#!/bin/bash
#
#  AAPCompliance.intune.sh
#  Microsoft Intune custom attribute: App Auto-Patch patch status.
#
#  Reads /Library/Application Support/AppAutoPatch/compliance.json, which App Auto-Patch's root
#  helper writes after each discovery and patch run, and prints one value from it. Nothing else is
#  run. Add it in Intune under Devices > macOS > Custom attributes, with the data type String
#  (or Integer for the counts and day values). Set FIELD to the value to report; add one custom
#  attribute per value:
#
#    status                  Not checked, No applicable applications discovered, Compliant, Pending,
#                            Deadline approaching or Overdue (default)
#    pendingCount            Number of pending updates
#    pendingLabels           Pending Installomator labels, separated by spaces
#    oldestPendingDays       Days since the oldest pending update was first seen
#    daysUntilHardDeadline   Days left before the hard deadline (negative once passed)
#    brokenLabels            Labels that report no latest version, separated by spaces
#    lastDiscovery           When updates were last checked (ISO 8601)
#    lastSuccessfulPatch     When App Auto-Patch last installed or confirmed an app (ISO 8601)
#
#  Prints "Not reported" when the file is missing, and nothing when the value is not set.
#

FIELD="status"
FILE="/Library/Application Support/AppAutoPatch/compliance.json"

if [ ! -f "${FILE}" ]; then
    echo "Not reported"
    exit 0
fi

case "${FIELD}" in
    pendingLabels|brokenLabels)
        /usr/bin/plutil -extract "${FIELD}" json -o - "${FILE}" 2>/dev/null \
            | /usr/bin/tr -d '[]"' | /usr/bin/tr ',' ' '
        echo
        ;;
    *)
        /usr/bin/plutil -extract "${FIELD}" raw -o - "${FILE}" 2>/dev/null
        ;;
esac