71a82d078d79961210cd687b4442e75fdaa777fa
5029
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Victor LyuboslavskyandLucas Manuel Rodriguez
|
8a28b83b00 |
Redis host cache optimizations (#46458)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46338 Changes load tested (osquery load test). <img width="1532" height="282" alt="image" src="https://github.com/user-attachments/assets/9eb38629-918e-4e05-bc0b-e2ae22e8b148" /> <img width="1414" height="937" alt="image" src="https://github.com/user-attachments/assets/1b90afd3-087c-452e-939f-b495df3e59c8" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance Improvements** * Extended host cache retention period from 60 seconds to 180 seconds to improve overall cache efficiency and hit rates. * Optimized host cache invalidation strategy to eliminate unnecessary reverse-index lookups, significantly reducing database reader load and Redis CPU consumption. * **Tests** * Added test coverage for host update cache invalidation edge cases to ensure proper behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46458?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Jordan Montgomery
|
032246d20d |
Fixing broken test(cert expired) (#46475)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # None - Regenerating a cert to fix tests # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Replaced SCEP test CA certificates and associated encrypted private-key test fixtures used by automated tests. * **Chores** * CI workflow path filters updated so changes to test data now trigger test runs. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46475?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
e09da91b95 |
CSUD: add migration to track update profiles (#46433)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45281 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. Will be added in the backend work PR - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added backend tracking to consolidate Apple and Windows software update settings into a single, consistent store with uniqueness and cascade-delete safeguards. * Backfilled existing qualifying Apple and Windows update configurations into the new tracking store. * **Tests** * Added tests validating correct population, constraint enforcement, and cascade-delete behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46433?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
4c7f9f497c |
Remove apple profile and decl from bulk set pending (#46321)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Follow up work as discovery made on the Apple reconciler changes. One more follow up PR will come with a clean up of all old and unused code. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated integration tests to use batched reconciliation workflows instead of direct database manipulation. * Improved test determinism by explicitly awaiting async profile-schedule triggers before state assertions. * Enhanced test failure diagnostics with more detailed profile comparison messages. * **Chores** * Marked internal reconciliation methods for future deletion with TODO annotations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46321?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus JensenandClaude
|
b42a154cf6 |
Optimize Apple profile reconciler approach by moving logic to code (#45573)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Closes #46153 This PR is big, but I found it worth it to include in the same PR to keep the mental change context in one place. This PR moves away from our previous version of a big SQL computing the desired state and label membership with big union branches. It does so by switching the model up completely, first: - We batch read hosts (current hardcoded is 5k), and we always iterate 5k hosts and then decide if they have changes, so that means a tick (30s) could read 5k hosts that DOES NOT require changes, but that is computed in code after, rather than relying on a big SQL to do it (twice). - We then for those hosts, bulk fetch label memberships, their related team profiles and current rows. This performs much better as we can lookup everything we need by primary key or super fast indexed columns, simple fetch all these calls. - Then once gathered the information we move to the code to determine if the operation is install, remove, NO-OP (Desired state calculation), then we check the label membership to further determine it's final action. - We then move to what we did before, which is queue the correct command etc. It comes with some slight caveats, which is we now load a lot more data into memory (but before we could spike worse), so when loadtesting we watched CPU/Memory utilization, which never seemed to spike as the datasets are kept as small as possible. _Cleanup will come in a follow-up PR where we remove all the old code._ # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance** * Optimized Apple profile and DDM (Declarations) reconciliation engine with batched processing for significantly improved performance in environments with large numbers of Apple-enrolled hosts. * Implemented cursor-based pagination for more efficient reconciliation across large fleets. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45573?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Magnus Jensen
|
0431f52b9e |
support standard and none end user account types (#46179)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45286 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Create local admin account = true Primary account type = none End user auth required = true = No primary account setup screen shown - jumps straight to username/password login which I can login to with the password shown in the UI. Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’` only returns `_fleetadmin` **Note: EACAS is not available on this mac (or this user?)** - however it’s still possible to Wipe via MDM commands. Create local admin account = true Primary account type = standard End user auth required = true = Primary account setup screen shown (also works with IDP info being locked and populated). Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’` returns `_fleetadmin` and my end user (IDP info locked in this case) Opening Settings -> Users & Groups -> Shows my primary account as “Standard” **Note: Benefit of the user can’t do EACAS** (Prompted: “Admin user required”) __fleetadmin also can’t do EACAS_ Create local admin account = false Primary Account type = N/A (but admin) End user auth required = true = Shown primary account setup screen with IDP info populated and locked Running `dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]’` only returns my primary user Opening Settings -> Users & groups -> shows my primary account as “Admin" <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * macOS setup now supports end-user account types: `admin`, `standard`, or `none`. * Setup flows and device commands respect the selected primary account type (e.g., create regular user or skip creation). * **Validation** * Configuration now enforces that a local admin account exists/enabled when required by the chosen end-user account type. * **Tests** * Added coverage for `standard` and `none` validation and command behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46179?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
87bb4090a8 |
Android profile content checksums (#46276)
**Related issue:** Resolves #43456 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android MDM profiles now include content checksums; devices are re-synced only when profile content changes, reducing unnecessary deliveries. * **Migrations** * Database schema updated to add and backfill checksum fields for Android configuration and host profiles. * **Tests** * Added and updated tests to validate checksum generation, backfill, and behavior in profile delivery scenarios. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46276?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
65708f9398 |
Android commands (frontend + more backend) (#46174)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41683 Updated frontend for Android commands along with additional changes in the backend. Did full QA testing with test plan. # Checklist for submitter - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android MDM: added Clear passcode action, Unenroll behavior, and refined BYO vs COBO action visibility and confirmations. * Optimistic pending states and Android-specific success/error messages in Lock/Wipe/Clear flows; modals require confirmations for Android. * **Bug Fixes** * More robust clearing of stale Android device actions during re-enrollment and Pub/Sub flows to keep UI state accurate. * **Tests** * Expanded Android MDM tests for action visibility, pending states, and end-to-end state transitions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46174?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
1ab42218a8 |
Fix GET /software/versions 422 too many placeholders without per_page (#45737)
Closes #43030 ## Summary - Batches title IDs in `getDisplayNamesByTeamAndTitleIds` (chunks of 32,000) to avoid exceeding MySQL's 65,535 prepared statement placeholder limit - Uses the existing `BatchProcessSimple` utility, matching the pattern already used in `software_titles.go` ## Root cause When `GET /api/v1/fleet/software/versions` is called without a `per_page` parameter, `DefaultPerPage` (1,000,000) is used. `ListSoftware` collects all `titleIDs` from the paginated results and passes them to `getDisplayNamesByTeamAndTitleIds`, which builds an `IN (?)` clause that exceeds MySQL's 65,535 placeholder limit. ## Manual testing 1. Started a local Fleet server with MySQL via `docker compose up` and `fleet serve --dev` 2. Seeded the database with 70,000 software titles, software entries, and software_host_counts records 3. **Before the fix**: `GET /api/latest/fleet/software/versions` (no `per_page`) returned HTTP 422 with `"Prepared statement contains too many placeholders"` 4. **After the fix**: the same request returns HTTP 200 with all 70,000 results 5. `GET /api/latest/fleet/software/versions?per_page=20` continued to work correctly in both cases ## Test plan - [x] Manual reproduction and verification (see above) - [x] `make lint-go-incremental` passes - [x] `go build ./server/datastore/mysql/...` compiles cleanly - [ ] CI passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed `GET /api/v1/fleet/software/versions` endpoint to prevent errors when returning results from large software inventories. * **Tests** * Added test coverage for high-volume display name queries. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45737?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
9b65497b78 |
Bump migrations due to cherry pick into 4.86.0 (#46384)
Resolves the following issue: 4.86.0 had: ``` ... 20260527215817_AddHostCertificatesOriginDeletedAtIndex.go ``` main had: ``` ... 20260522195236_AddMDMAndroidCommands.go 20260522195237_AddContinuousAutomationsEnabledToPolicies.go 20260527215817_AddHostCertificatesOriginDeletedAtIndex.go ``` So we have to move `AddMDMAndroidCommands` and `AddContinuousAutomationsEnabledToPolicies` to be after `AddHostCertificatesOriginDeletedAtIndex`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Android remote command support for Mobile Device Management. * Introduced a "continuous automations" toggle for security policies to enable automated enforcement and responses. * **Chores** * Updated database schema/migration state to include the new Android commands table and policy field. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46384?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
c70f6796a0 |
Add cert rollover tool, update Filevault key decryption for rollover process (#46226)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46226 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add CA certificate rollover CLI to renew MDM CA certs with an extend-years option while preserving the private key and certificate properties. * **Improvements** * Decryption logic updated to accept previously-rolled CA certificates so escrowed disk-encryption keys can be decrypted after rollover. * **Tests** * Expanded tests and mocks to cover rollover and decryption scenarios. * **Chores** * Updated ignore rules and added a changelog entry for the rollover process. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
2c47cee122 |
Fix FileVault key escrow on ADE-enrolled Macs (#45928)
After ADE enrollment with enable_disk_encryption: true, hosts reported
as unencrypted with the disk-encryption policy failing and no recovery
key escrowed until the user logged out/in or restarted.
## Root cause
Fleet's shared macOS disk-encryption probe was:
```
SELECT 1 FROM disk_encryption
WHERE user_uuid IS NOT "" AND filevault_status = 'on' LIMIT 1
```
On the osquery disk_encryption table, filevault_status and user_uuid
are populated from independent sources: filevault_status from
`fdesetup status`, user_uuid from `diskutil apfs listCryptoUsers`
(the UUID of a user with SecureToken authority to unlock the volume).
In the post-ADE window, even with ForceEnableInSetupAssistant=true,
SecureToken propagation can lag — filevault_status='on' but
user_uuid='' for a brief period that resolves on a session event.
When the predicate failed, the query returned 0 rows and three
downstream behaviors broke in lockstep:
- host_disks.encrypted flipped to false ("unencrypted")
- the built-in "Full disk encryption enabled (macOS)" policy failed
- mdm_disk_encryption_key_file_*_darwin returned encrypted=0,
gating the PRK ingest and leaving the recovery key un-escrowed
The predicate originated in groob's standard query library entry
from 2021 as a strict compliance check ("is the host actually
protected, with a user able to unlock it?"). When the disk-encryption
status feature shipped in Nov 2022 (PR #8526, issue #3906), the
same string was reused verbatim and later extracted into
usesMacOSDiskEncryptionQuery — never revisited for whether the
SecureToken gate made sense outside the compliance-policy context.
**Related issue:** Resolves #45369
|
||
|
Jordan Montgomery
|
af36f8acbf |
Remove stale users fix and associated tests (#46382)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Unreleased bugfix in https://github.com/fleetdm/fleet/issues/31138 We are setting the email on users Fleet creates via the API. We decided to remove the existing logic we were using to try and link VPP Users back to Fleet users if they get removed from the DB but by setting the email we can follow up(later) with a tool that can query the Apple APIs and list all users by their emails and we can insert them into the VPP users table # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * VPP app installation failures now report immediately without automatic retry or recovery attempts * Improved error transparency for Apple app provisioning failures * **Refactor** * Simplified VPP user management and error handling logic * Removed redundant user lookup and retry mechanisms from app distribution workflows <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46382?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
c9ae421a00 |
Emit failed VPP/in-house install activity, release reserved license (#46332)
Resolves #45851, #45854 |
||
|
Lucas Manuel Rodriguez
|
a1d91464ea |
Fix issue with permissions in host activity list for fleet-users (#46362)
**Related issue:** Resolves #46009. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Resolved an authorization issue preventing users from viewing past host activities on hosts that contained user-initiated operations such as lock, wipe, run script, or install software. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46362?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
132d5e3515 | Clear MDM-delivered certs when a host leaves MDM (#46289) | ||
|
Rachael Shaw
|
2b8c3418ab |
Add "Install software" endpoint to api_endpoints.yml (#46305)
This endpoint is no longer experimental. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added ability to install specific software on individual hosts via API. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46305?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
ef542eaf5b | Temp CVE Python test fix (#46323) | ||
|
Dante Catalfamo
|
dc56776a30 |
Don't process empty vuln data and remove existing records (#46075)
**Related issue:** Resolves #45602 |
||
|
Jonathan Katz
|
f79508580b |
Make software installer edits not cancel setup experience installs (#46236)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42744 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Tested setup experience on a macOS virtual machine, see below. This is what happens after the change: - Editing pkg while setup experience is running, whether the package is pending or currently running, doesn't cancel anything. Installs were successful. - Editing pkg while queueing a normal install caused it to cancel with no record. - Deleting while an installer is running causes the row to disappear immediately in the setup experience UI, HSI row removed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Editing a software installer no longer cancels in-progress setup-experience installs; running setup-experience flows are preserved when installer scripts are updated. * Deleting an installer still removes its associated pending setup-experience entries and related pending host-install records. * GitOps batch updates: editing installers in a batch preserves running setup experiences; omitting an installer from a batch deletes only that installer’s pending entries. * **Tests** * Added/updated integration tests validating edit/delete behavior during setup experience. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46236?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
f592d6a072 | Fixing unreleased issue with vpp installs on byod (#46108) | ||
|
Sharon Katz
|
6a481477e8 |
POST /api/latest/fleet/targets returns more info than needed (#46082)
## Summary Fixes a security issue where `POST /api/latest/fleet/targets` returned sensitive fleet configuration to users with insufficient privileges. Other team-facing endpoints apply proper access controls; the target search path did not. - Replaces the `teamSearchResult` struct with a slim version containing only the non-sensitive fields documented in the API response (`id`, `created_at`, `name`, `description`, `user_count`, `host_count`, `display_text`, `count`). - Removes the `MarshalJSON`/`UnmarshalJSON` methods (~70 lines) that serialized fields the target picker never uses. - Verified that no frontend component, fleetctl client, or integration test reads sensitive fields from the target search response. - Validated the response shape matches the documented API contract in `docs/REST API/rest-api.md`. Closes fleetdm/confidential#16054 Related advisory: GHSA-88p2-jj8w-j8qg ## How we reproduced 1. Started local dev server (`fleet serve --dev --dev_license`) 2. Created a global observer user and a saved query with `observer_can_run = true` 3. Logged in as the observer **Before fix** -- same observer session, same team: ``` GET /api/latest/fleet/fleets/2/secrets -> secret: "********" (correctly masked) POST /api/latest/fleet/targets {"query":"","query_id":7,"selected":{"hosts":[],"labels":[],"teams":[]}} -> sensitive configuration leaked for all teams ``` **After fix** -- rebuilt binary, restarted server, same observer: ``` GET /api/latest/fleet/fleets/2/secrets -> secret: "********" (unchanged) POST /api/latest/fleet/targets (same request) -> only non-sensitive fields returned (id, name, display_text, count, etc.) ``` Also verified admin target search still returns team metadata correctly. ## Test plan - [x] Manual reproduction on local dev server - [x] Manual verification after fix - [x] Admin target search still returns team metadata (id, name, host_count, display_text) - [x] Verified no consumers (frontend, fleetctl, tests) read sensitive fields from target search - [x] Validated response matches documented API contract in `docs/REST API/rest-api.md` - [x] Unit test verifies response contains only documented non-sensitive fields - [x] `go test ./server/service/ -run TestSearchTargets` passes - [ ] CI passes |
||
|
Tim Lee
|
819e3d372f | host_certificates: downgrade mdm rows to osquery on rediscovery (#45531) | ||
|
Victor Lyuboslavsky
|
33889ec177 | Fixed stale pending MDM profiles reappearing (#46111) | ||
|
Lucas Manuel Rodriguez
|
5b2427d187 |
Add backend changes for continuous automations on policies (#45999)
Resolves #45149 and #45150. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [X] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [X] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added team policy setting continuous_automations_enabled (default: false) to re-run software/script automations on every failing evaluation; exposed in APIs and GitOps YAML. Disallowed for "All fleets" and requires a premium license. * **Tests** * Added integration tests for CRUD, GitOps, and re-queuing behavior validating continuous automations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45999?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin SykulevandCopilot Autofix powered by AI
|
0a8e9fc328 |
Added more tests around orbit-enroll creates a duplicate host entries (#46230)
**Related issue:** Resolves #41802 related to https://github.com/fleetdm/fleet/issues/46001 ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Expanded automated test coverage for Android host enrollment, parameterizing platform and enrollment state to validate behavior across scenarios. * Added cases covering reversed enrollment order to ensure a single host record per device UUID and idempotent enrollment behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46230?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Konstantin Sykulev
|
6ae04f95b8 |
Better android host names (#46135)
**Related issue:** Resolves #41053 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Android hosts associated with an IdP now display as "{IdP first name}'s {device model}" when IdP fullname is available. * Enrollment now links hosts to an MDM IdP account when enrollment payload includes IdP info. * **Bug Fixes / Behavior** * Unenrollment records and host naming use device brand+model for hardware identification and sensible fallbacks when IdP data is missing. * Re-enrollment updates IdP association without creating duplicate hosts. * **Tests** * Added tests covering display-name and hardware-model behavior with and without IdP data. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46135?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
590bf185c2 |
Fix missing tags for OPA policy (#46203)
Resolves #46009. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed permissions for host activity items by aligning serialized field names used by authorization rules, ensuring fleet-scoped users receive correct access rights when listing and reading host activities. * **Tests** * Added authorization tests validating host activity access control across user roles and team scopes, including denial cases for unauthorized and GitOps-scoped users, and verifying policy evaluation depends on correct serialized field naming. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46203?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
e790260b85 |
Android commands backend (#46031)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41683 Support for Android lock, wipe, and clear passcode commands. Behavior is slightly different between BYOD and CODO. The fleetdm.com proxy isn't wired up, so they only work with direct Google connection. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Clear-passcode CLI plus Android Lock and Wipe commands (Wipe restricted to company-owned devices). * BYO unenroll now removes only the work profile, preserving personal data. * Commands issued with a 10-year duration; UI/CLI show Android-specific messaging and command IDs. * **Improvements** * Host MDM pages reflect command lifecycle transitions (pending → acknowledged or error with code/message) via Pub/Sub updates. * **Documentation** * Updated docs for Android MDM commands, ownership rules, and command duration. * **Tests** * New unit and integration tests for Android MDM flows. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
484adf3494 |
Fix GitOps policy install software parse function setting the wrong FMA slug field. (#46167)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46164 The policy does parse correctly into a GitOpsPolicySpec struct, but because there were two fields called `fleet_maintained_app_slug` it wasn't obvious that this would happen. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where patch policies with different software application slugs were incorrectly using the slug from the install automation setting instead of the patch policy's own configured slug, causing incorrect policy queries and validation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46167?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadam
|
d94e38076b |
Extract Apple APNs/SCEP pair validation onto MDMConfig (#46166)
Extracts the Apple APNs/SCEP both-or-neither check out of `runServeCmd` and puts it on `MDMConfig` as `ValidateAppleAPNSAndSCEPPair(initFatal)`. Same pattern as `ConditionalAccessConfig.Validate`, `AndroidAgentConfig.Validate`, and the validators added in #45583. The call site (inside the existing `if len(toInsert) > 0` gate) goes from six lines of inline conditional `initFatal` calls to one method call. Behavior, error messages, and gating are unchanged. Tests live in `server/config/config_test.go`: one smoke case plus two error branches (APNs-only and SCEP-only). Skipped the "neither set" case on purpose — the outer `if config.MDM.IsAppleAPNsSet() || config.MDM.IsAppleSCEPSet()` gate in `runServeCmd` guarantees at least one is set before the validator is ever reached. This is the last pure config validation left in `runServeCmd` per the broader-plan note on #45583. Remaining `initFatal` sites are runtime failure paths (datastore init, Redis init, MDM init wiring) which need the injection from #45343 — those would be the next slice. **Related issue:** Refs #33370 # Checklist for submitter - [x] Added/updated automated tests - [x] Input validation (validator method plus tests; no SQL/JS/shell paths involved) - Changes file: not applicable, internal refactor with no user-visible behavior change <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Apple MDM configuration validation to ensure APNs and SCEP certificates are properly paired during setup. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46166?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
arya rizky
|
e17eafd7d1 |
Fix typo: explicty -> explicitly in server/service/packs.go (#45874)
This is an independent contribution. No part of this PR was generated, reviewed, or influenced by any competitive or automated system. ## Summary Fix a typo in a code comment: `explicty` → `explicitly` ## Root Cause The comment on `TotalHostsCount` in `server/service/packs.go` contains the misspelling `explicty` instead of `explicitly`. ## Fix Corrected the spelling in the comment at line 18. ## Testing - No functional changes — comment-only fix - Go compilation unaffected <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Corrected spelling errors in internal code comments to improve code quality. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45874?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
4146978777 |
Windows MDM validation fixes (#46029)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42219 Resolves #42224 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced Windows MDM profile validation: uploads that are non-XML, empty, or lack required SyncML top-level elements are rejected; LocURI values that are empty, start with `/`, contain `..` path traversal, or are otherwise malformed are now rejected (whitespace-trimmed), preventing later device deployment failures. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46029?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
f2fca57c44 |
Renumber 4.86 migrations after the 4.85.1 cherry-pick (#46079) (#46097)
## Summary Fixes #46079. Migration `20260518194422_AddEncodingTypeToHostSCDData` was cherry-picked into the 4.85.1 patch release. Customers upgrading from 4.85.1 → 4.86.0 then saw `WARNING: Your Fleet database is missing required migrations` for 11 migrations that landed on `main` with earlier timestamps but never shipped in 4.85.1. This PR renumbers those 11 migrations to run after `20260518194422` and regenerates `schema.sql`: | Old timestamp | New timestamp | Name | |---|---|---| | 20260427134220 | 20260522195224 | AddPreserveHostActivitiesOnReenrollmentToAppConfig | | 20260428125634 | 20260522195225 | AddManagedLocalAccountRotationColumns | | 20260429180725 | 20260522195226 | CreateTableAppConfigurations | | 20260430103635 | 20260522195227 | AddRequireAllToPolicyAndQueryLabels | | 20260506132626 | 20260522195229 | AddVPPCountryCode | | 20260506171058 | 20260522195230 | AddSubjectAlternativeNameToCertificateTemplates | | 20260512143542 | 20260522195231 | AddOrbitDebugUntilToHosts | | 20260512173249 | 20260522195232 | CreateTableVPPClientUsers | | 20260512173250 | 20260522195233 | AddManagedAppleIDToHostMDM | | 20260518124441 | 20260522195234 | AllowNullTypeOnHostMDMManagedCertificates | | 20260518150028 | 20260522195235 | AddOriginToHostCertificates | This will be cherry-picked into `rc-minor-fleet-v4.86.0` once merged. ## Test plan - [x] `go build ./...` passes - [x] All 11 migrations run cleanly in order during `make dump-test-schema` - [x] No references to the old timestamps remain in the repo - [ ] Spin up 4.85.1, run migrations, then run the 4.86.0 binary built from this branch and confirm no `missing required migrations` warning <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reorganized database migration sequencing to ensure consistent schema updates during deployment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46097?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
5d9b102a1b |
45190 patch policy wrong installer (#46087)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Adds a missing `is_active=1` check to get the actual active installer for the software automation's installer. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - I tested by pinning the version of the app to the older one, then unpinning and back and checked that the policy is associated to the correct installer with the query below. - I did not manually test updating to a new FMA version. It's possible to do that easily by creating a new branch with a newer version and referring FLEET_DEV_MAINTAINED_APPS_BASE_URL to it. ``` SELECT si.id, si.team_id, si.title_id, si.filename, si.version, si.storage_id, si.uploaded_at, si.updated_at, si.url, si.fleet_maintained_app_id, si.install_during_setup, si.is_active, si.patch_query, si.http_etag, p.patch_software_title_id, p.software_installer_id, p.query FROM software_installers si LEFT JOIN policies p on si.id = p.software_installer_id WHERE filename LIKE "%<app name>%" AND platform = "darwin" AND global_or_team_id = <team id>; ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Patch policies using software install automations now correctly prioritize active installers, ensuring deployment uses the latest appropriate version rather than inactive or outdated alternatives. * **Tests** * Added test scenarios to validate policy installer version selection and active status during automation evaluation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46087?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
dc3694102f |
Updating SSE to be spec compliant, which now appears to work with ngrok (#45988)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45862 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - Already added in the previous PR. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved detection and reporting of enrollment errors sent by the server, ensuring error messages surface reliably. * Prevented streaming leaks by stopping background work when a client disconnects. * **Documentation / Protocol** * Made server-to-client streaming more spec-compliant (framing, heartbeats) for more robust Android Enterprise enrollment communication. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45988?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadamandJordan Montgomery
|
3ccf17f8ac |
Remove nano_view_queue from unscoped MDM commands list query (#45674)
Drops `nano_view_queue` from the Apple branch of the unscoped commands list and joins the underlying `nano_*` tables directly. The view's definition bakes in `ORDER BY q.priority DESC, q.created_at`, which MySQL re-materializes on every query — the outer `LIMIT` can't push past it, so each unscoped list call pays the full sort cost over the post-join row set regardless of page size. This is the same join shape the host-scoped path already uses (see `listMDMCommandsByHostIdentifier`), so I followed that pattern. Column output is identical to what the view was producing, which is why no test updates were needed — all the existing `TestListMDMCommands*` cases pass without modification. Scope of this PR is just the hot caller. The view itself isn't touched. The issue notes other call sites (`vpp.go`, `apple_mdm.go`) still go through it, and that dropping the `ORDER BY` from the view's definition would be the durable fix. Both feel like separate PRs — the audit work for other call sites is non-trivial, and modifying the view risks silently breaking any consumer that relied on its implicit ordering. Happy to follow up on either. Refs #44509. # Checklist for submitter - [x] Input is properly validated (no new user input paths; same parameterized query shape) - Tests: existing `TestListMDMCommands*` coverage exercises this path and passes unchanged. No new tests added — see rationale above. - Changes file: not applicable, internal query refactor with no user-visible behavior change. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Updated Mobile Device Management command status reporting to ensure accurate status and timestamp information. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45674?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
Nico
|
7290b27a56 |
Fix: My Device page not showing correct light/dark mode logo (#46063)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46034 ## Testing - [x] QA'd all new/changed functionality manually ### Before My Device page was showing the light mode logo even when in dark mode. <img width="1412" height="756" alt="Screenshot 2026-05-22 at 11 51 57 AM" src="https://github.com/user-attachments/assets/9f098d96-b9d1-4618-b6f4-e7ee49629506" /> <img width="1340" height="708" alt="Screenshot 2026-05-22 at 11 35 59 AM" src="https://github.com/user-attachments/assets/dfff3a53-e08b-4b7a-a3fc-97f33e0d691d" /> ### After My Device page correctly shows the logo for both modes Light: <img width="1434" height="725" alt="Screenshot 2026-05-22 at 11 48 51 AM" src="https://github.com/user-attachments/assets/4d5913c5-5264-40ac-bbdf-21c271637898" /> <img width="1337" height="451" alt="Screenshot 2026-05-22 at 11 48 55 AM" src="https://github.com/user-attachments/assets/1cd6193e-b910-46ea-8f89-0cd88ad07382" /> Dark (Fleet's default logo): <img width="1127" height="644" alt="Screenshot 2026-05-22 at 11 48 08 AM" src="https://github.com/user-attachments/assets/a55a0026-f301-4281-8419-83cc9a707bb7" /> <img width="1357" height="528" alt="Screenshot 2026-05-22 at 11 48 15 AM" src="https://github.com/user-attachments/assets/471a604a-9524-4d5a-8af4-cfe09d2430fc" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Organization logos now adapt to dark or light mode, showing the appropriate themed variant across the app. * **Bug Fixes / Improvements** * Device and host pages now pick the correct logo variant with sensible fallbacks so logos display consistently when theme-specific images are missing. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46063?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
f9c9ad0db4 |
Updated Windows setup experience to not cancel for BYOD. (#45994)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45946 Unreleased bug. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit **Bug Fixes** - Enhanced Windows setup experience cancellation to accurately validate device enrollment status before processing cancellations - Improved device identification reliability during concurrent operations through robust fallback mechanisms that reference recent enrollment records when initial lookups fail <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45994?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
3f6f138530 |
Fix duplicate Android host on orbit-enroll when Apple MDM is off (#46008)
The Fleet Android Agent's orbit-enroll did not match the existing AMAPI-created host record on Fleet instances with Apple MDM disabled, creating a duplicate hosts row alongside the AMAPI-enrolled one. The Android-specific UUID match clause in matchHostDuringEnrollment was gated by isMDMEnabled, which only reflects Apple MDM status. Gate the clause on platform="android" instead. The Fleet Android Agent always sends this since PR #43809, and the SELECT itself filters platform=android, so the clause is Android-safe by construction and no longer depends on the Apple-MDM flag. The serial-match clause keeps its existing isMDMEnabled gate. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Updated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevents duplicate host records when enrolling Android devices on instances with Apple MDM disabled. * Improves enrollment host-matching so devices are identified by their platform, reducing misattributed or duplicate hosts during enrollment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
aeac57bd04 |
Fix to populate host_emails during Linux/Windows SSO enrollment (#45951)
Resolves #45066. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed user email/device mapping for Windows and Linux hosts enrolling via end-user authentication (browser-based and EUA-token flows). Host listings and device mapping now reliably show the IdP email after enrollment, improving device identification and inventory accuracy. * **Tests** * Expanded integration tests to validate end-to-end enrollment and device mapping across platforms. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45951?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
4e3f8c0b69 |
Allow technicians to transfer hosts (#45956)
Resolves #41783. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Technicians can transfer hosts between fleets (Fleet Premium). Global technicians can transfer via the Fleet UI and REST API; fleet-scoped technicians can transfer between fleets they manage via the REST API. * Bulk transfer selection added on the hosts list for eligible global technicians, enabling multi-host transfers while preserving other bulk behaviors. * **Tests** * Added and updated tests covering Transfer visibility and authorization for global and fleet-scoped technician roles. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45956?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Rajendra kadam
|
2395d06e5b |
Extract early config validation from runServeCmd into testable helpers (#45583)
Extracts early config-validation logic out of `runServeCmd` and puts it on the relevant config types in `server/config/`, following the existing pattern used by `ConditionalAccessConfig.Validate(initFatal)` and `AndroidAgentConfig.Validate(initFatal)`. (First commit on this branch did the extraction into a separate file in `cmd/fleet/`; reshaped per review.) `runServeCmd` is now a series of `config.X.Validate(initFatal)` calls: - `config.Logging.Validate(initFatal)` — OTEL logs requires tracing enabled - `config.Osquery.Validate(initFatal)` — `host_identifier` must be one of `provided`, `instance`, `uuid`, `hostname` - `config.Server.NormalizeURLPrefix()` + `config.Server.ValidateURLPrefix(initFatal)` — Normalize mutates, ValidateURLPrefix is pure - `config.Server.Validate(initFatal)` — `private_key` vs `private_key_arn` mutex check (called before Secrets Manager retrieval so a misconfig fails fast without paying for an external lookup) - `config.Server.ValidatePrivateKeyLength(initFatal)` — minimum 32 bytes (called after Secrets Manager retrieval so an SM-provided short key is also caught) The private-key checks are split into two methods rather than folded into one because the XOR check has to fire before the SM call, and SM retrieval populates `PrivateKey` — so a single Validate called twice would false-positive the XOR check post-SM whenever the user originally configured only `private_key_arn`. Open to feedback if a different split is preferred. Tests live in `server/config/config_test.go` next to the existing config Validate tests, structured as one smoke case plus error branches per the existing convention. Behavior is preserved: `runServeCmd` still calls `initFatal` at the same points with the same descriptions. ## Broader plan Issue #33370 calls for moving logic out of `serve.go` ("should only contain critical config and dependency injection logic"). This PR is one slice. Follow-ups, each in their own small PR: - Extract more config validations (Apple APNs/SCEP both-or-neither, etc.) - Use the `initFatal` injection from #45343 to cover runtime failure paths (datastore init, Redis init, MDM init) - Larger extractions (license init, MDM wiring, mailer init) **Related issue:** Refs #33370 # Checklist for submitter - [x] Added/updated automated tests - [x] Input data is properly validated (validators added, no SQL/JS/shell paths involved) - Changes file: not applicable — internal refactor with no user-visible behavior change <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes & Improvements** * Centralized and strengthened startup configuration validation. * Enforced mutual exclusivity for private key sources and minimum private-key length. * Added URL-prefix normalization (ensure leading slash, trim trailing slash) and validation. * Ensured OTEL logging requires tracing when enabled. * Restricted osquery host identifier to supported values. * **Tests** * Added tests covering validation rules and URL-prefix normalization/validation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45583?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
8441136f69 |
Adding SCEP support to Windows MDM test client (#44562)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #37503 Test-code changes only. No product changes. Adding Windows SCEP support for osquery and Windows integration tests. Refactoring so that code can be reused from Apple client. Can be used when working on https://github.com/fleetdm/fleet/issues/45550 # Checklist for submitter ## Testing - [x] Added/updated automated tests <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved Windows MDM SCEP certificate installation handling during profile enrollment (avoids duplicate responses and properly tracks handled commands). * **Monitoring & Observability** * Added SCEP enrollment metrics: requests, successes, and errors. * **Tests** * Expanded unit and integration tests for Windows SCEP parsing, enrollment flows, and end-to-end profile verification. * **Refactor** * Centralized SCEP exchange logic for Apple and Windows test flows. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44562?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
8bb59b71cb |
Fix List certificate templates API docs: parameter name is fleet_id, not fleet (#45969) (#45978)
Closes #45969 ## Summary The `List certificate templates` API endpoint returned `null` for certificates because the **API docs documented the wrong query parameter name**. The docs said `fleet` but the code accepts `fleet_id` (or the deprecated `team_id`). Customers following the docs used `?fleet=11`, which was silently ignored, causing the endpoint to default to team 0 (unassigned) -- which typically has no certificates. - **Docs fix**: Changed the parameter name from `fleet` (string) to `fleet_id` (integer) in the REST API docs, matching how all other list endpoints document this parameter. - **API quality fix**: Initialize the `templates` slice in `GetCertificateTemplatesByTeamID` so that when no templates exist, the JSON response returns `"certificates": []` instead of `"certificates": null`. ## Root cause In `docs/REST API/rest-api.md`, the "List certificate templates" endpoint documented the query parameter as `fleet` (string), but the request struct accepts `fleet_id` or `team_id`: ```go type listCertificateTemplatesRequest struct { TeamID uint `query:"team_id,optional" renameto:"fleet_id"` } ``` When the customer used `?fleet=11` (as documented), the parameter was unrecognized and silently ignored. The endpoint defaulted to `team_id=0` (unassigned), which had no certificates. The nil Go slice then serialized to JSON `null`. Credit to Andrey Kizimenko for identifying the docs mismatch. ## Changes - `docs/REST API/rest-api.md` -- Fix parameter name from `fleet` (string) to `fleet_id` (integer) - `server/datastore/mysql/certificate_templates.go:174` -- Initialize slice to avoid `null` in JSON - `server/datastore/mysql/certificate_templates_test.go:489` -- Add `require.NotNil` regression test ## Testing All tests run locally against a real MySQL (Docker) and Redis instance: | Test suite | Command | Result | |---|---|---| | Datastore integration (all certificate tests) | `MYSQL_TEST=1 go test -run TestCertificates ./server/datastore/mysql/...` | 11 suites, 33 subtests, all PASS | | Service unit tests | `go test -run "TestCreateCertificateTemplate\|TestApplyCertificateTemplateSpecs\|..."` | 4 suites, all PASS | | Enterprise integration (full HTTP) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestCertificatesSpecs"` | PASS | | Enterprise integration (team delete) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestDeleteTeamCertificateTemplates"` | PASS | | Static analysis | `go build`, `go vet` | Clean | Andrey's reproduction confirmed via screenshots: - `?fleet_id=11` returns certificates correctly - `?fleet=11` (the documented param) returns `null` -- the bug - No param returns results when "unassigned" team has certificates ## QA steps 1. Follow the API docs to list certificate templates using `?fleet_id=<id>` 2. Verify the response contains `"certificates": [...]` with the correct data 3. Call without `fleet_id` and verify `"certificates": []` (not `null`) for a team with no templates <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed the "List certificate templates" API documentation with the correct query parameter name, enabling proper filtering of results. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45978?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ce66f3dd18 |
Move loginRequest and logoutRequest to server/fleet/ (#45908)
Resolves #36087 (one of several small PRs). - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reorganized internal API session models for improved code structure and maintainability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45908?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
3ea3ba9fee | Integration tests for non-proxied cert renewal (#45663) | ||
|
Noah Talerman
|
f6db618aa7 | GitOps: "teams" mentioned in error messages (#45878) | ||
|
Lucas Manuel Rodriguez
|
b4e907801f |
Add Android to the OS list (#45834)
Resolves #45711 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 30 48 PM" src="https://github.com/user-attachments/assets/05a0a93f-3b5b-4ba9-80c5-b0a91b9de1f3" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 30 37 PM" src="https://github.com/user-attachments/assets/3e23e88e-6a95-46f6-a68f-12fb98f1aefe" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 29 45 PM" src="https://github.com/user-attachments/assets/417ca981-0781-4df5-811b-dafaabbd61a9" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 29 30 PM" src="https://github.com/user-attachments/assets/cf13985d-5cb3-414a-9135-5cf4c5ee0dd1" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 31 33 PM" src="https://github.com/user-attachments/assets/8500e7b2-cc7b-425d-b6b7-bbbf128faac4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed host listing so filtering by Android OS name and version returns matching hosts. * **New Features** * Android hosts are now included in the operating systems aggregation and UI, with a dedicated Android icon. * Android OS version information is captured during device enrollment and on status reports. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45834?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ef12b0fcd2 |
Use ubuntu-latest runner for docs CI check (#45816)
I see no reason to use macOS for this job (given how unreliable and slow macOS runners are). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * CI workflow runner switched to ubuntu-latest. * Internal tooling updated to download and prepare the osqueryd binary for macOS and Linux. * macOS agent configuration expanded with additional options for keychain access and file-monitoring behavior. --- Note: No end-user visible features or breaking changes in this release. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45816?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
