From 4d0518137e9dec30b2ce60a959be9bf4d5af7679 Mon Sep 17 00:00:00 2001
From: Gabriel Hernandez <ghernandez345@gmail.com>
Date: Wed, 23 Jul 2025 12:11:32 +0100
Subject: [PATCH] Add service discovery API endpoint (#31089)

relates to #31057

adds an endpoint to expose the fleet handled service discovery endpoint.

> NOTE: test will be done in a follow up PR

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
---
 .../issue-31057-service-discovery-endpoint    |  0
 cmd/fleet/serve.go                            |  1 +
 server/mdm/apple/apple_mdm.go                 |  2 ++
 server/service/handler.go                     | 25 +++++++++++++++++++
 server/service/testing_utils.go               |  1 +
 5 files changed, 29 insertions(+)
 create mode 100644 changes/issue-31057-service-discovery-endpoint

diff --git a/changes/issue-31057-service-discovery-endpoint b/changes/issue-31057-service-discovery-endpoint
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index b8f0ed3912..05cb55b08b 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -1206,6 +1206,7 @@ the way that the Fleet server works.
 					mdmCheckinAndCommandService,
 					ddmService,
 					commander,
+					appCfg.ServerSettings.ServerURL,
 				); err != nil {
 					initFatal(err, "setup mdm apple services")
 				}
diff --git a/server/mdm/apple/apple_mdm.go b/server/mdm/apple/apple_mdm.go
index 9f917f4be7..276d06eaef 100644
--- a/server/mdm/apple/apple_mdm.go
+++ b/server/mdm/apple/apple_mdm.go
@@ -36,6 +36,8 @@ const (
 	SCEPPath = "/mdm/apple/scep"
 	// MDMPath is Fleet's HTTP path for the core MDM service.
 	MDMPath = "/mdm/apple/mdm"
+	// MDMServiceDiscoveryPath is Fleet's HTTP path for the MDM service discovery service.
+	ServiceDiscoveryPath = "/mdm/apple/service_discovery"
 
 	// EnrollPath is the HTTP path that serves the mobile profile to devices when enrolling.
 	EnrollPath = "/api/mdm/apple/enroll"
diff --git a/server/service/handler.go b/server/service/handler.go
index 154ab54e0d..c5964f41a6 100644
--- a/server/service/handler.go
+++ b/server/service/handler.go
@@ -1130,6 +1130,7 @@ func RegisterAppleMDMProtocolServices(
 	checkinAndCommandService nanomdm_service.CheckinAndCommandService,
 	ddmService nanomdm_service.DeclarativeManagement,
 	profileService nanomdm_service.ProfileService,
+	serverURLPrefix string,
 ) error {
 	if err := registerSCEP(mux, scepConfig, scepStorage, mdmStorage, logger); err != nil {
 		return fmt.Errorf("scep: %w", err)
@@ -1137,6 +1138,30 @@ func RegisterAppleMDMProtocolServices(
 	if err := registerMDM(mux, mdmStorage, checkinAndCommandService, ddmService, profileService, logger); err != nil {
 		return fmt.Errorf("mdm: %w", err)
 	}
+	if err := registerMDMServiceDiscovery(mux, logger, serverURLPrefix); err != nil {
+		return fmt.Errorf("service discovery: %w", err)
+	}
+	return nil
+}
+
+func registerMDMServiceDiscovery(
+	mux *http.ServeMux,
+	logger kitlog.Logger,
+	serverURLPrefix string,
+) error {
+	serviceDiscoveryLogger := kitlog.With(logger, "component", "mdm-apple-service-discovery")
+	fullMDMEnrollmentURL := fmt.Sprintf("%s%s", serverURLPrefix, apple_mdm.AccountDrivenEnrollPath)
+	serviceDiscoveryHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		serviceDiscoveryLogger.Log("msg", "serving MDM service discovery response", "url", fullMDMEnrollmentURL)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, err := fmt.Fprintf(w, `{"Servers":[{"Version": "mdm-byod", "BaseURL": "%s"}]}`, fullMDMEnrollmentURL)
+		if err != nil {
+			serviceDiscoveryLogger.Log("err", "error writing service discovery response", "err", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	})
+	mux.Handle(apple_mdm.ServiceDiscoveryPath, serviceDiscoveryHandler)
 	return nil
 }
 
diff --git a/server/service/testing_utils.go b/server/service/testing_utils.go
index 934a8f6366..33d7f52956 100644
--- a/server/service/testing_utils.go
+++ b/server/service/testing_utils.go
@@ -429,6 +429,7 @@ func RunServerForTestsWithServiceWithDS(t *testing.T, ctx context.Context, ds fl
 					logger: logger,
 				},
 				commander,
+				"https://test-url.com",
 			)
 			require.NoError(t, err)
 		}