device_management

package

v0.7.0 Latest Latest Go to latest Published: Jul 17, 2026 License: MIT Imports: 0 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/deploymenttheory/go-api-sdk-apple

Links

Open Source Insights

README ¶

device_management

A generated Go SDK for Apple MDM and Declarative Device Management (DDM), built from Apple's canonical schema repo apple/device-management.

Typed values in → spec-validated Apple config out:

apple/device-management @ pinned commit
        │ fetchspec (download, parse YAML, snapshot)
        ▼
metadata/specs/**.json           committed, reviewed snapshots + PROVENANCE
        │ gendm (offline, deterministic)
        ▼
mdm/commands  mdm/profiles       generated structs + Validate() + registries
ddm/{configurations,assets,
     activations,management}
        │ mdm / ddm envelope builders (the workflow engine)
        ▼
MDM command plists · .mobileconfig profiles · DDM declaration JSON

Usage

import (
    dm "github.com/deploymenttheory/go-api-sdk-apple/device_management"
    "github.com/deploymenttheory/go-api-sdk-apple/device_management/ddm"
    "github.com/deploymenttheory/go-api-sdk-apple/device_management/ddm/configurations"
    "github.com/deploymenttheory/go-api-sdk-apple/device_management/mdm"
    "github.com/deploymenttheory/go-api-sdk-apple/device_management/mdm/commands"
    "github.com/deploymenttheory/go-api-sdk-apple/device_management/ptr"
)

// MDM command plist
cmd, err := mdm.NewCommand(&commands.DeviceLock{PIN: ptr.To("123456")})

// Configuration profile (.mobileconfig)
prof, err := mdm.NewProfile("com.example.restrictions",
    mdm.WithDisplayName("Corporate Restrictions"),
    mdm.WithPayload(&profiles.Applicationaccess{AllowCamera: ptr.To(false)}))

// DDM declaration JSON
decl, err := ddm.BuildDeclaration("com.example.passcode",
    &configurations.PasscodeSettings{MinimumLength: ptr.To(int64(12))})

Every builder validates before emitting — invalid input never becomes config. Runnable examples live in examples/device_management.

The spec is honoured

Apple schema construct	Generated Go
`presence: required`	value field, always serialized
`presence: optional`	pointer / nil-able field, `omitempty`
`<string> <integer> <real> <boolean> <date> <data> <any>`	`string int64 float64 bool time.Time []byte any`
`<array>` / `<dictionary>` + subkeys	`[]T` / named nested structs (`subkeytype` shared types dedup)
`rangelist`	typed constants + `Validate()` membership check
`range`, `format`, `repetition`, `<url> <hostname> <email>`	`Validate()` bounds / regex / cardinality / format checks
`requesttype` / `payloadtype` / `declarationtype`	`RequestType()` / `PayloadType()` / `DeclarationType()` + per-family `By*` registries
supportedOS	doc comments (`Supported: iOS 15.0+, macOS 13.0+.`)

The pipeline

Stage	Command	Output
Acquire	`go run ./device_management/cmd/fetchspec`	`metadata/specs/**.json` + `PROVENANCE.json`
Generate	`go run ./device_management/cmd/gendm`	`mdm/`, `ddm/` generated packages
Diff	`go run ./device_management/cmd/specdiff -old <dir>`	semantic markdown change report

Generated packages separate construct kinds per spec: <name>.go holds the struct declarations, <name>_functions.go the wire-identifier and Validate() methods, <name>_enums.go the allowed-value constants, and each family's registry.go the identifier → factory map.

The upstream commit is pinned in cmd/fetchspec/main.go; -discover resolves the latest commit on Apple's release branch. Snapshots are committed, codegen is offline and byte-deterministic, and CI enforces both:

device-management-unit-tests.yml — build, vet, tests, plus the regenerate-and-git diff --exit-code determinism gate.
device-management-spec-update.yml — weekly: fetch latest upstream specs, regenerate, and open a PR whose body is the specdiff report — the moving target, reviewed change by change.

Not covered (v1)

declarative/status, declarative/protocol, mdm/checkin, mdm/errors and other/ specs (read-side/protocol plumbing — same generator can add them later), and transporting artifacts to devices (an MDM server's job).

Documentation ¶

Overview ¶

Package device_management is a generated Go SDK for Apple MDM and Declarative Device Management (DDM), built from Apple's canonical schema repo (github.com/apple/device-management).

Typed values go in, spec-validated Apple config comes out:

cmd, _ := mdm.NewCommand(&commands.DeviceLock{PIN: ptr.To("123456")})
prof, _ := mdm.NewProfile("com.example.wifi",
    mdm.WithPayload(&profiles.WiFiManaged{...}))
decl, _ := ddm.BuildDeclaration("com.example.passcode",
    &configurations.PasscodeSettings{MinimumLength: ptr.To(int64(8))})

The generated packages (mdm/commands, mdm/profiles, ddm/configurations, ddm/assets, ddm/activations, ddm/management) honour Apple's spec: required keys are value fields, optional keys are pointers, and every payload's Validate method enforces allowed values, ranges, formats and nested payload keys. Regeneration is driven by cmd/fetchspec (pinned upstream commit → metadata/specs snapshots) and cmd/gendm (offline codegen); cmd/specdiff renders semantic schema diffs between drops.

Source Files ¶

View all Source files

doc.go

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
fetchspec command Command fetchspec is the acquisition stage of the device-management SDK pipeline.	Command fetchspec is the acquisition stage of the device-management SDK pipeline.
gendm command Command gendm is the codegen stage of the device-management SDK pipeline: it reads the committed spec snapshots (metadata/specs) and emits the generated payload structs, validation and registries under mdm/ and ddm/.	Command gendm is the codegen stage of the device-management SDK pipeline: it reads the committed spec snapshots (metadata/specs) and emits the generated payload structs, validation and registries under mdm/ and ddm/.
specdiff command Command specdiff renders a semantic, human-readable markdown report of what changed between two spec snapshot trees — the review surface for Apple's moving schema target.	Command specdiff renders a semantic, human-readable markdown report of what changed between two spec snapshot trees — the review surface for Apple's moving schema target.
ddm Package ddm turns validated, generated declaration structs into syntactically correct Declarative Device Management JSON.	Package ddm turns validated, generated declaration structs into syntactically correct Declarative Device Management JSON.
activations
assets
configurations
management
internal
codegen Package codegen orchestrates the offline device-management code generator: it loads the committed spec snapshots, clears previously generated output (identified by the DO-NOT-EDIT header), builds view models (build), renders them through the template firewall (render) and assembles files (fileasm).	Package codegen orchestrates the offline device-management code generator: it loads the committed spec snapshots, clears previously generated output (identified by the DO-NOT-EDIT header), builds view models (build), renders them through the template firewall (render) and assembles files (fileasm).
codegen/build Package build flattens parsed specs into fully-resolved view models.	Package build flattens parsed specs into fully-resolved view models.
codegen/fileasm Package fileasm is the single choke-point for generated-file scaffolding: the DO-NOT-EDIT header, package clause, grouped imports and gofmt.	Package fileasm is the single choke-point for generated-file scaffolding: the DO-NOT-EDIT header, package clause, grouped imports and gofmt.
codegen/naming Package naming holds the spec-to-Go identifier rules shared by every emitter.	Package naming holds the spec-to-Go identifier rules shared by every emitter.
codegen/render Package render is the firewall between view models and Go source: view models go in, source fragments come out, and the only mechanism is text/template execution over the embedded .tmpl files.	Package render is the firewall between view models and Go source: view models go in, source fragments come out, and the only mechanism is text/template execution over the embedded .tmpl files.
codegen/view Package view defines the pure-data models the templates render.	Package view defines the pure-data models the templates render.
plistenc Package plistenc is a deterministic XML property-list encoder for the device-management SDK.	Package plistenc is a deterministic XML property-list encoder for the device-management SDK.
spec Package spec models Apple's device-management schema files (the YAML specs in github.com/apple/device-management) and parses them into the normalized form committed as JSON snapshots under metadata/specs.	Package spec models Apple's device-management schema files (the YAML specs in github.com/apple/device-management) and parses them into the normalized form committed as JSON snapshots under metadata/specs.
mdm Package mdm turns validated, generated payload structs into syntactically correct MDM artifacts: command plists and configuration profiles (.mobileconfig).	Package mdm turns validated, generated payload structs into syntactically correct MDM artifacts: command plists and configuration profiles (.mobileconfig).
commands
profiles
ptr Package ptr provides helpers for the SDK's optional fields.	Package ptr provides helpers for the SDK's optional fields.
validate Package validate implements the value checks Apple's device-management schema declares on payload keys: closed value sets (rangelist), numeric bounds (range), regular-expression formats, array cardinality (repetition) and string subtypes (<url>, <hostname>, <email>).	Package validate implements the value checks Apple's device-management schema declares on payload keys: closed value sets (rangelist), numeric bounds (range), regular-expression formats, array cardinality (repetition) and string subtypes (<url>, <hostname>, <email>).