From 9924773e4ddba55abfadcfdf4b6c5c2451dd2e6b Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:38:25 +0000
Subject: [PATCH] fix(OPENFRAM-010-2): 4 review findings in
 20250731151000_EnforceFileVaultAtLogin.go

---
 .../20250731151000_EnforceFileVaultAtLogin.go | 33 ++++++++++++++++---
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/server/datastore/mysql/migrations/tables/20250731151000_EnforceFileVaultAtLogin.go b/server/datastore/mysql/migrations/tables/20250731151000_EnforceFileVaultAtLogin.go
index 229ba5948b4..174813f5ec3 100644
--- a/server/datastore/mysql/migrations/tables/20250731151000_EnforceFileVaultAtLogin.go
+++ b/server/datastore/mysql/migrations/tables/20250731151000_EnforceFileVaultAtLogin.go
@@ -11,7 +11,7 @@ import (
 )
 
 func init() {
-	MigrationClient.AddMigration(Up_20250723111413, Down_20250723111413)
+	MigrationClient.AddMigration(Up_20250731151000, Down_20250731151000)
 }
 
 // enforceFileVaultAtLogin is used to set
@@ -31,6 +31,7 @@ func enforceFileVaultAtLogin(original []byte) ([]byte, error) {
 		return nil, errors.New("failed to access PayloadContent element")
 	}
 
+	found := false
 	for _, c := range payloadContent {
 		payload, ok := c.(map[string]interface{})
 		if !ok {
@@ -39,9 +40,14 @@ func enforceFileVaultAtLogin(original []byte) ([]byte, error) {
 
 		if payload["PayloadType"] == "com.apple.MCX.FileVault2" {
 			payload["DeferForceAtUserLoginMaxBypassAttempts"] = 0
+			found = true
 		}
 	}
 
+	if !found {
+		return nil, errors.New("failed to find com.apple.MCX.FileVault2 payload in profile")
+	}
+
 	out, err := plist.MarshalIndent(configuration, "  ")
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal new payload: %w", err)
@@ -50,7 +56,7 @@ func enforceFileVaultAtLogin(original []byte) ([]byte, error) {
 	return out, nil
 }
 
-func Up_20250723111413(tx *sql.Tx) error {
+func Up_20250731151000(tx *sql.Tx) error {
 	// Idempotent migration.
 	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
 
@@ -79,7 +85,7 @@ CREATE TABLE IF NOT EXISTS legacy_host_filevault_profiles (
 		return err
 	}
 
-	_, err = txx.Exec(`
+	res, err := txx.Exec(`
 		INSERT IGNORE INTO legacy_host_filevault_profiles
 			(host_uuid, status, operation_type, profile_uuid, detail, command_uuid, scope, created_at, updated_at)
 		SELECT 
@@ -99,6 +105,25 @@ CREATE TABLE IF NOT EXISTS legacy_host_filevault_profiles (
 		return fmt.Errorf("inserting legacy filevault profile hosts %w", err)
 	}
 
+	legacyRowsAffected, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("getting rows affected for legacy filevault profile hosts insert: %w", err)
+	}
+
+	var legacyHostCount int
+	if err := txx.Get(&legacyHostCount, `
+		SELECT COUNT(*) FROM host_mdm_apple_profiles WHERE profile_identifier = 'com.fleetdm.fleet.mdm.filevault'
+	`); err != nil {
+		return fmt.Errorf("counting host_mdm_apple_profiles filevault rows: %w", err)
+	}
+
+	if legacyHostCount > 0 && legacyRowsAffected == 0 {
+		return fmt.Errorf(
+			"expected to back up %d filevault host profile rows into legacy_host_filevault_profiles but inserted 0",
+			legacyHostCount,
+		)
+	}
+
 	fvProfiles := []struct {
 		ID           uint   `db:"profile_id"`
 		Mobileconfig []byte `db:"mobileconfig"`
@@ -132,6 +157,6 @@ CREATE TABLE IF NOT EXISTS legacy_host_filevault_profiles (
 	return nil
 }
 
-func Down_20250723111413(tx *sql.Tx) error {
+func Down_20250731151000(tx *sql.Tx) error {
 	return nil
 }