diff --git a/server/datastore/mysql/apple_mdm.go b/server/datastore/mysql/apple_mdm.go index ade0adb6e8..78daa528e2 100644 --- a/server/datastore/mysql/apple_mdm.go +++ b/server/datastore/mysql/apple_mdm.go @@ -385,7 +385,7 @@ COALESCE(detail, '') AS detail FROM host_mdm_apple_declarations WHERE -host_uuid = ? AND NOT (operation_type = '%s' AND COALESCE(status, '%s') IN('%s', '%s'))`, +host_uuid = ? AND declaration_name NOT IN (?) AND NOT (operation_type = '%s' AND COALESCE(status, '%s') IN('%s', '%s'))`, fleet.MDMDeliveryPending, fleet.MDMOperationTypeRemove, fleet.MDMDeliveryPending, @@ -398,8 +398,13 @@ host_uuid = ? AND NOT (operation_type = '%s' AND COALESCE(status, '%s') IN('%s', fleet.MDMDeliveryVerified, ) + stmt, args, err := sqlx.In(stmt, hostUUID, hostUUID, fleetmdm.ListFleetReservedMacOSDeclarationNames()) + if err != nil { + return nil, ctxerr.Wrap(ctx, err, "building in statement") + } + var profiles []fleet.HostMDMAppleProfile - if err := sqlx.SelectContext(ctx, ds.reader(ctx), &profiles, stmt, hostUUID, hostUUID); err != nil { + if err := sqlx.SelectContext(ctx, ds.reader(ctx), &profiles, stmt, args...); err != nil { return nil, err } return profiles, nil diff --git a/server/service/integration_mdm_test.go b/server/service/integration_mdm_test.go index 342aa693e8..cb4141f638 100644 --- a/server/service/integration_mdm_test.go +++ b/server/service/integration_mdm_test.go @@ -740,6 +740,13 @@ func (s *integrationMDMTestSuite) TestAppleProfileManagement() { }, http.StatusOK) s.checkMDMProfilesSummaries(t, nil, expectedNoTeamSummary, &expectedNoTeamSummary) s.checkMDMProfilesSummaries(t, &tm.ID, expectedTeamSummary, &expectedTeamSummary) + + // it should also not show up in the host's profiles list + s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/hosts/%d", host.ID), getHostRequest{}, http.StatusOK, &hostResp) + require.NotEmpty(t, hostResp.Host.MDM.Profiles) + resProfiles = *hostResp.Host.MDM.Profiles + // one extra profile for the fleetd config + require.Len(t, resProfiles, len(wantTeamProfiles)+1) } func (s *integrationMDMTestSuite) TestAppleProfileRetries() {