Skip to content

Keep BYOD iDevice inventory managed-only - #53028

Merged
cdcme merged 1 commit into
mainfrom
fix-52701-byod-idevice-apps
Sep 15, 2026
Merged

cdcme merged 1 commit into
mainfrom
fix-52701-byod-idevice-apps

Conversation

@cdcme

@cdcme cdcme commented Sep 11, 2026

Copy link
Copy Markdown
Member

Related issue: Resolves #52701

The InstalledApplicationList command Fleet sends after verifying an app install now asks for managed apps only on manually enrolled iPhones and iPads, matching the hourly refetch cron and the Refetch button. Before this the end user's own App Store apps landed in the host's software inventory until the next refetch removed them again.

Keyed on installed_from_dep for parity with the other two call sites. I think #52885 will want to move that predicate at all three together.

Checklist for submitter

  • Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
    See Changes files for more information.

Testing

  • Added/updated automated tests
  • QA'd all new/changed functionality manually

TestVPPInstallRefetchManagedAppsOnlyForBYODiDevices covers both enrollment types. The simulated device reports a personal app only when the command omits ManagedAppsOnly, so the test asserts the resulting inventory and not just the flag. It fails on main and passes here.

Manual QA drove an in-house .ipa install through the MDM protocol with a simulated iPadOS device, against a clone of a dev database, on builds with and without the change:

Build Enrollment refetch ManagedAppsOnly Inventory after install After Refetch
before manual false ipa_test, PersonalGame ipa_test
after manual true ipa_test ipa_test
after automatic false ipa_test, PersonalGame n/a

The first row is the flip described in the issue.

AI

AI: Claude Code (claude-opus-5[1m])

Summary by CodeRabbit

  • Bug Fixes
    • Fixed software inventory on manually enrolled BYOD iPhone and iPad devices to show only apps managed through Fleet after an app installation.
    • Automatically enrolled devices continue to include both managed and personal apps in their inventory.

@cdcme
cdcme deployed to Docker Hub September 11, 2026 13:08 — with GitHub Actions Active
@cdcme
cdcme marked this pull request as ready for review September 11, 2026 13:55
@cdcme
cdcme requested a review from a team as a code owner September 11, 2026 13:55
Copilot AI lite review requested due to automatic review settings September 11, 2026 13:55

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No unresolved blocking issues were identified.

Warning

  • Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview

Updates iOS/iPadOS post-install refetches to request managed apps only for manually enrolled devices.

Changes:

  • Applies enrollment-aware ManagedAppsOnly behavior.
  • Adds integration coverage for both enrollment types.
  • Documents the user-visible fix.
File summaries
File Summary
server/service/integration_vpp_install_test.go Tests inventory results for manual and automatic enrollment.
server/service/apple_mdm_cmd_results.go Applies enrollment-aware app refetching.
Review details

Files excluded by content exclusion policy (1)

  • changes/52701-byod-idevice-managed-apps-only
  • Files reviewed: 2/3 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 28c41f42-7eac-409d-a2a8-59cb5ec96d64

📥 Commits

Reviewing files that changed from the base of the PR and between df58d14 and bd3bcd0.

📒 Files selected for processing (3)
  • changes/52701-byod-idevice-managed-apps-only
  • server/service/apple_mdm_cmd_results.go
  • server/service/integration_vpp_install_test.go

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.


Walkthrough

The refetch-after-verification handler now reads the host MDM enrollment state and passes !InstalledFromDEP to InstalledApplicationList. This restricts application inventory to managed apps for manually enrolled BYOD iOS and iPadOS devices. A new integration test covers manual and DEP enrollment and verifies both the command flag and resulting inventory. A changelog entry documents the fix.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to bd3bc

No concrete merge-blocking risk was established for this change.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: limiting BYOD iDevice inventory to managed apps.
Description check ✅ Passed The description identifies the related issue, explains the behavior change, documents the changes file, automated tests, manual QA results, and AI usage. It is sufficiently complete for this backend b…
Linked Issues check ✅ Passed The change satisfies #52701. In server/service/apple_mdm_cmd_results.go, the post-install refetch now reads InstalledFromDEP and passes !hostMDM.InstalledFromDEP to InstalledApplicationList. M…
Out of Scope Changes check ✅ Passed The changed production code directly fixes the linked issue's post-install refetch path. The new integration test verifies the required manual and automatic enrollment behavior. The changelog entry do…
Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-52701-byod-idevice-apps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Sep 11, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 76.05%. Comparing base (878c8ec) to head (bd3bcd0).
⚠️ Report is 26 commits behind head on main.

Files with missing lines Patch % Lines
server/service/apple_mdm_cmd_results.go 80.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #53028      +/-   ##
==========================================
+ Coverage   76.03%   76.05%   +0.01%     
==========================================
  Files        4120     4120              
  Lines      249738   249804      +66     
  Branches    14436    14436              
==========================================
+ Hits       189896   189979      +83     
+ Misses      59665    59648      -17     
  Partials      177      177              
Flag Coverage Δ
backend 77.69% <80.00%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

return ctxerr.Wrap(ctx, err, "request refetch for host after vpp install verification")
}
default:
hostMDM, err := ds.GetHostMDMCheckinInfo(ctx, installedAppResult.HostUUID())

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it maybe be better to use host_mdm.is_personal_enrollment rather than host_mdm.installed_from_dep here?
Example from claude:

--- a/server/service/apple_mdm_cmd_results.go
+++ b/server/service/apple_mdm_cmd_results.go
@@ -264,12 +264,14 @@
 					return ctxerr.Wrap(ctx, err, "request refetch for host after vpp install verification")
 				}
 			default:
-				hostMDM, err := ds.GetHostMDMCheckinInfo(ctx, installedAppResult.HostUUID())
+				var hostMDM *fleet.HostMDM
+				hostMDM, err = ds.GetHostMDM(ctx, hostID)
 				if err != nil {
-					return ctxerr.Wrap(ctx, err, "get host mdm info to refetch apps")
+					return ctxerr.Wrap(ctx, err, "get host mdm info to refetch apps")
 				}
-				// BYOD devices are only queried for managed apps.
-				isBYOD := !hostMDM.InstalledFromDEP
+				// Personal (BYOD) devices are only asked for managed apps.
+				managedAppsOnly := hostMDM.IsPersonalEnrollment
 
 				// Track before enqueueing so a fast device ack can't race the
 				// insert and leave an orphaned row; on enqueue failure nothing
@@ -275,7 +282,7 @@
 					return ctxerr.Wrap(ctx, err, "add host mdm commands")
 				}
 
-				err = commander.InstalledApplicationList(ctx, []string{installedAppResult.HostUUID()}, fleet.RefetchAppsCommandUUID(), isBYOD)
+				err = commander.InstalledApplicationList(ctx, []string{installedAppResult.HostUUID()}, fleet.RefetchAppsCommandUUID(), managedAppsOnly)
 				if err != nil {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They differ only for On (manual) company-owned hosts, which #52701 covers too, so switching fails the test. The cron and Refetch button both use !installed_from_dep; I think #52885 is where this changes.

@jkatz01 jkatz01 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like we'll only want to make manual (company owned) report the complete inventory in #52885, so determining from host_mdm.installed_from_dep sounds good.

@cdcme
cdcme merged commit 0086d7f into main Sep 15, 2026
69 of 71 checks passed
@cdcme
cdcme deleted the fix-52701-byod-idevice-apps branch September 15, 2026 15:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fleet reports non-managed apps on BYOD iOS and iPadOS hosts

3 participants