Fixed a race where a host could silently revert to its previous team

[getvictor]

Related issue: Resolves #44071

Verified fix in loadtest.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes

  • Fixed a race condition that could cause hosts to silently revert to a previous team after an admin team transfer.
  • Improved reliability of team-transfer handling to prevent unexpected reversion during certificate/template transfers and device/profile operations.

• Tests

  • Added regression tests to ensure team assignments persist correctly across host refreshes and related workflows.

[getvictor]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.

[getvictor]

/agentic_review

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: eb4463eb-286b-4da7-911b-c2a6c810ebd8

📥 Commits

Reviewing files that changed from the base of the PR and between 938bb3f and 12975b3.

📒 Files selected for processing (1)

• changes/44071-team-transfer-race-with-update-host

✅ Files skipped from review due to trivial changes (1)

• changes/44071-team-transfer-race-with-update-host

---

Walkthrough

UpdateHost was changed to stop writing the host's team_id during refreshes to avoid a lost-update race that could revert admin-initiated team transfers. Tests across mysql packages were updated to persist host-team membership via AddHostsToTeam instead of setting Host.TeamID + UpdateHost. A regression test was added to ensure updateHostFunc (covering ds.UpdateHost and ds.SerialUpdateHost) does not overwrite hosts.team_id. A single release-note line documents the fix.

Possibly related PRs

• Add backend changes for team labels #37116: Modifies host/team update flows in server/datastore/mysql and updates tests around AddHostsToTeam; closely related to preventing UpdateHost from overwriting team_id.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: preventing a race condition where hosts revert to their previous team during concurrent transfers.
Description check	✅ Passed	The description provides the linked issue (#44071), marks the changes file checkbox, and confirms automated tests and manual QA were completed.
Linked Issues check	✅ Passed	All code changes address the core requirement to prevent UpdateHost from writing team_id: modifications to hosts.go remove team_id from the UPDATE statement, and updated tests ensure team_id is managed only via AddHostsToTeam.
Out of Scope Changes check	✅ Passed	All changes directly address the race condition fix: the release note documents the fix, hosts.go stops writing team_id, and test updates replace UpdateHost team_id assignments with AddHostsToTeam calls.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch victor/44071-team-transfer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Fixes a lost-update race where UpdateHost could overwrite a concurrent admin team transfer by writing a stale team_id back to the hosts row (Resolves #44071).

Changes:

• Stop Datastore.UpdateHost from updating hosts.team_id (team membership is now exclusively managed via team transfer/enrollment paths).
• Update affected tests to use AddHostsToTeam for team assignment instead of relying on UpdateHost to persist TeamID.
• Add a regression test ensuring UpdateHost cannot clobber (or resurrect) team_id during concurrent transfers.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
server/datastore/mysql/hosts.go	Removes team_id from the UpdateHost UPDATE statement and documents the rationale.
server/datastore/mysql/hosts_test.go	Adds regression coverage to ensure UpdateHost does not write team_id.
server/service/hosts_test.go	Adjusts test setup to assign teams via AddHostsToTeam.
server/datastore/mysql/mdm_test.go	Adjusts Windows MDM test hosts’ team assignment to use AddHostsToTeam.
server/datastore/mysql/host_certificate_templates_test.go	Updates “team transfer” simulation to use AddHostsToTeam (not UpdateHost).
server/datastore/mysql/certificate_templates_test.go	Uses AddHostsToTeam for team assignment before certificate template assertions.
server/datastore/mysql/android_test.go	Uses AddHostsToTeam for team assignment in Android MDM profile send tests.
changes/44071-team-transfer-race-with-update-host	Adds release note entry for the bug fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.78%. Comparing base (28908e6) to head (12975b3).
⚠️ Report is 63 commits behind head on main.

Files with missing lines	Patch %	Lines
server/datastore/mysql/hosts.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #44074      +/-   ##
==========================================
+ Coverage   66.75%   66.78%   +0.02%     
==========================================
  Files        2623     2621       -2     
  Lines      211148   211121      -27     
  Branches     9386     9386              
==========================================
+ Hits       140959   140992      +33     
+ Misses      57357    57314      -43     
+ Partials    12832    12815      -17     

Flag	Coverage Δ
backend	68.55% <75.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.