Fix ADE forced software updates

Do not require an update when the system is already up to date.
zentralopensource · Mar 13, 2024 · 1ba6ddb · 1ba6ddb
1 parent 2669bdf
commit 1ba6ddb
Show file tree

Hide file tree

Showing 4 changed files with 47 additions and 3 deletions.
diff --git a/tests/mdm/test_dep_enrollment_public_views.py b/tests/mdm/test_dep_enrollment_public_views.py
@@ -158,6 +158,35 @@ def test_dep_enroll_max_macos_update_required(self, vicsp, post_event):
         self.assertEqual(last_event.payload["status"], "warning")
         self.assertEqual(last_event.payload["reason"], "OS update to version 14.3 required")
 
+    def test_dep_enroll_max_macos_no_update_required(self, vicsp, post_event):
+        vicsp.side_effect = lambda d: d
+        session, _, _ = force_dep_enrollment_session(self.mbu, completed=True)
+        force_software_update(
+            device_id="J413AP",
+            version="14.4.0",
+            build="23E214",
+            posting_date=datetime.date(2024, 3, 7),
+            expiration_date=datetime.date(3000, 1, 2)
+        )
+        enrollment = session.dep_enrollment
+        enrollment.macos_min_version = "14.3.1"
+        enrollment.macos_max_version = "15"
+        enrollment.save()
+        response = self.client.post(reverse("mdm_public:dep_enroll", args=(enrollment.enrollment_secret.secret,)),
+                                    data=plistlib.dumps({"PRODUCT": "Macmini9,1",
+                                                         "SERIAL": session.enrolled_device.serial_number,
+                                                         "UDID": session.enrolled_device.udid,
+                                                         "MDM_CAN_REQUEST_SOFTWARE_UPDATE": True,
+                                                         "OS_VERSION": "14.4",
+                                                         "VERSION": "23A214",
+                                                         "SOFTWARE_UPDATE_DEVICE_ID": "J413AP"}),
+                                    content_type="application/octet-stream")
+        self.assertEqual(response.status_code, 200)
+        self.assertSuccess(post_event)
+        _, data = verify_signed_payload(response.content)
+        payload = plistlib.loads(data)
+        self.assertEqual(payload["PayloadIdentifier"], "zentral.mdm")
+
     def test_dep_enroll_max_ios_update_required_min_fallback(self, vicsp, post_event):
         vicsp.side_effect = lambda d: d
         session, _, _ = force_dep_enrollment_session(self.mbu, completed=True)

diff --git a/tests/mdm/test_software_updates.py b/tests/mdm/test_software_updates.py
@@ -9,7 +9,9 @@
 from django.utils.crypto import get_random_string
 from zentral.contrib.inventory.models import MetaBusinessUnit
 from zentral.contrib.mdm.models import Platform, SoftwareUpdate, SoftwareUpdateDeviceID
-from zentral.contrib.mdm.software_updates import best_available_software_updates, sync_software_updates
+from zentral.contrib.mdm.software_updates import (best_available_software_updates,
+                                                  best_available_software_update_for_device_id_and_build,
+                                                  sync_software_updates)
 from zentral.core.events.base import AuditEvent
 from .utils import force_ota_enrollment_session, force_software_update
 
@@ -473,6 +475,19 @@ def test_available_software_updates_all_updates(self):
         self.assertEqual(patch_update, su_p)
         self.assertEqual(rsr_update, su_e)
 
+    # best_available_software_update_for_device_id_and_build
+
+    def test_available_software_update_for_device_id_and_build(self):
+        su = force_software_update(
+            device_id="J413AP",
+            version="14.4.0",
+            build="23E214",
+            posting_date=datetime.date(2024, 3, 7),
+            expiration_date=datetime.date(3000, 1, 2)
+        )
+        b_su = best_available_software_update_for_device_id_and_build("J413AP", "123456")
+        self.assertEqual(su, b_su)
+
     # management command
 
     @patch("zentral.contrib.mdm.software_updates.requests.get")

diff --git a/zentral/contrib/mdm/models.py b/zentral/contrib/mdm/models.py
@@ -2687,7 +2687,7 @@ class Meta:
 
     @property
     def comparable_os_version(self):
-        return (self.major, self.minor, self.patch, self.extra)
+        return tuple(e for e in (self.major, self.minor, self.patch, self.extra) if e != "")
 
     def target_os_version(self):
         s = ".".join(

diff --git a/zentral/contrib/mdm/public_views/dep.py b/zentral/contrib/mdm/public_views/dep.py
@@ -83,7 +83,7 @@ def verify_os_version(self):
             software_update = best_available_software_update_for_device_id_and_build(
                 self.software_update_device_id, self.build
             )
-            if software_update:
+            if software_update and software_update.comparable_os_version > make_comparable_os_version(self.os_version):
                 details = {"OSVersion": software_update.target_os_version()}
                 if software_update.build:
                     details["BuildVersion"] = software_update.build