fix(adhoc-sweep-fixes): CU-86akj32d7 21 review findings across 22 files

api/helpers/ensure-trial-license-key.js

@@ -0,0 +1,69 @@
+module.exports = {
+
+
+  friendlyName: 'Ensure trial license key',
+
+
+  description: 'Generate and persist a Fleet Premium trial license key for the given user if they do not already have one.',
+
+
+  inputs: {
+
+    user: {
+      type: 'ref',
+      description: 'The logged-in user record (this.req.me) to check and possibly update.',
+      required: true,
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      outputDescription: 'The trial license key for this user, along with whether it is expired.',
+      outputType: {
+        trialLicenseKey: 'string',
+        userHasExpiredTrialLicense: 'boolean',
+      }
+    }
+
+  },
+
+
+  fn: async function ({user}) {
+
+    let userHasExpiredTrialLicense = false;
+    let trialLicenseKey;
+
+    if(user.fleetPremiumTrialLicenseKey) {
+      if(user.fleetPremiumTrialLicenseKeyExpiresAt < Date.now()) {
+        userHasExpiredTrialLicense = true;
+      }
+      trialLicenseKey = user.fleetPremiumTrialLicenseKey;
+    } else {
+      // If this user does not have a trial license key, generate a new one for them.
+      let thirtyDaysFromNowAt = Date.now() + (1000 * 60 * 60 * 24 * 30);
+      let trialLicenseKeyForThisUser = await sails.helpers.createLicenseKey.with({
+        numberOfHosts: 10,
+        organization: user.organization ? user.organization : 'Fleet Premium trial',
+        expiresAt: thirtyDaysFromNowAt,
+      });
+      // Save the trial license key to the DB record for this user.
+      await User.updateOne({id: user.id})
+      .set({
+        fleetPremiumTrialLicenseKey: trialLicenseKeyForThisUser,
+        fleetPremiumTrialLicenseKeyExpiresAt: thirtyDaysFromNowAt,
+      });
+      trialLicenseKey = trialLicenseKeyForThisUser;
+    }
+
+    return {
+      trialLicenseKey,
+      userHasExpiredTrialLicense,
+    };
+
+  }
+
+
+};

assets/scripts/install-wine.sh

@@ -26,4 +26,5 @@ have caused repeated breakage.
 
 EOF
 
-exit 1
+exit 0
+

cmd/fleetctl/fleetctl/goquerycmd/goquery.go

@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"strconv"
+	"sync"
 
 	"github.com/AbGuthrie/goquery/v2"
 	gqconfig "github.com/AbGuthrie/goquery/v2/config"
@@ -26,6 +27,7 @@ type activeQuery struct {
 
 type goqueryClient struct {
 	client       *service.Client
+	mu           sync.Mutex
 	queryCounter int
 	queries      map[string]activeQuery
 	// goquery passes the UUID, while we need the hostname (or ID) to
@@ -62,7 +64,9 @@ func (c *goqueryClient) CheckHost(query string) (gqhosts.Host, error) {
 		return gqhosts.Host{}, fmt.Errorf("host %s not found", query)
 	}
 
+	c.mu.Lock()
 	c.hostnameByUUID[host.UUID] = host.Hostname
+	c.mu.Unlock()
 
 	return gqhosts.Host{
 		UUID:         host.UUID,
@@ -73,32 +77,41 @@ func (c *goqueryClient) CheckHost(query string) (gqhosts.Host, error) {
 }
 
 func (c *goqueryClient) ScheduleQuery(uuid, query string) (string, error) {
+	c.mu.Lock()
 	c.queryCounter++
 	queryName := strconv.Itoa(c.queryCounter)
 
 	hostname, ok := c.hostnameByUUID[uuid]
 	if !ok {
+		c.mu.Unlock()
 		return "", errors.New("could not lookup host")
 	}
+	c.mu.Unlock()
 
 	res, err := c.client.LiveQuery(query, nil, []string{}, []string{hostname})
 	if err != nil {
 		return "", err
 	}
 
+	c.mu.Lock()
 	c.queries[queryName] = activeQuery{status: "Pending"}
+	c.mu.Unlock()
 
 	// We need to start a separate thread due to goquery expecting
 	// scheduling a query and retrieving results to be separate
 	// operations.
 	go func() {
 		select {
 		case hostResult := <-res.Results():
+			c.mu.Lock()
 			c.queries[queryName] = activeQuery{status: "Completed", results: hostResult.Rows}
+			c.mu.Unlock()
 
 			// Print an error
 		case err := <-res.Errors():
+			c.mu.Lock()
 			c.queries[queryName] = activeQuery{status: "error: " + err.Error()}
+			c.mu.Unlock()
 		}
 	}()
 
@@ -107,7 +120,9 @@ func (c *goqueryClient) ScheduleQuery(uuid, query string) (string, error) {
 }
 
 func (c *goqueryClient) FetchResults(queryName string) (gqmodels.Rows, string, error) {
+	c.mu.Lock()
 	res, ok := c.queries[queryName]
+	c.mu.Unlock()
 	if !ok {
 		return nil, "", fmt.Errorf("Unknown query %s", queryName)
 	}

ee/maintained-apps/inputs/homebrew/scripts/gpg-suite-uninstall.sh

@@ -134,7 +134,7 @@ remove_receipt_files() {
   fi
 
   echo "sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | tr '\\\\n' '\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf"
-  sudo pkgutil --only-files --files "$PKGID" | sed "s|^|/${INSTALL_LOCATION}/|" | tr '\n' '\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf
+  sudo pkgutil --only-files --files "$PKGID" | sed "s|^|${FULL_INSTALL_LOCATION}/|" | tr '\n' '\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf
 
   echo "sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\\\n' '\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf"
   sudo pkgutil --only-dirs --files "$PKGID" | sed "s|^|${FULL_INSTALL_LOCATION}/|" | grep '\.app$' | tr '\n' '\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf

ee/maintained-apps/inputs/homebrew/scripts/zoom_install.sh

@@ -33,10 +33,16 @@ quit_application() {
 
 restart_zoom() {
   local console_user="$1"
-  
+
   if [[ -n "$console_user" && "$console_user" != "root" ]]; then
     echo "Restarting Zoom for user: $console_user"
-    sudo -u "$console_user" open -a "zoom.us"
+    local console_uid
+    console_uid=$(id -u "$console_user" 2>/dev/null || echo "")
+    if [[ -n "$console_uid" ]]; then
+      launchctl asuser "$console_uid" sudo -u "$console_user" open -a "zoom.us"
+    else
+      sudo -u "$console_user" open -a "zoom.us"
+    fi
   else
     echo "No console user found, attempting direct Zoom start..."
     open -a "zoom.us"

ee/vulnerability-dashboard/api/helpers/get-compliance-information.js

@@ -90,7 +90,6 @@ module.exports = {
         }
         operatingSystemsInUse.push(osInfo);
       }
-      complianceInformation.versionsInUse = _.sortByOrder(complianceInformation.versionsInUse, 'sortByName');
 
       let numberOfHostsToReport = await Host.count({teamApid: teamApid});
       let numberOfHostsOnThisTeamWithACompliantOs = await Host.count({operatingSystem: {in: idsOfCompliantOperatingSystems}, teamApid: teamApid});
@@ -264,3 +263,4 @@ module.exports = {
 
 };
 
+

frontend/components/ActionsDropdown/ActionsDropdown.tests.tsx

@@ -10,9 +10,7 @@ const DROPDOWN_OPTIONS = [
   { disabled: true, label: "Delete", value: "delete-query" },
 ];
 const PLACEHOLDER = "Actions";
-const ON_CHANGE = (value: string) => {
-  console.log(value);
-};
+const ON_CHANGE = () => {};
 
 describe("Actions dropdown", () => {
   it("renders dropdown placeholder and options", async () => {

frontend/components/buttons/RevealButton/RevealButton.tests.tsx

@@ -4,8 +4,8 @@ import { renderWithSetup } from "test/test-utils";
 
 import RevealButton from "./RevealButton";
 
-const SHOW_TEXT = "Advanced options";
-const HIDE_TEXT = "Advanced options";
+const SHOW_TEXT = "Show advanced options";
+const HIDE_TEXT = "Hide advanced options";
 const TOOLTIP_CONTENT = "Customize logging type and platforms";
 
 describe("Reveal button", () => {

frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx

@@ -144,6 +144,7 @@ const AddCertModal = ({
         nameEquals: "subject_alternative_name",
       });
       const nameConflict = getErrorReason(e, {
+        nameEquals: "name",
         reasonIncludes: "already exists",
       });
       if (sanReason) {
@@ -253,3 +254,4 @@ const AddCertModal = ({
 };
 
 export default AddCertModal;
+

frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx

@@ -55,7 +55,7 @@ const getPlatformMessage = (isAppStoreApp: boolean, isAndroidApp: boolean) => {
       </p>
       <p>
         Pending installs and uninstalls will be canceled. If they have already
-        started, they won&apos; be canceled, and the results won&apos;t appear
+        started, they won&apos;t be canceled, and the results won&apos;t appear
         in Fleet.
       </p>
     </>

schema/tables/alf_explicit_auths.yml

@@ -4,8 +4,9 @@ examples: |-
   useful when looking to see if vulnerable software is exposed to networks. 
 
   ```
-  SELECT * FROM alf_exceptions;
+  SELECT * FROM alf_explicit_auths;
   ```
 notes: This table is currently affected by a
   [bug](https://github.com/osquery/osquery/issues/2322) and not returning
   applications visible in the preferences interface.
+

schema/tables/load_average.yml

@@ -3,5 +3,6 @@ examples: |-
   Find computers with a load average of 3.5 or higher over the last 15 minutes.
 
   ```
-  SELECT average from load_average WHERE period='15m' AND average|-=3.5;
+  SELECT average from load_average WHERE period='15m' AND average>=3.5;
   ```
+

server/datastore/mysql/migrations/tables/20250904091745_AddCertificateAuthoritiesTable_test.go

@@ -4,7 +4,6 @@ import (
 	"crypto/md5" // nolint:gosec // used only to hash for efficient comparisons
 	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"strings"
 	"testing"
 
@@ -116,7 +115,6 @@ func TestUp_20250904091745(t *testing.T) {
 	if err != nil {
 		t.Fatalf("failed to marshal integrationsJSON: %v", err)
 	}
-	fmt.Printf("Marshalled integrations_json: %s\n", string(integrationJSONBytes))
 
 	insertNDESPasswordStmt := `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES (?, ?, UNHEX(?))` // nolint:gosec // just test data, not hardcoded credentials
 	_, err = db.Exec(insertNDESPasswordStmt, fleet.MDMAssetNDESPassword, ndesEncryptedPassword, md5ChecksumBytes(ndesEncryptedPassword))

server/datastore/mysql/teams_test.go

@@ -157,7 +157,7 @@ func testTeamsGetSetDelete(t *testing.T, ds *Datastore) {
 					      mdm_apple_configuration_profiles (profile_uuid, team_id, identifier, name, mobileconfig, checksum)
 				     VALUES (?, ?, ?, ?, ?, ?)`,
 					fmt.Sprintf("uuid_%s", tt.name),
-					0,
+					team.ID,
 					fmt.Sprintf("TestPayloadIdentifier_%s", tt.name),
 					fmt.Sprintf("TestPayloadName_%s", tt.name),
 					`<?xml version="1.0"`,
@@ -169,14 +169,14 @@ func testTeamsGetSetDelete(t *testing.T, ds *Datastore) {
 				_, err = q.ExecContext(context.Background(), `
 								  INSERT INTO
 								      mdm_windows_configuration_profiles (team_id, name, syncml, profile_uuid)
-								  VALUES (?, ?, ?, ?)`, 0, fmt.Sprintf("TestPayloadName_%s", tt.name), `<?xml version="1.0"`, fmt.Sprintf("uuid_%s", tt.name))
+								  VALUES (?, ?, ?, ?)`, team.ID, fmt.Sprintf("TestPayloadName_%s", tt.name), `<?xml version="1.0"`, fmt.Sprintf("uuid_%s", tt.name))
 				if err != nil {
 					return err
 				}
 				_, err = q.ExecContext(context.Background(), `
 								  INSERT INTO
 								      mdm_android_configuration_profiles (profile_uuid, team_id, name, raw_json)
-								  VALUES (?, ?, ?, ?)`, fmt.Sprintf("uuid_%s", tt.name), 0, fmt.Sprintf("TestPayloadName_%s", tt.name), `{"foo": "bar"}`)
+								  VALUES (?, ?, ?, ?)`, fmt.Sprintf("uuid_%s", tt.name), team.ID, fmt.Sprintf("TestPayloadName_%s", tt.name), `{"foo": "bar"}`)
 				if err != nil {
 					return err
 				}
@@ -970,7 +970,7 @@ func testTeamConflictsWithName(t *testing.T, ds *Datastore) {
 	// e + combining acute accent).
 	reneeCombined, err := ds.NewTeam(ctx, &fleet.Team{Name: "Renée"})
 	require.NoError(t, err)
-	reneeDecomposed := "Renée" // e + U+0301 COMBINING ACUTE ACCENT
+	reneeDecomposed := "Renée" // e + U+0301 COMBINING ACUTE ACCENT
 	conflict, err = ds.TeamConflictsWithName(ctx, reneeDecomposed, 0)
 	require.NoError(t, err)
 	require.Equal(t, reneeCombined.ID, conflict.ID)

server/mdm/assets/assets_test.go

@@ -225,3 +225,4 @@ func TestABMToken(t *testing.T) {
 	require.True(t, ds.GetAllMDMConfigAssetsByNameFuncInvoked)
 	require.True(t, ds.GetABMTokenByOrgNameFuncInvoked)
 }
+

server/service/conditional_access_microsoft.go

@@ -132,8 +132,7 @@ func (svc *Service) ConditionalAccessMicrosoftConfirm(ctx context.Context) (conf
 
 	getResponse, err := svc.conditionalAccessMicrosoftProxy.Get(ctx, integration.TenantID, integration.ProxyServerSecret)
 	if err != nil {
-		svc.logger.ErrorContext(ctx, "failed to get integration settings from proxy", "err", err)
-		return false, "", nil
+		return false, "", ctxerr.Wrap(ctx, err, "failed to get integration settings from proxy")
 	}
 
 	if !getResponse.SetupDone {

tools/dibble/pkg/seed/vulns.go

@@ -19,11 +19,11 @@ var vulnCSVs embed.FS
 // VulnsOptions configures the vuln seeder. Counts are per-platform; pass 0
 // to skip a platform. DSN is a MySQL connection string.
 type VulnsOptions struct {
-	DSN      string
-	MacOS    int
-	Ubuntu   int
-	Windows  int
-	BatchSiz int
+	DSN       string
+	MacOS     int
+	Ubuntu    int
+	Windows   int
+	BatchSize int
 }
 
 // Vulns writes plausible-looking software rows directly to MySQL so the
@@ -41,8 +41,8 @@ type VulnsOptions struct {
 // from these rows on their own.
 func Vulns(ctx context.Context, log Logger, opt VulnsOptions) Result {
 	res := Result{Entity: "vulns"}
-	if opt.BatchSiz <= 0 {
-		opt.BatchSiz = 500
+	if opt.BatchSize <= 0 {
+		opt.BatchSize = 500
 	}
 
 	dsn, err := mysqlDSN(opt.DSN, true)
@@ -80,7 +80,7 @@ func Vulns(ctx context.Context, log Logger, opt VulnsOptions) Result {
 			res.Errors = append(res.Errors, fmt.Errorf("read %s: %w", p.file, err))
 			continue
 		}
-		if err := insertSoftware(ctx, db, p.platform, rows, p.count, opt.BatchSiz); err != nil {
+		if err := insertSoftware(ctx, db, p.platform, rows, p.count, opt.BatchSize); err != nil {
 			res.Errors = append(res.Errors, fmt.Errorf("insert %s: %w", p.platform, err))
 			continue
 		}