xolo-server 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0fcb07a6a96bb7c1994ddc769614f3c88839cdad9815b5943623a49977ba038
-  data.tar.gz: 569ff85e1c62df06bd00019a8a075b91c1a6e405fb3c6a8fb54cb49f9aaee3ef
+  metadata.gz: 5762b1b18f24e90927cac0c748c873b32150a55e5037d1e3db4792c93bb79e82
+  data.tar.gz: 5a068566e8e4c28687a26493d29a7c9506ce2247e1cd846fb1a8768d4833fdd4
 SHA512:
-  metadata.gz: 1a333641589671b4dbd125525a2cd8c8a8ad80aa16fabe8a87faaf9ea2ca31a302931a6a91307e1cdb2ed87e2566c4f013ec4df1ab8b509574e311bae86fd9bd
-  data.tar.gz: 795e16e01d4af3a1de5675e63aac8d9f31930d7d56b172b6fcea3b4426a51e5ad056b0a6ab70048acb61cd91eb86d2527a19b2a024154abd4366a888b65d1e5b
+  metadata.gz: afbc831c4e4662ccd04ef70f5cf8eef8511a65e2138b220dd74cd53efa45596b566b7dec7b3ccce0c73f9bcfbb61d444f913457ba62cb94b8a497927fcf4180d
+  data.tar.gz: 0cadf36f4e99a2ba8f394228bbb9cb131bd9d8b80179313528f6c4f6a8130b4581c32637646cc6cea6166d3d552ba0c44862b478ae2e0e87c5c917ab7cd0bc17

data/data/client/xolo

@@ -54,9 +54,15 @@ JAMF='/usr/local/bin/jamf'
 # The path to the client data json file
 CLIENT_DATA_JSON_FILE="/Library/Application Support/xolo/client-data.json"
 
+# The path to the test client data json file, from a text xolo server
+TEST_CLIENT_DATA_JSON_FILE="/Library/Application Support/xolo/test-client-data.json"
+
 # The jamf policy trigger to update the client data
 UPDATE_CLIENT_DATA_TRIGGER='update-xolo-client-data'
 
+# The jamf policy trigger to update the test client data
+TEST_UPDATE_CLIENT_DATA_TRIGGER='test-update-xolo-client-data'
+
 # In the CLI args, titles and versions are separated by the first
 # occurrence of the equals sign
 TITLE_VERSION_SEPARATOR='='
@@ -141,6 +147,10 @@ Options:
   -v, --verbose:     Enable verbose mode, extra information will be printed.
   -d, --debug:       Enable debug mode, extra debug information will be printed.
                      Implies --verbose.
+  -t, --test         If your site has a "test" xolo server running via the same
+                     Jamf Pro server, this causes 'xolo' to only see data, titles,
+                     policies, etc, from test xolo server, not the production server.
+                     Setting the XOLO_TEST_MODE env. variable does the same thing.
   -r, --recon:       With 'install' or 'uninstall' run a 'jamf recon' after the
                      operation completes successfully.
   -n, --no-versions: With the 'list-titles' and 'list-installed' commands,
@@ -221,6 +231,7 @@ function parse_cli() {
     {h,H,-help}=show_help \
     {v,-verbose}=be_verbose \
     {d,-debug}=debugging_on \
+    {t,-test}=test_mode \
     {n,-no-versions}=no_versions \
     {r,-recon}=do_recon \
     {V,-version}=show_xolo_version || \
@@ -230,10 +241,14 @@ function parse_cli() {
   show_help=$show_help[-1]
   be_verbose=$be_verbose[-1]
   debugging_on=$debugging_on[-1]
+  test_mode=$test_mode[-1]
   no_versions=$no_versions[-1]
   do_recon=$do_recon[-1]
   show_xolo_version=$show_xolo_version[-1]
 
+  # test mode can be triggered by an env var
+  [[ -n "$XOLO_TEST_MODE" ]] && test_mode=1
+
   # if debugging is on, verbose is also on
   [[ -n $debugging_on ]] && be_verbose=1
 
@@ -246,6 +261,8 @@ function parse_cli() {
   debug "..show_help is: $show_help"
   debug "..be_verbose is: $be_verbose"
   debug "..debugging_on is: $debugging_on"
+  debug "..test_mode is: $test_mode"
+  [[ -n "$XOLO_TEST_MODE" ]] && debug "  ..via XOLO_TEST_MODE env."
   debug "..no_versions is: $no_versions"
   debug "..show_xolo_version is: $show_xolo_version"
 
@@ -381,7 +398,7 @@ app.includeStandardAdditions = true;
 
 // run() is automatically executed when the program is called, and will print any output returned.
 function run() {
-    var parsed_data = JSON.parse(app.read("${CLIENT_DATA_JSON_FILE}"));
+    var parsed_data = JSON.parse(app.read("${client_data_json_file}"));
     var result;
 
     // the line below will sub-in whatever code we were passed
@@ -761,7 +778,7 @@ function refresh_client_data() {
 
   [[ "$command" == 'refresh' ]] && say "Refreshing client data..." || debug "Refreshing client data..."
 
-  run_jamf_policy_trigger $UPDATE_CLIENT_DATA_TRIGGER
+  run_jamf_policy_trigger "$update_client_data_trigger"
 
   client_data_refreshed=1
 }
@@ -1156,6 +1173,10 @@ function expire() {
 ###############################
 
 function main() {
+  # defaults
+  client_data_json_file="$CLIENT_DATA_JSON_FILE"
+  update_client_data_trigger="$UPDATE_CLIENT_DATA_TRIGGER"
+
   # Parse the command line
   parse_cli "$@"
 
@@ -1171,10 +1192,16 @@ function main() {
     exit 0
   fi
 
+  # use the test data file if in test mode
+  if [[ -n "$test_mode" ]] ; then
+    client_data_json_file="$TEST_CLIENT_DATA_JSON_FILE"
+    update_client_data_trigger="$TEST_UPDATE_CLIENT_DATA_TRIGGER"
+  fi
+
   if [[ "$command" != "refresh" ]] ; then
     # If we're not refreshing, we need to have the client data file
     # and it needs to be up to date
-    [[ -f "$CLIENT_DATA_JSON_FILE" ]] || die "No client data file found at $CLIENT_DATA_JSON_FILE.\nPlease run the 'refresh' command to update the client data."
+    [[ -f "$client_data_json_file" ]] || die "No client data file found at $client_data_json_file.\nPlease run the 'refresh' command to update the client data."
   fi
 
   [[ -z "$command" ]] && die "No command given.\nUsage: $USAGE\nUse --help for more information."

data/lib/xolo/core/base_classes/title.rb

@@ -474,6 +474,8 @@ module Xolo
             desc: <<~ENDDESC
               One or more Jamf Computer Groups whose members will automatically have new versions installed or updated for testing before it is released.
 
+              These groups affect both the initial installation of and updates to a title when a version is added, before it is released.
+
               These computers will be used for testing not just the software, but the installation process itself. Exclusions win, so computers that are also in an excluded group for the title will not be used as pilots.
 
               Pilot groups can also be defined per version, in which case these will be ignored. Defining them in the title is useful for subscribed titles, where new versions are created automatically.
@@ -505,7 +507,9 @@ module Xolo
             readline: :jamf_computer_group_names,
             invalid_msg: 'Invalid release group(s). Must exist in Jamf and not be excluded.',
             desc: <<~ENDDESC
-              One or more Jamf Computer Groups whose members will automatically have this title installed when new versions are released.
+              One or more Jamf Computer Groups whose members will automatically have this title installed.
+
+              These groups affect the _initial_ installation of a title when a version is released. Any Mac with the title installed, will get updates (if not excluded) regardless of the release-groups.
 
               If your Xolo administrators allow it, you can use '#{Xolo::TARGET_ALL}' to auto-install on all computers that aren't excluded. If not, you'll be told how to request setting release groups to '#{Xolo::TARGET_ALL}'.
 
@@ -534,7 +538,7 @@ module Xolo
             desc: <<~ENDDESC
               One or more Jamf Computer Groups whose members are not allowed to install this title.
 
-              When a computer is in one of these groups, the title is not available even if the computer is in a pilot or release group.
+              When a computer is in one of these groups, the title is not available at all, for installation or updates, even if the computer is in a pilot or release group.
 
               When using the --excluded-groups CLI option, you can specify more than one group by using the option more than once, or by providing a single option value with the groups separated by commas.
 
@@ -663,6 +667,7 @@ module Xolo
               It will never be available to excluded computers.
 
               Self Service is not available for titles with the release_group 'all'.
+              To remove the self-service option, use --no-self-service.
             ENDDESC
           },
 
@@ -799,7 +804,7 @@ module Xolo
           # @!attribute ted_id_number
           #   @return [Integer] The Windoo::SoftwareTitle#softwareTitleId
           ted_id_number: {
-            label: 'Title Editor ID Number',
+            label: 'Title Editor ID',
             type: :integer,
             cli: false,
             changelog: false,
@@ -812,7 +817,7 @@ module Xolo
           # @!attribute jamf_patch_title_id
           #   @return [Integer] The Windoo::SoftwareTitle#softwareTitleId
           jamf_patch_title_id: {
-            label: 'The Jamf ID Number of this Patch Title',
+            label: 'Jamf Patch Title ID',
             type: :integer,
             cli: false,
             changelog: false,

data/lib/xolo/core/base_classes/version.rb

@@ -170,6 +170,7 @@ module Xolo
             changelog: true,
             desc: <<~ENDDESC
               The installation of this version requires the computer to reboot. Users will be notified before installation.
+              To remove the reboot option, use --no-reboot.
             ENDDESC
           },
 
@@ -186,6 +187,7 @@ module Xolo
             changelog: true,
             desc: <<~ENDDESC
               The installer for this version is a full installer, not an incremental patch that must be installed on top of an earlier version.
+              To remove the standalone option, use --no-standalone.
             ENDDESC
           },
 
@@ -217,6 +219,7 @@ module Xolo
               use them as a killapp by specifying '#{USE_TITLE_FOR_KILLAPP}'
 
               If not using --walkthru you can use --killapps multiple times
+              To remove all killapps, use '#{Xolo::NONE}'.
             ENDDESC
           },
 
@@ -237,6 +240,8 @@ module Xolo
               This can cause problems if that unknown version is actually newer than this version, e.g. a beta or pre-release version, or when the app has a 'self-update' mechanism that installs newer versions outside of Jamf Patch before it is aware of them.
 
               But sometimes it may be desirable to have all unknown versions updated to this version, e.g. when the title is a helper app that is not regularly updated, or when the title is being newly managed by Xolo/Jamf Patch and you want to get all existing installations onto this version.
+
+              To remove the patch-unknown option, use --no-patch-unknown.
             ENDDESC
           },
 
@@ -262,7 +267,7 @@ module Xolo
 
               When using the --pilot-groups CLI option, you can specify more than one group by using the option more than once, or by providing a single option value with the groups separated by commas.
 
-              When adding a new version, the pilot groups from the previous version will be inherited if you don't specify any. To make the new version have no pilot groups use '#{Xolo::NONE}'.
+              When adding a new version, the pilot groups from the previous version will be inherited if you don't specify any. To make the version have no pilot groups use '#{Xolo::NONE}'.
 
               NOTE: Any non-excluded computer can be used for piloting at any time by manually installing the yet-to-be-released version using `sudo xolo install <title> <version>`.  The members of the pilot groups are just the ones that will have it auto-installed.
             ENDDESC

data/lib/xolo/core/version.rb

@@ -12,7 +12,7 @@ module Xolo
 
     module Version
 
-      VERSION = '2.0.2'.freeze
+      VERSION = '2.0.3'.freeze
 
     end
 

data/lib/xolo/server/helpers/autopkg.rb

@@ -92,6 +92,7 @@ module Xolo
         # the autopkg run command for this title
         #####################################
         def autopkg_run_command(title_object)
+          # is autopkg enabled for the server as a whole?
           return unless autopkg_enabled?
 
           [
@@ -101,10 +102,10 @@ module Xolo
             'sudo',
             '-u',
             Xolo::Server.config.autopkg_user,
-            Xolo::Server.config.autopkg_executable.shellescape,
+            Xolo::Server.config.autopkg_executable,
             'run',
             '--verbose',
-            title_object.autopkg_recipe.shellescape,
+            title_object.autopkg_recipe,
             FAIL_UNTRUSTED_RECIPES_CLI_OPT
           ]
         end
@@ -118,10 +119,12 @@ module Xolo
         #   or nil if the recipe is not enabled for this title
         ##############################
         def run_autopkg_recipe(title_object)
+          # is autopkg enabled for this title?
           return unless title_object.autopkg_enabled?
 
           recipe = title_object.autopkg_recipe
           pkgdir = Pathname.new title_object.autopkg_dir
+          clean_old_pkgs pkgdir
 
           cmd = autopkg_run_command(title_object)
           progress "Running AutoPkg recipe for #{title_object.title} via command: #{cmd.join(' ')}", log: :info
@@ -140,14 +143,24 @@ module Xolo
             pkgs.max_by(&:mtime)
 
           else
-            progress "ERROR: AutoPkg recipe #{autopkg_recipe} failed with status #{status.exitstatus}.", log: :error, alert: true
+            progress "ERROR: AutoPkg recipe #{recipe} failed with status #{status.exitstatus}.", log: :error, alert: true
             log_error 'AutoPkg output:'
             souterr.lines.each { |l| log_error "AutoPkg: #{l.chomp}" }
 
-            raise "AutoPkg recipe #{autopkg_recipe} failed."
+            raise "AutoPkg recipe #{recipe} failed."
           end
         end
 
+        # remove any existing pkgs from the given autopkg output dir
+        #
+        # @param pkgdir[Pathname] the directory to clean
+        # @return [void]
+        ##################
+        def clean_old_pkgs(pkgdir)
+          log_debug "Removing .pkg files from #{pkgdir} before running autopkg recipe"
+          pkgdir.children.each { |c| c.delete if c.extname == '.pkg' }
+        end
+
       end # AutoPkg
 
     end # Helpers

data/lib/xolo/server/helpers/client_data.rb

@@ -19,7 +19,7 @@ module Xolo
       # This is used as a 'helper' in the Sinatra server
       #
       # This means methods here are available in all routes, views, and helpers
-      # the Sinatra server app.
+      # in the Sinatra server app.
       #
       # The client data package is a Jamf::JPackage that installs a JSON file on all
       # managed Macs. This JSON file contains data about all titles and versions, and

data/lib/xolo/server/mixins/title_jamf_access.rb

@@ -177,7 +177,6 @@ module Xolo
           delete_jamf_uninstall_policy
           delete_jamf_manual_install_released_policy
           delete_jamf_uninstall_script
-          delete_lingering_policies_for_title
           sleep 5
 
           # must delete this group before the patch title
@@ -192,19 +191,6 @@ module Xolo
           delete_jamf_frozen_group
         end
 
-        ################################
-        def delete_lingering_policies_for_title
-          Jamf::Policy.all_names(:refresh, cnx: jamf_cnx).each do |polname|
-            next unless polname.start_with? jamf_obj_name_pfx
-
-            polid = Jamf::Policy.valid_id(polname, cnx: jamf_cnx)
-            next unless polid
-
-            progress "Jamf: Deleting lingering policy #{polname}, possibly from a failed version action.", log: :info
-            Jamf::Policy.delete(polid, cnx: jamf_cnx)
-          end
-        end
-
         # If any title changes require updates to existing versions in
         # Jamf, this loops thru the versions and applies
         # them
@@ -281,12 +267,13 @@ module Xolo
         ######################
         def patch_report(vers: nil)
           vers = Xolo::Server::Helpers::JamfPro::PATCH_REPORT_UNKNOWN_VERSION if vers == Xolo::UNKNOWN
-          vers &&= CGI.escape vers.to_s
 
           page_size = Xolo::Server::Helpers::JamfPro::PATCH_REPORT_JPAPI_PAGE_SIZE
           page = 0
-          paged_rsrc = "#{patch_report_rsrc}?page=#{page}&page-size=#{page_size}"
-          paged_rsrc << "&filter=version%3D%3D#{vers}" if vers
+          paged_rsrc = +"#{patch_report_rsrc}?page=#{page}&page-size=#{page_size}"
+
+          filter = vers ? jp_api_filter_string_for_version(vers) : nil
+          paged_rsrc << filter if filter
 
           report = []
           loop do
@@ -297,7 +284,7 @@ module Xolo
             report += data
             page += 1
             paged_rsrc = "#{patch_report_rsrc}?page=#{page}&page-size=#{page_size}"
-            paged_rsrc << "&filter=version%3D%3D#{vers}" if vers
+            paged_rsrc << filter if filter
           end
 
           # log_debug "REPORT: #{report}"
@@ -310,6 +297,27 @@ module Xolo
           report
         end
 
+        # given a version, return a patch report filter
+        # with it properly quoted and URL escaped
+        #
+        # e.g. this string: 7.1.5 (84650)
+        # becomes: version=="7.1.5 (84650)"
+        # becomes: version%3D%3D%227.1.5+%2884650%29%22
+        # becomes: &filter=version%3D%3D%227.1.5+%2884650%29%22
+        #
+        # Use CGI.escape because it encodes all special cars, like parens,
+        # which we want here, rather than URI::Parser.new.escape
+        # which is meant to parse whole URLs leaving URL functional characters.
+        #
+        # @param vers [String] the version the filter for
+        # @return [String] the quoted and escaped filter string
+        ################################
+        def jp_api_filter_string_for_version(vers)
+          raw_fiter_query = "version==\"#{vers}\""
+          escaped_filter_query = CGI.escape raw_fiter_query
+          "&filter=#{escaped_filter_query}"
+        end
+
         #######  The Patch Ext Attribute
         ###########################################
         ###########################################
@@ -1496,6 +1504,13 @@ module Xolo
 
           configure_pol_for_self_service(pol)
           pol.save
+
+          # loop thru versions to make any SSvc changes
+          version_objects.each do |vobj|
+            ppol = vobj.jamf_patch_policy
+            vobj.configure_patch_pol_for_self_service ppol
+            ppol.save
+          end
         end
 
         # Add the jamf_manual_install_released_policy to self service if needed
@@ -1511,6 +1526,14 @@ module Xolo
           pol.remove_from_self_service
 
           pol.save
+
+          # loop thru versions to make any SSvc changes
+          version_objects.each do |vobj|
+            progress "Jamf: Removing patch policy for version '#{vobj.version}' of title '#{title}' from Self Service'", log: :info
+            ppol = vobj.jamf_patch_policy
+            ppol.remove_from_self_service
+            ppol.save
+          end
         end
 
         # Update whether or not we are in self service, based on the setting in the title
@@ -1541,8 +1564,6 @@ module Xolo
           end
 
           pol.save
-
-          # TODO: if we decide to use ssvc in patch policies, loop thru versions to make any changes
         end
 
         # configure the self-service settings of the manual_install_released_policy
@@ -1563,17 +1584,18 @@ module Xolo
             pol.add_self_service_category new_cat if new_cat
           end
 
-          new_display_name = changes_for_update&.dig(:self_service_display_name, :new) || display_name
+          new_display_name = changes_for_update&.dig(:display_name, :new) || display_name
           progress "Jamf: Setting Self Service display name to '#{new_display_name}'", log: :debug
           pol.self_service_display_name = new_display_name
 
-          new_desc = changes_for_update&.dig(:self_service_description, :new) || description
+          new_desc = changes_for_update&.dig(:description, :new) || description
           progress "Jamf: Setting Self Service description to '#{new_desc}'", log: :debug
           pol.self_service_description = new_desc
 
           pol.self_service_install_button_text = Xolo::Server::Title::SELF_SERVICE_INSTALL_BTN_TEXT
           return unless ssvc_icon_file
 
+          # TODO: Is this needed if we already have a ssvc_icon_id ??
           progress 'Jamf: Uploading Self Service icon', log: :debug
           pol.save # won't do anything unless needed, but has to exist before we can upload icons
           pol.upload :icon, ssvc_icon_file

data/lib/xolo/server/mixins/version_jamf_access.rb

@@ -212,16 +212,7 @@ module Xolo
           update_jamf_pkg_reboot if changes_for_update&.key? :reboot
           update_jamf_pkg_min_os if changes_for_update&.key? :min_os
 
-          # TODO: Update the critera for the jamf_installed_group IF
-          #
-          # - the group exists AND
-          # - the title has changed how it determines installed versions, e.g. by adding or
-          #   changing a version_script or app_bundle_id
-          #   Changing those is very rare, and ill-advised, so we will implement
-          #   this later.
-          #
-          # if jamf_installed_group_exist?
-          # end
+          update_jamf_patch_policy_patch_unknown if changes_for_update&.key? :patch_unknown
         end
 
         # Validate and fix any Jamf::JPackage objects that
@@ -411,6 +402,19 @@ module Xolo
           jamf_package.save
         end
 
+        # update the :patch_unknown for the patch policy
+        # @return [void]
+        ##############################
+        def update_jamf_patch_policy_patch_unknown
+          return unless changes_for_update&.key? :patch_unknown
+
+          ppol = jamf_patch_policy
+          action = changes_for_update[:patch_unknown][:new] ? 'Enabling' : 'Disabling'
+          progress "Jamf: #{action} 'patch_unknown' for patch policy #{ppol.name}", log: :debug
+          ppol.patch_unknown = changes_for_update[:patch_unknown][:new] ? true : false
+          ppol.save
+        end
+
         # repair the package object only
         #############################
         def repair_jamf_package
@@ -879,28 +883,6 @@ module Xolo
         def create_jamf_patch_policy
           progress "Jamf: Creating Patch Policy for Version '#{version}' of Title '#{title}'.", log: :info
 
-          # TODO: decide how many patch policies - see comments at top
-          # Probably one: for pilots initially and then rescoped to all for release
-          #
-          # TODO: How to set these, and should they be settable
-          # at the Xolo::Title or  Xolo::Version level?
-          #
-          # allow downgrade? No, to start with.
-          # When a version is released, IF we are rolling back, then this will be set.
-          # This is to be set only on the current release and only when it was a rollback.
-          #
-          # patch_unknown_versions... yes?
-          #
-          # if not in ssvc:
-          # - grace period?
-          # - update warning Message and Subject
-          #
-          # if in ssvc:
-          # - any way to use existing icon?
-          # - use title desc... do we want a version desc??
-          # - notifications?  Message and Subject? SSvc only, Notif Ctr?
-          # - deadline and grace period message and subbject
-
           ppol = Jamf::PatchPolicy.create(
             cnx: jamf_cnx,
             name: jamf_patch_policy_name,
@@ -908,26 +890,12 @@ module Xolo
             target_version: version
           )
 
-          # when first creating a patch policy, its status is always
-          # 'pilot' so the scope targets are the pilot groups, if any.
-          # When the version is released, the patch policy will be
-          # rescoped to all targets (limited by eligibility)
-          set_policy_pilot_groups ppol
+          configure_jamf_patch_policy(ppol)
 
-          # exclusions are for always
-          set_policy_exclusions ppol
-
-          # This will be set to true as needed if
+          # This is always false to start will be set to true as needed if
           # a rollback is being done
           ppol.allow_downgrade = false
 
-          # This should default to false, so that
-          # we don't accidentally downgrade non-xolo test installs,
-          # or server-pushed updates (like with commvault or cisco VPN)
-          ppol.patch_unknown = patch_unknown ? true : false
-
-          ppol.enable
-
           ppol.save
 
           # refetch it rather than using the one we just created
@@ -941,14 +909,28 @@ module Xolo
           assign_pkg_to_patch_in_jamf
 
           ppol = jamf_patch_policy
+
+          configure_jamf_patch_policy(ppol)
+
+          ppol.save
+        end
+
+        # Configure the patch policy
+        # NOTE: This doesn't save the changes!
+        ##############################
+        def configure_jamf_patch_policy(ppol)
           ppol.name = jamf_patch_policy_name
           ppol.target_version = version
 
-          # This should default tofalse, so that
+          # This should default to false, so that
           # we don't accidentally downgrade non-xolo test installs,
           # or server-pushed updates (like with commvault or cisco VPN)
           ppol.patch_unknown = patch_unknown ? true : false
 
+          # when first creating a patch policy, its status is always
+          # 'pilot' so the scope targets are the pilot groups, if any.
+          # When the version is released, the patch policy will be
+          # rescoped to all targets (limited by eligibility)
           if pilot?
             set_policy_pilot_groups ppol
           else
@@ -958,13 +940,74 @@ module Xolo
           # exclusions are for always
           set_policy_exclusions ppol
 
+          # only pilot and released versions should have the patch policy enabled
           if pilot? || released?
             ppol.enable
           else
             ppol.disable
           end
 
-          ppol.save
+          configure_patch_pol_for_self_service ppol
+        end
+
+        # Configure the patch policy for self service
+        # NOTE: Does NOT save the policy changes!
+        # @param ppol [Jamf::PatchPolicy] The patch policy to configure
+        # @return [void]
+        # ###############################
+        def configure_patch_pol_for_self_service(ppol = nil)
+          ppol ||= jamf_patch_policy
+
+          # if we're here we're in ssvc
+          progress "Jamf: Configuring patch policy for version '#{version}' of title '#{title}' for Self Service'", log: :info
+
+          # TODO: xadm settings for most of these ssvc values.
+          # TODO: deadlines, graceperiod ? needed in ruby-jss
+          msg = "#{title_object.display_name} is ready to be updated to version #{version}"
+          ppol.add_to_self_service
+          ppol.self_service_install_button_text = 'Update'
+          ppol.self_service_description = msg
+          ppol.self_service_notifications_enabled = true
+          ppol.self_service_notification_type = :ssvc_and_nctr
+          ppol.self_service_notification_subject = "#{title_object.display_name} update available"
+          ppol.self_service_notification_message = msg
+          ppol.self_service_reminders_enabled = true
+          ppol.self_service_reminder_frequency = 24 # hours
+
+          return unless title_object.ssvc_icon_id
+
+          set_patch_policy_ssvc_icon ppol, title_object.ssvc_icon_id
+        end
+
+        # Set an existing ssvc icon for a given patch policy
+        #
+        # NOTE: Update this if/when ruby-jss and the JPAPI can handle
+        # PatchPolicy Icons.
+        #
+        # This shouldn't interfere with a future #save of a PatchPolicy
+        # object, since that xml won't contain self_service_icon data at all.
+        #
+        # @param ppol [Jamf::PatchPolicy] The Patch Pol. to set the icon for
+        # @param icon_id [Integer, String] The id of the existing icon to use.
+        # @return [Void]
+        ##########################
+        def set_patch_policy_ssvc_icon(ppol, icon_id)
+          # this str can't be frozen for now
+          icon_xml = +<<~ENDXML
+            <?xml version="1.0" encoding="UTF-8"?>
+            <patch_policy>
+              <user_interaction>
+                <self_service_icon>
+                  <id>#{icon_id}</id>
+                </self_service_icon>
+              </user_interaction>
+            </patch_policy>
+          ENDXML
+
+          log_debug "Jamf: Adding existing SSvc icon to patch policy for version '#{version}' of title '#{title}'"
+          # TODO: in ruby-jss, update c_put and related methods to
+          # use unfrozen dups of strings for #gsub
+          jamf_cnx.c_put ppol.rest_rsrc, icon_xml
         end
 
         # @return [String] the URL for the Jamf Pro Patch Policy that updates to this version

data/lib/xolo/server/routes/titles.rb

@@ -53,12 +53,6 @@ module Xolo
 
           with_streaming do
             title.create
-            # we don't need to update client data when managed titles are created
-            # because they don't have any versions yet, so there's nothing a
-            # client can do with them.
-            #
-            # However subscribed titles will have their latest version activated
-            # will need client data updated
           end
         end
 
@@ -99,7 +93,8 @@ module Xolo
           log_info "Admin #{session[:admin]} is updating title '#{params[:title]}'"
           with_streaming do
             title.update new_data
-            update_client_data
+            # Moved to title.update
+            # update_client_data
           end
         end
 
@@ -127,7 +122,8 @@ module Xolo
 
           with_streaming do
             title.release vers_to_release
-            update_client_data
+            # moved to title.release
+            # update_client_data
           end
         end
 
@@ -148,7 +144,8 @@ module Xolo
 
           with_streaming do
             title.repair repair_versions: do_versions
-            update_client_data
+            # moved to title.repair
+            # update_client_data
           end
         end
 
@@ -162,7 +159,8 @@ module Xolo
 
           with_streaming do
             title.delete
-            update_client_data
+            # moved to title.delete
+            # update_client_data
           end
         end
 

data/lib/xolo/server/routes/versions.rb

@@ -77,7 +77,8 @@ module Xolo
           Xolo::Server.rw_lock(data[:title], data[:version]).with_write_lock do
             with_streaming do
               vers.create
-              update_client_data
+              # moved to vers.create
+              # update_client_data
             end
           end
         end
@@ -126,7 +127,8 @@ module Xolo
 
           with_streaming do
             vers.update new_data
-            update_client_data
+            # moved to vers.update
+            # update_client_data
           end
         end
 
@@ -149,7 +151,8 @@ module Xolo
 
           with_streaming do
             vers.delete
-            update_client_data
+            # moved to vers.delete
+            # update_client_data
           end
         end
 
@@ -206,7 +209,8 @@ module Xolo
 
           with_streaming do
             vers.repair
-            update_client_data
+            # moved to vers.repair
+            # update_client_data
           end
         end
 

data/lib/xolo/server/title.rb

@@ -677,6 +677,10 @@ module Xolo
 
         log_change msg: 'Title Created'
 
+        # we don't need to update client data when titles are created
+        # because they don't have any versions yet, so there's nothing a
+        # client can do with them. It'll be updated when the version is created
+
         # ssvc icon is uploaded in a separate process, and the
         # title data file will be updated as needed then.
       ensure
@@ -729,7 +733,8 @@ module Xolo
 
         # any new self svc icon will be uploaded in a separate process
         # and the local data will be updated again then
-        #
+
+        server_app_instance.update_client_data
       rescue => e
         log_change msg: "ERROR: The update failed and the changes didn't all go through!\n#{e.class}: #{e.message}\nSee server log for details."
 
@@ -929,6 +934,7 @@ module Xolo
 
         progress "Deleting Xolo server data for title '#{title}'", log: :info
         title_dir.rmtree
+        server_app_instance.update_client_data
       ensure
         unlock
       end
@@ -950,12 +956,10 @@ module Xolo
 
         update_versions_for_release version_to_release
 
-        # the jamf 'manual install released' policy for the new release
-        # is updated in the release_version method below
-
         # update the title
         self.released_version = version_to_release
         save_local_data
+        server_app_instance.update_client_data
       ensure
         unlock
       end
@@ -1110,6 +1114,8 @@ module Xolo
           progress '#########'
           vobj.repair
         end
+
+        server_app_instance.update_client_data
       ensure
         unlock
       end

data/lib/xolo/server/tmp_overrides.rb

@@ -0,0 +1,38 @@
+# Temp fixes for ruby-jss
+###########################
+module Jamf
+
+  #########################
+  module SelfServable
+
+    # set ssvc notification settings in xml
+    # FIX: its 'notification_enabled' NOT 'notifications_enabled'
+    def add_self_service_notification_xml(ssvc)
+      return unless @self_service_data_config[:notifications_supported]
+
+      # oldstyle/broken, only sscv notifs
+      if @self_service_data_config[:notifications_supported] == :ssvc_only
+        ssvc.add_element('notification').text = self_service_notifications_enabled.to_s
+        ssvc.add_element('notification_subject').text = self_service_notification_subject if self_service_notification_subject
+        ssvc.add_element('notification_message').text = self_service_notification_message if self_service_notification_message
+        return
+      end
+
+      # newstyle, 'notifications' subset
+      notif = ssvc.add_element('notifications')
+      # NEXT LINE IS THE FIX until pushed via ruby-jss, its 'notification_enabled' NOT 'notifications_enabled'
+      notif.add_element('notification_enabled').text = self_service_notifications_enabled.to_s
+      notif.add_element('notification_type').text = NOTIFICATION_TYPES[self_service_notification_type] if self_service_notification_type
+      notif.add_element('notification_subject').text = self_service_notification_subject if self_service_notification_subject
+      notif.add_element('notification_message').text = self_service_notification_message if self_service_notification_message
+
+      return unless @self_service_data_config[:notification_reminders]
+
+      reminds = notif.add_element('reminders')
+      reminds.add_element('notification_reminders_enabled').text = self_service_reminders_enabled.to_s
+      reminds.add_element('notification_reminder_frequency').text = self_service_reminder_frequency.to_s if self_service_reminder_frequency
+    end
+
+  end # module
+
+end # module

data/lib/xolo/server/version.rb

@@ -281,8 +281,11 @@ module Xolo
         # create it in xolo
         vobj.create
 
+        # moved to vobj.create:
+        # vobj.server_app_instance.update_client_data
+
         # tell someone
-        msg = "ACTION REQUIRED: New pilot version '#{new_version}' for subscribed title '#{title_object.title}' has been created in Xolo via subscription."
+        msg = "ACTION REQUIRED: New pilot for subscribed title '#{title_object.title}', version '#{new_version}' has been created in Xolo via subscription."
 
         # if not autopkg enabled, we need to tell someone to upload a pkg for this new version
         unless title_object.autopkg_enabled?
@@ -638,6 +641,10 @@ module Xolo
         lock
         @current_action = :creating
 
+        # NOTE: this for later in this method,
+        # since uploads are processed in separate threads
+        pkg_upload_given = !pkg_to_upload.pix_empty?
+
         self.creation_date = Time.now
         self.created_by = admin
         self.status = STATUS_PENDING
@@ -671,7 +678,8 @@ module Xolo
         # so we don't want to do it here in the create method
 
         # do we have an uploaded pkg?
-        if pkg_to_upload.to_s.start_with? '/'
+        if pkg_upload_given
+
           progress "Pkg will be uploaded to xolo via xadm shortly, from path '#{pkg_to_upload}'", log: :info
 
         # if we have an autopkg recipe and dir, get the .pkg and upload it to Jamf
@@ -685,6 +693,8 @@ module Xolo
           # no alert when subscribed because a better alert mesg is sent from add_version_via_subscription
           subscribed? ? progress(msg, log: :warn) : progress(msg, log: :warn, alert: true)
         end
+
+        server_app_instance.update_client_data
       ensure
         unlock
       end
@@ -757,6 +767,7 @@ module Xolo
         update_local_instance_values
         save_local_data
 
+        server_app_instance.update_client_data
         # new pkg uploads happen in a separate process
       rescue => e
         log_change msg: "ERROR: The update failed and the changes didn't all go through!\n#{e.class}: #{e.message}\nSee server log for details."
@@ -816,6 +827,10 @@ module Xolo
 
         end
         save_local_data
+        # no need to update client data now if we're being repaired along with our title
+        return if title_object.current_action == :repairing
+
+        server_app_instance.update_client_data
       ensure
         unlock
       end
@@ -1002,6 +1017,7 @@ module Xolo
         log_change msg: 'Version Deleted'
 
         progress "Version '#{version}' of Title '#{title}' has been deleted from Xolo.", log: :info
+        server_app_instance.update_client_data
       ensure
         unlock
       end

data/lib/xolo/server.rb

@@ -43,6 +43,10 @@ require 'concurrent/atomic/reentrant_read_write_lock'
 require 'concurrent/executor/thread_pool_executor'
 require 'concurrent/timer_task'
 
+# Temp fixes or overrides, esp for ruby-jss or windoo
+#############
+require 'xolo/server/tmp_overrides'
+
 # Xolo Server - order matters
 ######
 require 'xolo/server/constants'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: xolo-server
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.3
 platform: ruby
 authors:
 - Chris Lasell
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-16 00:00:00.000000000 Z
+date: 2026-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -220,6 +220,7 @@ files:
 - lib/xolo/server/routes/uploads.rb
 - lib/xolo/server/routes/versions.rb
 - lib/xolo/server/title.rb
+- lib/xolo/server/tmp_overrides.rb
 - lib/xolo/server/version.rb
 homepage: https://pixaranimationstudios.github.io/xolo-home/
 licenses: