Host details: "My device" link shows for iOS/iPadOS hosts that aren't enrolled in MDM (Pending or Off)

[AndreyKizimenko]

Fleet versions

• Discovered: rc-minor-fleet-v4.93.0 (1f30f3a)

Web browser and operating system: Chromium 149.0.7827.55 on macOS 27.0

---

💥 Actual behavior

Host details shows the My device link for iOS/iPadOS hosts that aren't enrolled in Fleet's MDM:

• MDM status "Pending" (assigned in Apple Business, not enrolled yet): selecting My device shows "Couldn't open My device page. Please try again." Trying again doesn't help, because GET /api/v1/fleet/hosts/:id/device_url returns 500 host has no UUID to build a device URL from.
• MDM status "Off" (enrolled, then MDM turned off): the link opens the self-service page, which the device's end user can't reach and which can't install anything on an unmanaged device.

🛠️ Expected behavior

Hide the My device link for iOS/iPadOS hosts whose MDM status is "Pending" or "Off". #48439's goal is to show the link only when the My device page is relevant/available for the host.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Have an iPhone or iPad with MDM status Pending (assigned to Fleet in Apple Business, not enrolled yet), and/or one with MDM status Off (enrolled, then MDM removed).
2. As a global admin, open Host details for that host. My device is shown in the User card.
3. Select My device.

🕯️ More info (optional)

• canShowMyDeviceButton (frontend/pages/hosts/details/HostDetailsPage/helpers.ts:28) skips the Fleet Desktop check for iOS/iPadOS but doesn't check MDM enrollment. hasEverEnrolled in the same file already detects pending hosts.
• Pending Apple Business hosts are created without a UUID (server/datastore/mysql/apple_mdm.go:1807). For those hosts, HostDeviceURL returns an unmapped error (server/service/hosts.go:3014), which becomes the 500.
• Introduced by Hide the My device link on platforms that have no My device page #52245 (Host details > My device link doesn't work for iOS/iPadOS and doesn't make sense for Android/ChromeOS #48439). The frontend part also shipped in 4.92.0 with the cherry-pick of harden sso desktop gate #53125 (CP: harden sso desktop gate (#53125) #53323), but the 4.92 API still rejects every iOS/iPadOS host.