Cherrypick of Merged 48342 & 48343 PRs->4.90.0

[JordanMontgomery]

Related issue: Resolves #48342 & #48343

Cherrypick of #49141 and #49333

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• New Features
  • Added the ability to edit existing Apple, Windows, Android, and Apple DDM configuration profiles.
  • Profile content can be replaced, or label targeting can be updated without changing the profile file.
  • Added an edit action and modal to the configuration profile list.
  • Improved activity feed messages for individual and batch profile edits.
• Bug Fixes
  • Improved validation, error messages, profile size handling, and activity tracking during edits.

[codecov]

Codecov Report

❌ Patch coverage is 80.35714% with 176 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.88%. Comparing base (d91d8d7) to head (1875c46).
⚠️ Report is 1 commits behind head on rc-minor-fleet-v4.90.0.

Files with missing lines	Patch %	Lines
server/service/apple_mdm.go	82.35%	28 Missing and 11 partials ⚠️
server/service/mdm.go	81.86%	20 Missing and 13 partials ⚠️
server/datastore/mysql/microsoft_mdm.go	73.23%	10 Missing and 9 partials ⚠️
server/datastore/mysql/apple_mdm.go	82.82%	10 Missing and 7 partials ⚠️
...ds/ConfigurationProfiles/ConfigurationProfiles.tsx	0.00%	14 Missing ⚠️
server/service/windows_mdm_profiles.go	84.14%	9 Missing and 4 partials ⚠️
frontend/services/entities/mdm.ts	0.00%	12 Missing ⚠️
server/datastore/mysql/android.go	79.24%	6 Missing and 5 partials ⚠️
...ionProfiles/components/ProfileUploader/helpers.tsx	82.92%	7 Missing ⚠️
...s/components/EditProfileModal/EditProfileModal.tsx	94.00%	6 Missing ⚠️
... and 2 more

Additional details and impacted files

@@                    Coverage Diff                     @@
##           rc-minor-fleet-v4.90.0   #49644      +/-   ##
==========================================================
+ Coverage                   67.81%   67.88%   +0.07%     
==========================================================
  Files                        3890     3889       -1     
  Lines                      247631   248314     +683     
  Branches                    12981    13021      +40     
==========================================================
+ Hits                       167942   168580     +638     
- Misses                      64526    64530       +4     
- Partials                    15163    15204      +41     

Flag	Coverage Δ
backend	69.27% <81.38%> (+0.04%)	⬆️
frontend	60.39% <76.47%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Cherry-picks the merged backend + frontend work for “Edit configuration profiles” into the 4.90.0 release line, adding an in-place edit flow (PATCH) for existing MDM configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, Android), including activity logging and comprehensive unit/integration/UI test coverage.

Changes:

• Added PATCH /api/latest/fleet/configuration_profiles/{profile_uuid} to update profile contents and/or label targeting (replace semantics).
• Implemented platform-specific service + datastore update paths (including variable association handling, OS-update tracking reconciliation, and prior-content retention where applicable).
• Added a new UI “Edit profile” modal and updated activity feed messaging/filter labels to reflect single-profile vs fleetctl/GitOps batch edits.

Reviewed changes

Copilot reviewed 39 out of 40 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
server/service/windows_mdm_profiles.go	Refactors Windows create validation for reuse and adds the Windows update service path + edited activity.
server/service/windows_mdm_profiles_test.go	Adds service-layer unit tests for Windows update behaviors (labels-only, content update, authz, Fleet-managed rejection, etc.).
server/service/mdm.go	Adds PATCH request/endpoint wiring, dispatches UpdateMDMConfigProfile, and introduces shared helpers for team resolution and labels-only validation.
server/service/integration_mdm_profiles_test.go	Adds end-to-end integration coverage for PATCH across Apple/Windows/Android/DDM, checksum semantics, identifier/name gating, and activities.
server/service/handler.go	Registers the new PATCH route for configuration profiles.
server/service/apple_mdm.go	Adds Apple .mobileconfig and Apple declaration update service paths, preserves variable associations on labels-only edits, logs edited activities.
server/mock/service/service_mock.go	Extends the mocked service interface with UpdateMDMConfigProfile.
server/mock/datastore_mock.go	Extends datastore mocks with update methods for Apple/Windows/Android config profiles.
server/fleet/service.go	Adds UpdateMDMConfigProfile to the service interface.
server/fleet/request.go	Centralizes the max-profile-size error message as MaxProfileSizeErrMsg.
server/fleet/datastore.go	Adds update methods to the datastore interface for Apple/Windows/Android profiles.
server/fleet/activities.go	Extends edited-profile activity payloads to optionally include profile name/identifier for single edits.
server/datastore/mysql/microsoft_mdm.go	Implements atomic Windows profile update (content, labels, variables), prior-content retention, and OS-update tracking reconciliation.
server/datastore/mysql/microsoft_mdm_test.go	Adds datastore-level tests for Windows update semantics (labels replace/clear, uploaded_at, vars, tracking, retention).
server/datastore/mysql/apple_mdm.go	Implements in-place Apple config profile update and improves OS-update tracking reconciliation for declaration upserts.
server/datastore/mysql/apple_mdm_test.go	Adds datastore-level tests for Apple update semantics and OS-update tracking behavior on declaration upsert edits.
server/datastore/mysql/android.go	Implements atomic Android profile update (content, labels, variables) with uploaded_at no-op preservation.
server/datastore/mysql/android_test.go	Adds datastore-level tests for Android update semantics (labels replace/clear, vars, uploaded_at).
frontend/services/entities/mdm.ts	Adds updateProfile client for PATCHing an existing profile via multipart form.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/ConfigurationProfiles.tsx	Replaces the labels-only modal flow with a full edit modal and refresh-on-success behavior.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/helpers.tsx	Promotes shared label targeting helpers + improves error messaging for add vs edit flows (with tests).
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/helpers.tests.tsx	Adds unit tests for label targeting key generation and add/edit error message mapping.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx	Reuses shared targeting helper and fixes label query caching by scoping to team id.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/components/AddProfileModal/helpers.ts	Removes now-duplicated helper (moved to shared helpers).
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileUploader/components/AddProfileModal/helpers.tests.ts	Removes tests for the deleted helper (replaced by shared helper tests).
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileListItem/ProfileListItem.tsx	Adds “Edit” action and adjusts label iconography.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileListItem/ProfileListItem.tests.tsx	Updates tests for new edit callback prop and removed labels modal prop.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileLabelsModal/ProfileLabelsModal.tsx	Removes the old “labels-only” modal UI.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileLabelsModal/ProfileLabelsModal.tests.tsx	Removes tests for the deleted labels modal.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/ProfileLabelsModal/_styles.scss	Removes styles for the deleted labels modal.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/EditProfileModal/index.ts	Exports the new edit modal component.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/EditProfileModal/EditProfileModal.tsx	Adds the edit modal UI (optional file replacement + label targeting + GitOps mode disabling).
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/EditProfileModal/EditProfileModal.tests.tsx	Adds UI tests covering label prefills, submissions, file-type validation, and GitOps mode disabling.
frontend/pages/ManageControlsPage/OSSettings/cards/ConfigurationProfiles/components/EditProfileModal/_styles.scss	Adds styles for the edit modal layout.
frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx	Renders single-profile edited activities distinctly from fleetctl/GitOps batch edits.
frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tests.tsx	Adds test coverage for the new edited-activity message variants.
frontend/interfaces/activity.ts	Updates activity filter labels to reflect edited profile activities (not GitOps-only wording).
changes/48342-edit-config-profile-endpoint	Release note entry (content excluded from review by policy).

Files excluded by content exclusion policy (1)

• changes/48342-edit-config-profile-endpoint

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[georgekarrv]

Approved for cherry pick override. This is a very helpful feature we heard requested sooner than later by customers