New gitops role (#10850)

#8593

This PR adds a new role `gitops` to Fleet.
MDM capabilities for the role coming on a separate PR. We need this
merged ASAP so that we can unblock the UI work for this.

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [X] Documented any permissions changes
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [x] Manual QA for all new/changed functionality
  - ~For Orbit and Fleet Desktop changes:~
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~

changes/8593-gitops

@@ -0,0 +1 @@
+* Add `gitops` user role to Fleet. GitOps users are users that can manage configuration.

cmd/fleetctl/api.go

@@ -16,6 +16,7 @@ import (
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/service"
+	kithttp "github.com/go-kit/kit/transport/http"
 	"github.com/kolide/kit/version"
 	"github.com/urfave/cli/v2"
 )
@@ -81,14 +82,18 @@ func clientFromCLI(c *cli.Context) (*service.Client, error) {
 	}
 
 	// check that AppConfig's Apple BM terms are not expired.
-	appCfg, err := fleetClient.GetAppConfig()
-	if err != nil {
+	var sce kithttp.StatusCoder
+	switch appCfg, err := fleetClient.GetAppConfig(); {
+	case err == nil:
+		if appCfg.MDM.AppleBMTermsExpired {
+			fleet.WriteAppleBMTermsExpiredBanner(os.Stderr)
+			// This is just a warning, continue ...
+		}
+	case errors.As(err, &sce) && sce.StatusCode() == http.StatusForbidden:
+		// OK, could be a user without permissions to read app config (e.g. gitops).
+	default:
 		return nil, err
 	}
-	if appCfg.MDM.AppleBMTermsExpired {
-		fleet.WriteAppleBMTermsExpiredBanner(os.Stderr)
-		// This is just a warning, continue ...
-	}
 
 	return fleetClient, nil
 }