fix(windows): don't fail uninstall when the configuration directory is unresolved

Co-authored-by: chouetz <24426034+chouetz@users.noreply.github.com>

Author: datadog-datadog-prod-us1[bot]

releasenotes/notes/fix-windows-uninstall-corrupted-config-root-659a419420adaa88.yaml

@@ -0,0 +1,14 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    On Windows, fixed an issue where uninstalling the Agent could fail with MSI error code 1603
+    when the Agent's install state in the registry had been removed or corrupted. The configuration
+    directory owner check no longer blocks the operation when the configuration directory cannot be
+    resolved, since there is nothing to secure in that case.

tools/windows/DatadogAgentInstaller/CustomActions.Tests/CustomActions.Tests.csproj

@@ -83,6 +83,7 @@
     <Compile Include="IntegrationTests\TestConfig.cs" />
     <Compile Include="Logs\ProcessConfigTests.cs" />
     <Compile Include="Native\SecureDirectoryTests.cs" />
+    <Compile Include="Prerequisites\EnsureSecureConfigRootTests.cs" />
     <Compile Include="ProcessUserCustomActions\TestDelegate.cs" />
     <Compile Include="Process\ProcessConfigTests.cs" />
     <Compile Include="Proxy\ProcessConfigTests.cs" />

tools/windows/DatadogAgentInstaller/CustomActions.Tests/Prerequisites/EnsureSecureConfigRootTests.cs

@@ -0,0 +1,34 @@
+using Datadog.CustomActions;
+using FluentAssertions;
+using WixToolset.Dtf.WindowsInstaller;
+using Xunit;
+
+namespace CustomActions.Tests.Prerequisites
+{
+    public class EnsureSecureConfigRootTests : SessionTestBaseSetup
+    {
+        // Uninstalling an Agent whose install state (the registry values that record the configuration
+        // directory) was removed or corrupted leaves APPLICATIONDATADIRECTORY unset. The configuration
+        // directory owner check must not fail in that case, otherwise the custom action returns Failure
+        // and the MSI aborts with exit code 1603, making a broken install impossible to uninstall.
+        // See incident 58787.
+        [Fact]
+        public void EnsureSecureConfigRoot_Succeeds_When_ConfigRoot_Is_Not_Set()
+        {
+            PrerequisitesCustomActions.EnsureSecureConfigRoot(Session.Object)
+                .Should()
+                .Be(ActionResult.Success);
+        }
+
+        [Fact]
+        public void EnsureSecureConfigRootUI_Reports_Valid_When_ConfigRoot_Is_Not_Set()
+        {
+            PrerequisitesCustomActions.EnsureSecureConfigRoot(Session.Object, calledFromUIControl: true)
+                .Should()
+                .Be(ActionResult.Success);
+
+            Properties.Should()
+                .Contain(PrerequisitesCustomActions.ConfigRootValidProperty, "True");
+        }
+    }
+}

tools/windows/DatadogAgentInstaller/CustomActions/PrerequisitesCustomActions.cs

@@ -66,7 +66,7 @@ public static ActionResult EnsureAdminCaller(Session session)
         /// dialog cannot send a message to the user, and returning failure exits the installer.
         /// https://learn.microsoft.com/en-us/windows/win32/msi/sending-messages-to-windows-installer-using-msiprocessmessage
         /// </remarks>
-        private static ActionResult EnsureSecureConfigRoot(ISession session, bool calledFromUIControl = false)
+        internal static ActionResult EnsureSecureConfigRoot(ISession session, bool calledFromUIControl = false)
         {
             if (calledFromUIControl)
             {
@@ -78,15 +78,27 @@ private static ActionResult EnsureSecureConfigRoot(ISession session, bool called
             // Read outside the try so that the messages below can name the directory
             var configRoot = session.Property("APPLICATIONDATADIRECTORY");
 
-            try
+            if (string.IsNullOrEmpty(configRoot))
             {
-                if (string.IsNullOrEmpty(configRoot))
+                // On a fresh install or a maintenance (Change/Repair) run, CostFinalize resolves this
+                // property to a concrete path before this action runs, so an empty value means the
+                // install state that records the configuration directory is unavailable. That happens
+                // when operating on an install whose registry state was removed or corrupted - for
+                // example uninstalling it. There is no directory to verify or secure in that case, and
+                // returning Failure would fail the MSI (exit code 1603) and make a broken-but-removable
+                // install impossible to uninstall. Treat it as nothing to verify and let the operation
+                // proceed. See incident 58787.
+                session.Log("APPLICATIONDATADIRECTORY is not set, skipping the configuration directory owner check");
+                if (calledFromUIControl)
                 {
-                    // Resolved by CostFinalize, which runs before this action in both sequences, so an
-                    // empty value means something is wrong. Fail rather than skip the check.
-                    throw new InvalidOperationException("APPLICATIONDATADIRECTORY is not set");
+                    session[ConfigRootValidProperty] = "True";
                 }
 
+                return ActionResult.Success;
+            }
+
+            try
+            {
                 SecureDirectory.AssertSecureOwner(session, configRoot);
             }
             catch (SecureDirectoryException e)