Self-heal expired dynamic SCEP (NDES) challenges for Apple profiles

[dantecatalfamo]

Related issue: Resolves #46291

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

• Confirmed that the fix is not expected to adversely impact load test results
• Alerted the release DRI if additional load testing is needed

Database migrations

• Checked schema for all modified table for columns that will auto-update timestamps during migration.
• Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
• Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

New Fleet configuration settings

• Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for GitOps-enabled settings:

• Verified that the setting is exported via fleetctl generate-gitops
• Verified the setting is documented in a separate PR to the GitOps documentation
• Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
• Verified that any relevant UI is disabled when GitOps mode is enabled

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

[dantecatalfamo]

@getvictor I'd like to get your feedback on this one

[qodo-free-for-open-source-projects]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: aggregate-result

Failed stage: Check for failures [❌]

Failed test name: main-mysql8.0.44

Failure summary: The action failed because the status aggregation step detected a failed test job: - The status file ./main-mysql8.0.44-status/status contained fail, so the script marked the test main-mysql8.0.44 as failed. - The script then exited with code 1 due to failed_tests being non-empty (❌ One or more test jobs failed: main-mysql8.0.44), which caused the GitHub Action to fail.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 126: Artifact download completed successfully. 127: Extracting artifact entry: /home/runner/work/fleet/fleet/integration-core-mysql8.0.44-status/status 128: Artifact download completed successfully. 129: Extracting artifact entry: /home/runner/work/fleet/fleet/integration-mdm-mysql8.0.44-status/status 130: Extracting artifact entry: /home/runner/work/fleet/fleet/scripts-status/status 131: Extracting artifact entry: /home/runner/work/fleet/fleet/main-mysql8.0.44-status/status 132: Artifact download completed successfully. 133: Artifact download completed successfully. 134: Artifact download completed successfully. 135: Extracting artifact entry: /home/runner/work/fleet/fleet/vuln-mysql8.0.44-status/status 136: Artifact download completed successfully. 137: Extracting artifact entry: /home/runner/work/fleet/fleet/fast-status/status 138: Artifact download completed successfully. 139: Total of 10 artifact(s) downloaded 140: Download artifact has finished successfully 141: ##[group]Run failed_tests="" 142: �[36;1mfailed_tests=""�[0m 143: �[36;1mstatus_count=0�[0m 144: �[36;1m# Find all status files (they are in directories like 'fleetctl-mysql8.0.44-status/status')�[0m 145: �[36;1mfor status_file in $(find ./ -type f -name 'status'); do�[0m 146: �[36;1m status_count=$((status_count + 1))�[0m 147: �[36;1m # Extract test name from parent directory (e.g., 'fleetctl-mysql8.0.44-status')�[0m 148: �[36;1m test_dir=$(basename $(dirname "$status_file"))�[0m 149: �[36;1m # Remove '-status' suffix to get the test name�[0m 150: �[36;1m test_name="${test_dir%-status}"�[0m 151: �[36;1m status_content=$(cat "$status_file")�[0m 152: �[36;1m echo "Processing: $status_file (Test: $test_name) with status content: $status_content"�[0m 153: �[36;1m if grep -q "fail" "$status_file"; then�[0m 154: �[36;1m echo " ❌ Test failed: $test_name"�[0m 155: �[36;1m failed_tests="${failed_tests}${test_name}, "�[0m 156: �[36;1m else�[0m 157: �[36;1m echo " ✅ Test passed: $test_name"�[0m 158: �[36;1m fi�[0m 159: �[36;1mdone�[0m 160: �[36;1mif [[ $status_count -eq 0 ]]; then�[0m 161: �[36;1m echo "❌ ERROR: No status files found! This indicates a workflow issue."�[0m 162: �[36;1m exit 1�[0m 163: �[36;1mfi�[0m 164: �[36;1mif [[ -n "$failed_tests" ]]; then�[0m 165: �[36;1m echo "❌ One or more test jobs failed: ${failed_tests%, }"�[0m 166: �[36;1m exit 1�[0m ... 174: ✅ Test passed: vuln-mysql8.0.44 175: Processing: ./service-mysql8.0.44-status/status (Test: service-mysql8.0.44) with status content: success 176: ✅ Test passed: service-mysql8.0.44 177: Processing: ./integration-core-mysql8.0.44-status/status (Test: integration-core-mysql8.0.44) with status content: success 178: ✅ Test passed: integration-core-mysql8.0.44 179: Processing: ./mysql-mysql8.0.44-status/status (Test: mysql-mysql8.0.44) with status content: success 180: ✅ Test passed: mysql-mysql8.0.44 181: Processing: ./integration-enterprise-mysql8.0.44-status/status (Test: integration-enterprise-mysql8.0.44) with status content: success 182: ✅ Test passed: integration-enterprise-mysql8.0.44 183: Processing: ./integration-mdm-mysql8.0.44-status/status (Test: integration-mdm-mysql8.0.44) with status content: success 184: ✅ Test passed: integration-mdm-mysql8.0.44 185: Processing: ./scripts-status/status (Test: scripts) with status content: success 186: ✅ Test passed: scripts 187: Processing: ./fast-status/status (Test: fast) with status content: success 188: ✅ Test passed: fast 189: Processing: ./main-mysql8.0.44-status/status (Test: main-mysql8.0.44) with status content: fail 190: ❌ Test failed: main-mysql8.0.44 191: ❌ One or more test jobs failed: main-mysql8.0.44 192: ##[error]Process completed with exit code 1. 193: Post job cleanup.

[codecov]

Codecov Report

❌ Patch coverage is 95.65217% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 67.24%. Comparing base (651d591) to head (92f5ae9).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
ee/server/service/scep/scep_proxy.go	90.90%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##             main   #47878    +/-   ##
========================================
  Coverage   67.23%   67.24%            
========================================
  Files        3638     3640     +2     
  Lines      230042   230196   +154     
  Branches    11833    11833            
========================================
+ Hits       154678   154784   +106     
- Misses      61474    61514    +40     
- Partials    13890    13898     +8     

Flag	Coverage Δ
backend	68.85% <95.65%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.