ruby-jss 0.7.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0b5245057f32987e52e0753f330b6b2fdd3b5a26
-  data.tar.gz: 8028f472e0694cfc2dd1fbf93914369482fdddd5
+  metadata.gz: 4328e0cc23db07a92bfa3136ea036a84b614eb38
+  data.tar.gz: 9ec5ef3a805471764d22061b7a15e809eb966e27
 SHA512:
-  metadata.gz: c4b8aaa54395cf65ccd910b15694edef02d70899169ef3f433f61721b2729d5b7af31558990bb88e2b48ef829079cf2f0bcf81fbe49f463059977e4ff39aef84
-  data.tar.gz: 8577fd4833e3f93c6582612210ca63dd2ec9da3249f1e199f1471c12569b5e7bdd247e42d1acb818f779a06ef57b5f7c97906995a1717c9548b906a1f44fceea
+  metadata.gz: c3f80986485ec6620fc9f2b9ee45b6ce3bc68390a8db443abd1ad26362222602f09638b34600e6e378ebd2c61f771d8ba109a185013d0f9361763f18ab0fbb68
+  data.tar.gz: 1b8ebb3ffafc7562a3f9c4ad08cc8b562b1596d9c523ce69f57820016ee8d393e3b8009d27e5fdf7e9491fee2a739652e7accf56cc27713f5da4d76c277284b6

data/CHANGES.md

@@ -1,8 +1,36 @@
 # Change History
 
+## v0.8.1 2017-06-05
+
+- Improvement: Support for the new semantic versioning of Jamf products starting with Jamf Pro 9.99
+- The alpha 'Webhooks framework' has been removed from ruby-jss and will reappear soon as it's own project with a new name.
+- Fix: JSS::Package uploading and zipping wasn't worked correctly, should be now.
+- Improvement: JSS::APIObject and subclasses now have .fetch and .make class methods which are wrappers for .new. .fetch is the preferred way to retrieve instances of existing API objects, and .make for making not-yet-existing objects to be created in the JSS. The .new class method still works as before, but is considered deprecated.
+- Improvement: JSS::APIConnection now has a #rest_url attribute that returns the base of the url for the current REST connection, e.g. "https://jamf.company.com:8443/JSSResource", or nil if not connected.
+
+## v0.8.0 2017-04-07
+
+- Change: Lots of code cleanup to follow RuboCop guidelines (more of this comming)
+- Fix: sometimes the port would default to 80 rather than 8443
+- Fix?: sometimes DB connections would double-disconnect, causing superfluous exceptions.
+- Change: APIConnection class is no longer a singleton. The first step towards the ability to swap between multiple connections.
+- Add: #port, #protocol, and #last_http_response to APIConnection instances
+- Change: Improved APIConnection's ability to figure out default connection settings
+- Add: APIConnection#post_rsrc and #put_rsrc now catch and re-raise HTTP 409 Conflict errors as JSS::ConflictError with error message about what caused the conflict.
+- Improvement: APIObject mixin module parsing is now handled automatically by the APIObject superclass.
+- Improvement: APIObject subclasses have predicate methods to see if they have various mixed-in abilities, e.g. #creatable?, #locatable?
+- Change: All handling of Category data in non-Category objects is in a new Categorizable mixin module.
+- Add: JSS::MobileDeviceApplication class
+- Add: JSS::Icon class, handled by the improved SelfServable mixin module
+- Add: JSS::Client.jamf_helper method now takes arg_string:, output_file: and abandon_process: parameters.
+- Add: executable bin/jamfHelperBackgrounder, wrapper to run jamfHelper as a stand-alone process, allowing polcies to continue while a window is displayed
+- Add: explicitly require the standard library 'English', and start using it rather than cryptic globals like $! and $@
+- Add: first attempts at adding SSL/TLS support to the Webhooks framework.
+  - NOTE: the Webhooks framework is still 'alpha' code, and will be moved into a separate git repo eventually. It doesn't rely on ruby-jss.
+
 ## v0.7.0 2017-02-01
 
-- JSS::NetworkSegment - many bugfixes and cleanup. I didn't really have a proper grasp of IP CIDR masks before and how the (don't) related to the IP ranges used by Network Segments in the JSS. They CIDRs and full netmasks can still be used to set the ending addresses of NetworkSegment objects, but the #cidr method is gone, since it was meaningless for segments that didn't match subnet-ranges.
+- JSS::NetworkSegment - many bugfixes and cleanup. I didn't really have a proper grasp of IP CIDR masks before and how they (don't) relate to the IP ranges used by Network Segments in the JSS. The CIDRs and full netmasks can still be used to set the ending addresses of NetworkSegment objects, but the #cidr method is gone, since it was meaningless for segments that didn't match subnet-ranges.
 - subnect-update, the example command in the bin directory, has been renamed to negseg-update. It's also been cleaned up and uses the new functionality of JSS::NetworkSegment.
 - JSS::DBConnection - fixed a bug where meaningless IO 'stream closed' errors would appear when closing the DB connection.
 
@@ -14,49 +42,31 @@
 ## v0.6.6 2016-11-30
 
 - Added String#jss_to_pathname to convert Strings to Pathname instances in JSS::Configuration.
-
 - JSS::DBConnection#connect now returns the server hostname, to match the behavior of JSS::APIConnection#connect
-
 - JSS::Client: added .console_user method
-
 - JSS::Policy, now creatable, and self-servable, and more attributes are updatable
-
 - JSS::SelfServable, finally getting this module functional, at least for policies
-
 - JSS::Creatable, added #clone method - all creatable objects can be cloned easily.
-
 - JSS::APIObject, added .exist? and .valid_id class methods and #to_s instance method
-
 - Change the mountpoint directory for JSS::DistributionPoint#mount to /tmp, because Sierra doesn't allow mounting in /Volumes except by root. (Thanks @LM2807! )
-
 - Starting cleaning up code to better adhere to [RuboCop](http://rubocop.readthedocs.io/en/latest/) standards
-
 - Added alpha version of a JSS WebHooks framwork
 
 ## v0.6.5 2016-08-10
 
 - Cleanup of redundant constants (Thanks @aurica!)
-
 - Added JSS::ComputerInvitation class (Thanks @tostart-pickagreatname!)
-
 - Added JSS::Account class (Thanks @JonPulsifer!)
-
 - Added JSS::OSXConfigurationProfile class (Thanks @tostart-pickagreatname!)
-
 - JSS::Computer: added methods #boot_drive, #filevault2_enabled?, and #filevault1_accounts
-
 - Various small bugfixes & improvements
 
 ## v0.6.4 2016-03-24
 
 - JSS::Package#dlete can optionally delete the master file at the same time
-
 - Added an example ruby-jss.conf file with internal documentation
-
 - Various small bugfixes & improvements
-
 - Updated the config file name to match the new gem name, maintaining backwards compatibility
-
 - Improved error messages
 
 ## v0.6.3 2016-03-09
@@ -76,15 +86,12 @@ The 'jss-api' gem has been updated one last time, also to v0.6.2. That gem has a
 #### additions & features
 
 - JSS::Package#os_ok? and JSS::Package#processor_ok? methods can now check those things against the package settings, and not attempt to install if the machine isn't up to snuff.
-
 - JSS::ExtensionAttribute#latest_values always now includes :username in the returned data.
 
 #### bugfixes
 
 - JSS::stdin_lines no longer uses a constant to store incoming stdin data at load time, which causes hangs when there's no terminal on stdin. Now stdin is only read when the method is called, and data stored in a module variable.
-
 - JSS::Composer::mk_dmg fix for building/indexing dmg's, no longer creates an unreadable .Trashes folder.
-
 - Several small typos and other tiny bugs.
 
 ## v0.6.1 2016-03-01

data/README.md

@@ -1,4 +1,4 @@
-# ruby-jss: Access to the Casper Suite from Ruby
+# ruby-jss: Access to the Jamf Pro from Ruby
 [![Gem Version](https://badge.fury.io/rb/ruby-jss.svg)](http://badge.fury.io/rb/ruby-jss)
 
 ### Table of contents
@@ -27,13 +27,20 @@
 
 ## DESCRIPTION
 
-The ruby-jss project provides a Ruby module called JSS, which is used for accessing the REST API of the JAMF Software Server (JSS), the core of the Casper Suite, an enterprise-level management tool for Apple devices from [JAMF Software, LLC](http://www.jamfsoftware.com/). It is available as a [rubygem](https://rubygems.org/gems/ruby-jss), and the [source is on github](https://github.com/PixarAnimationStudios/ruby-jss).
+The ruby-jss project provides a Ruby module called JSS, which is used for accessing the REST API of
+the JAMF Software Server (JSS), the core of Jamf Pro, an enterprise-level management tool for Apple
+devices from [JAMF Software, LLC](http://www.jamf.com/). It is available as a
+[rubygem](https://rubygems.org/gems/ruby-jss), and the
+[source is on github](https://github.com/PixarAnimationStudios/ruby-jss).
 
-The module abstracts API resources as Ruby objects, and provides methods for interacting with those resources. It also provides some features that aren't a part of the API itself, but come with other Casper-related tools, such as uploading .pkg and .dmg {JSS::Package} data to the master distribution point, and the installation of {JSS::Package} objects on client machines. (See BEYOND THE API)
+The module abstracts API resources as Ruby objects, and provides methods for interacting with those
+resources. It also provides some features that aren't a part of the API itself, but come with other
+Jamf-related tools, such as uploading .pkg and .dmg {JSS::Package} data to the master distribution
+point, and the installation of {JSS::Package} objects on client machines. (See [BEYOND THE API](#beyond-the-api)
 
-The module is not a complete implementation of the Casper API. Only some API objects are modeled, some only minimally. Of
-those, some are read-only, some partially writable, some fully read-write (all implemented objects can be deleted)
-See OBJECTS IMPLEMENTED for a list.
+The module is not a complete implementation of the Jamf API. Only some API objects are modeled, some
+only minimally. Of those, some are read-only, some partially writable, some fully read-write (all
+implemented objects can be deleted) See [OBJECTS IMPLEMENTED](#objects-implemented) for a list.
 
 We've implemented the things we need in our environment, and as our needs grow, we'll add more.
 Hopefully others will find it useful, and add more to it as well.
@@ -46,33 +53,31 @@ Hopefully others will find it useful, and add more to it as well.
 ```ruby
 require 'jss'
 
-JSS::API.connect(
-  :user => jss_user,
-  :pw => jss_user_pw,
-  :server => jss_server_hostname
-)
+# Connect to the API
+JSS::API.connect user: jss_user, pw: jss_user_pw, server: jss_server_hostname
 
-# get an array of data about all JSS::Package objects in the JSS:
-JSS::Package.all
+# get an array of basic data about all JSS::Package objects in the JSS:
+pkgs = JSS::Package.all
 
 # get an array of names of all JSS::Package objects in the JSS:
-JSS::Package.all_names
+pkg_names = JSS::Package.all_names
 
-# Get a static computer group
-mg = JSS::ComputerGroup.new :name => "Macs of interest"
+# Get a static computer group. This creates a new Ruby object
+# representing the existing JSS computer group.
+mg = JSS::ComputerGroup.fetch name: "Macs of interest"
 
 # Add a computer to the group
 mg.add_member "pricklepants"
 
-# save my changes
-mg.update
+# save changes back to the JSS, mg.update works also
+mg.save
 
-# Create a new network segment to store in the JSS
-ns = JSS::NetworkSegment.new(
-  :id => :new,
-  :name => 'Private Class C',
-  :starting_address => '192.168.0.0',
-  :ending_address => '192.168.0.255'
+# Create a new network segment to store in the JSS.
+# This makes a new Ruby Object that doesn't yet exist in the JSS.
+ns = JSS::NetworkSegment.make(
+  name: 'Private Class C',
+  starting_address: '192.168.0.0',
+  ending_address: '192.168.0.255'
 )
 
 # Associate this network segment with a specific building,
@@ -83,8 +88,8 @@ ns.building = "Main Office"
 #  which must exist in the JSS, and be listed in JSS::SoftwareUpdateServer.all_names
 ns.swu_server = "Main SWU Server"
 
-# Create the new network segment in the JSS
-ns.create
+# save the new network segment in the JSS, ns.create works as well
+ns.save
 ```
 
 ## USAGE
@@ -94,23 +99,24 @@ ns.create
 Before you can work with JSS Objects via the API, you have to connect to it.
 
 The constant {JSS::API} contains the connection to the API (a singleton instance of {JSS::APIConnection}). When the JSS Module is first loaded, it isn't
-connected.  To remedy that, use JSS::API.connect, passing it values for :user, :pw, and :server:
+connected.  To remedy that, use JSS::API.connect, passing it values for the connection. In this example, those values are stored
+in the local variables jss_user, jss_user_pw, and jss_server_hostname, and others are left as default.
 
 ```ruby
-JSS::API.connect :user => jss_user, :pw => jss_user_pw, :server => jss_server_hostname
+JSS::API.connect user: jss_user, pw: jss_user_pw, server: jss_server_hostname
 ```
 
-Make sure the user has privileges in the JSS to do things with API Objects.
+Make sure the user has privileges in the JSS to do things with desired Objects.
 
 The {JSS::API#connect} method also accepts the symbols :stdin and :prompt as values for :pw, which will cause it to read the
-password from stdin, or prompt for it in the shell. See the JSS::APIConnection class for more connection options and details about its methods.
+password from stdin, or prompt for it in the shell. See the {JSS::APIConnection} class for more connection options and details about its methods.
 
-Also see {JSS::Configuration}, and the CONFIGURATION section below, for how to store
+Also see {JSS::Configuration}, and the [CONFIGURATION](#configuration) section below, for how to store
 server connection parameters in a simple config file.
 
 ### Working with JSS Objects (a.k.a REST Resources)
 
-All API Object classes are subclasses of JSS::APIObject and share methods for listing, retrieving, and deleting from the JSS. All supported objects can be listed, retrieved and deleted, but only some can be updated or created. Those classes do so by mixing in the JSS::Creatable and/or JSS::Updateable modules. See below for the level of implementation of each class.
+All API Object classes are subclasses of JSS::APIObject and share methods for listing, retrieving, and deleting from the JSS. All supported objects can be listed, retrieved and deleted, but only some can be updated or created. See below for the level of implementation of each class.
 
 --------
 
@@ -136,32 +142,29 @@ Some Classes provide other ways to list objects, depending on the data available
 
 #### Retrieving Objects
 
-To retrieve a single object call the object's constructor (.new) and provide either :name or :id or :data.
+To retrieve a single object call the class's constructor .fetch method and provide a name:,  id:, or other valid
+lookup attribute.
 
-* :name or :id will be looked up via the API
 
 ```ruby
-a_dept = JSS::Department.new :name => "Payroll" # =>  #<JSS::Department:0x10b4c0818...
+a_dept = JSS::Department.fetch name: "Payroll" # =>  #<JSS::Department:0x10b4c0818...
 ```
 
-* :data must be the parsed JSON output of a separate API query (a hash with symbolized keys)
-
-```ruby
-dept_data = JSS::API.get_rsrc("departments/name/Payroll")[:department] # => {:name=>"Payroll", :id=>42}
-a_dept = JSS::Department.new :data => dept_data  # =>  #<JSS::Department:0x10b4a83f8...
-```
+Some classes can use more than just the :id and :name keys for lookups, e.g. computers can be looked up with :udid, :serial_number, or :mac_address.
 
-Some subclasses can use more than just the :id and :name keys for lookups, e.g. computers can be looked up with :udid, :serial_number, or :mac_address.
+*NOTE*: A class's '.fetch' method is now the preferred method to use for retrieving existing objects. The '.new' method still works as before, but is
+deprecated for object retrieval and doing so may raise errors in the future. See below for using .make to create new objects in the JSS.
 
 --------
 
 #### Creating Objects
 
-Some Objects can be created anew in the JSS. To make a new object, first instantiate one using :id => :new, and provide a unique :name.
+Some Objects can be created anew in the JSS via ruby. To do so, first make a Ruby object using the class's .make method and providinga unique :name:, e.g.
 
 ```ruby
-new_pkg = JSS::Package.new :id => :new, :name => "transmogrifier-2.3-1.pkg"
+new_pkg = JSS::Package.make name: "transmogrifier-2.3-1.pkg"
 ```
+*NOTE*: some classes require more data than just a :name when created with .create.
 
 Then set the attributes of the new object as needed
 
@@ -171,13 +174,13 @@ new_pkg.category = "CoolTools"
 # etc..
 ```
 
-Then use the #create method to create it in the JSS.
+Then use the #create method to create it in the JSS. The #save method is an alias of #create
 
 ```ruby
-new_pkg.create # => 453 # the id number of the object just created
+new_pkg.create # returns 453, the id number of the object just created
 ```
 
-*NOTE* some subclasses require more data than just a :name when instantiating with :id => :new.
+*NOTE*: A class's '.make' method is now the preferred method to use for creating new objects. The '.new id: :new' method still works as before, but is deprecated for object creation and doing so may raise errors in the future.
 
 --------
 
@@ -186,14 +189,14 @@ new_pkg.create # => 453 # the id number of the object just created
 Some objects can be modified in the JSS.
 
 ```ruby
-existing_script = JSS::Script.new :id => 321
+existing_script = JSS::Script.fetch id: 321
 existing_script.name = "transmogrifier-2.3-1.post-install"
 ```
 
 After changing any attributes, use the #update method (also aliased to #save) to push the changes to the JSS.
 
 ```ruby
-existing_script.update # or existing_script.save  => true # the update was successful
+existing_script.update #  => returns the id number of the object just saved
 ```
 
 --------
@@ -203,7 +206,7 @@ existing_script.update # or existing_script.save  => true # the update was succe
 To delete an object, just call its #delete method
 
 ```ruby
-existing_script = JSS::Script.new :id => 321
+existing_script = JSS::Script.fetch id: 321
 existing_script.delete # => true # the delete was successful
 ```
 
@@ -225,6 +228,7 @@ See each Class's documentation for details.
 * {JSS::ComputerExtensionAttribute}
 * {JSS::ComputerGroup}
 * {JSS::Department}
+* {JSS::MobileDeviceApplication}
 * {JSS::MobileDeviceExtensionAttribute}
 * {JSS::MobileDeviceGroup}
 * {JSS::NetworkSegment}
@@ -278,6 +282,7 @@ These must be created and edited via the JSS WebApp
 * {JSS::DistributionPoint}
 * {JSS::LDAPServer}
 * {JSS::NetBootServer}
+* {JSS::RestrictedSoftware}
 * {JSS::SoftwareUpdateServer}
 
 ### Deletable
@@ -335,15 +340,15 @@ Here's an example of how to use a password stored in a file:
 
 ```ruby
 password = File.read "/path/to/secure/password/file" # read the password from a file
-JSS::API.connect :pw => password   # other arguments used from the config settings
+JSS::API.connect pw: password   # other arguments used from the config settings
 ```
 
 And here's an example of how to read a password from a web server and use it.
 
 ```ruby
 require 'open-uri'
-password =  open('http://server.org.org/path/to/password').read
-JSS::API.connect :pw => password   # other arguments used from the config settings
+password =  open('https://server.org.org/path/to/password').read
+JSS::API.connect pw: password   # other arguments used from the config settings
 ```
 
 ## BEYOND THE API
@@ -372,10 +377,9 @@ While the Casper API provides access to object data in the JSS, this gem tries t
 
 the JSS gem was written for:
 
-* Mac OS X 10.8 and higher
+* Mac OS X 10.9 or higher
+* Ruby 2.0 or higher
 * Casper Suite version 9.4 or higher
-* Casper 9.4 - 9.6 require Ruby 1.8.7 and higher
-* Casper >= 9.61 require Ruby 1.9.3 and higher
 
 It also requires these gems, which will be installed automatically if you install JSS with `gem install jss`
 
@@ -393,46 +397,22 @@ It also requires these gems, which will be installed automatically if you instal
 
 NOTE: You may need to install XCode, and it's CLI tools, in order to install the required gems.
 
-In general, you can install the JSS Gem with this command:
+In general, you can install ruby-jss with this command:
 
 `gem install ruby-jss`
 
-If you're using Ruby 1.8.7 (Casper 9.4 - 9.6 only), install the following gems manually first, since the JSS gem will try to install newer, incompatible versions if they aren't pre-installed.
-
-`gem install json -v 1.6.5`
-
-`gem install mime-types -v 1.25.1`
-
-`gem install rest-client -v 1.6.8`
-
 
 ## HELP
 
+Full documentation is available at [rubydoc.info](http://www.rubydoc.info/gems/ruby-jss/)
+
 [Email the developer](mailto:ruby-jss@pixar.com)
 
 [Macadmins Slack Channel](https://macadmins.slack.com/messages/#jss-api/)
 
 ## LICENSE
 
-Copyright 2016 Pixar
-
-Licensed under the Apache License, Version 2.0 (the "Apache License")
-with the following modification; you may not use this file except in
-compliance with the Apache License and the following modification to it:
-
-Section 6. Trademarks. is deleted and replaced with:
-
-  6\. Trademarks. This License does not grant permission to use the trade
-  names, trademarks, service marks, or product names of the Licensor
-  and its affiliates, except as required to comply with Section 4(c) of
-  the License and to reproduce the content of the NOTICE file.
-
-You may obtain a copy of the Apache License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
+Copyright 2017 Pixar
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the Apache License with the above modification is
-distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied. See the Apache License for the specific
-language governing permissions and limitations under the Apache License.
+Licensed under the Apache License, Version 2.0 (the "Apache License") with
+modifications. See LICENSE.txt for details

data/bin/jamfHelperBackgrounder

@@ -0,0 +1,148 @@
+#!/usr/bin/ruby
+
+### Copyright 2017 Pixar
+
+###
+###    Licensed under the Apache License, Version 2.0 (the "Apache License")
+###    with the following modification; you may not use this file except in
+###    compliance with the Apache License and the following modification to it:
+###    Section 6. Trademarks. is deleted and replaced with:
+###
+###    6. Trademarks. This License does not grant permission to use the trade
+###       names, trademarks, service marks, or product names of the Licensor
+###       and its affiliates, except as required to comply with Section 4(c) of
+###       the License and to reproduce the content of the NOTICE file.
+###
+###    You may obtain a copy of the Apache License at
+###
+###        http://www.apache.org/licenses/LICENSE-2.0
+###
+###    Unless required by applicable law or agreed to in writing, software
+###    distributed under the Apache License with the above modification is
+###    distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+###    KIND, either express or implied. See the Apache License for the specific
+###    language governing permissions and limitations under the Apache License.
+
+# == Synopsis
+#   Run the jamfHelper program as a detached background process, optionally
+#   writing its output to a file, and optionally running it as the console user
+#   (if this script is being run by root).
+#
+#  WARNING: You shouldn't run this command directly as a launchd job. Rather
+#  you should write a small script that runs this command, and use launchd
+#  to run that.
+#
+#
+# == Usage
+#   jamfHelperBackgrounder <options> | -help
+#
+#
+# == Author
+#   Chris Lasell <chrisl@pixar.com>
+#
+# == Copyright
+#   Copyright (c) 2017 Pixar Animation Studios
+##############################
+
+require 'ruby-jss'
+
+# The app object
+class App
+
+  WIN_TYPE_PARAM = '-windowType'.freeze
+  CONS_USER_PARAM = '-consoleUser'.freeze
+  OUTPUT_FILE_PARAM = '-outputFile'.freeze
+
+  # Set up
+  #
+  def initialize(args)
+    if args.include? '-help'
+      @help = true
+      return
+    end
+
+    if args.include? CONS_USER_PARAM
+      args.delete CONS_USER_PARAM
+      @as_user = JSS::Client.console_user
+    else
+
+      wintype_idx = args.index { |a| a == WIN_TYPE_PARAM }
+      raise 'missing option: -windowType' unless wintype_idx
+      args.delete_at wintype_idx
+      @window_type = args.delete_at(wintype_idx).to_sym
+
+      if args.include? OUTPUT_FILE_PARAM
+        outfile_idx = args.index { |a| a == OUTPUT_FILE_PARAM }
+        args.delete_at outfile_idx
+        @outfile = args.delete_at outfile_idx
+      end
+
+    end # if args.include? AS_USER_PARAM...else...
+
+    @arg_string = ''
+    args.each { |a| @arg_string << " #{Shellwords.escape a}" }
+  end # init
+
+  # Do the thing. Win the points.
+  #
+  # @return [void]
+  #
+  def run
+    if @help
+      show_help
+      return
+    end
+
+    if @as_user
+      raise 'Only root can do things as another user' unless JSS.superuser?
+      cmd = ['su', '-l', @as_user, '-c', "#{Shellwords.escape __FILE__} #{@arg_string}"]
+      exec(*cmd)
+    end
+
+    JSS::Client.jamf_helper @window_type, arg_string: @arg_string, abandon_process: true, output_file: @outfile
+  end # run
+
+  # Spew helpful info to output
+  #
+  # @return [void]
+  #
+  def show_help
+    puts <<-ENDHELP
+This command runs the jamfHelper command as a detached background process.
+This means that you use this command in a policy (via script, usually) and the
+Policy execution will continue, and exit properly, even while the jamfHelper window
+is still open.
+
+This is important because future Jamf checkins will not happen if an earlier checkin
+policy is waiting for a jamfHelper window to close.
+
+This command takes all the same commandline options as jamfHelper, plus these:
+
+  -outputFile <path>      Write the numeric output from jamfHelper to the file
+                          at <path>. The path must be writable by the user
+                          running jamfHelper (see below).
+                          This file can be examined later to determine what
+                          the user clicked.
+
+  -consoleUser            Run the jamfHelper process as the current console (GUI)
+                          user. This is needed from most policies and other code
+                          running as root, in order to show the window in the
+                          current console user's UI. If no one is logged into the
+                          console, nothing happens.
+                          This can only be used by the root user.
+
+  -help                   Show this help.
+
+WARNING: You shouldn't run this command directly as a launchd job. Rather
+you should write a small script that runs this command, and use launchd
+to run that.
+ENDHELP
+  end # show help
+
+end # app
+
+##############################
+# create the app and go
+
+app = App.new(ARGV)
+app.run