add default fleet for BYOD Apple migration

[MagnusHJensen]

Related issue: Resolves #45595

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information. (Will add in a follow up story)

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

Release Notes

• New Features
  • Enabled BYOD fleet enrollments with default team assignment capability
  • Added enrollment challenge tracking and management for ADUE device registrations
  • Implemented secure enrollment URL token generation for enrollment flows

[Copilot]

Pull request overview

This PR implements the database/schema changes for BYOD Apple enrollment work by extending abm_tokens with a BYOD default team pointer and a required enrollment URL token, plus introducing a new mdm_adue_enrollment_challenges table. It also adds a Fleet helper for generating the URL-safe random token and includes a migration test.

Changes:

• Add byod_default_team_id and required enrollment_url_token (unique + length check) to abm_tokens, with a backfill for existing rows.
• Add mdm_adue_enrollment_challenges table with FK relationships to abm_tokens and mdm_idp_accounts.
• Add a shared helper to generate a 32-byte-entropy base64url token and add migration tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
server/fleet/mdm.go	Adds helper for generating 32-byte random base64url token.
server/datastore/mysql/schema.sql	Updates canonical schema for new ABM token fields + new ADUE challenges table.
server/datastore/mysql/migrations/tables/20260609104220_AddBYODFleetAndADUEEnrollment.go	Adds migration that alters abm_tokens, backfills enrollment_url_token, and creates ADUE challenges table.
server/datastore/mysql/migrations/tables/20260609104220_AddBYODFleetAndADUEEnrollment_test.go	Adds migration test coverage for backfill + constraints/FK behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Walkthrough

This PR introduces foundational schema and infrastructure for BYOD default fleet enrollment and ADUE enrollment challenge tracking. It adds a cryptographic token generation utility, extends the abm_tokens table with a byod_default_team_id foreign key to teams (with cascade SET NULL on deletion) and a unique enrollment_url_token column (with minimum length enforcement), creates a new mdm_adue_enrollment_challenges table to store ADUE challenges with references to IdP accounts and ABM tokens (with cascade delete), implements the migration with Go-based token backfill for existing ABM token rows, and provides comprehensive tests validating all constraints, foreign key relationships, and referential integrity actions.

Possibly related issues

• #30871 – This PR implements the BYOD default team linkage and enrollment token infrastructure for ABM tokens as described in the related user story; the byod_default_team_id column and enrollment_url_token generation directly enable per-ABM-token BYOD fleet behavior.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'add default fleet for BYOD Apple migration' directly summarizes the main change: adding BYOD Apple migration support with default fleet configuration.
Description check	✅ Passed	The description references issue #45595, includes relevant checklist items (validation, testing), notes that a changes-file will be added in a follow-up, and documents that automated tests were added and manual QA performed.
Linked Issues check	✅ Passed	All requirements from #45595 are met: migration alters abm_tokens with byod_default_team_id and enrollment_url_token; backfills tokens using crypto/rand and base64 encoding; creates mdm_adue_enrollment_challenges table with correct constraints; includes comprehensive tests verifying backfill, FK behavior, and uniqueness; Down migration is a no-op; schema is updated.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to requirements from #45595: migration file, test file, schema updates, and a utility function (GenerateRandom32ByteEntropyURLSafeToken) for secure token generation—all necessary for the migration implementation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 45595-byof-migration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@server/datastore/mysql/migrations/tables/20260609104220_AddBYODFleetAndADUEEnrollment_test.go`:
- Around line 80-83: The negative tests for abm_tokens FK constraints are not
isolating the intended foreign-key failures because required non-null columns
are omitted, so the DB may reject the row for the wrong reason; update the
failing insert statements that target byod_default_team_id, idp_account_uuid,
and abm_token_id to include all other required non-null columns (e.g.,
enrollment_url_token, challenge, idp_account_uuid, abm_token_id as appropriate)
with valid placeholder values so the only failing condition is the specific FK
being tested (refer to the abm_tokens table columns byod_default_team_id,
enrollment_url_token, challenge, idp_account_uuid, abm_token_id to locate and
fix the three blocks around the current failing checks).

In
`@server/datastore/mysql/migrations/tables/20260609104220_AddBYODFleetAndADUEEnrollment.go`:
- Around line 32-44: The rows.Err() check is currently executed before iterating
and therefore won't catch iteration-time errors; move the check to run after the
for rows.Next() loop that scans into the temporary token struct and appends to
abmTokens so any errors from rows.Next() or rows.Scan() are captured (i.e.,
perform rows.Err() after the loop that processes abm_tokens using rows.Next()
and rows.Scan()).
- Around line 71-87: The idp_account_uuid column in table
mdm_adue_enrollment_challenges is declared as VARCHAR(36) but it references
mdm_idp_accounts.uuid which is VARCHAR(255); update the idp_account_uuid
definition in the CREATE TABLE for mdm_adue_enrollment_challenges to match the
referenced type and collation (change VARCHAR(36) to VARCHAR(255) COLLATE
utf8mb4_unicode_ci NOT NULL) so the foreign key constraint (CONSTRAINT
mdm_adue_idp_account_fk FOREIGN KEY (idp_account_uuid) REFERENCES
mdm_idp_accounts(uuid) ON DELETE CASCADE) remains valid and consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aa3bff7e-f708-409b-8954-9d3bba20be07

📥 Commits

Reviewing files that changed from the base of the PR and between ac16ca6 and 7e9ee38.

📒 Files selected for processing (4)

• server/datastore/mysql/migrations/tables/20260609104220_AddBYODFleetAndADUEEnrollment.go
• server/datastore/mysql/migrations/tables/20260609104220_AddBYODFleetAndADUEEnrollment_test.go
• server/datastore/mysql/schema.sql
• server/fleet/mdm.go

[codecov]

Codecov Report

❌ Patch coverage is 69.44444% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.19%. Comparing base (b4dcea8) to head (394aba1).

Files with missing lines	Patch %	Lines
...es/20260609104220_AddBYODFleetAndADUEEnrollment.go	69.49%	10 Missing and 8 partials ⚠️
server/datastore/mysql/apple_mdm.go	66.66%	1 Missing and 1 partial ⚠️
server/fleet/mdm.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #47161   +/-   ##
=======================================
  Coverage   67.19%   67.19%           
=======================================
  Files        3273     3274    +1     
  Lines      227905   227975   +70     
  Branches    11746    11746           
=======================================
+ Hits       153137   153188   +51     
- Misses      60956    60967   +11     
- Partials    13812    13820    +8     

Flag	Coverage Δ
backend	68.84% <69.44%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.