Rotate recovery lock password

[mostlikelee]

Related issue: Resolves #39782

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects

Testing

• Added/updated automated tests

• QA'd all new/changed functionality manually

Database migrations

• Checked schema for all modified table for columns that will auto-update timestamps during migration.
• Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

Summary by CodeRabbit

New Features

• Recovery Lock Password Rotation: Added ability to rotate recovery lock passwords for macOS Apple Silicon hosts enrolled in Fleet MDM.
• Rotation Status Tracking: Track pending, completed, and failed rotation states for recovery lock passwords.
• Activity Logging: Recovery lock password rotation events are now logged as activities for audit purposes.
• MDM Command Integration: Rotation commands are automatically issued through MDM infrastructure.

[Copilot]

Pull request overview

Adds support for rotating a macOS host’s Apple MDM recovery lock password by introducing a new authenticated API endpoint, MDM command + secret expansion support for the “pending” password, and datastore/schema changes to track and finalize rotation.

Changes:

• Add POST /fleet/hosts/{id}/recovery_lock_password/rotate endpoint and fleet.Service.RotateRecoveryLockPassword API.
• Implement rotation state in MySQL (pending_encrypted_password, pending_error_message) plus datastore helpers and result-handler logic to complete/fail rotation.
• Add Apple MDM commander support for SetRecoveryLock rotation (CurrentPassword + NewPassword placeholders) and a new activity type for audit logging.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/service/hosts.go	Adds rotate endpoint wiring + Free-tier stub implementation (license-gated).
server/service/handler.go	Registers the new authenticated route for rotation.
server/service/apple_mdm.go	Extends SetRecoveryLock results handler to detect/handle rotations.
server/service/apple_mdm_cmd_results_test.go	Updates existing tests to stub the new rotation check (no new rotation cases).
server/mock/service/service_mock.go	Extends service mock with RotateRecoveryLockPassword hook.
server/mock/datastore_mock.go	Extends datastore mock with rotation-related methods.
server/mdm/apple/commander.go	Adds RotateRecoveryLock command payload using secret placeholders.
server/fleet/service.go	Extends Service interface with RotateRecoveryLockPassword.
server/fleet/secrets.go	Adds a host secret type for pending recovery lock password expansion.
server/fleet/datastore.go	Extends Datastore interface with rotation lifecycle methods.
server/fleet/apple_mdm.go	Extends Apple command issuer interface + adds rotation status struct.
server/fleet/activities.go	Adds new activity type for recovery lock password rotation.
server/datastore/mysql/secret_variables.go	Supports decrypt/expand of pending recovery lock password secret.
server/datastore/mysql/schema.sql	Adds pending rotation columns to host_recovery_key_passwords and bumps migration id.
server/datastore/mysql/migrations/tables/20260317120000_AddRecoveryLockPasswordRotation.go	Migration to add pending rotation columns.
server/datastore/mysql/apple_mdm.go	Implements rotation datastore methods and status queries.
server/datastore/mysql/apple_mdm_test.go	Adds datastore-level tests for rotation lifecycle.
ee/server/service/hosts.go	Implements the EE RotateRecoveryLockPassword workflow (validation, enqueue, activity).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[getvictor]

Looks good. Please review any remaining AI agent comments.

[mostlikelee]

@getvictor fixed a merge conflict