Add host name template enforcement pipeline and verification

Relates to #48623

Adds the mdm_apple_profile_manager cron step that resolves each queued
host's name template and enqueues the Settings/DeviceName command,
the DEVNAME- command-result handler, and independent verification with
drift detection at both name-ingestion sites (iOS/iPadOS
DeviceInformation refetch and macOS osquery detail
ingest). Mismatching reports arriving shortly after an acknowledgment
are treated as stale pre-rename reports rather than drift.

Author: juan-fdz-hawa

cmd/fleet/cron.go

@@ -1902,6 +1902,9 @@ func newAppleMDMProfileManagerSchedule(
 		schedule.WithJob("manage_apple_declarations", func(ctx context.Context) error {
 			return service.ReconcileAppleDeclarationsBatched(ctx, ds, commander, logger)
 		}),
+		schedule.WithJob("manage_apple_device_names", func(ctx context.Context) error {
+			return service.ReconcileHostDeviceNames(ctx, ds, commander, logger)
+		}),
 	)
 
 	return s, nil

server/datastore/mysql/apple_device_names.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -76,27 +77,36 @@ func (ds *Datastore) ListHostsPendingDeviceNameCommand(ctx context.Context, limi
 	return pending, nil
 }
 
-func (ds *Datastore) SetHostDeviceNameCommandSent(ctx context.Context, hostUUID, commandUUID, expectedName string) error {
+func (ds *Datastore) SetHostDeviceNameStatus(ctx context.Context, hostUUID string, status fleet.MDMDeliveryStatus, commandUUID *string, expectedName, detail string) error {
+	// commandUUID is bound directly: a non-nil value records the enqueued
+	// command; nil clears it so a result from a previously sent command can't
+	// match this row and overwrite the outcome recorded here.
 	const stmt = `
 		UPDATE host_mdm_apple_device_names
-		SET status = ?, command_uuid = ?, expected_device_name = ?, detail = ''
+		SET status = ?, command_uuid = ?, expected_device_name = ?, detail = ?
 		WHERE host_uuid = ?`
 
-	res, err := ds.writer(ctx).ExecContext(ctx, stmt, fleet.MDMDeliveryPending, commandUUID, expectedName, hostUUID)
+	res, err := ds.writer(ctx).ExecContext(ctx, stmt, status, commandUUID, expectedName, detail, hostUUID)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "set host device name command sent")
+		return ctxerr.Wrap(ctx, err, "set host device name status")
 	}
 	if rows, _ := res.RowsAffected(); rows == 0 {
-		// The row went away between the cron listing it and sending the command
-		// (e.g. the template was cleared). The command's later result will simply
-		// not match any row and be dropped.
-		ds.logger.DebugContext(ctx, "device name command sent but no enforcement row updated", "host_uuid", hostUUID, "command_uuid", commandUUID)
+		// The row went away between the cron listing it and this write (e.g. the
+		// template was cleared); nothing to record. Any command already sent will
+		// simply not match a row when its result arrives and be dropped.
+		ds.logger.DebugContext(ctx, "host device name status set but no enforcement row updated", "host_uuid", hostUUID)
 	}
 	return nil
 }
 
-func (ds *Datastore) UpdateHostDeviceNameStatusFromCommand(ctx context.Context, commandUUID string, status fleet.MDMDeliveryStatus, detail string) (hostUUID string, expectedName string, err error) {
-	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+func (ds *Datastore) UpdateHostDeviceNameStatusFromCommand(ctx context.Context, commandUUID string, acknowledged bool, detail string) error {
+	// The command result is one of exactly two outcomes: acknowledged (the
+	// device applied the rename → verifying) or an error (→ failed).
+	status := fleet.MDMDeliveryFailed
+	if acknowledged {
+		status = fleet.MDMDeliveryVerifying
+	}
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		// The UPDATE is authoritative. A 0-row result means no current row holds
 		// this command UUID: it was superseded by a newer command for the same
 		// host (the row keeps only the latest) or the row was deleted. Either way
@@ -113,51 +123,93 @@ func (ds *Datastore) UpdateHostDeviceNameStatusFromCommand(ctx context.Context,
 			return ctxerr.Wrap(ctx, notFound("HostDeviceNameEnforcement").WithName(commandUUID))
 		}
 
-		// Read back the host and the name we told the device to apply so the
-		// caller can rename the host in Fleet; a plain UPDATE can't return these.
-		// The row is locked by the UPDATE above, so this can't miss.
-		var row struct {
-			HostUUID           string  `db:"host_uuid"`
+		if !acknowledged {
+			// Only an acknowledgment renames the host; error results just record
+			// the failure on the row.
+			return nil
+		}
+
+		// Acknowledged: rename the host in Fleet in this same transaction so the
+		// row transition and the Fleet-side rename are atomic. Join the row to
+		// its host to read the expected name and the fields needed to derive the
+		// display name. The row is locked by the UPDATE above, so this can't miss.
+		var host struct {
+			ID                 uint    `db:"id"`
+			HardwareModel      string  `db:"hardware_model"`
+			HardwareSerial     string  `db:"hardware_serial"`
 			ExpectedDeviceName *string `db:"expected_device_name"`
 		}
 		const selectStmt = `
-			SELECT host_uuid, expected_device_name
-			FROM host_mdm_apple_device_names
-			WHERE command_uuid = ?`
-		if err := sqlx.GetContext(ctx, tx, &row, selectStmt, commandUUID); err != nil {
-			return ctxerr.Wrapf(ctx, err, "get host device name enforcement for command %s", commandUUID)
+			SELECT h.id, h.hardware_model, h.hardware_serial, n.expected_device_name
+			FROM host_mdm_apple_device_names n
+			JOIN hosts h ON h.uuid = n.host_uuid
+			WHERE n.command_uuid = ?`
+		if err := sqlx.GetContext(ctx, tx, &host, selectStmt, commandUUID); err != nil {
+			return ctxerr.Wrapf(ctx, err, "get host to rename for command %s", commandUUID)
 		}
+		// A row only carries a command_uuid when SetHostDeviceNameStatus set it
+		// together with the resolved expected_device_name, so a row matched here by
+		// command_uuid always has a name.
+		name := *host.ExpectedDeviceName
 
-		hostUUID = row.HostUUID
-		if row.ExpectedDeviceName != nil {
-			expectedName = *row.ExpectedDeviceName
+		if _, err := tx.ExecContext(ctx,
+			`UPDATE hosts SET computer_name = ?, hostname = ? WHERE id = ?`, name, name, host.ID); err != nil {
+			return ctxerr.Wrap(ctx, err, "rename host from device name")
+		}
+		displayName := fleet.HostDisplayName(name, name, host.HardwareModel, host.HardwareSerial)
+		if _, err := tx.ExecContext(ctx, `
+			INSERT INTO host_display_names (host_id, display_name) VALUES (?, ?)
+			ON DUPLICATE KEY UPDATE display_name = VALUES(display_name)`, host.ID, displayName); err != nil {
+			return ctxerr.Wrap(ctx, err, "update host display name from device name")
 		}
 		return nil
 	})
-	return hostUUID, expectedName, err
 }
 
-func (ds *Datastore) VerifyHostDeviceName(ctx context.Context, hostUUID, reportedName string) error {
+// deviceNameVerifyGracePeriod is how long after an acknowledgment (the row
+// entered verifying) a mismatching reported name is ignored rather than
+// recorded as drift. A report the agent collected before the device applied the
+// rename can arrive after the acknowledgment carrying the old name; the only
+// staleness is the agent's collect-to-submit latency (seconds), so a small
+// fixed window comfortably covers it. The comparison is entirely against the DB
+// clock (updated_at vs NOW()), so there's no cross-machine skew to pad for.
+const deviceNameVerifyGracePeriod = 60 * time.Second
+
+func (ds *Datastore) UpdateHostDeviceNameStatusFromReport(ctx context.Context, hostUUID, reportedName string) error {
 	// Only rows already awaiting or past verification are reconciled against the
 	// device-reported name: a match confirms the rename (verified), a mismatch
 	// records drift (failed). Rows in any other state and hosts with no row are
 	// left untouched.
+	//
+	// A mismatch on a row acknowledged within the last deviceNameVerifyGracePeriod
+	// is left untouched (false drift; failed rows only recover via an explicit
+	// resend). Rows already verified reached that state through a fresh
+	// post-rename report, so a mismatch there is genuine drift regardless of age.
+	// When the CASEs resolve to the current values, MySQL skips the row write,
+	// preserving updated_at (the grace anchor).
 	const stmt = `
 		UPDATE host_mdm_apple_device_names
 		SET
-			status = CASE WHEN expected_device_name = ? THEN ? ELSE ? END,
-			detail = CASE WHEN expected_device_name = ? THEN '' ELSE ? END
+			status = CASE
+				WHEN expected_device_name = ? THEN ?
+				WHEN status = ? AND updated_at > DATE_SUB(NOW(6), INTERVAL ? SECOND) THEN status
+				ELSE ? END,
+			detail = CASE
+				WHEN expected_device_name = ? THEN ''
+				WHEN status = ? AND updated_at > DATE_SUB(NOW(6), INTERVAL ? SECOND) THEN detail
+				ELSE ? END
 		WHERE host_uuid = ?
 			AND status IN (?, ?)`
 
 	const driftDetail = "Host was renamed on the device and no longer matches the fleet's naming template."
+	graceSeconds := int(deviceNameVerifyGracePeriod.Seconds())
 	if _, err := ds.writer(ctx).ExecContext(ctx, stmt,
-		reportedName, fleet.MDMDeliveryVerified, fleet.MDMDeliveryFailed,
-		reportedName, driftDetail,
+		reportedName, fleet.MDMDeliveryVerified, fleet.MDMDeliveryVerifying, graceSeconds, fleet.MDMDeliveryFailed,
+		reportedName, fleet.MDMDeliveryVerifying, graceSeconds, driftDetail,
 		hostUUID,
 		fleet.MDMDeliveryVerifying, fleet.MDMDeliveryVerified,
 	); err != nil {
-		return ctxerr.Wrap(ctx, err, "verify host device name")
+		return ctxerr.Wrap(ctx, err, "update host device name status from report")
 	}
 	return nil
 }