Install in-house apps during iOS/iPadOS setup experience

changes/33995-ipa-setup-experience

@@ -0,0 +1 @@
+- Added support for automatically installing in-house apps (`.ipa`) on iOS and iPadOS hosts when they enroll into Fleet.

cmd/fleet/cron.go

@@ -1272,6 +1272,7 @@ func newAppleMDMWorkerSchedule(
 	commander *apple_mdm.MDMAppleCommander,
 	bootstrapPackageStore fleet.MDMBootstrapPackageStore,
 	vppInstaller fleet.AppleMDMVPPInstaller,
+	inHouseAppInstaller worker.InHouseAppInstaller,
 	newActivityFn fleet.NewActivityFunc,
 ) (*schedule.Schedule, error) {
 	const (
@@ -1290,6 +1291,7 @@ func newAppleMDMWorkerSchedule(
 		Commander:             commander,
 		BootstrapPackageStore: bootstrapPackageStore,
 		VPPInstaller:          vppInstaller,
+		InHouseAppInstaller:   inHouseAppInstaller,
 		NewActivityFn:         newActivityFn,
 	}
 

cmd/fleet/cron_registration.go

@@ -215,7 +215,7 @@ func registerWorkerCrons(ctx context.Context, deps cronSchedulesDeps) {
 func registerMDMCrons(ctx context.Context, deps cronSchedulesDeps) {
 	deps.register("failed to register apple_mdm_worker schedule", func() (fleet.CronSchedule, error) {
 		vppInstaller := deps.svc.(fleet.AppleMDMVPPInstaller)
-		return newAppleMDMWorkerSchedule(ctx, deps.instanceID, deps.ds, deps.logger, deps.commander, deps.bootstrapPackageStore, vppInstaller, deps.svc.NewActivity)
+		return newAppleMDMWorkerSchedule(ctx, deps.instanceID, deps.ds, deps.logger, deps.commander, deps.bootstrapPackageStore, vppInstaller, deps.svc, deps.svc.NewActivity)
 	})
 
 	deps.register("failed to register apple_mdm_dep_profile_assigner schedule", func() (fleet.CronSchedule, error) {

ee/server/service/setup_experience.go

@@ -412,6 +412,17 @@ func (svc *Service) SetupExperienceNextStep(ctx context.Context, host *fleet.Hos
 					return false, ctxerr.Wrap(ctx, err, "updating setup experience with vpp install command uuid")
 				}
 			}
+		case sw.InHouseAppID != nil:
+			// In-house apps only install during setup experience on iOS/iPadOS,
+			// which is driven in one pass by the worker and never reaches this
+			// poll-driven flow. Fail the item instead of letting it fall through
+			// the switch silently and stall the queue.
+			sw.Status = fleet.SetupExperienceStatusFailure
+			sw.Error = new("In-house apps can only be installed during setup experience on iOS and iPadOS.")
+			if err := svc.ds.UpdateSetupExperienceStatusResult(ctx, sw); err != nil {
+				return false, ctxerr.Wrap(ctx, err, "updating setup experience status result to failure")
+			}
+			svc.logger.ErrorContext(ctx, "unexpected in-house app setup experience item in poll-driven flow", "status_id", sw.ID)
 		}
 	case softwareRunning == 0 && len(scriptsPending) > 0:
 		// enqueue scripts

ee/server/service/software_installers.go

@@ -1749,7 +1749,8 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 			}
 			switch err := svc.precheckAppConfigResolvable(ctx, host, cfg); {
 			case errors.Is(err, apple_mdm.ErrUnresolvableAppConfigVar):
-				return svc.recordFailedInHouseInstall(ctx, host.ID, iha.InstallerID, opts, unresolvableAppConfigFailureReason(err))
+				_, err := svc.recordFailedInHouseInstall(ctx, host.ID, iha.InstallerID, opts, unresolvableAppConfigFailureReason(err))
+				return err
 			case err != nil:
 				return ctxerr.Wrap(ctx, err, "pre-flight substitute fleet variables in in-house app configuration")
 			}
@@ -1961,19 +1962,50 @@ func (svc *Service) recordFailedVPPInstall(ctx context.Context, host *fleet.Host
 }
 
 // recordFailedInHouseInstall is the in-house (.ipa) counterpart of
-// recordFailedVPPInstall.
-func (svc *Service) recordFailedInHouseInstall(ctx context.Context, hostID, inHouseAppID uint, opts fleet.HostSoftwareInstallOptions, reason string) error {
+// recordFailedVPPInstall. Like it, the setup-experience driver needs an error
+// signal to transition the step to Failure, so ForSetupExperience returns a
+// *fleet.PreflightInstallFailedError (see that type's doc).
+func (svc *Service) recordFailedInHouseInstall(ctx context.Context, hostID, inHouseAppID uint, opts fleet.HostSoftwareInstallOptions, reason string) (string, error) {
 	cmdUUID := uuid.NewString()
 	user, act, err := svc.ds.RecordFailedInHouseAppInstall(ctx, hostID, inHouseAppID, cmdUUID, reason, opts)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "record failed in-house install")
+		return "", ctxerr.Wrap(ctx, err, "record failed in-house install")
 	}
 	if act != nil {
 		if err := svc.NewActivity(ctx, user, act); err != nil {
-			return ctxerr.Wrap(ctx, err, "create activity for failed in-house install")
+			return "", ctxerr.Wrap(ctx, err, "create activity for failed in-house install")
 		}
 	}
-	return nil
+	if opts.ForSetupExperience {
+		return cmdUUID, &fleet.PreflightInstallFailedError{Reason: reason}
+	}
+	return cmdUUID, nil
+}
+
+// InstallInHouseAppForSetupExperience enqueues an in-house app (.ipa) install
+// for a host held in Setup Assistant. Unlike the manual install path above, it
+// deliberately skips IsInHouseAppLabelScoped: labels don't apply during setup
+// experience for any software type, and a freshly-enrolled host has no
+// computed label membership yet anyway.
+func (svc *Service) InstallInHouseAppForSetupExperience(ctx context.Context, host *fleet.Host, inHouseAppID uint, softwareTitleID uint) (string, error) {
+	opts := fleet.HostSoftwareInstallOptions{SelfService: false, ForSetupExperience: true}
+
+	cfg, err := svc.ds.GetInHouseAppConfiguration(ctx, inHouseAppID)
+	if err != nil && !fleet.IsNotFound(err) {
+		return "", ctxerr.Wrap(ctx, err, "get in-house app configuration for pre-flight check")
+	}
+	switch err := svc.precheckAppConfigResolvable(ctx, host, cfg); {
+	case errors.Is(err, apple_mdm.ErrUnresolvableAppConfigVar):
+		return svc.recordFailedInHouseInstall(ctx, host.ID, inHouseAppID, opts, unresolvableAppConfigFailureReason(err))
+	case err != nil:
+		return "", ctxerr.Wrap(ctx, err, "pre-flight substitute fleet variables in in-house app configuration")
+	}
+
+	cmdUUID := uuid.NewString()
+	if err := svc.ds.InsertHostInHouseAppInstall(ctx, host.ID, inHouseAppID, softwareTitleID, cmdUUID, opts); err != nil {
+		return "", ctxerr.Wrap(ctx, err, "insert in-house app install for setup experience")
+	}
+	return cmdUUID, nil
 }
 
 func (svc *Service) InstallVPPAppPostValidation(ctx context.Context, host *fleet.Host, vppApp *fleet.VPPApp, token string, opts fleet.HostSoftwareInstallOptions) (string, error) {
@@ -4470,7 +4502,8 @@ func (svc *Service) selfServiceInstallInHouseApp(ctx context.Context, host *flee
 	}
 	switch err := svc.precheckAppConfigResolvable(ctx, host, cfg); {
 	case errors.Is(err, apple_mdm.ErrUnresolvableAppConfigVar):
-		return svc.recordFailedInHouseInstall(ctx, host.ID, iha.InstallerID, opts, unresolvableAppConfigFailureReason(err))
+		_, err := svc.recordFailedInHouseInstall(ctx, host.ID, iha.InstallerID, opts, unresolvableAppConfigFailureReason(err))
+		return err
 	case err != nil:
 		return ctxerr.Wrap(ctx, err, "pre-flight substitute fleet variables in in-house app configuration")
 	}

server/datastore/mysql/setup_experience.go

@@ -202,6 +202,7 @@ SELECT
 	'pending' AS status,
 	si.id AS software_installer_id,
 	NULL AS vpp_app_team_id,
+	NULL AS in_house_app_id,
 	-- policy_gated: true when the installer has at least one policy whose install-software automation points at it (a gating policy
 	-- used as a gate during setup experience). A policy's software_installer_id already uniquely identifies the installer (and its
 	-- team), so no team check is needed; only gate on Windows/Linux. The specific policy ids are derived from the installer at
@@ -267,6 +268,7 @@ SELECT
 	'pending' AS status,
 	si.id AS software_installer_id,
 	NULL AS vpp_app_team_id,
+	NULL AS in_house_app_id,
 	FALSE AS policy_gated,
 	COALESCE(stdn.display_name, st.name) AS sort_name,
 	st.id AS software_title_id
@@ -303,6 +305,7 @@ SELECT
 	'pending' AS status,
 	NULL AS software_installer_id,
 	vat.id AS vpp_app_team_id,
+	NULL AS in_house_app_id,
 	FALSE AS policy_gated,
 	COALESCE(stdn.display_name, st.name) AS sort_name,
 	st.id AS software_title_id
@@ -330,6 +333,43 @@ AND %s`
 		}
 	}
 
+	// In-house apps (.ipa) install during setup on iOS/iPadOS only. Deliberately
+	// no in_house_app_labels join: labels don't apply during setup (see the
+	// comment on the INSERT below), and a freshly-enrolled host has no computed
+	// label membership yet anyway.
+	if fleetPlatform == "ios" || fleetPlatform == "ipados" {
+		inHouseSelect := `
+SELECT
+	? AS host_uuid,
+	st.name AS name,
+	'pending' AS status,
+	NULL AS software_installer_id,
+	NULL AS vpp_app_team_id,
+	iha.id AS in_house_app_id,
+	FALSE AS policy_gated,
+	COALESCE(stdn.display_name, st.name) AS sort_name,
+	st.id AS software_title_id
+FROM in_house_apps iha
+INNER JOIN software_titles st
+	ON iha.title_id = st.id
+LEFT JOIN software_title_display_names stdn
+	ON stdn.software_title_id = st.id AND stdn.team_id = ?
+WHERE iha.install_during_setup = true
+AND iha.global_or_team_id = ?
+AND iha.platform = ?
+AND %s`
+		if resetFailedSetupSteps {
+			inHouseSelect = fmt.Sprintf(inHouseSelect, "iha.id NOT IN (SELECT in_house_app_id FROM setup_experience_status_results WHERE host_uuid = ? AND status = 'success' AND in_house_app_id IS NOT NULL)")
+		} else {
+			inHouseSelect = fmt.Sprintf(inHouseSelect, "TRUE")
+		}
+		softwareUnionParts = append(softwareUnionParts, inHouseSelect)
+		softwareArgs = append(softwareArgs, hostUUID, teamID, teamID, fleetPlatform)
+		if resetFailedSetupSteps {
+			softwareArgs = append(softwareArgs, hostUUID)
+		}
+	}
+
 	var stmtSoftwareCombined string
 	if len(softwareUnionParts) > 0 {
 		// A title can now hold several packages, and more than one can be flagged for setup. Queue only
@@ -342,9 +382,10 @@ INSERT INTO setup_experience_status_results (
 	status,
 	software_installer_id,
 	vpp_app_team_id,
+	in_house_app_id,
 	policy_gated
 )
-SELECT host_uuid, name, status, software_installer_id, vpp_app_team_id, policy_gated FROM (
+SELECT host_uuid, name, status, software_installer_id, vpp_app_team_id, in_house_app_id, policy_gated FROM (
 	SELECT combined.*, ROW_NUMBER() OVER (
 		PARTITION BY software_title_id
 		ORDER BY (software_installer_id IS NULL), software_installer_id ASC
@@ -353,7 +394,7 @@ SELECT host_uuid, name, status, software_installer_id, vpp_app_team_id, policy_g
 	) AS combined
 ) AS deduped
 WHERE software_installer_id IS NULL OR first_added_rank = 1
-ORDER BY sort_name ASC, COALESCE(software_installer_id, vpp_app_team_id, 0)`, strings.Join(softwareUnionParts, " UNION ALL "))
+ORDER BY sort_name ASC, COALESCE(software_installer_id, vpp_app_team_id, in_house_app_id, 0)`, strings.Join(softwareUnionParts, " UNION ALL "))
 	}
 
 	stmtSetupScripts := `
@@ -820,16 +861,18 @@ SELECT
 	sesr.host_software_installs_execution_id,
 	sesr.vpp_app_team_id,
 	sesr.nano_command_uuid,
+	sesr.in_house_app_id,
 	sesr.setup_experience_script_id,
 	sesr.script_execution_id,
 	sesr.policy_gated,
 	NULLIF(va.adam_id, '') AS vpp_app_adam_id,
 	NULLIF(va.platform, '') AS vpp_app_platform,
 	ses.script_content_id,
-	COALESCE(si.title_id, COALESCE(va.title_id, NULL)) AS software_title_id,
+	COALESCE(si.title_id, va.title_id, iha.title_id) AS software_title_id,
 	COALESCE(
 		(SELECT source FROM software_titles WHERE id = si.title_id),
-		(SELECT source FROM software_titles WHERE id = va.title_id)
+		(SELECT source FROM software_titles WHERE id = va.title_id),
+		(SELECT source FROM software_titles WHERE id = iha.title_id)
 	) AS source,
     CASE
         WHEN hsi.execution_status = 'failed_install' THEN
@@ -849,6 +892,7 @@ LEFT JOIN host_software_installs hsi ON hsi.execution_id = sesr.host_software_in
 LEFT JOIN host_script_results hsr ON hsr.execution_id = sesr.script_execution_id
 LEFT JOIN vpp_apps_teams vat ON vat.id = sesr.vpp_app_team_id
 LEFT JOIN vpp_apps va ON vat.adam_id = va.adam_id AND vat.platform = va.platform
+LEFT JOIN in_house_apps iha ON iha.id = sesr.in_house_app_id
 WHERE host_uuid = ?
 ORDER BY sesr.id
 	`

server/datastore/mysql/setup_experience_test.go

@@ -44,6 +44,7 @@ func TestSetupExperience(t *testing.T) {
 		{"CrossPlatformPyScripts", testSetupExperienceCrossPlatformPyScripts},
 		{"FirstAddedPerTitleNoDoubleQueue", testEnqueueSetupExperienceFirstAddedPerTitle},
 		{"InHouseApps", testSetupExperienceInHouseApps},
+		{"EnqueueInHouseApps", testEnqueueSetupExperienceInHouseApps},
 	}
 
 	for _, c := range cases {
@@ -1373,6 +1374,95 @@ func testSetupExperienceInHouseApps(t *testing.T, ds *Datastore) {
 	require.True(t, fleet.IsNotFound(err))
 }
 
+func testEnqueueSetupExperienceInHouseApps(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	// .ipa upload creates iOS and iPadOS rows; select only the iOS one
+	iosAppID, iosTitleID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		TeamID:           &team.ID,
+		UserID:           user1.ID,
+		Title:            "Acme",
+		Filename:         "acme.ipa",
+		BundleIdentifier: "com.acme.app",
+		StorageID:        "acme-storage",
+		Platform:         string(fleet.IOSPlatform),
+		Extension:        "ipa",
+		Version:          "1.0",
+		ValidatedLabels:  &fleet.LabelIdentsWithScope{},
+	})
+	require.NoError(t, err)
+	err = ds.SetSetupExperienceSoftwareTitles(ctx, "ios", team.ID, []uint{iosTitleID})
+	require.NoError(t, err)
+
+	iphone, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:       "iphone-test",
+		OsqueryHostID:  new("osquery-iphone"),
+		NodeKey:        new("node-key-iphone"),
+		UUID:           "iphone-uuid",
+		Platform:       "ios",
+		HardwareSerial: "serial-iphone",
+		TeamID:         &team.ID,
+	})
+	require.NoError(t, err)
+	_, err = ds.NewHost(ctx, &fleet.Host{
+		Hostname:       "ipad-test",
+		OsqueryHostID:  new("osquery-ipad"),
+		NodeKey:        new("node-key-ipad"),
+		UUID:           "ipad-uuid",
+		Platform:       "ipados",
+		HardwareSerial: "serial-ipad",
+		TeamID:         &team.ID,
+	})
+	require.NoError(t, err)
+
+	// give the app an include-any label the host does not match, so
+	// IsInHouseAppLabelScoped rejects the host; setup experience must still
+	// enqueue the app — labels don't apply during setup. This assertion fails
+	// if a label join is ever reintroduced in the enqueue query.
+	label, err := ds.NewLabel(ctx, &fleet.Label{Name: "no-members"})
+	require.NoError(t, err)
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx,
+			`INSERT INTO in_house_app_labels (in_house_app_id, label_id, exclude) VALUES (?, ?, 0)`, iosAppID, label.ID)
+		return err
+	})
+	scoped, err := ds.IsInHouseAppLabelScoped(ctx, iosAppID, iphone.ID)
+	require.NoError(t, err)
+	require.False(t, scoped, "precondition: the host must be out of label scope for this test to be meaningful")
+
+	// enrolling iPhone gets exactly one item, the in-house app
+	enqueued, err := ds.EnqueueSetupExperienceItems(ctx, "ios", "ios", "iphone-uuid", team.ID)
+	require.NoError(t, err)
+	require.True(t, enqueued)
+	results, err := ds.ListSetupExperienceResultsByHostUUID(ctx, "iphone-uuid", team.ID)
+	require.NoError(t, err)
+	require.Len(t, results, 1)
+	require.NotNil(t, results[0].InHouseAppID)
+	require.Equal(t, iosAppID, *results[0].InHouseAppID)
+	require.True(t, results[0].IsForInHouseApp())
+	require.True(t, results[0].IsForSoftware())
+	require.Equal(t, fleet.SetupExperienceStatusPending, results[0].Status)
+	require.NotNil(t, results[0].SoftwareTitleID)
+	require.Equal(t, iosTitleID, *results[0].SoftwareTitleID)
+	require.NotNil(t, results[0].Source)
+	require.Equal(t, "ios_apps", *results[0].Source)
+	awaitingConfig, err := ds.GetHostAwaitingConfiguration(ctx, "iphone-uuid")
+	require.NoError(t, err)
+	require.True(t, awaitingConfig)
+
+	// enrolling iPad gets nothing: only the iOS sibling is selected
+	enqueued, err = ds.EnqueueSetupExperienceItems(ctx, "ipados", "ipados", "ipad-uuid", team.ID)
+	require.NoError(t, err)
+	require.False(t, enqueued)
+	results, err = ds.ListSetupExperienceResultsByHostUUID(ctx, "ipad-uuid", team.ID)
+	require.NoError(t, err)
+	require.Empty(t, results)
+}
+
 func testSetSetupExperienceTitles(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 	test.CreateInsertGlobalVPPToken(t, ds)

server/fleet/service.go

@@ -805,6 +805,10 @@ type Service interface {
 	// InstallVPPAppPostValidation installs a VPP app, assuming that GetVPPTokenIfCanInstallVPPApps has passed and provided a VPP token
 	InstallVPPAppPostValidation(ctx context.Context, host *Host, vppApp *VPPApp, token string, opts HostSoftwareInstallOptions) (string, error)
 
+	// InstallInHouseAppForSetupExperience validates the in-house app's managed configuration for the
+	// host and enqueues its InstallApplication command during setup experience, returning the command UUID.
+	InstallInHouseAppForSetupExperience(ctx context.Context, host *Host, inHouseAppID uint, softwareTitleID uint) (string, error)
+
 	// UninstallSoftwareTitle uninstalls a software title in the given host.
 	UninstallSoftwareTitle(ctx context.Context, hostID uint, softwareTitleID uint) error