Support custom (secret) variables in host name templates

[juan-fdz-hawa]

Relates to #38806

Host name templates previously accepted only built-in $FLEET_VAR_* variables and rejected custom $FLEET_SECRET_* (secret) variables. Allow secret variables so admins can embed an org-wide custom value in an Apple host's name.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

• New Features

  • Host name templates can now include Fleet secret variables alongside standard host variables.
  • Secret values are expanded when generating Apple device names.
  • Templates using valid, existing secrets are accepted while preserving the configured placeholder.

• Bug Fixes

  • Invalid or missing secrets now produce clear validation errors.
  • Secrets cannot be deleted while referenced by a team or global host name template.
  • Device-name processing handles missing secrets without blocking unrelated hosts.

[juan-fdz-hawa]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Walkthrough

Host name templates now accept $FLEET_SECRET_* references and validate those secrets through the datastore. MDM and team update paths use the new validation. Apple device-name reconciliation expands secrets with cached results and handles missing-secret failures per host. Secret deletion is blocked while a team or global host name template references the secret, with corresponding unit and integration test coverage.

Possibly related PRs

• fleetdm/fleet#48690: Overlaps the host-name-template validation and MDM enforcement pipeline.
• fleetdm/fleet#48699: Introduced the host name template validation APIs extended by this change.
• fleetdm/fleet#48793: Overlaps ReconcileHostDeviceNames and its enforcement flow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: adding custom secret variables to host name templates.
Description check	✅ Passed	The description covers the issue, change summary, validation, tests, and manual QA; only some non-applicable template sections were omitted.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 38806-extend-secrets

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 79.71014% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.96%. Comparing base (ada55da) to head (ebed63d).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/apple_device_names.go	61.11%	6 Missing and 1 partial ⚠️
server/fleet/datastore.go	20.00%	4 Missing ⚠️
server/datastore/mysql/secret_variables.go	91.66%	1 Missing and 1 partial ⚠️
server/service/appconfig.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #49337   +/-   ##
=======================================
  Coverage   67.95%   67.96%           
=======================================
  Files        3820     3820           
  Lines      240982   241058   +76     
  Branches    12693    12693           
=======================================
+ Hits       163759   163826   +67     
- Misses      62346    62354    +8     
- Partials    14877    14878    +1     

Flag	Coverage Δ
backend	69.54% <79.71%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lucasmrod]

We should probably update these instances to be "Unassigned" instead of "No team" (IIRC it's for the error)

[juan-fdz-hawa]

Cool - I'll make that update in the other batch of changes