Manual labels no longer factor in created_at time for exclusions - #30745
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 📝 WalkthroughWalkthroughThe changes update label scoping logic for software installers so that manual labels are always counted regardless of timestamps, while dynamic labels still depend on the host's label update time. Related tests were added to verify this behavior. A device authentication token expiration check was also removed from host lookup logic. Changes
Sequence Diagram(s)sequenceDiagram
participant Host
participant Datastore
participant SQL
Host->>Datastore: Request available software installers
Datastore->>SQL: Query with label scoping logic
Note right of SQL: Manual labels always count<br>Dynamic labels depend on timestamps
SQL-->>Datastore: Return filtered installers
Datastore-->>Host: Return available installers
Assessment against linked issues
Assessment against linked issues: Out-of-scope changes
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
In this case Firefox was installed by the host (not by fleet) and there is a software installer on fleet that matches. 
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (2)
server/datastore/mysql/hosts.go (2)
601-601: Consider the security implications of removing token expiration.By removing the expiration check, device authentication tokens will now work indefinitely regardless of their age. This could create a security vulnerability if tokens are compromised, as they would remain valid until explicitly revoked rather than expiring naturally.
Please ensure this behavioral change aligns with your security requirements and consider if additional token management mechanisms are needed.
2541-2541: Remove unused parameter from function signature.The
tokenTTLparameter is no longer used in the function implementation but remains in the signature. This creates confusion about the function's behavior and should be cleaned up.-func (ds *Datastore) LoadHostByDeviceAuthToken(ctx context.Context, authToken string, tokenTTL time.Duration) (*fleet.Host, error) { +func (ds *Datastore) LoadHostByDeviceAuthToken(ctx context.Context, authToken string) (*fleet.Host, error) {Please also update all callers of this function to remove the tokenTTL argument.
🧹 Nitpick comments (1)
changes/29315-manual-label-scoping (1)
1-1: tighten the wording for claritya tiny grammar tweak makes the sentence smoother and consistent with the other change-log bullets in this repo.
-* Label created_at no longer factored in when scoping software packages by "exclude any" manual labels +* The `created_at` timestamp of a label is no longer factored in when scoping software packages with the “exclude any” manual-label rule
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 729de42 and 657b34316660f1a239bb118e02c7316a5deb82b3.
📒 Files selected for processing (4)
changes/29315-manual-label-scoping(1 hunks)server/datastore/mysql/hosts.go(1 hunks)server/datastore/mysql/software.go(2 hunks)server/datastore/mysql/software_test.go(2 hunks)
🧰 Additional context used
🧠 Learnings (1)
server/datastore/mysql/hosts.go (2)
undefined
<retrieved_learning>
Learnt from: getvictor
PR: #30589
File: ee/server/service/hostidentity/depot/depot.go:104-119
Timestamp: 2025-07-08T16:06:54.576Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the security concern where shared challenges allow certificate revocation (lines 104-119) is a known issue that will be addressed in a later feature, not an immediate concern to fix.
</retrieved_learning>
<retrieved_learning>
Learnt from: getvictor
PR: #30589
File: ee/server/service/hostidentity/depot/depot.go:115-115
Timestamp: 2025-07-08T16:11:49.555Z
Learning: In ee/server/service/hostidentity/depot/depot.go, the error from result.RowsAffected() is intentionally ignored because the information is only used for logging purposes, not for critical program logic.
</retrieved_learning>
🧬 Code Graph Analysis (1)
server/datastore/mysql/hosts.go (1)
server/fleet/hosts.go (1)
Host(274-388)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (19)
- GitHub Check: test-go (main, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (vuln, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (mysql, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: test-go (vuln, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: test-go (fleetctl, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (main, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: test-go (fleetctl, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: test-go (mysql, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (integration-mdm, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: test-go (integration-enterprise, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (integration-core, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: test-go (integration-core, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (integration-mdm, ubuntu-latest, mysql:8.0.36, false)
- GitHub Check: test-go (integration-enterprise, ubuntu-latest, mysql:9.3.0, false)
- GitHub Check: lint (windows-latest)
- GitHub Check: lint (ubuntu-latest)
- GitHub Check: lint (macos-latest)
- GitHub Check: publish
- GitHub Check: Analyze (go)
🔇 Additional comments (4)
server/datastore/mysql/hosts.go (1)
2541-2612: Verify this change aligns with the PR objectives.This change removes timestamp-based filtering for device authentication tokens, which seems related to the broader PR theme about manual labels and created_at time exclusions. However, the connection isn't immediately clear from the context.
Please confirm that this device auth token change is intentionally part of this PR and not an accidental inclusion.
server/datastore/mysql/software.go (2)
670-676: Logic looks good for manual label timestamp exclusionThe conditional logic correctly implements the requirement where manual labels (
label_membership_type = 1) bypass the timestamp check entirely, while dynamic labels (label_membership_type = 0) continue to respect thehost_label_updated_at >= labels.created_atcondition. This aligns perfectly with the PR objective.
692-698: Consistent implementation of label scoping logicGreat to see the same conditional logic pattern applied consistently in the second location within the
exclude_anyCTE. This ensures that manual labels are treated uniformly throughout the exclusion logic.server/datastore/mysql/software_test.go (1)
85-85: Well-structured test for label scoping timestamp logic!The new test case thoroughly validates the behavior where manual labels are counted regardless of timestamps while dynamic labels respect the host's label update time. This aligns perfectly with the PR objective to exclude created_at time considerations for manual labels.
Also applies to: 7970-8162
657b343 to
c7b8a42
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #30745 +/- ##
==========================================
+ Coverage 64.12% 64.16% +0.03%
==========================================
Files 1879 1887 +8
Lines 184565 184947 +382
Branches 5437 5435 -2
==========================================
+ Hits 118353 118663 +310
- Misses 56904 56953 +49
- Partials 9308 9331 +23
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
iansltx
left a comment
iansltx
left a comment
There was a problem hiding this comment.
If I understand the logic correctly, this is good. Just need a few more lines of tests.
iansltx
left a comment
iansltx
left a comment
There was a problem hiding this comment.
Thanks for the tweaks/explanation!
2 participants
Fixes #29315
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)Summary by CodeRabbit
Bug Fixes
Tests