fb7b88c0d691cb2e34fe4e949ee5f2c8449dee35
5001
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Victor Lyuboslavsky
|
e790260b85 |
Android commands backend (#46031)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41683 Support for Android lock, wipe, and clear passcode commands. Behavior is slightly different between BYOD and CODO. The fleetdm.com proxy isn't wired up, so they only work with direct Google connection. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Clear-passcode CLI plus Android Lock and Wipe commands (Wipe restricted to company-owned devices). * BYO unenroll now removes only the work profile, preserving personal data. * Commands issued with a 10-year duration; UI/CLI show Android-specific messaging and command IDs. * **Improvements** * Host MDM pages reflect command lifecycle transitions (pending → acknowledged or error with code/message) via Pub/Sub updates. * **Documentation** * Updated docs for Android MDM commands, ownership rules, and command duration. * **Tests** * New unit and integration tests for Android MDM flows. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46031?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
484adf3494 |
Fix GitOps policy install software parse function setting the wrong FMA slug field. (#46167)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46164 The policy does parse correctly into a GitOpsPolicySpec struct, but because there were two fields called `fleet_maintained_app_slug` it wasn't obvious that this would happen. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where patch policies with different software application slugs were incorrectly using the slug from the install automation setting instead of the patch policy's own configured slug, causing incorrect policy queries and validation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46167?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadam
|
d94e38076b |
Extract Apple APNs/SCEP pair validation onto MDMConfig (#46166)
Extracts the Apple APNs/SCEP both-or-neither check out of `runServeCmd` and puts it on `MDMConfig` as `ValidateAppleAPNSAndSCEPPair(initFatal)`. Same pattern as `ConditionalAccessConfig.Validate`, `AndroidAgentConfig.Validate`, and the validators added in #45583. The call site (inside the existing `if len(toInsert) > 0` gate) goes from six lines of inline conditional `initFatal` calls to one method call. Behavior, error messages, and gating are unchanged. Tests live in `server/config/config_test.go`: one smoke case plus two error branches (APNs-only and SCEP-only). Skipped the "neither set" case on purpose — the outer `if config.MDM.IsAppleAPNsSet() || config.MDM.IsAppleSCEPSet()` gate in `runServeCmd` guarantees at least one is set before the validator is ever reached. This is the last pure config validation left in `runServeCmd` per the broader-plan note on #45583. Remaining `initFatal` sites are runtime failure paths (datastore init, Redis init, MDM init wiring) which need the injection from #45343 — those would be the next slice. **Related issue:** Refs #33370 # Checklist for submitter - [x] Added/updated automated tests - [x] Input validation (validator method plus tests; no SQL/JS/shell paths involved) - Changes file: not applicable, internal refactor with no user-visible behavior change <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Apple MDM configuration validation to ensure APNs and SCEP certificates are properly paired during setup. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46166?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
arya rizky
|
e17eafd7d1 |
Fix typo: explicty -> explicitly in server/service/packs.go (#45874)
This is an independent contribution. No part of this PR was generated, reviewed, or influenced by any competitive or automated system. ## Summary Fix a typo in a code comment: `explicty` → `explicitly` ## Root Cause The comment on `TotalHostsCount` in `server/service/packs.go` contains the misspelling `explicty` instead of `explicitly`. ## Fix Corrected the spelling in the comment at line 18. ## Testing - No functional changes — comment-only fix - Go compilation unaffected <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Corrected spelling errors in internal code comments to improve code quality. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45874?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
4146978777 |
Windows MDM validation fixes (#46029)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42219 Resolves #42224 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced Windows MDM profile validation: uploads that are non-XML, empty, or lack required SyncML top-level elements are rejected; LocURI values that are empty, start with `/`, contain `..` path traversal, or are otherwise malformed are now rejected (whitespace-trimmed), preventing later device deployment failures. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46029?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George Karr
|
f2fca57c44 |
Renumber 4.86 migrations after the 4.85.1 cherry-pick (#46079) (#46097)
## Summary Fixes #46079. Migration `20260518194422_AddEncodingTypeToHostSCDData` was cherry-picked into the 4.85.1 patch release. Customers upgrading from 4.85.1 → 4.86.0 then saw `WARNING: Your Fleet database is missing required migrations` for 11 migrations that landed on `main` with earlier timestamps but never shipped in 4.85.1. This PR renumbers those 11 migrations to run after `20260518194422` and regenerates `schema.sql`: | Old timestamp | New timestamp | Name | |---|---|---| | 20260427134220 | 20260522195224 | AddPreserveHostActivitiesOnReenrollmentToAppConfig | | 20260428125634 | 20260522195225 | AddManagedLocalAccountRotationColumns | | 20260429180725 | 20260522195226 | CreateTableAppConfigurations | | 20260430103635 | 20260522195227 | AddRequireAllToPolicyAndQueryLabels | | 20260506132626 | 20260522195229 | AddVPPCountryCode | | 20260506171058 | 20260522195230 | AddSubjectAlternativeNameToCertificateTemplates | | 20260512143542 | 20260522195231 | AddOrbitDebugUntilToHosts | | 20260512173249 | 20260522195232 | CreateTableVPPClientUsers | | 20260512173250 | 20260522195233 | AddManagedAppleIDToHostMDM | | 20260518124441 | 20260522195234 | AllowNullTypeOnHostMDMManagedCertificates | | 20260518150028 | 20260522195235 | AddOriginToHostCertificates | This will be cherry-picked into `rc-minor-fleet-v4.86.0` once merged. ## Test plan - [x] `go build ./...` passes - [x] All 11 migrations run cleanly in order during `make dump-test-schema` - [x] No references to the old timestamps remain in the repo - [ ] Spin up 4.85.1, run migrations, then run the 4.86.0 binary built from this branch and confirm no `missing required migrations` warning <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reorganized database migration sequencing to ensure consistent schema updates during deployment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46097?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
5d9b102a1b |
45190 patch policy wrong installer (#46087)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Adds a missing `is_active=1` check to get the actual active installer for the software automation's installer. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - I tested by pinning the version of the app to the older one, then unpinning and back and checked that the policy is associated to the correct installer with the query below. - I did not manually test updating to a new FMA version. It's possible to do that easily by creating a new branch with a newer version and referring FLEET_DEV_MAINTAINED_APPS_BASE_URL to it. ``` SELECT si.id, si.team_id, si.title_id, si.filename, si.version, si.storage_id, si.uploaded_at, si.updated_at, si.url, si.fleet_maintained_app_id, si.install_during_setup, si.is_active, si.patch_query, si.http_etag, p.patch_software_title_id, p.software_installer_id, p.query FROM software_installers si LEFT JOIN policies p on si.id = p.software_installer_id WHERE filename LIKE "%<app name>%" AND platform = "darwin" AND global_or_team_id = <team id>; ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Patch policies using software install automations now correctly prioritize active installers, ensuring deployment uses the latest appropriate version rather than inactive or outdated alternatives. * **Tests** * Added test scenarios to validate policy installer version selection and active status during automation evaluation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46087?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
dc3694102f |
Updating SSE to be spec compliant, which now appears to work with ngrok (#45988)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45862 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - Already added in the previous PR. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved detection and reporting of enrollment errors sent by the server, ensuring error messages surface reliably. * Prevented streaming leaks by stopping background work when a client disconnects. * **Documentation / Protocol** * Made server-to-client streaming more spec-compliant (framing, heartbeats) for more robust Android Enterprise enrollment communication. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45988?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadamandJordan Montgomery
|
3ccf17f8ac |
Remove nano_view_queue from unscoped MDM commands list query (#45674)
Drops `nano_view_queue` from the Apple branch of the unscoped commands list and joins the underlying `nano_*` tables directly. The view's definition bakes in `ORDER BY q.priority DESC, q.created_at`, which MySQL re-materializes on every query — the outer `LIMIT` can't push past it, so each unscoped list call pays the full sort cost over the post-join row set regardless of page size. This is the same join shape the host-scoped path already uses (see `listMDMCommandsByHostIdentifier`), so I followed that pattern. Column output is identical to what the view was producing, which is why no test updates were needed — all the existing `TestListMDMCommands*` cases pass without modification. Scope of this PR is just the hot caller. The view itself isn't touched. The issue notes other call sites (`vpp.go`, `apple_mdm.go`) still go through it, and that dropping the `ORDER BY` from the view's definition would be the durable fix. Both feel like separate PRs — the audit work for other call sites is non-trivial, and modifying the view risks silently breaking any consumer that relied on its implicit ordering. Happy to follow up on either. Refs #44509. # Checklist for submitter - [x] Input is properly validated (no new user input paths; same parameterized query shape) - Tests: existing `TestListMDMCommands*` coverage exercises this path and passes unchanged. No new tests added — see rationale above. - Changes file: not applicable, internal query refactor with no user-visible behavior change. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Updated Mobile Device Management command status reporting to ensure accurate status and timestamp information. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45674?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
Nico
|
7290b27a56 |
Fix: My Device page not showing correct light/dark mode logo (#46063)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46034 ## Testing - [x] QA'd all new/changed functionality manually ### Before My Device page was showing the light mode logo even when in dark mode. <img width="1412" height="756" alt="Screenshot 2026-05-22 at 11 51 57 AM" src="https://github.com/user-attachments/assets/9f098d96-b9d1-4618-b6f4-e7ee49629506" /> <img width="1340" height="708" alt="Screenshot 2026-05-22 at 11 35 59 AM" src="https://github.com/user-attachments/assets/dfff3a53-e08b-4b7a-a3fc-97f33e0d691d" /> ### After My Device page correctly shows the logo for both modes Light: <img width="1434" height="725" alt="Screenshot 2026-05-22 at 11 48 51 AM" src="https://github.com/user-attachments/assets/4d5913c5-5264-40ac-bbdf-21c271637898" /> <img width="1337" height="451" alt="Screenshot 2026-05-22 at 11 48 55 AM" src="https://github.com/user-attachments/assets/1cd6193e-b910-46ea-8f89-0cd88ad07382" /> Dark (Fleet's default logo): <img width="1127" height="644" alt="Screenshot 2026-05-22 at 11 48 08 AM" src="https://github.com/user-attachments/assets/a55a0026-f301-4281-8419-83cc9a707bb7" /> <img width="1357" height="528" alt="Screenshot 2026-05-22 at 11 48 15 AM" src="https://github.com/user-attachments/assets/471a604a-9524-4d5a-8af4-cfe09d2430fc" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Organization logos now adapt to dark or light mode, showing the appropriate themed variant across the app. * **Bug Fixes / Improvements** * Device and host pages now pick the correct logo variant with sensible fallbacks so logos display consistently when theme-specific images are missing. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46063?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
f9c9ad0db4 |
Updated Windows setup experience to not cancel for BYOD. (#45994)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45946 Unreleased bug. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit **Bug Fixes** - Enhanced Windows setup experience cancellation to accurately validate device enrollment status before processing cancellations - Improved device identification reliability during concurrent operations through robust fallback mechanisms that reference recent enrollment records when initial lookups fail <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45994?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
3f6f138530 |
Fix duplicate Android host on orbit-enroll when Apple MDM is off (#46008)
The Fleet Android Agent's orbit-enroll did not match the existing AMAPI-created host record on Fleet instances with Apple MDM disabled, creating a duplicate hosts row alongside the AMAPI-enrolled one. The Android-specific UUID match clause in matchHostDuringEnrollment was gated by isMDMEnabled, which only reflects Apple MDM status. Gate the clause on platform="android" instead. The Fleet Android Agent always sends this since PR #43809, and the SELECT itself filters platform=android, so the clause is Android-safe by construction and no longer depends on the Apple-MDM flag. The serial-match clause keeps its existing isMDMEnabled gate. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46001 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Updated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevents duplicate host records when enrolling Android devices on instances with Apple MDM disabled. * Improves enrollment host-matching so devices are identified by their platform, reducing misattributed or duplicate hosts during enrollment. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
aeac57bd04 |
Fix to populate host_emails during Linux/Windows SSO enrollment (#45951)
Resolves #45066. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed user email/device mapping for Windows and Linux hosts enrolling via end-user authentication (browser-based and EUA-token flows). Host listings and device mapping now reliably show the IdP email after enrollment, improving device identification and inventory accuracy. * **Tests** * Expanded integration tests to validate end-to-end enrollment and device mapping across platforms. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45951?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguezandcoderabbitai[bot]
|
4e3f8c0b69 |
Allow technicians to transfer hosts (#45956)
Resolves #41783. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Technicians can transfer hosts between fleets (Fleet Premium). Global technicians can transfer via the Fleet UI and REST API; fleet-scoped technicians can transfer between fleets they manage via the REST API. * Bulk transfer selection added on the hosts list for eligible global technicians, enabling multi-host transfers while preserving other bulk behaviors. * **Tests** * Added and updated tests covering Transfer visibility and authorization for global and fleet-scoped technician roles. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45956?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Rajendra kadam
|
2395d06e5b |
Extract early config validation from runServeCmd into testable helpers (#45583)
Extracts early config-validation logic out of `runServeCmd` and puts it on the relevant config types in `server/config/`, following the existing pattern used by `ConditionalAccessConfig.Validate(initFatal)` and `AndroidAgentConfig.Validate(initFatal)`. (First commit on this branch did the extraction into a separate file in `cmd/fleet/`; reshaped per review.) `runServeCmd` is now a series of `config.X.Validate(initFatal)` calls: - `config.Logging.Validate(initFatal)` — OTEL logs requires tracing enabled - `config.Osquery.Validate(initFatal)` — `host_identifier` must be one of `provided`, `instance`, `uuid`, `hostname` - `config.Server.NormalizeURLPrefix()` + `config.Server.ValidateURLPrefix(initFatal)` — Normalize mutates, ValidateURLPrefix is pure - `config.Server.Validate(initFatal)` — `private_key` vs `private_key_arn` mutex check (called before Secrets Manager retrieval so a misconfig fails fast without paying for an external lookup) - `config.Server.ValidatePrivateKeyLength(initFatal)` — minimum 32 bytes (called after Secrets Manager retrieval so an SM-provided short key is also caught) The private-key checks are split into two methods rather than folded into one because the XOR check has to fire before the SM call, and SM retrieval populates `PrivateKey` — so a single Validate called twice would false-positive the XOR check post-SM whenever the user originally configured only `private_key_arn`. Open to feedback if a different split is preferred. Tests live in `server/config/config_test.go` next to the existing config Validate tests, structured as one smoke case plus error branches per the existing convention. Behavior is preserved: `runServeCmd` still calls `initFatal` at the same points with the same descriptions. ## Broader plan Issue #33370 calls for moving logic out of `serve.go` ("should only contain critical config and dependency injection logic"). This PR is one slice. Follow-ups, each in their own small PR: - Extract more config validations (Apple APNs/SCEP both-or-neither, etc.) - Use the `initFatal` injection from #45343 to cover runtime failure paths (datastore init, Redis init, MDM init) - Larger extractions (license init, MDM wiring, mailer init) **Related issue:** Refs #33370 # Checklist for submitter - [x] Added/updated automated tests - [x] Input data is properly validated (validators added, no SQL/JS/shell paths involved) - Changes file: not applicable — internal refactor with no user-visible behavior change <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes & Improvements** * Centralized and strengthened startup configuration validation. * Enforced mutual exclusivity for private key sources and minimum private-key length. * Added URL-prefix normalization (ensure leading slash, trim trailing slash) and validation. * Ensured OTEL logging requires tracing when enabled. * Restricted osquery host identifier to supported values. * **Tests** * Added tests covering validation rules and URL-prefix normalization/validation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45583?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
8441136f69 |
Adding SCEP support to Windows MDM test client (#44562)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #37503 Test-code changes only. No product changes. Adding Windows SCEP support for osquery and Windows integration tests. Refactoring so that code can be reused from Apple client. Can be used when working on https://github.com/fleetdm/fleet/issues/45550 # Checklist for submitter ## Testing - [x] Added/updated automated tests <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved Windows MDM SCEP certificate installation handling during profile enrollment (avoids duplicate responses and properly tracks handled commands). * **Monitoring & Observability** * Added SCEP enrollment metrics: requests, successes, and errors. * **Tests** * Expanded unit and integration tests for Windows SCEP parsing, enrollment flows, and end-to-end profile verification. * **Refactor** * Centralized SCEP exchange logic for Apple and Windows test flows. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44562?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
8bb59b71cb |
Fix List certificate templates API docs: parameter name is fleet_id, not fleet (#45969) (#45978)
Closes #45969 ## Summary The `List certificate templates` API endpoint returned `null` for certificates because the **API docs documented the wrong query parameter name**. The docs said `fleet` but the code accepts `fleet_id` (or the deprecated `team_id`). Customers following the docs used `?fleet=11`, which was silently ignored, causing the endpoint to default to team 0 (unassigned) -- which typically has no certificates. - **Docs fix**: Changed the parameter name from `fleet` (string) to `fleet_id` (integer) in the REST API docs, matching how all other list endpoints document this parameter. - **API quality fix**: Initialize the `templates` slice in `GetCertificateTemplatesByTeamID` so that when no templates exist, the JSON response returns `"certificates": []` instead of `"certificates": null`. ## Root cause In `docs/REST API/rest-api.md`, the "List certificate templates" endpoint documented the query parameter as `fleet` (string), but the request struct accepts `fleet_id` or `team_id`: ```go type listCertificateTemplatesRequest struct { TeamID uint `query:"team_id,optional" renameto:"fleet_id"` } ``` When the customer used `?fleet=11` (as documented), the parameter was unrecognized and silently ignored. The endpoint defaulted to `team_id=0` (unassigned), which had no certificates. The nil Go slice then serialized to JSON `null`. Credit to Andrey Kizimenko for identifying the docs mismatch. ## Changes - `docs/REST API/rest-api.md` -- Fix parameter name from `fleet` (string) to `fleet_id` (integer) - `server/datastore/mysql/certificate_templates.go:174` -- Initialize slice to avoid `null` in JSON - `server/datastore/mysql/certificate_templates_test.go:489` -- Add `require.NotNil` regression test ## Testing All tests run locally against a real MySQL (Docker) and Redis instance: | Test suite | Command | Result | |---|---|---| | Datastore integration (all certificate tests) | `MYSQL_TEST=1 go test -run TestCertificates ./server/datastore/mysql/...` | 11 suites, 33 subtests, all PASS | | Service unit tests | `go test -run "TestCreateCertificateTemplate\|TestApplyCertificateTemplateSpecs\|..."` | 4 suites, all PASS | | Enterprise integration (full HTTP) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestCertificatesSpecs"` | PASS | | Enterprise integration (team delete) | `MYSQL_TEST=1 REDIS_TEST=1 go test -run "TestIntegrationsEnterprise/TestDeleteTeamCertificateTemplates"` | PASS | | Static analysis | `go build`, `go vet` | Clean | Andrey's reproduction confirmed via screenshots: - `?fleet_id=11` returns certificates correctly - `?fleet=11` (the documented param) returns `null` -- the bug - No param returns results when "unassigned" team has certificates ## QA steps 1. Follow the API docs to list certificate templates using `?fleet_id=<id>` 2. Verify the response contains `"certificates": [...]` with the correct data 3. Call without `fleet_id` and verify `"certificates": []` (not `null`) for a team with no templates <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed the "List certificate templates" API documentation with the correct query parameter name, enabling proper filtering of results. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45978?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ce66f3dd18 |
Move loginRequest and logoutRequest to server/fleet/ (#45908)
Resolves #36087 (one of several small PRs). - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reorganized internal API session models for improved code structure and maintainability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45908?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
3ea3ba9fee | Integration tests for non-proxied cert renewal (#45663) | ||
|
Noah Talerman
|
f6db618aa7 | GitOps: "teams" mentioned in error messages (#45878) | ||
|
Lucas Manuel Rodriguez
|
b4e907801f |
Add Android to the OS list (#45834)
Resolves #45711 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 30 48 PM" src="https://github.com/user-attachments/assets/05a0a93f-3b5b-4ba9-80c5-b0a91b9de1f3" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 30 37 PM" src="https://github.com/user-attachments/assets/3e23e88e-6a95-46f6-a68f-12fb98f1aefe" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 29 45 PM" src="https://github.com/user-attachments/assets/417ca981-0781-4df5-811b-dafaabbd61a9" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 29 30 PM" src="https://github.com/user-attachments/assets/cf13985d-5cb3-414a-9135-5cf4c5ee0dd1" /> <img width="1216" height="527" alt="Screenshot 2026-05-19 at 5 31 33 PM" src="https://github.com/user-attachments/assets/8500e7b2-cc7b-425d-b6b7-bbbf128faac4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed host listing so filtering by Android OS name and version returns matching hosts. * **New Features** * Android hosts are now included in the operating systems aggregation and UI, with a dedicated Android icon. * Android OS version information is captured during device enrollment and on status reports. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45834?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ef12b0fcd2 |
Use ubuntu-latest runner for docs CI check (#45816)
I see no reason to use macOS for this job (given how unreliable and slow macOS runners are). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * CI workflow runner switched to ubuntu-latest. * Internal tooling updated to download and prepare the osqueryd binary for macOS and Linux. * macOS agent configuration expanded with additional options for keychain access and file-monitoring behavior. --- Note: No end-user visible features or breaking changes in this release. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45816?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
9100a1265d |
Move carve requests to server/fleet/ (#45785)
Resolves #36087 (one of several PRs) ## Testing - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reorganized internal API request/response types for carve operations to centralize type definitions and improve code maintainability. * **Tests** * Updated carve operation tests to align with refactored code structure. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45785?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
arya rizky
|
cd9d0395c8 |
fix: correct typo "occured" to "occurred" in ErrorChain comment (#45871)
This is an independent contribution made by an individual developer. This work is not associated with any hackathon, competition, or coordinated PR campaign. ## Summary Fixes a typo in a comment in `server/mdm/nanomdm/mdm/command.go` where "occured" should be "occurred" in the `ErrorChain` type documentation. ## Root Cause The comment on line 14 of `command.go` describing the `ErrorChain` type uses the misspelling "occured" instead of the correct spelling "occurred". ## Fix Changed "occured" to "occurred" in the type documentation comment. ## Changes - `server/mdm/nanomdm/mdm/command.go`: 1 line changed (`+1 -1`) ## Testing - The change modifies only a comment string; no functional behavior is affected. - `go build ./...` passes with no regressions. - The `ErrorChain` type documentation now uses the correct spelling. ✅ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Fixed spelling in internal comments. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45871?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
6f8942f8da |
Skip unneeded query when getting CVE chart (#45813)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45720 # Details When requesting CVE chart data, we were making a call to get the set of tracked CVEs to filter the data by. Currently we're only _collecting_ data for the tracked CVEs, so there's no reason to make this call at all. When we add more filtering options and start collecting more data, we'll need a call like this again, and will likely need to start caching the results. Otherwise it's a multi-second cost per query on large deployments. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - removed some outdated tests - replaced with a test that checks that when an entity filter returns no items (an empty, rather than nil slice) we get empty buckets returned rather than getting data for all entities. This is a regression test for when we add filtering back. - [X] QA'd all new/changed functionality manually - validated that chart still loads and shows the same data. - tried it on a load test env and saw dramatic API request time improvement <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Optimized CVE chart data retrieval by eliminating redundant queries, reducing unnecessary database operations and improving performance. * Fixed entity ID filtering logic to correctly handle edge cases and prevent unintended filter interactions across metrics. * **Tests** * Added test coverage for chart data queries with empty entity filters. * Improved test isolation to ensure metric-specific filtering behavior is properly separated. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45813?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
6becc62393 |
Add bundle_identifier to top-level host software API response (#42188)
- @noahtalerman: For the following story: - https://github.com/fleetdm/fleet/issues/43557 ## Summary - Adds `bundle_identifier` as a top-level field on `HostSoftwareWithInstaller` struct, which is the response type for all host software API endpoints (`GET /api/v1/fleet/hosts/{id}/software`, `GET /api/v1/fleet/device/{token}/software`, etc.) - The value is sourced directly from `software_titles.bundle_identifier` via the SQL query, so it is always present even when `installed_versions` is empty (e.g., software that has never been installed on a host) - Falls back to `installed_versions[0].bundle_identifier` if the title-level value is not available - The field is retained inside `installed_versions` for full backwards compatibility ## Changes ### `server/fleet/software_installer.go` - Added `BundleIdentifier string` field with `json:"bundle_identifier,omitempty" db:"-"` tag to `HostSoftwareWithInstaller` struct ### `server/datastore/mysql/software.go` - Added `TitleBundleIdentifier` field to internal `hostSoftware` struct mapped to `title_bundle_identifier` DB column - Added `software_titles.bundle_identifier AS title_bundle_identifier` to all four SQL query branches: - Software installers SELECT - VPP apps SELECT - In-house apps SELECT - Available-for-install SELECT (`stmtAvailable`) - Added `software_titles.bundle_identifier` to GROUP BY clauses for software installers and VPP apps - In the return path, populates `BundleIdentifier` from `TitleBundleIdentifier` (with fallback to first installed version) ### `server/datastore/mysql/software_test.go` - Added `BundleIdentifier` assertion to both `compareResults` helper functions (macOS/Linux and iOS/iPadOS test suites) - Added explicit top-level `BundleIdentifier` assertions in `testListHostSoftwareWithVPPApps` where the installed version bundle identifier is already verified ## Example response shape ```json { "id": 121, "name": "Google Chrome.app", "bundle_identifier": "com.google.Chrome", "icon_url": null, "software_package": { ... }, "app_store_app": null, "source": "apps", "status": "failed_install", "installed_versions": [ { "version": "121.0", "bundle_identifier": "com.google.Chrome", ... } ] } ``` Built for [ntalerman](https://fleetdm.slack.com/archives/D0AEA6U4SM9/p1774036621198819?thread_ts=1774035719.384099&cid=D0AEA6U4SM9) by [Kilo for Slack](https://kilo.ai/features/slack-integration) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Kilo Code <kilo@kilo.ai> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: jkatz01 <yehonatankatz@gmail.com> |
||
|
|
3e10ad717c |
Add optional SES sender domain configuration (#43811)
**Related issue:** Resolves #42288 # Summary This PR adds support for configuring an optional SES sender domain. When the SES email backend is enabled, Fleet can now use a configured sender domain for the `From` address instead of always deriving the domain from `server.server_url`. If the setting is not provided, Fleet keeps the existing behavior. # Impact This gives self-hosted operators a server-side SES configuration option for email sending without changing UI-managed SMTP settings. # Root cause The SES sender path only generated `do-not-reply@<server host>` from the Fleet server URL, so there was no way to override the sender domain through server configuration. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [x] Setting(s) is/are explicitly excluded from GitOps ## Testing - [x] `go test -tags full,fts5,netgo ./server/mail -run 'Test_(getFromSES|sesSender_SendEmail)$'` - [x] `go test -tags full,fts5,netgo ./server/config -run 'TestConfig(SESSenderDomain|Roundtrip)$'` - [x] `go test -tags full,fts5,netgo ./server/service -run 'TestService_EmailConfig$'` - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added optional SES sender domain configuration. Users can specify a custom domain for the email "From" address via config or environment variable; when unset it falls back to the server hostname. * **Tests** * Added and expanded tests to verify sender-domain precedence, From-header generation, and related error cases. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/43811?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Scott Gress
|
d7fa35e417 |
Implement roaring bitmaps for historical data collection (#45709)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45715 # Details This PR refactors the way the charts module stores historical data to use the [roaring bitmap](https://github.com/RoaringBitmap/roaring) package instead of saving raw bitmaps. See [this blurb](https://github.com/RoaringBitmap/roaring#how-does-roaring-compares-with-the-alternatives) to learn how roaring compresses data, but TL;DR for our purposes it represents a huge improvement especially for larger deployments where host ID numbers may be very large. In testing, some data was reduced 96%. The majority of the changes in this PR are straight swapping of types from `[]byte` to `*roaring.Bitmap` in vars and function signatures, and updating the internals of our bit math helpers to use roaring methods instead of native AND and OR methods. I've tried to comment on all functional changes. Since the charts have been shipped already, so there will be data in the wild in the prior "dense" format, the code still handles dense bitmaps on _read_, but will always _write_ roaring bitmaps. The majority of the data will therefore have turned over within 30 days on its own, but I plan on a follow-up PR that will transform open rows when the cron runs so that we should be guaranteed to turn over completely within 30 days. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - Tests updated to accommodate the new format, and existing unchanged tests act as proof against regression - [X] QA'd all new/changed functionality manually - Using a tool that dumps the `host_scd_data` rows data into a JSON file (with the keys being entity_id+data and the values being host IDs on that date), compared the data from main branch and this and confirmed they're identical - With a host count of ~9000, some of which have IDs of over 1,000,000, the data storage requirements were: * 82,558,976 bytes for dense * 2,867,200 for roaring (a 96% decrease) For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results - should hugely improve - [X] Alerted the release DRI if additional load testing is needed ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Implemented roaring bitmaps in historical data collection to optimize bitmap handling for chart data aggregation * Added encoding support to bitmap storage schema for flexible data representation <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
George KarrandCopilot Autofix powered by AI
|
4d0534a48d |
Adding my device link on host details page with backend logic to generate it if needed (#45659)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43895 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Self-service install/uninstall activities now render in passive voice, omit an actor name, and include a “(self-service)” marker across feeds * Global admins see a "My device" button on host user cards that opens the end‑user device page in a new tab; the link is refreshed/generated as needed * Device page and browser tab header show the end‑user's name when available (fallback: "My device") * **Tests** * Added/updated coverage for self‑service activity rendering and the "My device" flow <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45659?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Tim Lee
|
bbfbea8de2 | Cert renewal for non-proxied SCEP and ACME (Phase 1 + Phase 2) (#45696) | ||
|
Lucas Manuel Rodriguez
|
9e7781a004 |
Update enrolling activities and preserve osquery display name (#45697)
Resolves #36417. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## Manual tests performed ✅ MDM enrollment first, then fleetd enrollment (checked both activities match serial and display name is preserved). ✅ fleetd enrollment first, then MDM enrollment (checked both activities match serial and display name is preserved). <img width="520" height="383" alt="activities_mdm_macos_enrollment" src="https://github.com/user-attachments/assets/35c74612-ad80-4245-bfd9-20a3dc5e78bb" /> ✅ Enrolled ABM iPad. <img width="599" height="65" alt="Screenshot 2026-05-18 at 10 57 23 AM" src="https://github.com/user-attachments/assets/b7ad552b-82af-4606-a860-361eedb97483" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enrollment activities now show device serial numbers alongside host display names, avoid duplicating the serial if already included, and fall back to serial/generic messaging when no display name is available. * Fleet enrollment entries no longer show an actor prefix, matching other enrollment activity items. * **Bug Fixes** * Display names set by prior fleetd enrollment are preserved and no longer overwritten during MDM enrollment. * **Tests** * Added and relaxed activity-feed tests covering enrollment message variants. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45697?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
e1512dacc9 |
Fix nil-pointer panic in Android Enterprise Pub/Sub endpoint (#45520)
Fixes #45520 The Pub/Sub status-report and enrollment handlers dereferenced device.HardwareInfo before any nil check, so a payload from Google's Android Management API with hardwareInfo omitted panicked the request goroutine. |
||
|
Lucas Manuel Rodriguez
|
18671eba94 |
Move HostDetailResponse type to server/fleet/ (#45718)
Resolves #45220 (one of several PRs). ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Consolidated and standardized host detail response handling across server and CLI, aligning host/device and MDM flows for more consistent behavior. * **Tests** * Updated integration tests to reflect the standardized host detail response format. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45718?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
44f284cd71 |
Remove testing dependency in server/config/config.go (#45703)
Resolves #45220. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Internal improvements to configuration management with no user-facing changes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45703?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
b0d429ef69 |
Fix SAML JIT login failing when role attributes have empty values (#42874)
Fixes #42874 Empty, whitespace-only, and missing `FLEET_JIT_USER_ROLE_*` SAML attribute values are now treated as `null` (ignored) instead of returning an error, matching the literal `"null"` workaround. |
||
|
Lucas Manuel Rodriguez
|
fef357ceb6 |
Move testing_utils.go to testing_utils_test.go for SCEP tests (#45619)
Resolves #45220 Here's one example why this is a good idea. On `main`, the fleet production binary contains a private key used for testing: ``` $ strings ./build/fleet | rg "BEGIN RSA TESTING" proto3-----BEGIN RSA TESTING KEY----- ``` And it's gone when using this branch: ``` $ strings ./build/fleet | rg "BEGIN RSA TESTING" <empty> ``` ## Testing - [X] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reorganized and centralized SCEP test helpers and servers for certificate enrollment tests. * Added embedded HTML fixtures to better emulate SCEP/NDES admin responses (cache/full, permissions, password). * Standardized UTF‑16 handling for test responses and improved test server response handling. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45619?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor LyuboslavskyandLuke Heath
|
19de907416 |
Windows setup experience: UI and BYOD fixes (#45331)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #38785 - UI changes per Figma and latest product guidelines - Do not cancel setup experience during BYOD (when critical software install fails) - Allow a host to rerun setup experience even if it has been in Fleet for over 24 hours - This fixes a bug where a host is wiped but not deleted from Fleet, and then it doesn't run setup experience. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved Windows re-enrollment detection to better handle BYOD scenarios, preventing unintended cancellation of pending setup steps for recently re-enrolled devices. * Added a fallback lookup for unlinked Windows enrollments to improve enrollment matching. * **Bug Fixes** * Clarified cancellation activity messages to note when users are asked to restart after install failures. * Updated Windows install copy and tooltips based on enrollment status. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45331) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Luke Heath <luke@fleetdm.com> |
||
|
George Karr
|
9416a81124 |
gkarr 44008 setup experience (#45202)
- **Adding vpp users table** - **Adding ManagedAppleID to HostMDM tables to pull when installing vpp apps to a BYOD user enrolled device** - **Adding user create vpp apis** - **Updating install application to support user enrolled devices** - **Handling already installed gracefully** - **Adding provision user logic** - **Adding logic to associate assets on install** - **Add license managemnt logic** - **Adding self service ui** - **Adding setup experience support** - **Adding setup experience flow** - **Fix issue with fleet's docker image in k8s environments (#44373)** - **Changing how the appleid is captured to use idp mdm users** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Account-based User Enrollment (iOS/iPadOS) supports VPP and in‑house .ipa installs, including self‑service installs. * Enrollment now applies the selected Setup experience automatically for user‑enrolled hosts. * Installs and license associations are scoped to account user associations (user‑scoped installs). * **Bug Fixes** * Improved error messaging for license/association failures (including per‑user device cap cases). * Mobile UI: self‑service now shows user‑enrolled iOS/iPadOS apps. * “Already installed” install results are treated as acknowledged successes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45202) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
1f496781a2 |
Rename and move testing_utils.go from schedule and orbit tests (#45609)
Resolves #45220 (one of many small PRs, we are close) ## Testing - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Refactored test infrastructure for scheduling components to use centralized test utilities. --- **Note:** This release contains no user-facing changes. All modifications are internal testing and code organization improvements. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45609) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
c77d1b4ff4 |
allow gitops mode to be set in yaml (#45537)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45330 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests so many - [X] QA'd all new/changed functionality manually - [X] was able to set gitops mode to enabled via `fleetctl gitops` - [X] attempting to set gitops mode w/out repository_url in `fleetctl gitops` failed w/ helpful error - [X] attempting to set gitops mode w/ invalid repository_url in `fleetctl gitops` failed w/ helpful error - [X] attempting to set gitops exceptions in `fleetctl gitops` failed w/ helpful error - [X] was able to unset gitops mode via `fleetctl gitops` - [X] leaving `gitops:` blank in `fleetctl gitops` left the mode untouched (it would retain its previous value) ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` it is not, but it's not a requirement here and leaving it out is a no-op - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) it is not, nor should it be, as that would clear gitops mode on every customer currently using it - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled n/a, you still need to be able to do gitops mode in the UI <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * GitOps mode and repository URL can now be set via GitOps YAML. * **Bug Fixes** * Server preserves existing GitOps settings during config updates; requires repository URL when enabling and rejects unsupported exceptions in GitOps YAML. * **Tests** * Added tests covering apply behavior, YAML validation, activity emission on mode changes, and license-restricted rejection on free tier. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45537) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
dc9d3d18c6 |
Added invariant that MDMProfileSpecsMatch cannot contain duplicate path entries (#45489)
|
||
|
Nico
|
c19df6d2c7 |
Fix double-counted Linux disk space from bind-mounted filesystems (#44969)
**Related issue:** Resolves #43091 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [ ] Added/updated automated tests - [x] QA'd all new/changed functionality manually Was able to reproduce by enrolling a Ubuntu 25.10 host and mounting / onto a different path like this: ```bash sudo mkdir -p /tmp/snap.rootfs_TESTING sudo mount --bind / /tmp/snap.rootfs_TESTING ``` Then, refetched vitals and saw the total disk space doubled: <img width="211" height="108" alt="Screenshot 2026-05-07 at 9 40 12 PM" src="https://github.com/user-attachments/assets/81cad4af-f146-4ea9-84e3-ee56eb426d8a" /> With the fix applied on this branch, refetched again and saw the correct total disk space: <img width="251" height="118" alt="Screenshot 2026-05-07 at 9 31 15 PM" src="https://github.com/user-attachments/assets/cbb6f91b-320a-4d48-8583-f5fdf5a4fcd9" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes - Resolved inaccurate total disk space reporting on Linux systems where the same filesystem is bind-mounted at multiple paths. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
11a862729c |
Return 404's for not found resources in some batch script endpoints (#45348)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43027 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Endpoints for fleet script batch executions now return HTTP 404 for nonexistent batch execution resources. * **Tests** * Added tests to verify 404 behavior for missing batch execution resources and related error handling. * **Tools** * Added a command-line load-test seeding/teardown utility to create and remove configuration profiles and related test data. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45348) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
3b476704d1 |
Create maintainedappstest package (to prevent testing code in production binaries) (#45494)
Resolves #45220 (one of several PRs) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added a dedicated maintained-apps test helper and updated integration tests to use it, consolidating sync test setup and improving reliability of maintained-apps scenarios. * Updated several tests to use improved test utilities and helper variants for SQL test helpers and request fixtures. * **Chores** * Adjusted CI lint checks to exclude the new test helper location from specific env-var override validations. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45494) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
267d626383 |
Fix main tests (#45551)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated internal test utilities and helpers to improve test infrastructure reliability. * **Refactor** * Improved code formatting consistency in test configurations. --- **Note:** This release contains internal testing and maintenance updates with no user-facing changes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45551) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra kadam
|
182307ac3b |
Add unit tests for Windows MDM WSTEP CSR parser helpers (#45457)
Adds unit tests for previously-uncovered parser helpers in `server/mdm/microsoft/wstep_csr.go`: - `parseBase128Int` — single/multi-byte values, non-minimal encoding (leading `0x80`), truncation, 5-byte cap, `MaxInt32` overflow - `parseTagAndLength` — short/long-form length, indefinite-length rejection, non-minimal length and tag, shift overflow - `parseSANExtension` — DNS, email, URI, IPv4, IPv6, plus malformed IP length and non-IA5 DNS - `domainToReverseLabels` — trailing dots, empty middle labels, single labels ASN.1 fixtures are built with `cryptobyte.Builder` to match the source file's existing toolchain — no new dependencies. Pure-Go tests, run in the `fast` bundle without Docker. **Related issue:** Refs #33373 # Checklist for submitter - [x] Added/updated automated tests <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added comprehensive test coverage for certificate Subject Alternative Name (SAN) parsing: domain label reversal, base‑128 integer decoding with error classification, ASN.1 tag/length validation and boundary cases, end‑to‑end parsing of multiple SAN name types (DNS, email, IPv4/IPv6, URI), and numerous malformed/input edge‑case checks. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45457) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
4f59f39c9f |
VPP/in-house app managed configuration bug fixes and integration test (#45452)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43973 Fixes a few bugs regarding managed app configurations. Includes a few cherry-picks for commits that were supposed to be merged, but got overwritten by subsequent PRs that didn't get pushed properly while working with the github stack. Also includes some more integration test cases. # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved error handling for VPP managed app configurations that reference unresolvable Fleet variables. * **Bug Fixes** * Fixed cleanup of VPP app configuration data during team deletion. * In-house app configurations now apply only to their specific installer instead of sibling installers. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45452) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
6c1c9bf0d2 |
Fixed an issue where the MDM solution name reported for a host could flip between values across osquery ingestions (#45496)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45491 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Deterministic MDM solution name reporting for osquery ingestions when server URLs match multiple vendor substrings; resolves ambiguous matches (e.g., jumpcloud.awmdm.com) and normalizes case. * **Tests** * Added unit tests covering empty/unknown inputs, multiple vendor hostnames, case-insensitive URLs, and ambiguous-match resolution. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45496) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan MontgomeryandCopilot Autofix powered by AI
|
bee5edaa0b |
Add server-side orbit debug logging enablement - currently only configurable as a duration-after-enrollment setting (#45367)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43997 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Configure Orbit to enable debug logging for a limited window on agent enrollment; enrolled hosts receive debug/verbose behavior while the window is active and it is reflected in agent config. * **Chores** * Added database column to record per-host debug-until timestamps and datastore support to extend it safely. * **Tests** * Added integration and unit tests covering validation, enrollment stamping, config generation, and runtime debug toggling. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45367) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Sharon Katz
|
903e3a3f45 |
Sort software titles by display name instead of installer filename (#44873)
Closes #43673 ## Changes Sorts the `/software/titles` endpoint by display name (when set) instead of the internal `software_titles.name` (often an installer filename). **3 changes in `server/datastore/mysql/software_titles.go`:** 1. **Order key mapping** (line 24): `"name"` sort key now maps to `COALESCE(NULLIF(stdn.display_name, ''), st.name)` — uses display name when set, falls back to `st.name`. `NULLIF` ensures cleared display names (empty string) are treated as unset. 2. **Secondary sort** (line 579): Same `COALESCE(NULLIF(...))` expression for tie-breaking when sorting by a non-name column. 3. **LEFT JOIN** (line 635): Joins `software_title_display_names` so the COALESCE expressions can resolve. ## Testing ### Manual testing Inserted test software titles with display names that sort differently from installer filenames. Confirmed: - Before fix: sorted by internal `st.name` (installer filename) - After fix: sorted by display name, with fallback to `st.name` when no display name is set - Verified with `order_direction=asc`, `desc`, and secondary sort via `hosts_count` ### Unit tests `server/datastore/mysql/software_titles_sort_test.go` — 5 subtests (no MySQL required): - Order key mapping uses `NULLIF` for empty display names - Secondary sort uses `NULLIF` for empty display names - Primary name sort doesn't add redundant secondary name sort - SQL template includes `display_names` join - Empty display name falls back to `st.name` in sort expression SQL fixture (`select_software_titles_sql_fixture.gz`) regenerated to match updated queries. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Software titles listing now sorts by team-specific display names when present, falling back to default names; tie-breaking and overall sort behavior refined for more consistent ordering. * **Tests** * Added tests validating display-name sorting, correct fallback for empty names, secondary sort behavior, and generated query structure to ensure consistent results. [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44873) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
