Implement clear passcode backend

[MagnusHJensen]

Related issue: Resolves #42368

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information. For the overall story

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

Pull request overview

Adds a new premium ClearPasscode MDM action for iOS/iPadOS hosts, including API route wiring, MDM command generation, unlock-token secret expansion, and related test coverage.

Changes:

• Added POST /api/latest/fleet/hosts/{id}/clear_passcode endpoint and Service.ClearPasscode method (free returns missing license; EE implements behavior).
• Implemented Apple MDM ClearPasscode command issuance using a host-secret placeholder that expands to the device’s stored UnlockToken.
• Updated Nano MDM enrollment details retrieval to return a struct (including unlock_token) and adapted mocks/tests accordingly.

Reviewed changes

Copilot reviewed 27 out of 28 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
server/service/mdm.go	Adds ClearPasscode endpoint/response types; blocks ClearPasscode command on Fleet Free via premium command list.
server/service/handler.go	Registers /clear_passcode host route.
ee/server/service/mdm.go	Implements premium ClearPasscode behavior (Apple mobile only).
server/mdm/apple/commander.go	Adds MDMAppleCommander.ClearPasscode command construction using host-secret placeholder.
server/mdm/apple/commander_test.go	Tests ClearPasscode command enqueue uses host-secret placeholder.
server/mdm/nanomdm/service/nanomdm/service.go	Expands host secrets for ClearPasscode at delivery time.
server/datastore/mysql/secret_variables.go	Adds host-secret expansion for MDM unlock token (base64 encoding for plist <data>).
server/datastore/mysql/secret_variables_test.go	Adds test for unlock-token expansion.
server/datastore/mysql/apple_mdm.go	Extends enrollment details query to include nd.unlock_token and returns struct.
server/datastore/mysql/apple_mdm_test.go	Updates tests for new enrollment details return type.
server/fleet/datastore.go	Updates datastore interface signature for enrollment details.
server/fleet/mdm.go	Adds AppleMDMCommandTypeClearPasscode and NanoMDMEnrollmentDetails struct.
server/fleet/apple_mdm.go	Extends Apple command issuer interface with ClearPasscode.
server/fleet/secrets.go	Adds HostSecretMDMUnlockToken secret type.
server/fleet/errors.go	Adds user-facing message for ClearPasscode on personal hosts.
server/fleet/activities.go	Adds ActivityTypeClearedPasscode activity type.
pkg/mdm/mdmtest/apple.go	Test client now includes UnlockToken in TokenUpdate.
server/service/integration_mdm_test.go	Adds personal-host ClearPasscode endpoint coverage.
server/service/integration_mdm_commands_test.go	Adds end-to-end ClearPasscode command integration test.
server/service/hosts.go	Adapts to new enrollment details return type.
server/service/hosts_test.go	Updates mocks for new enrollment details signature.
server/mock/datastore_mock.go	Updates mock signature for enrollment details.
server/mock/service/service_mock.go	Adds ClearPasscode to service mock.
server/service/apple_mdm_test.go	Ensures ClearPasscode is treated as premium command for Fleet Free.
cmd/fleetctl/fleetctl/mdm_test.go	Updates mocks for new enrollment details signature.
changes/39570-clear-passcode	Adds changelog entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MagnusHJensen]

@claude review once

[Copilot]

Pull request overview

Copilot reviewed 27 out of 28 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 42368-clear-passcode

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 76.29630% with 32 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.85%. Comparing base (7ce1bdf) to head (d204b04).
⚠️ Report is 77 commits behind head on main.

Files with missing lines	Patch %	Lines
ee/server/service/mdm.go	78.00%	6 Missing and 5 partials ⚠️
server/mdm/nanomdm/service/nanomdm/service.go	40.00%	5 Missing and 4 partials ⚠️
server/datastore/mysql/secret_variables.go	40.00%	3 Missing and 3 partials ⚠️
server/service/mdm.go	70.00%	3 Missing ⚠️
server/service/testing_client.go	85.71%	1 Missing and 1 partial ⚠️
server/datastore/mysql/apple_mdm.go	83.33%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #43072   +/-   ##
=======================================
  Coverage   66.84%   66.85%           
=======================================
  Files        2578     2578           
  Lines      206893   206987   +94     
  Branches     9244     9244           
=======================================
+ Hits       138307   138383   +76     
- Misses      56009    56021   +12     
- Partials    12577    12583    +6     

Flag	Coverage Δ
backend	68.62% <76.29%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JordanMontgomery]

This looks great. Haven't had time to test it yet but no complaints