Return an error when refetching an Android host

[Dhvanit41]

Related issue: Resolves #50882

POST /api/v1/fleet/hosts/:id/refetch returned 200 for Android hosts and flagged them for refetch, even though an Android host will never act on that flag.

Android hosts report their data through AMAPI and run neither osquery nor Apple MDM. refetch_requested is only cleared in two places — the osquery detail query path (server/service/osquery.go) and the Apple MDM DeviceInformation response (server/service/apple_mdm.go) — so once set on an Android host it stayed true permanently. The API therefore reported a refetch as pending indefinitely on a host that will never perform one.

The Host details page already disables the Refetch button for Android hosts and explains why (#50001), so this returns the same explanation to API callers:

400 Bad Request
Refetch is not supported for Android hosts. Android hosts sync data automatically when it changes.

Changes

• server/service/hosts.go — reject refetch for Android hosts in RefetchHost, after the authorization check and before the refetch_requested write, so the flag is never set.
• server/service/hosts_test.go — regression test asserting the error and that UpdateHostRefetchRequested is not called.
• docs/REST API/rest-api.md — document the Android behavior on the "Refetch host" endpoint.

Notes for the reviewer

• I used fleet.BadRequestError (400) to match fleet.ValidateAndroidWipeRequest, the closest existing precedent for an action that isn't supported on a given platform. Happy to switch to NewInvalidArgumentError (422) or adjust the wording if the group prefers something else.

• The device-authenticated route (POST /device/{token}/refetch) is left alone, because none of its three authentication modes can be reached by an Android host:

  • AuthnDeviceURL — AuthenticateIDeviceByURL explicitly rejects any platform that isn't iOS or iPadOS.
  • AuthnDeviceToken — device auth tokens are only issued by orbit/fleetd and conditional access, and Android hosts run neither.
  • AuthnDeviceCertificate — resolves the host from an MDM SCEP certificate serial, which is part of Apple MDM enrollment.

  Guarding that path would add a host lookup to a route an Android host can't reach.

• The background callers of refetch_requested (calendar cron, apple_mdm.go, orbit.go) write through the datastore directly rather than RefetchHost, so they are unaffected.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• Added/updated automated tests

• QA'd all new/changed functionality manually

On the manual QA box: I verified this with automated tests rather than against a live Android host, since I don't have an Android Enterprise environment to enroll one. TestRefetchHostAndroidNotSupported fails with the fix reverted (returns nil instead of an error, i.e. the reported 200), so it reproduces the reported behavior. I also checked that no existing integration test refetches an Android host — the refetch tests that assert 200 use Linux hosts (createHosts defaults to debian/rhel/linux) or iOS/iPadOS hosts. Confirmation against a real enrolled Android device from someone with that setup would be welcome.

Summary by CodeRabbit

• Bug Fixes
  • Refetch requests for Android hosts now return a clear 400 bad-request response instead of indicating success.
  • The response explains that Android hosts synchronize automatically, preventing misleading refetch actions.
  • Android host refetch requests no longer update the refetch status when rejected.
• Documentation
  • Documented the updated Android host refetch behavior and expected API response.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 50870be4-5c0f-4307-9665-a31fe2bb805a

📥 Commits

Reviewing files that changed from the base of the PR and between 676e1a6 and 7f41ac8.

📒 Files selected for processing (1)

• server/service/hosts_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• server/service/hosts_test.go

---

Walkthrough

RefetchHost now returns a 400 bad-request error for Android hosts. The error states that Android hosts synchronize automatically through AMAPI. The handler does not schedule a refetch or update the refetch flag. Tests verify the error and the absence of the datastore update. The changelog documents this behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation meets issue #50882 by rejecting Android refetch requests with an explanatory error and preventing the flag update.
Out of Scope Changes check	✅ Passed	The code, regression test, changes file, and REST API documentation directly support the linked issue and stated objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly and concisely describes the main change: returning an error when an Android host refetch is requested.
Description check	✅ Passed	The description identifies the issue, explains the behavior, documents the changes, links the issue, and records automated testing and manual QA limitations.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.64%. Comparing base (5dd3f36) to head (7f41ac8).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #51119      +/-   ##
==========================================
- Coverage   68.65%   68.64%   -0.01%     
==========================================
  Files        3995     3995              
  Lines      257616   257620       +4     
  Branches    13802    13802              
==========================================
- Hits       176855   176851       -4     
- Misses      65028    65036       +8     
  Partials    15733    15733              

Flag	Coverage Δ
backend	69.74% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.