Android provision certificates before dependent profiles - #46759
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR ensures Android certificate templates are created for transferred hosts before dependent Android/ONC profiles are applied. AddHostsToTeam and AddHostsToTeamByFilter now fetch transferred Android UUIDs, create pending certificate-template records for the destination team (using team ID 0 for no-team transfers), then proceed with bulk pending-profile logic and Android-apps queueing. Tests import the Android MDM package, stub the Android UUID lookup, and add tests verifying pending cert template creation and team-ID behavior. Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server/service/hosts.go`:
- Around line 1291-1298: The Android certificate rows are being created after
BulkSetPendingMDMHostProfiles which allows Android profiles to become pending
before their certificates exist; move the
CreatePendingCertificateTemplatesForNewHost calls to run before the
BulkSetPendingMDMHostProfiles call so certificate templates for androidUUIDs
(when teamID != nil) are created first; apply this reordering in both
AddHostsToTeam and AddHostsToTeamByFilter, ensuring
svc.ds.CreatePendingCertificateTemplatesForNewHost is invoked for each hostUUID
in androidUUIDs prior to calling BulkSetPendingMDMHostProfiles.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 628e840d-257a-4b96-9ee3-d508ef384fa2
📒 Files selected for processing (3)
changes/45022-android-profile-cert-race-conditionserver/service/hosts.goserver/service/hosts_test.go
There was a problem hiding this comment.
Pull request overview
This PR addresses a Fleet MDM Android team-transfer race where ONC profiles that depend on certificates can be applied before the certificates are available, causing a temporary enforcement failure during team transfers.
Changes:
- Create pending Android certificate template records when hosts are transferred to a team (both direct host ID transfers and filter-based transfers).
- Ensure Android “available apps” recalculation is still queued on transfer paths.
- Add a changelog entry and update existing unit tests to account for the new datastore call.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
server/service/hosts.go |
Adds creation of pending Android certificate template records during host team transfer flows. |
server/service/hosts_test.go |
Updates mocks to stub ListMDMAndroidUUIDsToHostIDs so existing tests continue to run. |
changes/45022-android-profile-cert-race-condition |
Adds a user-visible changelog note describing the fix. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| for hostUUID := range androidUUIDs { | ||
| if _, err := svc.ds.CreatePendingCertificateTemplatesForNewHost(ctx, hostUUID, destTeamID); err != nil { | ||
| return ctxerr.Wrap(ctx, err, "create pending certificate templates for transferred android host") | ||
| } | ||
| } |
| for hostUUID := range androidUUIDs { | ||
| if _, err := svc.ds.CreatePendingCertificateTemplatesForNewHost(ctx, hostUUID, destTeamID); err != nil { | ||
| return ctxerr.Wrap(ctx, err, "create pending certificate templates for transferred android host") | ||
| } | ||
| } |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #46759 +/- ##
==========================================
+ Coverage 66.91% 66.98% +0.06%
==========================================
Files 2836 2826 -10
Lines 225064 224556 -508
Branches 11619 11362 -257
==========================================
- Hits 150611 150411 -200
+ Misses 60788 60476 -312
- Partials 13665 13669 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
Related issue: Resolves #45022
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Testing
Summary by CodeRabbit