002 add pppc keys

.specify/feature.json

@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/001-fix-deprecations"
+  "feature_directory": "specs/002-add-pppc-keys"
 }

.specify/memory/constitution.md

@@ -51,6 +51,7 @@ acceptable only for components without adequate SwiftUI coverage.
 
 - Minimum deployment target: macOS 13.0.
 - All interactive UI elements MUST have accessibility identifiers and labels.
+- Service keys in the main window MUST appear in alphabetical order.
 - Profiles MUST be saveable locally (signed or unsigned) and uploadable to
   Jamf Pro (bearer token, basic auth fallback, or OAuth client credentials).
 
@@ -86,4 +87,4 @@ Git) are maintained in `CLAUDE.md`. Amendments require:
 All PRs and code reviews MUST verify compliance with this constitution.
 Complexity violations MUST be justified in the PR description.
 
-**Version**: 1.1.0 | **Ratified**: 2026-04-09 | **Last Amended**: 2026-04-09
+**Version**: 1.2.0 | **Ratified**: 2026-04-09 | **Last Amended**: 2026-04-09

CLAUDE.md

@@ -24,8 +24,16 @@
 - Avoid snake_case in test names (e.g., `generateDisplayName_bundleIdentifier`). If a name is getting long, use a Trait with a sentence-style description instead.
 - For complex tests, use a descriptive `@Test("...")` trait that explains the scenario and expected outcome so the test is understandable without reading the body.
 - Use parameterized tests with Traits where it reduces duplication; 1–2 args is ideal, max 3
+  ```swift
+  @Test("Service key round-trip preserves value", arguments: [
+      ("BluetoothAlways", "Allow"),
+      ("SystemPolicyAppBundles", "Deny")
+  ])
+  func serviceKeyRoundTrip(serviceKey: String, value: String) async { … }
+  ```
 - Beyond 3 params: create separate tests with some values hard-coded
 - Use `deinit` as teardown for repeated cleanup across tests in a suite. Use `class` for suites that need `deinit`; use `struct` otherwise.
+- After adding or refactoring tests, look for duplication or tests that are no longer relevant. Do not add redundant tests.
 
 ## UI Testing Conventions
 
@@ -35,6 +43,14 @@
 - Use accessibility identifiers set in `setupAccessibilityIdentifiers()` to locate UI elements
 - The `-UITestMode` launch argument triggers test-specific setup (e.g., loading a test profile)
 
+## UI Conventions
+
+- Service keys (popup rows) in the main window must appear in alphabetical order.
+
+## Naming
+
+- Avoid "new" in test or function names — it becomes stale quickly. Describe the behavior, not the novelty.
+
 ## Git
 
 - Do not stage or commit changes in terminal sessions

PPPC Utility.xcodeproj/project.pbxproj

@@ -59,6 +59,7 @@
 		C07B1FB82AF596D80075E38B /* UploadManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = C07B1FB72AF596D80075E38B /* UploadManager.swift */; };
 		C0A2B5422B1A5D5C0007F510 /* JamfProAPIClientTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = C0A2B5412B1A5D5C0007F510 /* JamfProAPIClientTests.swift */; };
 		C0A85DB5279873C600086283 /* TestTCCUnsignedProfile-allLower.mobileconfig in Resources */ = {isa = PBXBuildFile; fileRef = C0A85DB4279873C600086283 /* TestTCCUnsignedProfile-allLower.mobileconfig */; };
+		AA002200000000000000002B /* TestTCCUnsignedProfile-Legacy.mobileconfig in Resources */ = {isa = PBXBuildFile; fileRef = AA002200000000000000002A /* TestTCCUnsignedProfile-Legacy.mobileconfig */; };
 		C0DC2BB92B2263FC003A4474 /* Haversack in Frameworks */ = {isa = PBXBuildFile; productRef = C0DC2BB82B2263FC003A4474 /* Haversack */; };
 		C0E0383F27A30C7100A23FA2 /* PPPCServiceInfo.swift in Sources */ = {isa = PBXBuildFile; fileRef = C0E0383D27A30C7100A23FA2 /* PPPCServiceInfo.swift */; };
 		C0E0384027A30C7100A23FA2 /* PPPCServicesManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = C0E0383E27A30C7100A23FA2 /* PPPCServicesManager.swift */; };
@@ -151,6 +152,7 @@
 		C07B1FB72AF596D80075E38B /* UploadManager.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = UploadManager.swift; sourceTree = "<group>"; };
 		C0A2B5412B1A5D5C0007F510 /* JamfProAPIClientTests.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = JamfProAPIClientTests.swift; sourceTree = "<group>"; };
 		C0A85DB4279873C600086283 /* TestTCCUnsignedProfile-allLower.mobileconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; path = "TestTCCUnsignedProfile-allLower.mobileconfig"; sourceTree = "<group>"; };
+		AA002200000000000000002A /* TestTCCUnsignedProfile-Legacy.mobileconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; path = "TestTCCUnsignedProfile-Legacy.mobileconfig"; sourceTree = "<group>"; };
 		C0E0383D27A30C7100A23FA2 /* PPPCServiceInfo.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = PPPCServiceInfo.swift; sourceTree = "<group>"; };
 		C0E0383E27A30C7100A23FA2 /* PPPCServicesManager.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = PPPCServicesManager.swift; sourceTree = "<group>"; };
 		C0E0384127A30D1D00A23FA2 /* PPPCServices.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = PPPCServices.json; sourceTree = "<group>"; };
@@ -266,6 +268,7 @@
 			children = (
 				5F95AE2B2315B172002E0A22 /* TestTCCProfileSigned-Broken.mobileconfig */,
 				C0A85DB4279873C600086283 /* TestTCCUnsignedProfile-allLower.mobileconfig */,
+				AA002200000000000000002A /* TestTCCUnsignedProfile-Legacy.mobileconfig */,
 				5F95AE2A2315B172002E0A22 /* TestTCCUnsignedProfile-Broken.mobileconfig */,
 				5F95AE2C2315B172002E0A22 /* TestTCCUnsignedProfile-Empty.mobileconfig */,
 				5F95AE292315B172002E0A22 /* TestTCCUnsignedProfile.mobileconfig */,
@@ -536,6 +539,7 @@
 				5F95AE312315B172002E0A22 /* TestTCCUnsignedProfile-Empty.mobileconfig in Resources */,
 				5F95AE2F2315B172002E0A22 /* TestTCCUnsignedProfile-Broken.mobileconfig in Resources */,
 				C0A85DB5279873C600086283 /* TestTCCUnsignedProfile-allLower.mobileconfig in Resources */,
+				AA002200000000000000002B /* TestTCCUnsignedProfile-Legacy.mobileconfig in Resources */,
 				C0EE9A7D28639BF800738B6B /* TestTCCProfileForJamfProAPI.txt in Resources */,
 				5F95AE302315B172002E0A22 /* TestTCCProfileSigned-Broken.mobileconfig in Resources */,
 			);

PPPC UtilityTests/Helpers/TCCProfileBuilder.swift

@@ -47,7 +47,10 @@ class TCCProfileBuilder: NSObject {
     func buildTCCPolicies(allowed: Bool?, authorization: TCCPolicyAuthorizationValue?) -> [String: [TCCPolicy]] {
         return [
             "SystemPolicyAllFiles": [buildTCCPolicy(allowed: allowed, authorization: authorization)],
-            "AppleEvents": [buildTCCPolicy(allowed: allowed, authorization: authorization)]
+            "AppleEvents": [buildTCCPolicy(allowed: allowed, authorization: authorization)],
+            "BluetoothAlways": [buildTCCPolicy(allowed: allowed, authorization: authorization)],
+            "SystemPolicyAppBundles": [buildTCCPolicy(allowed: allowed, authorization: authorization)],
+            "SystemPolicyAppData": [buildTCCPolicy(allowed: allowed, authorization: authorization)]
         ]
     }
 

PPPC UtilityTests/ModelTests/ExecutableTests.swift

@@ -34,60 +34,62 @@ import Testing
 struct ExecutableTests {
     let executable = Executable()
 
-    @Test("Display name uses last component of bundle identifier")
-    func generateDisplayNameBundleIdentifier() {
+    @Test(
+        "Display name uses last component of identifier",
+        arguments: [
+            ("com.example.MyApp", "MyApp"),
+            ("/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal", "Terminal"),
+            ("Terminal", "Terminal")
+        ])
+    func generateDisplayName(identifier: String, expected: String) {
         // when
-        let displayName = executable.generateDisplayName(identifier: "com.example.MyApp")
+        let displayName = executable.generateDisplayName(identifier: identifier)
 
         // then
-        #expect(displayName == "MyApp")
+        #expect(displayName == expected)
     }
 
-    @Test("Display name uses last component of path identifier")
-    func generateDisplayNamePathIdentifier() {
+    @Test(
+        "Icon path matches identifier type",
+        arguments: [
+            ("com.example.MyApp", "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/GenericApplicationIcon.icns"),
+            ("/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal", "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/ExecutableBinaryIcon.icns")
+        ])
+    func generateIconPath(identifier: String, expected: String) {
         // when
-        let displayName = executable.generateDisplayName(identifier: "/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal")
+        let iconPath = executable.generateIconPath(identifier: identifier)
 
         // then
-        #expect(displayName == "Terminal")
+        #expect(iconPath == expected)
     }
 
-    @Test("Display name returns identifier when single component")
-    func generateDisplayNameSingleComponent() {
-        // when
-        let displayName = executable.generateDisplayName(identifier: "Terminal")
-
-        // then
-        #expect(displayName == "Terminal")
-    }
-
-    @Test("Icon path is application for bundle identifier")
-    func generateIconPathForBundleIdentifier() {
-        // when
-        let iconPath = executable.generateIconPath(identifier: "com.example.MyApp")
-
-        // then
-        #expect(iconPath == IconFilePath.application)
-    }
-
-    @Test("Icon path is binary for path identifier")
-    func generateIconPathForPathIdentifier() {
-        // when
-        let iconPath = executable.generateIconPath(identifier: "/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal")
-
-        // then
-        #expect(iconPath == IconFilePath.binary)
-    }
-
-    @Test("All policy values default to dash")
-    func allPolicyValuesAreDefaults() {
+    @Test("All policy properties default to dash")
+    func policyPropertiesDefaultToDash() {
         let policy = Policy()
 
-        // when
-        let values = policy.allPolicyValues()
-
         // then
-        #expect(values.count == 20)
-        #expect(values.allSatisfy { $0 == "-" })
+        #expect(policy.Accessibility == "-")
+        #expect(policy.AddressBook == "-")
+        #expect(policy.BluetoothAlways == "-")
+        #expect(policy.Calendar == "-")
+        #expect(policy.Camera == "-")
+        #expect(policy.FileProviderPresence == "-")
+        #expect(policy.ListenEvent == "-")
+        #expect(policy.MediaLibrary == "-")
+        #expect(policy.Microphone == "-")
+        #expect(policy.Photos == "-")
+        #expect(policy.PostEvent == "-")
+        #expect(policy.Reminders == "-")
+        #expect(policy.ScreenCapture == "-")
+        #expect(policy.SpeechRecognition == "-")
+        #expect(policy.SystemPolicyAllFiles == "-")
+        #expect(policy.SystemPolicyAppBundles == "-")
+        #expect(policy.SystemPolicyAppData == "-")
+        #expect(policy.SystemPolicyDesktopFolder == "-")
+        #expect(policy.SystemPolicyDocumentsFolder == "-")
+        #expect(policy.SystemPolicyDownloadsFolder == "-")
+        #expect(policy.SystemPolicyNetworkVolumes == "-")
+        #expect(policy.SystemPolicyRemovableVolumes == "-")
+        #expect(policy.SystemPolicySysAdminFiles == "-")
     }
 }

PPPC UtilityTests/ModelTests/ModelTests.swift

@@ -267,39 +267,46 @@ struct ModelTests {
         #expect(model.selectedExecutables.first?.policy.SystemPolicyAllFiles == "Deny")
     }
 
-    // MARK: - tests for policyFromString
-
-    @Test
-    func policyWhenUsingAllow() {
-        let app = Executable(identifier: "id", codeRequirement: "req")
+    // MARK: - Service key round-trips
+
+    @Test(
+        "Service key round-trip preserves value",
+        arguments: [
+            ("BluetoothAlways", "Allow"),
+            ("SystemPolicyAppBundles", "Deny"),
+            ("SystemPolicyAppData", "Allow")
+        ])
+    func serviceKeyRoundTrip(serviceKey: String, value: String) async {
+        let model = ModelBuilder()
+            .addExecutable(settings: [serviceKey: value])
+            .build()
 
         // when
-        let policy = model.policyFromString(executable: app, value: "Allow")
+        let profile = model.exportProfile(organization: "Org", identifier: "ID", displayName: "Name", payloadDescription: "Desc")
+        await model.importProfile(tccProfile: profile)
 
         // then
-        #expect(policy?.authorization == .allow)
+        let result = model.selectedExecutables.last?.policy.value(forKey: serviceKey) as? String
+        #expect(result == value)
     }
 
-    @Test
-    func policyWhenUsingDeny() {
-        let app = Executable(identifier: "id", codeRequirement: "req")
-
-        // when
-        let policy = model.policyFromString(executable: app, value: "Deny")
-
-        // then
-        #expect(policy?.authorization == .deny)
-    }
+    // MARK: - tests for policyFromString
 
-    @Test
-    func policyWhenUsingAllowForStandardUsers() {
+    @Test(
+        "policyFromString maps display value to authorization",
+        arguments: [
+            ("Allow", TCCPolicyAuthorizationValue.allow),
+            ("Deny", TCCPolicyAuthorizationValue.deny),
+            ("Let Standard Users Approve", TCCPolicyAuthorizationValue.allowStandardUserToSetSystemService)
+        ])
+    func policyFromStringAuthorization(value: String, expected: String) {
         let app = Executable(identifier: "id", codeRequirement: "req")
 
         // when
-        let policy = model.policyFromString(executable: app, value: "Let Standard Users Approve")
+        let policy = model.policyFromString(executable: app, value: value)
 
         // then
-        #expect(policy?.authorization == .allowStandardUserToSetSystemService)
+        #expect(policy?.authorization == expected)
     }
 
     @Test

PPPC UtilityTests/ModelTests/PPPCServicesManagerTests.swift

@@ -39,7 +39,22 @@ struct PPPCServicesManagerTests {
         let actual = PPPCServicesManager()
 
         // then
-        #expect(actual.allServices.count == 21)
+        #expect(actual.allServices.count == 24)
+    }
+
+    @Test(
+        "Service is loaded with correct English name",
+        arguments: [
+            ("BluetoothAlways", "Bluetooth Always"),
+            ("SystemPolicyAppBundles", "App Bundles"),
+            ("SystemPolicyAppData", "App Data")
+        ])
+    func serviceIsLoaded(key: String, expectedName: String) throws {
+        let services = PPPCServicesManager()
+        let service = try #require(services.allServices[key])
+
+        // then
+        #expect(service.englishName == expectedName)
     }
 
     @Test("User help with entitlements")

PPPC UtilityTests/TCCProfileImporterTests/TCCProfileImporterTests.swift

@@ -72,7 +72,31 @@ struct TCCProfileImporterTests {
 
         let tccProfile = try tccProfileImporter.decodeTCCProfile(fileUrl: resourceURL)
         #expect(!tccProfile.content.isEmpty)
-        #expect(!tccProfile.content[0].services.isEmpty)
+        let services = tccProfile.content[0].services
+        #expect(!services.isEmpty)
+        #expect(services.count == 24, "Profile should contain exactly 24 services")
+        #expect(services["BluetoothAlways"] != nil, "BluetoothAlways service should exist")
+        #expect(services["SystemPolicyAppBundles"] != nil, "SystemPolicyAppBundles service should exist")
+        #expect(services["SystemPolicyAppData"] != nil, "SystemPolicyAppData service should exist")
+    }
+
+    @Test("Legacy profile without new keys imports with dash defaults")
+    func legacyProfileImportsWithDashDefaults() async throws {
+        let tccProfileImporter = TCCProfileImporter()
+        let resourceURL = try getResourceProfile(fileName: "TestTCCUnsignedProfile-Legacy")
+        let tccProfile = try tccProfileImporter.decodeTCCProfile(fileUrl: resourceURL)
+
+        // when
+        let model = Model()
+        await model.importProfile(tccProfile: tccProfile)
+
+        // then
+        #expect(!model.selectedExecutables.isEmpty, "Legacy profile should import at least one executable")
+        for executable in model.selectedExecutables {
+            #expect(executable.policy.BluetoothAlways == "-", "BluetoothAlways should default to dash for legacy profiles")
+            #expect(executable.policy.SystemPolicyAppBundles == "-", "SystemPolicyAppBundles should default to dash for legacy profiles")
+            #expect(executable.policy.SystemPolicyAppData == "-", "SystemPolicyAppData should default to dash for legacy profiles")
+        }
     }
 
     @Test

PPPC UtilityTests/TCCProfileImporterTests/TCCProfileTests.swift

@@ -63,7 +63,7 @@ struct TCCProfileTests {
             #expect(content.version == 1)
 
             // then verify the services key
-            #expect(content.services.count == 2)
+            #expect(content.services.count == 5)
             let allFiles = content.services["SystemPolicyAllFiles"]
             #expect(allFiles?.count == 1)
             allFiles?.forEach { policy in
@@ -77,6 +77,9 @@ struct TCCProfileTests {
                 #expect(policy.receiverIdentifierType == "policy receiver id type")
                 #expect(policy.receiverCodeRequirement == "policy receiver code req")
             }
+            #expect(content.services["BluetoothAlways"] != nil, "BluetoothAlways should be included")
+            #expect(content.services["SystemPolicyAppBundles"] != nil, "SystemPolicyAppBundles should be included")
+            #expect(content.services["SystemPolicyAppData"] != nil, "SystemPolicyAppData should be included")
         }
     }
 
@@ -108,7 +111,7 @@ struct TCCProfileTests {
             #expect(content.version == 1)
 
             // then verify the services key
-            #expect(content.services.count == 2)
+            #expect(content.services.count == 5)
             let allFiles = content.services["SystemPolicyAllFiles"]
             #expect(allFiles?.count == 1)
             allFiles?.forEach { policy in
@@ -141,13 +144,7 @@ struct TCCProfileTests {
             #expect(content.version == 1)
 
             // then verify the services key
-            #expect(content.services.count == 2)
-            let allFiles = content.services["SystemPolicyAllFiles"]
-            #expect(allFiles?.count == 1)
-            allFiles?.forEach { policy in
-                #expect(policy.allowed == false)
-                #expect(policy.authorization == .allow)
-            }
+            #expect(content.services.count == 5)
         }
     }