George Karr
3b32a526ee
**Related issue:** Resolves #47963 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually ## Summary Fixes a 500 seen via monitoring during `POST /api/mdm/apple/enroll`: ``` checking os updates settings serial [redacted]: getting team id for host: sql: no rows in result set ``` ### Root cause During DEP enrollment, `CheckMDMAppleEnrollmentWithMinimumOSVersion` → `shouldOSUpdateForDEPEnrollment` calls `GetMDMAppleOSUpdatesSettingsByHostSerial`, which joins `hosts` to `host_dep_assignments` by serial. When no matching row exists yet — e.g. the enrollment request arrives before the host / DEP assignment row is created or replicated (replica lag / ordering) — `sqlx.GetContext` returns `sql.ErrNoRows`. The service layer already handles this case gracefully (skip the OS-update check, allow enrollment to proceed) via `fleet.IsNotFound(err)`. But the datastore wrapped the raw `sql.ErrNoRows` with a plain `ctxerr.Wrap`, which does not implement the `IsNotFound()` interface, so the graceful path never triggered and the request 500'd. ### Fix Convert `sql.ErrNoRows` into a proper `notFound` error in the datastore method, matching the existing pattern used throughout `apple_mdm.go`. This lets the existing service-layer graceful-skip path take over so enrollment proceeds. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Apple MDM enrollment to continue gracefully when OS update settings are missing because a host’s DEP assignment hasn’t been created yet or hasn’t replicated. * Prevented enrollment from failing with an unexpected 500 error by returning a clear “not found” outcome instead. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 lines
301 B
Plaintext
2 lines
301 B
Plaintext
- Fixed a 500 error during Apple MDM enrollment when a host had no DEP assignment yet (e.g. the enrollment request arrived before the host/DEP assignment row was created or replicated). The OS updates settings lookup now returns a not-found error so enrollment proceeds gracefully instead of failing.
|