 Missing and 2 partials ⚠️
cmd/fleetctl/fleetctl/generate_gitops.go	50.00%	0 Missing and 1 partial ⚠️
server/service/global_policies.go	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #47686      +/-   ##
==========================================
+ Coverage   67.18%   67.19%   +0.01%     
==========================================
  Files        3629     3630       +1     
  Lines      229302   229468     +166     
  Branches    11948    11948              
==========================================
+ Hits       154060   154195     +135     
- Misses      61387    61410      +23     
- Partials    13855    13863       +8     

Flag	Coverage Δ
backend	68.84% <20.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[juan-fdz-hawa]

nit: Refactor this so that the cmd.AppConfig.License.IsPremium() check is at the top:

if cmd.AppConfig.License.IsPremium() {
   if policy.LabelsIncludeAny != nil {
    ...