Prefer to render enrollment instructions by platform tab

[Leanngove]

• The Add hosts modal now passes a platform query param on each tab's enrollment link, and enroll-ota.html prefers it over user-agent guessing when present (preventing an admin previewing an Android link on a desktop browser seeing "Apple MDM is turned off", for example)

• The platform param also survives the IdP SSO redirect round-trip

• Also removes QR code from MacOS enrollment page

• QR code is added to the Android and iOS/iPadOS pages so a desktop browser (Mac or Windows) previewing those links gets a QR-only view to hand off to the actual device, instead of written steps meant for that device

Enrollment instruction matrix

What /enroll (enroll-ota.html) renders for every combination of Android MDM state, Apple MDM state, the device opening the link, whether the link carries a platform query parameter, and how the separate fully_managed=true flag interacts with all of it.

Legend: 🛑 error only · ✅ full written instructions · 📱 QR-only (no written steps)

Links that include a platform parameter

(generated by the Add hosts modal — one per tab)

Opening on…	Android MDM off	Android MDM on	Apple MDM off	Apple MDM on
Windows, platform=android	🛑 "Android MDM is turned off."	📱 "Enrolling a mobile device?" QR code, no written instructions	— not checked	— not checked
Windows, platform=ios/ipad	— not checked	— not checked	🛑 "Apple MDM is turned off."	📱 "Enrolling a mobile device?" QR code, no written instructions
Windows, platform=macos	— not checked	— not checked	🛑 "Apple MDM is turned off."	✅ Full written "turn on MDM on your Mac" steps
Mac, platform=android	🛑 "Android MDM is turned off."	📱 "Enrolling a mobile device?" QR code, no written instructions	— not checked	— not checked
Mac, platform=ios/ipad	— not checked	— not checked	🛑 "Apple MDM is turned off."	📱 "Enrolling a mobile device?" QR code, no written instructions
Mac, platform=macos	— not checked	— not checked	🛑 "Apple MDM is turned off."	✅ Full written Mac steps
iOS/iPad, platform=ios/ipad	— not checked	— not checked	🛑 "Apple MDM is turned off."	✅ Full written steps + Personal/Company-owned tabs render on the device. A non-Safari browser (e.g. Chrome on iOS) is redirected to "Open in Safari" first
Android, platform=android	🛑 "Android MDM is turned off."	✅ Full written steps + Enroll button render on the device	— not checked	— not checked

Links with no platform parameter (guessed from the user agent)

Opening on…	Android MDM off	Android MDM on	Apple MDM off	Apple MDM on
Mac	— not checked	— not checked	🛑 "Apple MDM is turned off."	✅ Full written Mac steps
iOS/iPad	— not checked	— not checked	🛑 "Apple MDM is turned off."	✅ Full written steps
Android	🛑 "Android MDM is turned off."	✅ Full written steps + Enroll button	— not checked	— not checked

Notes

1. Fleet never validates that a platform parameter (or fully_managed) matches the device actually opening the link. Whatever the query params say is what renders, regardless of the real device — e.g. a platform=android link opened on an actual iPhone renders the Android template (Enroll button and all) directly on that iPhone.
2. The in-page Safari check looks for the substring "Safari" while excluding known iOS alternate browsers (CriOS, FxiOS, EdgiOS, OPiOS, OPT, Brave). Android Chrome's user agent also contains "Safari" and isn't on that exclusion list, so it can pass the same check — a pre-existing quirk, not something this change introduced.

Related issue: Resolves #50883

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

• Confirmed that the fix is not expected to adversely impact load test results
• Alerted the release DRI if additional load testing is needed

Database migrations

• Checked schema for all modified table for columns that will auto-update timestamps during migration.
• Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
• Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

New Fleet configuration settings

• Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for GitOps-enabled settings:

• Verified that the setting is exported via fleetctl generate-gitops
• Verified the setting is documented in a separate PR to the GitOps documentation
• Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
• Verified that any relevant UI is disabled when GitOps mode is enabled

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.59%. Comparing base (8c6bedf) to head (5285f7e).
⚠️ Report is 385 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #51593      +/-   ##
==========================================
+ Coverage   68.31%   68.59%   +0.28%     
==========================================
  Files        3951     3969      +18     
  Lines      252699   253743    +1044     
  Branches    13512    13885     +373     
==========================================
+ Hits       172627   174056    +1429     
+ Misses      64633    64247     -386     
- Partials    15439    15440       +1     

Flag	Coverage Δ
frontend	63.64% <100.00%> (+2.00%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.