From 24a19f3fcc07c5989fe3c2542ae6ab9c327ef534 Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Sun, 20 Apr 2025 12:58:41 -0400
Subject: [PATCH 01/84] chore: add type hints, add helper method for loading
 JSON

---
 webhook/jawa_receiver.py | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 40ba0ba..64e286e 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -30,10 +30,13 @@
 import json
 import os
 import subprocess
+from typing import Any, Dict, List, Optional, Tuple, Union
 
 from bin import okta_verification
 from bin import logger
 
+JSONType = Union[Dict[str, Any], List[Any], str, int, float, bool, None]
+
 logthis = logger.setup_child_logger('jawa', 'webhook_receiver')
 
 server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
@@ -42,10 +45,13 @@
 
 blueprint = Blueprint('jawa_receiver', __name__, template_folder='templates')
 
+def load_json(file_path: str) -> Any:
+    with open(file_path, "r") as fin:
+        return json.load(fin)
+    
 
-def validate_webhook(webhook_data, webhook_name, webhook_user, webhook_pass, webhook_apikey):
-    with open(jp_webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
+def validate_webhook(webhook_data: JSONType, webhook_name: str, webhook_user: str, webhook_pass: str, webhook_apikey: str) -> bool:
+    webhooks_json = load_json(jp_webhooks_file)
     truth_test = False
     for each_webhook in webhooks_json:
         if each_webhook['name'] == webhook_name:
@@ -59,15 +65,14 @@ def validate_webhook(webhook_data, webhook_name, webhook_user, webhook_pass, web
     return truth_test
 
 
-def run_script(webhook_data, webhook_name):
-    with open(jp_webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
+def run_script(webhook_data: JSONType, webhook_name: str) -> Optional[bytes]:
+    webhooks_json = load_json(jp_webhooks_file)
     for each_webhook in webhooks_json:
         if each_webhook['name'] == webhook_name:
             return script_results(webhook_data, each_webhook)
 
 
-def script_results(webhook_data, each_webhook):
+def script_results(webhook_data: JSONType, each_webhook: Dict) -> bytes:
     webhook_data = json.dumps(webhook_data)
     proc = subprocess.Popen([each_webhook['script'], f"{webhook_data}"], stdout=subprocess.PIPE,
                             stderr=subprocess.STDOUT)
@@ -78,9 +83,8 @@ def script_results(webhook_data, each_webhook):
     return output
 
 
-def custom_output_options(webhook_name):
-    with open(jp_webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
+def custom_output_options(webhook_name: str) -> Union[Tuple[Any, Any], Tuple[None, None]]:
+    webhooks_json = load_json(jp_webhooks_file)
     for each_webhook in webhooks_json:
         if each_webhook['name'] == webhook_name:
             webhook_tag = each_webhook.get('tag')
@@ -90,7 +94,7 @@ def custom_output_options(webhook_name):
 
 
 @blueprint.route('/hooks/<webhook_name>', methods=['POST', 'GET'])
-def webhook_handler(webhook_name):
+def webhook_handler(webhook_name: str):
     logthis.info(f"Incoming request at /hooks/{webhook_name} ...")
     if request.headers.get('x-okta-verification-challenge'):
         logthis.info("This is an Okta verification challenge...")
@@ -126,7 +130,7 @@ def webhook_handler(webhook_name):
         if custom_output and webhook_tag == "custom":
             return {"webhook": f"{webhook_name}", "result": f"{output}"}, 202
         else:
-            return {"webhook": f"{webhook_name}", "result": f"valid webhook received"}
+            return {"webhook": f"{webhook_name}", "result": "valid webhook received"}
     else:
         logthis.info(f"401 - Incorrect authentication provided for /hooks/{webhook_name}.")
         return f"Unauthorized - incorrect authentication provided for /hooks/{webhook_name}.", 401

From b0fd8eda9fa289b3330f91715e98581cd7ac46d7 Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Sun, 20 Apr 2025 12:59:11 -0400
Subject: [PATCH 02/84] chore: add type hints

---
 bin/logger.py            |  5 +++--
 bin/okta_verification.py |  7 +++++--
 bin/tokens.py            | 12 ++++++------
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/bin/logger.py b/bin/logger.py
index 4bb6d05..288ddd1 100644
--- a/bin/logger.py
+++ b/bin/logger.py
@@ -29,6 +29,7 @@
 import logging
 from logging import handlers
 import os
+from typing import Optional
 
 formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
 logger_name = 'jawa'
@@ -37,7 +38,7 @@
 log_backupCount = 10
 
 
-def setup_logger(log_name=logger_name, log_filename=f"{logger_name}.log", log_level=default_log_level):
+def setup_logger(log_name: Optional[str] = logger_name, log_filename: Optional[str] = f"{logger_name}.log", log_level: Optional[int] = default_log_level) -> logging.Logger:
     log_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data'))
     if not os.path.isdir(log_path):
         os.makedirs(log_path)
@@ -52,7 +53,7 @@ def setup_logger(log_name=logger_name, log_filename=f"{logger_name}.log", log_le
     return logger
 
 
-def setup_child_logger(name_of_logger, name_of_child):
+def setup_child_logger(name_of_logger: str, name_of_child: str) -> logging.Logger:
     return logging.getLogger(name_of_logger).getChild(name_of_child)
 
 
diff --git a/bin/okta_verification.py b/bin/okta_verification.py
index 2b7bf22..a73a7cf 100755
--- a/bin/okta_verification.py
+++ b/bin/okta_verification.py
@@ -25,11 +25,14 @@
 #       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-def verify_new_webhook(challenge):
+from typing import Dict, Optional
+
+
+def verify_new_webhook(challenge: Optional[str]) -> Dict[str, str]:
     return {"verification": f"{challenge}"}
 
 
-def main():
+def main() -> None:
     pass
 
 
diff --git a/bin/tokens.py b/bin/tokens.py
index ae1eef6..02424da 100644
--- a/bin/tokens.py
+++ b/bin/tokens.py
@@ -27,16 +27,16 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 from datetime import datetime, timezone, timedelta
-from flask import session, redirect, url_for
+from flask import Response, session, redirect, url_for
 import requests
-import time
+from typing import Optional
 
 from bin import logger
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
 
-def get_token():
+def get_token() -> Optional[Response]:
     try:
         resp = requests.post(f"{session['url']}/api/v1/auth/token",
                              headers={'Authorization': f"Basic {session['b64_auth'].decode()}"})
@@ -44,12 +44,12 @@ def get_token():
         session['token'] = data.get('token')
         session['expires'] = data.get('expires')
     except Exception as err:
-        logthis.info(f"[{session.get('url')}] Could not get a token using session credentials.  Logging out.")
+        logthis.info(f"[{session.get('url')}] Could not get a token using session credentials: {err}.  Logging out.")
         return redirect(
             url_for('home_view.logout', error_title="Error Fetching API Token", error_message="Please sign in again"))
 
 
-def validate_token(expires):
+def validate_token(expires: str) -> bool:
     time_to_expire = datetime.strptime(expires, '%Y-%m-%dT%H:%M:%S.%f%z') - datetime.strptime(
         str(datetime.now(timezone.utc)), '%Y-%m-%d %H:%M:%S.%f%z')
     if time_to_expire > timedelta(0):
@@ -59,7 +59,7 @@ def validate_token(expires):
         return False
 
 
-def invalidate_token():
+def invalidate_token() -> None:
     if not session.get('token'):
         return
     try:

From dd0266d25d841bc17d2654bea2b53c32268f7244 Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Mon, 21 Apr 2025 15:10:47 -0400
Subject: [PATCH 03/84] chore: add ruff config for code formatting

---
 ruff.toml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 ruff.toml

diff --git a/ruff.toml b/ruff.toml
new file mode 100644
index 0000000..c294fe0
--- /dev/null
+++ b/ruff.toml
@@ -0,0 +1,4 @@
+line-length = 79
+
+[format]
+quote-style = "single"
\ No newline at end of file

From 1bb0ca938cd489bc77f6f423f9c7322ed1e082c0 Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Mon, 21 Apr 2025 15:11:19 -0400
Subject: [PATCH 04/84] chore: add type hints, format code to PEP standards
 with ruff

---
 app.py                   | 221 +++++++++++-----
 bin/load_home.py         |  37 ++-
 bin/logger.py            |  24 +-
 bin/okta_verification.py |   2 +-
 bin/tokens.py            |  50 +++-
 bin/v2_upgrade.py        |  42 ++-
 bin/view_modifiers.py    |  24 +-
 views/cron_view.py       | 323 +++++++++++++++--------
 views/custom_webhook.py  | 220 +++++++++++-----
 views/home_view.py       | 252 ++++++++++++------
 views/jamf_webhook.py    | 537 +++++++++++++++++++++++++--------------
 views/log_view.py        | 120 +++++++--
 views/okta_webhook.py    | 193 ++++++++------
 views/resource_view.py   | 215 +++++++++++-----
 views/webhook_view.py    | 127 ++++++---
 webhook/jawa_receiver.py | 115 ++++++---
 16 files changed, 1704 insertions(+), 798 deletions(-)

diff --git a/app.py b/app.py
index b953585..e067069 100644
--- a/app.py
+++ b/app.py
@@ -32,10 +32,18 @@
 import uuid
 
 from datetime import timedelta
-from flask import (Flask, request, render_template,
-                   session, redirect, url_for)
+from flask import (
+    Flask,
+    request,
+    render_template,
+    session,
+    redirect,
+    url_for,
+    Response,
+)
 from markupsafe import escape
 from waitress import serve
+from typing import Any, Dict, Union
 
 from bin import logger
 from bin.view_modifiers import response
@@ -43,7 +51,7 @@
 
 # Flask logging
 logthis = logger.setup_child_logger('jawa', 'app')
-error_message = ""
+error_message = ''
 
 # Initiate Flask
 app = Flask(__name__)
@@ -51,112 +59,154 @@
 
 # Session heartbeat
 @app.before_request
-def func():
+def func() -> None:
     session.modified = True
 
 
-def main():
+def main() -> None:
     base_dir = os.path.dirname(__file__)
-    logthis.info(f"JAWA initializing...\n Sandcrawler home:  {base_dir}")
+    logthis.info(f'JAWA initializing...\n Sandcrawler home:  {base_dir}')
     environment_setup(base_dir)
     register_blueprints()
     app.secret_key = str(uuid.uuid4())
     app.permanent_session_lifetime = timedelta(minutes=10)
-    serve(app, url_scheme='https', host='0.0.0.0', port=8000, threads=15) # Serve me the sky with a big slice of lemon
+    serve(
+        app, url_scheme='https', host='0.0.0.0', port=8000, threads=15
+    )  # Serve me the sky with a big slice of lemon
 
 
-def environment_setup(project_dir):
+def environment_setup(project_dir: str) -> None:
     global webhooks_file, cron_file, server_json_file, scripts_directory
-    webhooks_file = os.path.abspath(os.path.join(project_dir, 'data', 'webhooks.json'))
+    webhooks_file = os.path.abspath(
+        os.path.join(project_dir, 'data', 'webhooks.json')
+    )
     cron_file = os.path.abspath(os.path.join(project_dir, 'data', 'cron.json'))
-    server_json_file = os.path.abspath(os.path.join(project_dir, 'data', 'server.json'))
+    server_json_file = os.path.abspath(
+        os.path.join(project_dir, 'data', 'server.json')
+    )
     scripts_directory = os.path.abspath(os.path.join(project_dir, 'scripts'))
-    logthis.info(f"Detecting JAWA environment:\n"
-                 f"Webhooks configuration file: {webhooks_file}\n"
-                 f"Cron configuration file: {cron_file}\n"
-                 f"Server configuration file: {server_json_file}\n"
-                 f"Scripts directory: {scripts_directory}")
+    logthis.info(
+        f'Detecting JAWA environment:\n'
+        f'Webhooks configuration file: {webhooks_file}\n'
+        f'Cron configuration file: {cron_file}\n'
+        f'Server configuration file: {server_json_file}\n'
+        f'Scripts directory: {scripts_directory}'
+    )
 
 
-def register_blueprints():
+def register_blueprints() -> None:
     # JAWA Receiver
     from webhook import jawa_receiver
+
     app.register_blueprint(jawa_receiver.blueprint)
     # Jamf Pro Webhooks view
     from views import jamf_webhook
+
     app.register_blueprint(jamf_webhook.blueprint)
     # Okta Webhooks view
     from views.okta_webhook import blueprint
+
     app.register_blueprint(blueprint)
     # Create a new Cron Job
     from views.cron_view import blueprint
+
     app.register_blueprint(blueprint)
     # Log view
     from views import log_view
+
     app.register_blueprint(log_view.blueprint)
     # Resources (aka files) view
     from views import resource_view
+
     app.register_blueprint(resource_view.blueprint)
     # Custom Webhooks view
     from views import custom_webhook
+
     app.register_blueprint(custom_webhook.blueprint)
     # Webhooks Base view
     from views import webhook_view
+
     app.register_blueprint(webhook_view.blueprint)
     # Home, Dashboard and Login view
     from views import home_view
+
     app.register_blueprint(home_view.blueprint)
 
 
 # Server setup including making .json file necessary for webhooks
 @app.route('/setup', methods=['GET', 'POST'])
-def setup():
+def setup() -> Union[Response, str]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if request.method == 'POST':
-        logthis.debug(f"[{session.get('url')}] {session.get('username')} /setup - POST")
+        logthis.debug(
+            f'[{session.get("url")}] {session.get("username")} /setup - POST'
+        )
         server_url = request.form.get('address')
         if not server_url:
             return redirect(url_for('setup'))
         jps_url = request.form.get('jss-lock')
         jps2_check = request.form.get('alternate-jamf')
         jps_url2 = request.form.get('alternate')
-        logthis.info(f"{session.get('username')} made JAWA Setup Changes\n"
-                     f"JAWA URL: {server_url}\n"
-                     f"Primary JPS: {jps_url}\n"
-                     f"Alternate JPS: {jps_url2}\n"
-                     f"Alternate enabled?: {jps2_check}")
+        logthis.info(
+            f'{session.get("username")} made JAWA Setup Changes\n'
+            f'JAWA URL: {server_url}\n'
+            f'Primary JPS: {jps_url}\n'
+            f'Alternate JPS: {jps_url2}\n'
+            f'Alternate enabled?: {jps2_check}'
+        )
         new_json = {}
         if server_url != '':
             new_json['jawa_address'] = server_url
         if jps_url != '':
             new_json['jps_url'] = jps_url
         if not os.path.isfile(server_json_file):
-            with open(server_json_file, "w") as outfile:
-                server_json = {'jawa_address': server_url, 'jps_url': jps_url, 'alternate_jps': jps_url2}
+            with open(server_json_file, 'w') as outfile:
+                server_json = {
+                    'jawa_address': server_url,
+                    'jps_url': jps_url,
+                    'alternate_jps': jps_url2,
+                }
                 json.dump(server_json, outfile)
         elif os.path.isfile(server_json_file):
-            with open(server_json_file, "w") as outfile:
-                server_json = {'jawa_address': server_url, 'jps_url': jps_url, 'alternate_jps': jps_url2}
+            with open(server_json_file, 'w') as outfile:
+                server_json = {
+                    'jawa_address': server_url,
+                    'jps_url': jps_url,
+                    'alternate_jps': jps_url2,
+                }
                 json.dump(server_json, outfile)
-            with open(server_json_file, "r") as fin:
+            with open(server_json_file, 'r') as fin:
                 data = json.load(fin)
             data.update(new_json)
-            with open(server_json_file, "w+") as outfile:
+            with open(server_json_file, 'w+') as outfile:
                 json.dump(data, outfile)
 
-        return render_template('success.html',
-                               webhooks="success",
-                               success_msg="JAWA Setup Complete!",
-                               username=str(escape(session['username'])))
+        return render_template(
+            'success.html',
+            webhooks='success',
+            success_msg='JAWA Setup Complete!',
+            username=str(escape(session['username'])),
+        )
     else:
-        logthis.debug(f"[{session.get('url')}] {session.get('username')} - /setup - GET")
+        logthis.debug(
+            f'[{session.get("url")}] {session.get("username")} - /setup - GET'
+        )
         if not os.path.isfile(server_json_file):
-            with open(server_json_file, "w") as outfile:
-                server_json = {'jawa_address': '', 'jps_url': '', 'alternate_jps': ''}
+            with open(server_json_file, 'w') as outfile:
+                server_json = {
+                    'jawa_address': '',
+                    'jps_url': '',
+                    'alternate_jps': '',
+                }
                 json.dump(server_json, outfile)
-        with open(server_json_file, "r") as fin:
+        with open(server_json_file, 'r') as fin:
             server_json = json.load(fin)
         jps_url2 = server_json.get('alternate_jps')
         if jps_url2 == str(escape(session['url'])):
@@ -164,65 +214,93 @@ def setup():
         else:
             primary_jps = str(escape(session['url']))
         jawa_url = server_json.get('jawa_address')
-        return render_template('setup/setup.html',
-                               login="false", jps_url=primary_jps, jps_url2=jps_url2,
-                               jawa_url=jawa_url, username=session.get('username'))
+        return render_template(
+            'setup/setup.html',
+            login='false',
+            jps_url=primary_jps,
+            jps_url2=jps_url2,
+            jawa_url=jawa_url,
+            username=session.get('username'),
+        )
 
 
-@app.route("/cleanup", methods=['GET', 'POST'])
-@response(template_file="setup/cleanup.html")
-def cleanup():
+@app.route('/cleanup', methods=['GET', 'POST'])
+@response(template_file='setup/cleanup.html')
+def cleanup() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if request.method != 'POST':
         owd = os.getcwd()
         if not os.path.isdir(scripts_directory):
             os.mkdir(scripts_directory)
         os.chdir(scripts_directory)
-        old_scripts = glob.glob("*.old")
+        old_scripts = glob.glob('*.old')
         os.chdir(owd)
-        return {"username": session.get('username'), "scripts_dir": scripts_directory, "scripts": old_scripts}
-    logthis.info(f"[{session.get('url')}] {session.get('username')} is cleaning up scripts...")
+        return {
+            'username': session.get('username'),
+            'scripts_dir': scripts_directory,
+            'scripts': old_scripts,
+        }
+    logthis.info(
+        f'[{session.get("url")}] {session.get("username")} is cleaning up scripts...'
+    )
     owd = os.getcwd()
     if not os.path.isdir(scripts_directory):
         os.mkdir(scripts_directory)
     os.chdir(scripts_directory)
     del_list = []
-    for file in glob.glob("*.old"):
-        logthis.info(f"[{session.get('url')}] {session.get('username')} removed the script {file}...")
-        del_list.append(f"{file}")
+    for file in glob.glob('*.old'):
+        logthis.info(
+            f'[{session.get("url")}] {session.get("username")} removed the script {file}...'
+        )
+        del_list.append(f'{file}')
         os.remove(file)
     os.chdir(owd)
     if not del_list:
-        success_msg = "No Script files found to clean up."
+        success_msg = 'No Script files found to clean up.'
     else:
-        txt_list = "Deleted: \n"
+        txt_list = 'Deleted: \n'
         for file in del_list:
-            txt_list += f"{file}\n"
-        success_msg = txt_list or "No script files found to clean up."
+            txt_list += f'{file}\n'
+        success_msg = txt_list or 'No script files found to clean up.'
     return redirect(url_for('success', success_msg=success_msg))
 
 
-@app.route("/")
-def home():
+@app.route('/')
+def home() -> Union[Response, str]:
     return load_home()
 
 
 @app.route('/success', methods=['GET', 'POST'])
-def success(success_msg=""):
+def success(success_msg='') -> Union[Response, str]:
     if 'username' not in session:
-        logthis.info("No user logged in - returning to login page.")
+        logthis.info('No user logged in - returning to login page.')
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     success_msg = request.args.get('success_msg')
     if success_msg:
         success_msg = escape(success_msg)
-    return render_template('success.html', success_msg=success_msg, login="true", username=str(escape(session['username'])))
+    return render_template(
+        'success.html',
+        success_msg=success_msg,
+        login='true',
+        username=str(escape(session['username'])),
+    )
 
 
 @app.route('/error', methods=['GET', 'POST'])
-def error():
+def error() -> Union[Response, str]:
     error_title = request.args.get('error')
     error_message = request.args.get('error_message')
     if error_title:
@@ -232,19 +310,26 @@ def error():
     if 'username' not in session:
         return redirect(url_for('home_view.logout'))
     logthis.info(
-        f"[{session.get('url')}] {session.get('username').title()} was a victim of a series of accidents, as are we all. (/error)")
-    return render_template('error.html', username=session.get('username'), error_message=error_title,
-                           error=error_message)
+        f'[{session.get("url")}] {session.get("username").title()} was a victim of a series of accidents, as are we all. (/error)'
+    )
+    return render_template(
+        'error.html',
+        username=session.get('username'),
+        error_message=error_title,
+        error=error_message,
+    )
 
 
 @app.errorhandler(404)
-def page_not_found(error):
+def page_not_found() -> Union[Response, str]:
     if 'username' in session:
         logthis.info(
-            f"[{session.get('url')}] {session.get('username')} wandered off course  ({request.path}) - redirecting to /dashboard.")
+            f'[{session.get("url")}] {session.get("username")} wandered off course  ({request.path}) - redirecting to /dashboard.'
+        )
         return redirect(url_for('home_view.dashboard'))
     logthis.info(
-        f"An invalid path ({request.path}) was provided and no user is logged in.  Returning login page.")
+        f'An invalid path ({request.path}) was provided and no user is logged in.  Returning login page.'
+    )
     return load_home()
 
 
diff --git a/bin/load_home.py b/bin/load_home.py
index 694b3c0..2e730a5 100644
--- a/bin/load_home.py
+++ b/bin/load_home.py
@@ -25,26 +25,29 @@
 #       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-from flask import render_template, session, redirect, url_for
+from flask import Response, render_template, session, redirect, url_for
 from glob import escape
 import json
 import os
+from typing import Union
 
 from bin import logger
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
 
 
-def load_home():
+def load_home() -> Union[Response, str]:
     if 'username' in session:
         return redirect(url_for('dashboard'))
-    with open(server_json_file, "r") as fin:
+    with open(server_json_file, 'r') as fin:
         server_json = json.load(fin)
     if not server_json:
         return render_template('home.html')
-    brand = server_json.get("brand")
+    brand = server_json.get('brand')
 
     if 'jps_url' not in server_json:
         return render_template('home.html', app_name=brand)
@@ -56,13 +59,21 @@ def load_home():
         if 'alternate_jps' not in server_json:
             return render_template('home.html', app_name=brand)
 
-        if server_json['alternate_jps'] != "":
-            return render_template('home.html',
-                                   jps_url=server_json['jps_url'],
-                                   jps_url2=server_json['alternate_jps'],
-                                   welcome="true", jsslock="true", app_name=brand)
+        if server_json['alternate_jps'] != '':
+            return render_template(
+                'home.html',
+                jps_url=server_json['jps_url'],
+                jps_url2=server_json['alternate_jps'],
+                welcome='true',
+                jsslock='true',
+                app_name=brand,
+            )
 
         session['url'] = server_json['jps_url']
-        return render_template('home.html',
-                               jps_url=str(escape(session['url'])),
-                               welcome="true", jsslock="true", app_name=brand)
+        return render_template(
+            'home.html',
+            jps_url=str(escape(session['url'])),
+            welcome='true',
+            jsslock='true',
+            app_name=brand,
+        )
diff --git a/bin/logger.py b/bin/logger.py
index 288ddd1..461593d 100644
--- a/bin/logger.py
+++ b/bin/logger.py
@@ -31,19 +31,29 @@
 import os
 from typing import Optional
 
-formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+formatter = logging.Formatter(
+    '%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+)
 logger_name = 'jawa'
 default_log_level = logging.INFO
-log_roll_size = (1048576 * 100)
+log_roll_size = 1048576 * 100
 log_backupCount = 10
 
 
-def setup_logger(log_name: Optional[str] = logger_name, log_filename: Optional[str] = f"{logger_name}.log", log_level: Optional[int] = default_log_level) -> logging.Logger:
-    log_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data'))
+def setup_logger(
+    log_name: Optional[str] = logger_name,
+    log_filename: Optional[str] = f'{logger_name}.log',
+    log_level: Optional[int] = default_log_level,
+) -> logging.Logger:
+    log_path = os.path.abspath(
+        os.path.join(os.path.dirname(__file__), '..', 'data')
+    )
     if not os.path.isdir(log_path):
         os.makedirs(log_path)
     log_file = os.path.join(log_path, log_filename)
-    handler = handlers.RotatingFileHandler(log_file, maxBytes=log_roll_size, backupCount=log_backupCount)
+    handler = handlers.RotatingFileHandler(
+        log_file, maxBytes=log_roll_size, backupCount=log_backupCount
+    )
     handler.setFormatter(formatter)
     logger = logging.getLogger(log_name)
     if logger.hasHandlers():
@@ -53,7 +63,9 @@ def setup_logger(log_name: Optional[str] = logger_name, log_filename: Optional[s
     return logger
 
 
-def setup_child_logger(name_of_logger: str, name_of_child: str) -> logging.Logger:
+def setup_child_logger(
+    name_of_logger: str, name_of_child: str
+) -> logging.Logger:
     return logging.getLogger(name_of_logger).getChild(name_of_child)
 
 
diff --git a/bin/okta_verification.py b/bin/okta_verification.py
index a73a7cf..befe569 100755
--- a/bin/okta_verification.py
+++ b/bin/okta_verification.py
@@ -29,7 +29,7 @@
 
 
 def verify_new_webhook(challenge: Optional[str]) -> Dict[str, str]:
-    return {"verification": f"{challenge}"}
+    return {'verification': f'{challenge}'}
 
 
 def main() -> None:
diff --git a/bin/tokens.py b/bin/tokens.py
index 02424da..e49a2db 100644
--- a/bin/tokens.py
+++ b/bin/tokens.py
@@ -38,24 +38,38 @@
 
 def get_token() -> Optional[Response]:
     try:
-        resp = requests.post(f"{session['url']}/api/v1/auth/token",
-                             headers={'Authorization': f"Basic {session['b64_auth'].decode()}"})
+        resp = requests.post(
+            f'{session["url"]}/api/v1/auth/token',
+            headers={'Authorization': f'Basic {session["b64_auth"].decode()}'},
+        )
         data = resp.json()
         session['token'] = data.get('token')
         session['expires'] = data.get('expires')
     except Exception as err:
-        logthis.info(f"[{session.get('url')}] Could not get a token using session credentials: {err}.  Logging out.")
+        logthis.info(
+            f'[{session.get("url")}] Could not get a token using session credentials: {err}.  Logging out.'
+        )
         return redirect(
-            url_for('home_view.logout', error_title="Error Fetching API Token", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Error Fetching API Token',
+                error_message='Please sign in again',
+            )
+        )
 
 
 def validate_token(expires: str) -> bool:
-    time_to_expire = datetime.strptime(expires, '%Y-%m-%dT%H:%M:%S.%f%z') - datetime.strptime(
-        str(datetime.now(timezone.utc)), '%Y-%m-%d %H:%M:%S.%f%z')
+    time_to_expire = datetime.strptime(
+        expires, '%Y-%m-%dT%H:%M:%S.%f%z'
+    ) - datetime.strptime(
+        str(datetime.now(timezone.utc)), '%Y-%m-%d %H:%M:%S.%f%z'
+    )
     if time_to_expire > timedelta(0):
         return True
     else:
-        logthis.info(f"[{session.get('url')}] API token expired ({time_to_expire}). Attempting to fetch new token...")
+        logthis.info(
+            f'[{session.get("url")}] API token expired ({time_to_expire}). Attempting to fetch new token...'
+        )
         return False
 
 
@@ -63,14 +77,24 @@ def invalidate_token() -> None:
     if not session.get('token'):
         return
     try:
-        resp = requests.post(f"{session['url']}/api/v1/auth/invalidate-token",
-                             headers={'Authorization': f"Bearer {session.get('token')}"})
+        resp = requests.post(
+            f'{session["url"]}/api/v1/auth/invalidate-token',
+            headers={'Authorization': f'Bearer {session.get("token")}'},
+        )
     except Exception as err:
-        logthis.info(f"[{session.get('url')}] Error accessing Jamf Pro API endpoint for token invalidation. {err}")
+        logthis.info(
+            f'[{session.get("url")}] Error accessing Jamf Pro API endpoint for token invalidation. {err}'
+        )
         return
     if resp.status_code == 204:
-        logthis.info(f"[{session.get('url')}] Successfully invalidated token for logout.")
+        logthis.info(
+            f'[{session.get("url")}] Successfully invalidated token for logout.'
+        )
     elif resp.status_code == 401:
-        logthis.info(f"[{session.get('url')}] Token is already invalid.  Logging out.")
+        logthis.info(
+            f'[{session.get("url")}] Token is already invalid.  Logging out.'
+        )
     else:
-        logthis.info(f"[{session.get('url')}] An unknown error occurred when invalidating the token.")
+        logthis.info(
+            f'[{session.get("url")}] An unknown error occurred when invalidating the token.'
+        )
diff --git a/bin/v2_upgrade.py b/bin/v2_upgrade.py
index 30f279e..d194e61 100644
--- a/bin/v2_upgrade.py
+++ b/bin/v2_upgrade.py
@@ -37,14 +37,14 @@
     jp_webhooks_path = f'{backup_dir}/v2/jp_webhooks.json'
     webhook_conf = f'{backup_dir}/v2/webhook.conf'
     new_webhooks_path = f'{backup_dir}/data/webhooks.json'
-    jawa_address = ""
-except IndexError as err:
-    print("Backup directory not specified in program arguments.")
+    jawa_address = ''
+except IndexError:
+    print('Backup directory not specified in program arguments.')
     exit(1)
 
 # Create data dir in backup dir if necessary
-if not os.path.isdir(f"{backup_dir}/data"):
-    os.mkdir(f"{backup_dir}/data")
+if not os.path.isdir(f'{backup_dir}/data'):
+    os.mkdir(f'{backup_dir}/data')
 
 # Check for server.json
 if os.path.isfile(old_server_json_path):
@@ -54,7 +54,7 @@
         new_server_json = each_entry
         jawa_address = each_entry.get('jawa_address')
         jps_url = each_entry.get('jps_url')
-        new_server_json['alternate_jps'] = ""
+        new_server_json['alternate_jps'] = ''
     with open(new_server_json_path, 'w') as fout:
         json.dump(new_server_json, fout, indent=4)
 
@@ -65,10 +65,18 @@
     with open(jp_webhooks_path) as fin:
         jp_webhooks_json = json.load(fin)
     for each_entry in jp_webhooks_json:
-        new_entry = {'url': each_entry['url'], 'jawa_admin': each_entry['username'], 'name': each_entry['name'],
-                     'webhook_username': 'null', 'webhook_password': 'null', 'event': each_entry['event'],
-                     'script': each_entry['script'], 'description': each_entry['description'], 'tag': "jamfpro",
-                     'jamf_id': ""}
+        new_entry = {
+            'url': each_entry['url'],
+            'jawa_admin': each_entry['username'],
+            'name': each_entry['name'],
+            'webhook_username': 'null',
+            'webhook_password': 'null',
+            'event': each_entry['event'],
+            'script': each_entry['script'],
+            'description': each_entry['description'],
+            'tag': 'jamfpro',
+            'jamf_id': '',
+        }
         new_webhooks_json.append(new_entry)
 
 names = [each_entry['name'] for each_entry in new_webhooks_json]
@@ -81,10 +89,16 @@
     for each_entry in webhooks_json:
         # Checking for unique entries
         if each_entry['id'] not in names:
-            new_entry = {'url': jps_url, 'jawa_admin': 'Guy Incognito', 'name': each_entry['id'],
-                         'webhook_username': 'null', 'webhook_password': 'null',
-                         'script': each_entry['execute-command'],
-                         'description': "", 'tag': "custom"}
+            new_entry = {
+                'url': jps_url,
+                'jawa_admin': 'Guy Incognito',
+                'name': each_entry['id'],
+                'webhook_username': 'null',
+                'webhook_password': 'null',
+                'script': each_entry['execute-command'],
+                'description': '',
+                'tag': 'custom',
+            }
             new_webhooks_json.append(new_entry)
 
 # Writing new webhook file
diff --git a/bin/view_modifiers.py b/bin/view_modifiers.py
index 2f63dc1..f71b13e 100644
--- a/bin/view_modifiers.py
+++ b/bin/view_modifiers.py
@@ -1,16 +1,21 @@
 from functools import wraps
+from typing import Callable, Optional, Any, TypeVar
 
 import flask
 import werkzeug
 import werkzeug.wrappers
 
+F = TypeVar('F', bound=Callable[..., Any])
 
-def response(*, mimetype: str = None, template_file: str = None):
-    def response_inner(f):
+
+def response(
+    *, mimetype: Optional[str] = None, template_file: Optional[str] = None
+) -> Callable[[F], F]:
+    def response_inner(f: F) -> F:
         # print("Wrapping in response {}".format(f.__name__), flush=True)
 
         @wraps(f)
-        def view_method(*args, **kwargs):
+        def view_method(*args, **kwargs) -> flask.Response:
             response_val = f(*args, **kwargs)
 
             if isinstance(response_val, werkzeug.wrappers.Response):
@@ -26,10 +31,15 @@ def view_method(*args, **kwargs):
 
             if template_file and not isinstance(response_val, dict):
                 raise Exception(
-                    "Invalid return type {}, we expected a dict as the return value.".format(type(response_val)))
+                    'Invalid return type {}, we expected a dict as the return value.'.format(
+                        type(response_val)
+                    )
+                )
 
             if template_file:
-                response_val = flask.render_template(template_file, **response_val)
+                response_val = flask.render_template(
+                    template_file, **response_val
+                )
 
             resp = flask.make_response(response_val)
             resp.model = model
@@ -38,8 +48,6 @@ def view_method(*args, **kwargs):
 
             return resp
 
-        return view_method
+        return view_method  # type: ignore
 
     return response_inner
-
-
diff --git a/views/cron_view.py b/views/cron_view.py
index 3190299..3060e6f 100644
--- a/views/cron_view.py
+++ b/views/cron_view.py
@@ -27,12 +27,21 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 from crontab import CronTab
-from flask import (Blueprint, redirect, render_template,
-                   request, session, url_for)
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
 from markupsafe import escape
 import getpass
 import json
 import os
+from typing import Any, Dict, List, Tuple, Union
+
 from werkzeug.utils import secure_filename
 
 from bin import logger
@@ -40,45 +49,71 @@
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
-cron_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'cron.json'))
-time_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'time.json'))
-scripts_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+cron_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'cron.json')
+)
+time_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'time.json')
+)
+scripts_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+)
 
 blueprint = Blueprint('cron', __name__)
 
 
 @blueprint.route('/cron', methods=['GET', 'POST'])
 @response(template_file='cron/home.html')
-def cron_home():
+def cron_home() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+    )
     with open(cron_json_file, 'r') as fin:
         cron_json = json.load(fin)
-    return {"username": session.get('username'), "cron_list": cron_json}
+    return {'username': session.get('username'), 'cron_list': cron_json}
 
 
 @blueprint.route('/cron/new', methods=['GET', 'POST'])
-def new_cron():
+def new_cron() -> Union[Response, str]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+    )
     days, frequencies, hours = time_definitions()
 
     if request.method != 'POST':
-        return render_template('cron/new.html',
-                               cron="cron",
-                               frequencies=frequencies,
-                               days=days,
-                               hours=hours,
-                               username=str(escape(session['username'])))
+        return render_template(
+            'cron/new.html',
+            cron='cron',
+            frequencies=frequencies,
+            days=days,
+            hours=hours,
+            username=str(escape(session['username'])),
+        )
 
     if ' ' in request.form.get('cron_name'):
-        error_message = "Single-string name only."
-        return render_template('error.html',
-                               error_message=error_message,
-                               error="error",
-                               username=str(escape(session['username'])))
+        error_message = 'Single-string name only.'
+        return render_template(
+            'error.html',
+            error_message=error_message,
+            error='error',
+            username=str(escape(session['username'])),
+        )
 
     cron_description = request.form.get('description')
     cron_name = request.form.get('cron_name')
@@ -89,8 +124,8 @@ def new_cron():
     os.chdir(scripts_dir)
     script = request.files['script']
     if ' ' in script.filename:
-        script.filename = script.filename.replace(" ", "-")
-    new_script_name = f"cron_{cron_name}_{script.filename}"
+        script.filename = script.filename.replace(' ', '-')
+    new_script_name = f'cron_{cron_name}_{script.filename}'
     script.save(secure_filename(new_script_name))
     script_file = os.path.join(scripts_dir, new_script_name)
 
@@ -108,25 +143,31 @@ def new_cron():
     for i in data:
         # Mister Krabs
         if str(i['name']) == cron_name:
-            error_message = "Name already exists!"
-            return render_template('error.html',
-                                   error_message=error_message,
-                                   error="error",
-                                   username=str(escape(session['username'])))
+            error_message = 'Name already exists!'
+            return render_template(
+                'error.html',
+                error_message=error_message,
+                error='error',
+                username=str(escape(session['username'])),
+            )
     try:
         cron = CronTab(user=True)
     except IOError as err:
-        logthis.info(f"Error accessing crontab for {getpass.getuser()} - {err}")
+        logthis.info(
+            f'Error accessing crontab for {getpass.getuser()} - {err}'
+        )
         os.remove(script_file)
-        return render_template('error.html', error=err, username=session.get('username'))
+        return render_template(
+            'error.html', error=err, username=session.get('username')
+        )
 
-    if frequency == "everyhour":
+    if frequency == 'everyhour':
         job1 = cron.new(command=script_file, comment=cron_name)
         job1.every().hours()
         job1.minute.on(0)
         cron.write()
 
-    if frequency == "everyday":
+    if frequency == 'everyday':
         time = request.form.get('daytime')
         job1 = cron.new(command=script_file, comment=cron_name)
         job1.day.every(1)
@@ -134,7 +175,7 @@ def new_cron():
         job1.minute.on(0)
         cron.write()
 
-    if frequency == "everyweek":
+    if frequency == 'everyweek':
         day = request.form.get('weekday')
         time = request.form.get('weektime')
         job1 = cron.new(command=script_file, comment=cron_name)
@@ -143,7 +184,7 @@ def new_cron():
         job1.minute.on(0)
         cron.write()
 
-    if frequency == "everymonth":
+    if frequency == 'everymonth':
         day = request.form.get('monthday')
         time = request.form.get('monthtime')
         job1 = cron.new(command=script_file, comment=cron_name)
@@ -152,7 +193,7 @@ def new_cron():
         job1.minute.on(0)
         cron.write()
 
-    if frequency == "custom":
+    if frequency == 'custom':
         custom_frequency = request.form.get('customfreq')
         try:
             job1 = cron.new(command=script_file, comment=cron_name)
@@ -161,29 +202,37 @@ def new_cron():
         except (KeyError, ValueError) as err:
             return render_template(
                 'error.html',
-                error="Custom Crontab Frequency Error",
+                error='Custom Crontab Frequency Error',
                 error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  Please check your syntax and try again.\nCheck your syntax:  ",
-                link=f"https://crontab.guru/#{custom_frequency}", username=str(escape(session['username']))
+                link=f'https://crontab.guru/#{custom_frequency}',
+                username=str(escape(session['username'])),
             )
 
-        frequency = f"Custom [ {custom_frequency} ]"
+        frequency = f'Custom [ {custom_frequency} ]'
 
-    data.append({"name": cron_name,
-                 "description": cron_description,
-                 "frequency": frequency,
-                 "script": script_file})
+    data.append(
+        {
+            'name': cron_name,
+            'description': cron_description,
+            'frequency': frequency,
+            'script': script_file,
+        }
+    )
 
     with open(cron_json_file, 'w') as outfile:
         json.dump(data, outfile, indent=4)
-    success_msg = f"[{session.get('url')}] {session.get('username')} created {cron_name} to run at the frequency:\n {frequency}."
-    logthis.info(f"{success_msg}")
+    success_msg = f'[{session.get("url")}] {session.get("username")} created {cron_name} to run at the frequency:\n {frequency}.'
+    logthis.info(f'{success_msg}')
 
-    return render_template('success.html',
-                           webhooks="success", success_msg=success_msg,
-                           username=str(escape(session['username'])))
+    return render_template(
+        'success.html',
+        webhooks='success',
+        success_msg=success_msg,
+        username=str(escape(session['username'])),
+    )
 
 
-def time_definitions():
+def time_definitions() -> Tuple[List, List, List]:
     with open(time_json_file, 'r+') as fin:
         content = fin.read()
         time_data = json.loads(content)
@@ -209,30 +258,42 @@ def time_definitions():
 
 
 @blueprint.route('/cron/delete', methods=['GET', 'POST'])
-def delete_cron():
+def delete_cron() -> Union[Response, str]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username')} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username")} viewed {request.path}'
+    )
     target_job = request.args.get('target_job')
     with open(cron_json_file) as fin:
         cron_json = json.load(fin)
     names = [str(cron_json[i]['name']) for i, item in enumerate(cron_json)]
     if not names:
-        return render_template('cron/home.html',
-                               username=str(escape(session['username'])))
+        return render_template(
+            'cron/home.html', username=str(escape(session['username']))
+        )
 
     if request.method != 'POST':
-        return render_template('cron/delete.html',
-                               content=names, target_job=target_job,
-                               delete_cron="delete_cron",
-                               username=str(escape(session['username'])))
+        return render_template(
+            'cron/delete.html',
+            content=names,
+            target_job=target_job,
+            delete_cron='delete_cron',
+            username=str(escape(session['username'])),
+        )
     target_job = request.args.get('target_job')
 
     data = json.load(open(cron_json_file))
 
     for d in data:
         if d['name'] == target_job:
-            script_path = (d['script'])
+            script_path = d['script']
             new_script_path = f'{script_path}.old'
             if os.path.exists(script_path):
                 os.rename(script_path, new_script_path)
@@ -240,12 +301,18 @@ def delete_cron():
     try:
         cron = CronTab(user=True)
     except IOError as err:
-        logthis.info(f"Error accessing crontab for {getpass.getuser()} - {err}")
-        return render_template('error.html', error=err, username=session.get('username'))
+        logthis.info(
+            f'Error accessing crontab for {getpass.getuser()} - {err}'
+        )
+        return render_template(
+            'error.html', error=err, username=session.get('username')
+        )
 
     for job in cron:
         if job.comment == target_job:
-            logthis.info(f"[{session.get('url')}] {session.get('username')} removed cron job {target_job}")
+            logthis.info(
+                f'[{session.get("url")}] {session.get("username")} removed cron job {target_job}'
+            )
             cron.remove(job)
             cron.write()
 
@@ -253,22 +320,37 @@ def delete_cron():
 
     with open(cron_json_file, 'w') as outfile:
         json.dump(data, outfile, indent=4)
-    success_msg = f"[{session.get('url')}] {session.get('username')} successfully deleted the Timed Automation: {target_job}."
-    return render_template('success.html', success_msg=success_msg,
-                           username=str(escape(session['username'])))
+    success_msg = f'[{session.get("url")}] {session.get("username")} successfully deleted the Timed Automation: {target_job}.'
+    return render_template(
+        'success.html',
+        success_msg=success_msg,
+        username=str(escape(session['username'])),
+    )
 
 
 @blueprint.route('/cron/edit', methods=['GET', 'POST'])
-def edit_cron():
+def edit_cron() -> Union[Response, str]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username')} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username")} viewed {request.path}'
+    )
 
     try:
         cron = CronTab(user=True)
     except IOError as err:
-        logthis.info(f"Error accessing crontab for {getpass.getuser()} - {err}")
-        return render_template('error.html', error=err, username=session.get('username'))
+        logthis.info(
+            f'Error accessing crontab for {getpass.getuser()} - {err}'
+        )
+        return render_template(
+            'error.html', error=err, username=session.get('username')
+        )
 
     with open(cron_json_file) as fin:
         cron_json = json.load(fin)
@@ -279,38 +361,58 @@ def edit_cron():
         if item.get('name') == name:
             description = item.get('description')
     if not name:
-        logthis.info(f'{request.path} - Warning: No name provided for editing, redirecting to cron home')
+        logthis.info(
+            f'{request.path} - Warning: No name provided for editing, redirecting to cron home'
+        )
 
         return redirect(url_for('cron.cron_home'))
-    logthis.debug(f"[{session.get('url')}] {session.get('username').title()} checking for job '{name}' in {cron.user}'s crontab")
+    logthis.debug(
+        f"[{session.get('url')}] {session.get('username').title()} checking for job '{name}' in {cron.user}'s crontab"
+    )
 
     check_for_name = [True for job in cron if job.comment == name]
-    logthis.debug(f"Does {name} exist in {cron.user}'s crontab? {check_for_name}")
+    logthis.debug(
+        f"Does {name} exist in {cron.user}'s crontab? {check_for_name}"
+    )
 
     if not check_for_name:
-        logthis.debug(f"JAWA is not aware of any job named {name} in {cron.user}'s crontab")
+        logthis.debug(
+            f"JAWA is not aware of any job named {name} in {cron.user}'s crontab"
+        )
         return redirect(url_for('cron.cron_home'))
 
     if not names:
-        return render_template('cron/home.html',
-                               username=str(escape(session['username'])))
+        return render_template(
+            'cron/home.html', username=str(escape(session['username']))
+        )
 
     if request.method != 'POST':
         days, frequencies, hours = time_definitions()
-        return render_template('cron/edit.html',
-                               content=names, edit_name=name, description=description, days=days, hours=hours,
-                               frequencies=frequencies, username=str(escape(session['username'])))
+        return render_template(
+            'cron/edit.html',
+            content=names,
+            edit_name=name,
+            description=description,
+            days=days,
+            hours=hours,
+            frequencies=frequencies,
+            username=str(escape(session['username'])),
+        )
 
     if ' ' in request.form.get('cron_name'):
-        error_message = "Single-string name only."
-        return render_template('error.html',
-                               error_message=error_message,
-                               error="error",
-                               username=str(escape(session['username'])))
+        error_message = 'Single-string name only.'
+        return render_template(
+            'error.html',
+            error_message=error_message,
+            error='error',
+            username=str(escape(session['username'])),
+        )
 
     button_choice = request.form.get('button_choice')
     if button_choice == 'Delete':
-        logthis.debug(f"[{session.get('url')}] {session.get('username')} is considering deleting a Timed Automation ({name})...")
+        logthis.debug(
+            f'[{session.get("url")}] {session.get("username")} is considering deleting a Timed Automation ({name})...'
+        )
         return redirect(url_for('cron.delete_cron', target_job=name))
 
     for each_cron in cron_json:
@@ -329,22 +431,22 @@ def edit_cron():
                 frequency = each_cron.get('frequency')
             else:
                 frequency_change = True
-            if frequency == "custom":
+            if frequency == 'custom':
                 frequency_change = True
                 custom_frequency = request.form.get('customfreq')
-                each_cron['frequency'] = f"Custom [ {custom_frequency} ]"
+                each_cron['frequency'] = f'Custom [ {custom_frequency} ]'
             else:
                 each_cron['frequency'] = frequency
             if request.files.get('script'):
                 script = request.files.get('script')
                 if ' ' in script.filename:
-                    script.filename = script.filename.replace(" ", "-")
+                    script.filename = script.filename.replace(' ', '-')
                 if script.filename:
                     if not os.path.isdir(scripts_dir):
                         os.mkdir(scripts_dir)
                     owd = os.getcwd()
                     os.chdir(scripts_dir)
-                    new_script_name = f"cron_{new_cron_name}_{script.filename}"
+                    new_script_name = f'cron_{new_cron_name}_{script.filename}'
                     script.save(secure_filename(new_script_name))
                     script_file = os.path.join(scripts_dir, new_script_name)
                     os.chmod(script_file, mode=0o0755)
@@ -360,47 +462,54 @@ def edit_cron():
             each_job.command = script_file
             each_job.comment = new_cron_name
             if frequency_change:
-                if frequency == "everyhour":
+                if frequency == 'everyhour':
                     each_job.every().hours()
                     each_job.minute.on(0)
 
-                if frequency == "everyday":
+                if frequency == 'everyday':
                     time = request.form.get('daytime')
                     each_job.day.every(1)
                     each_job.hour.on(time)
                     each_job.minute.on(0)
 
-                if frequency == "everyweek":
+                if frequency == 'everyweek':
                     day = request.form.get('weekday')
                     time = request.form.get('weektime')
                     each_job.dow.on(day)
                     each_job.hour.on(time)
                     each_job.minute.on(0)
 
-                if frequency == "everymonth":
+                if frequency == 'everymonth':
                     day = request.form.get('monthday')
                     time = request.form.get('monthtime')
                     each_job.day.on(day)
                     each_job.hour.on(time)
                     each_job.minute.on(0)
-                if frequency == "custom":
+                if frequency == 'custom':
                     custom_frequency = request.form.get('customfreq')
                     try:
                         each_job.setall(f'{custom_frequency}')
                     except (KeyError, ValueError) as err:
-                        custom_frequency = custom_frequency.replace(" ", "_")
-                        return render_template('error.html', error="Custom Crontab Frequency Error",
-                                               error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  "
-                                                             f"Please check your syntax and try again.\n"
-                                                             f"Check your syntax:  ",
-                                               link=f"https://crontab.guru/#{custom_frequency}", username=str(escape(session['username'])))
+                        custom_frequency = custom_frequency.replace(' ', '_')
+                        return render_template(
+                            'error.html',
+                            error='Custom Crontab Frequency Error',
+                            error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  "
+                            f'Please check your syntax and try again.\n'
+                            f'Check your syntax:  ',
+                            link=f'https://crontab.guru/#{custom_frequency}',
+                            username=str(escape(session['username'])),
+                        )
             cron.write()
 
     with open(cron_json_file, 'w') as outfile:
         json.dump(cron_json, outfile, indent=4)
-    success_msg = f"[{session.get('url')}] {session.get('username')} edited {new_cron_name} to run at the frequency:  {frequency}."
-    logthis.info(f"{success_msg}")
-
-    return render_template('success.html', success_msg=success_msg,
-                           webhooks="success",
-                           username=str(escape(session['username'])))
+    success_msg = f'[{session.get("url")}] {session.get("username")} edited {new_cron_name} to run at the frequency:  {frequency}.'
+    logthis.info(f'{success_msg}')
+
+    return render_template(
+        'success.html',
+        success_msg=success_msg,
+        webhooks='success',
+        username=str(escape(session['username'])),
+    )
diff --git a/views/custom_webhook.py b/views/custom_webhook.py
index a47eb04..f0b450a 100644
--- a/views/custom_webhook.py
+++ b/views/custom_webhook.py
@@ -27,11 +27,20 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 from collections import defaultdict
-from flask import (Blueprint, redirect, render_template,
-                   request, session, url_for)
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
 import json
 from markupsafe import escape
 import os
+from typing import Any, Dict, Union
+
 from werkzeug.utils import secure_filename
 
 from bin.view_modifiers import response
@@ -41,68 +50,102 @@
 
 blueprint = Blueprint('custom_webhook', __name__, template_folder='templates')
 
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-okta_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json'))
-okta_verification_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'))
-webhooks_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json'))
-scripts_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+okta_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json')
+)
+okta_verification_file = os.path.abspath(
+    os.path.join(
+        os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'
+    )
+)
+webhooks_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+)
+scripts_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+)
 
 
 @blueprint.route('/webhooks/custom', methods=['GET', 'POST'])
 @response(template_file='webhooks/custom/home.html')
-def custom_webhook():
+def custom_webhook() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     with open(webhooks_file, 'r') as fin:
         webhooks_json = json.load(fin)
     custom_webhooks_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
+        data = defaultdict(lambda: 'MISSING', each_webhook)
         tag = data['tag']
-        if tag == "custom":
+        if tag == 'custom':
             custom_webhooks_list.append(each_webhook)
 
-    return {'username': session.get('username'),
-            'custom_list': custom_webhooks_list}
+    return {
+        'username': session.get('username'),
+        'custom_list': custom_webhooks_list,
+    }
 
 
 @blueprint.route('/webhooks/custom/edit', methods=['GET', 'POST'])
 @response(template_file='webhooks/custom/edit.html')
-def edit_webhook():
+def edit_webhook() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     name = request.args.get('name')
     if name:
         name = escape(name)
     logthis.info(f"Checking for custom webhook '{name}'")
     with open(webhooks_file) as fin:
         webhooks_json = json.load(fin)
-    check_for_name = [True for each_webhook in webhooks_json if each_webhook['name'] == name]
-    logthis.info(f"Name exists? {check_for_name}")
+    check_for_name = [
+        True for each_webhook in webhooks_json if each_webhook['name'] == name
+    ]
+    logthis.info(f'Name exists? {check_for_name}')
     if not check_for_name:
-        logthis.info(f"JAWA is not aware of any custom webhook named {name}")
+        logthis.info(f'JAWA is not aware of any custom webhook named {name}')
         return redirect(url_for('custom_webhook.custom_webhook'))
 
     extra_notice = None
     custom_header = None
-    
+
     if request.method == 'POST':
         button_choice = request.form.get('button_choice')
         if button_choice == 'Delete':
-            logthis.info(f"{session.get('username')} is considering deleting a custom webhook ({name})...")
-            return redirect(url_for('webhooks.delete_webhook', target_webhook=name))
+            logthis.info(
+                f'{session.get("username")} is considering deleting a custom webhook ({name})...'
+            )
+            return redirect(
+                url_for('webhooks.delete_webhook', target_webhook=name)
+            )
         for each_webhook in webhooks_json:
             if each_webhook['name'] == name:
-                logthis.info(f"{session.get('username')} is editing a custom webhook ({name})...")
+                logthis.info(
+                    f'{session.get("username")} is editing a custom webhook ({name})...'
+                )
                 output = request.form.get('output')
                 new_custom_name = request.form.get('custom_name')
                 if not new_custom_name:
                     new_custom_name = name
                 description = request.form.get('description')
                 if request.form.get('basic'):
-                    new_webhook_user = request.form.get('basic_username', 'null')
+                    new_webhook_user = request.form.get(
+                        'basic_username', 'null'
+                    )
                     new_webhook_pass = request.form.get('new-password', 'null')
                 else:
                     new_webhook_user = 'null'
@@ -110,18 +153,18 @@ def edit_webhook():
                 if request.form.get('custom'):
                     new_webhook_apikey = request.form.get('api_key', 'null')
                     extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:'
-                    custom_header = {f"x-api-key": f"{new_webhook_apikey}"}
+                    custom_header = {'x-api-key': f'{new_webhook_apikey}'}
                 else:
                     new_webhook_apikey = 'null'
-                if new_webhook_user and new_webhook_user != "":
+                if new_webhook_user and new_webhook_user != '':
                     each_webhook['webhook_username'] = new_webhook_user
                 else:
                     each_webhook['webhook_username'] = 'null'
-                if new_webhook_pass and new_webhook_pass != "":
+                if new_webhook_pass and new_webhook_pass != '':
                     each_webhook['webhook_password'] = new_webhook_pass
                 else:
                     each_webhook['webhook_password'] = 'null'
-                if new_webhook_apikey and new_webhook_apikey != "":
+                if new_webhook_apikey and new_webhook_apikey != '':
                     each_webhook['api_key'] = new_webhook_apikey
                 else:
                     each_webhook['webhook_password'] = 'null'
@@ -131,11 +174,15 @@ def edit_webhook():
                     os.chdir(scripts_dir)
 
                     if ' ' in new_script.filename:
-                        new_script.filename = new_script.filename.replace(" ", "-")
+                        new_script.filename = new_script.filename.replace(
+                            ' ', '-'
+                        )
 
-                    new_filename = f"{new_custom_name}-{new_script.filename}"
+                    new_filename = f'{new_custom_name}-{new_script.filename}'
                     new_script.save(secure_filename(new_filename))
-                    new_filename = os.path.join(scripts_dir, f"{new_custom_name}-{new_script.filename}")
+                    new_filename = os.path.join(
+                        scripts_dir, f'{new_custom_name}-{new_script.filename}'
+                    )
                     os.chmod(new_filename, mode=0o0755)
                     os.chdir(owd)
                     each_webhook['script'] = new_filename
@@ -150,21 +197,38 @@ def edit_webhook():
                 with open(webhooks_file, 'w') as fout:
                     json.dump(webhooks_json, fout, indent=4)
                 webhook_info = [each_webhook]
-                return {"webhooks": "success",
-                        "success_msg": f"Edited custom webhook {new_custom_name}.",
-                        "username": session.get('username'), 'webhook_info': webhook_info,
-                        "webhook_name": new_custom_name,
-                        "description": each_webhook.get('description'), "extra_notice": extra_notice,
-                        "custom_header": custom_header}
-    webhook_info = [each_webhook for each_webhook in webhooks_json if each_webhook['name'] == name]
-    return {'username': session.get('username'), 'webhook_name': name, 'webhook_info': webhook_info}
+                return {
+                    'webhooks': 'success',
+                    'success_msg': f'Edited custom webhook {new_custom_name}.',
+                    'username': session.get('username'),
+                    'webhook_info': webhook_info,
+                    'webhook_name': new_custom_name,
+                    'description': each_webhook.get('description'),
+                    'extra_notice': extra_notice,
+                    'custom_header': custom_header,
+                }
+    webhook_info = [
+        each_webhook
+        for each_webhook in webhooks_json
+        if each_webhook['name'] == name
+    ]
+    return {
+        'username': session.get('username'),
+        'webhook_name': name,
+        'webhook_info': webhook_info,
+    }
 
 
 @blueprint.route('/webhooks/custom/new', methods=['GET', 'POST'])
-def new_webhook():
+def new_webhook() -> Union[Response, Dict[str, Any], str]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if request.method == 'POST':
         new_custom_name = request.form.get('custom_name')
         description = request.form.get('description')
@@ -172,13 +236,14 @@ def new_webhook():
 
         if request.form.get('custom_name') != '':
             check = 0
-            logthis.info(f"New webhook name: {request.form.get('custom_name')}")
+            logthis.info(
+                f'New webhook name: {request.form.get("custom_name")}'
+            )
 
             with open(webhooks_file, 'r') as json_file:
                 webhooks_json = json.load(json_file)
             if webhooks_json:
                 for each_webhook in webhooks_json:
-
                     if each_webhook.get('name') == new_custom_name:
                         check = 1
             owd = os.getcwd()
@@ -188,49 +253,66 @@ def new_webhook():
             target_file = request.files.get('new_file')
 
             if ' ' in target_file.filename:
-                target_file.filename = target_file.filename.replace(" ", "-")
+                target_file.filename = target_file.filename.replace(' ', '-')
 
-            new_filename = f"{new_custom_name}-{target_file.filename}"
+            new_filename = f'{new_custom_name}-{target_file.filename}'
             target_file.save(secure_filename(new_filename))
-            new_filename = os.path.join(scripts_dir, f"{new_custom_name}-{target_file.filename}")
+            new_filename = os.path.join(
+                scripts_dir, f'{new_custom_name}-{target_file.filename}'
+            )
             os.chmod(new_filename, mode=0o0755)
             os.chdir(owd)
             if check != 0:
-                error_message = "Name already exists!"
-                logthis.info(f"Could not create new webhook. Message: {error_message}")
-                return {"error": error_message, "username": session.get('username'), 'name': new_custom_name,
-                        'description': description}
+                error_message = 'Name already exists!'
+                logthis.info(
+                    f'Could not create new webhook. Message: {error_message}'
+                )
+                return {
+                    'error': error_message,
+                    'username': session.get('username'),
+                    'name': new_custom_name,
+                    'description': description,
+                }
             new_webhook_user = request.form.get('basic_username', 'null')
             if not new_webhook_user:
-                new_webhook_user = "null"
+                new_webhook_user = 'null'
             new_webhook_pass = request.form.get('new-password', 'null')
             if not new_webhook_pass:
-                new_webhook_pass = "null"
+                new_webhook_pass = 'null'
             if request.form.get('custom'):
                 api_key = request.form.get('api_key', 'null')
                 extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:'
-                custom_header = {f"x-api-key": f"{api_key}"}
+                custom_header = {'x-api-key': f'{api_key}'}
             else:
                 extra_notice = None
                 custom_header = None
                 api_key = 'null'
-            webhooks_json.append({"url": str(session['url']),
-                                  "jawa_admin": str(session['username']),
-                                  "name": new_custom_name,
-                                  "webhook_username": new_webhook_user,
-                                  "webhook_password": new_webhook_pass,
-                                  "api_key": api_key,
-                                  "script": new_filename,
-                                  "description": description,
-                                  "tag": "custom",
-                                  "output": output})
+            webhooks_json.append(
+                {
+                    'url': str(session['url']),
+                    'jawa_admin': str(session['username']),
+                    'name': new_custom_name,
+                    'webhook_username': new_webhook_user,
+                    'webhook_password': new_webhook_pass,
+                    'api_key': api_key,
+                    'script': new_filename,
+                    'description': description,
+                    'tag': 'custom',
+                    'output': output,
+                }
+            )
 
             with open(webhooks_file, 'w') as outfile:
                 json.dump(webhooks_json, outfile, indent=4)
-            success_msg = "New webhook created:"
-            return render_template('success.html',
-                                   webhooks="success",
-                                   success_msg=success_msg, extra_notice=extra_notice,
-                                   custom_header=custom_header,
-                                   username=str(escape(session['username'])))
-    return render_template('webhooks/custom/new.html', username=session.get('username'))
+            success_msg = 'New webhook created:'
+            return render_template(
+                'success.html',
+                webhooks='success',
+                success_msg=success_msg,
+                extra_notice=extra_notice,
+                custom_header=custom_header,
+                username=str(escape(session['username'])),
+            )
+    return render_template(
+        'webhooks/custom/new.html', username=session.get('username')
+    )
diff --git a/views/home_view.py b/views/home_view.py
index 10a7315..1ad5238 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -30,10 +30,18 @@
 import json
 import os
 from collections import defaultdict
+from typing import Union
 
 import requests
-from flask import (Blueprint, redirect, render_template,
-                   request, session, url_for)
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
 from markupsafe import escape
 
 from bin import logger
@@ -41,20 +49,34 @@
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
-log_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log'))
-server_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-webhooks_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json'))
-cron_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'cron.json'))
-resources_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'resources'))
-files_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'resources', 'files'))
-img_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'static', 'img'))
+log_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log')
+)
+server_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+webhooks_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+)
+cron_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'cron.json')
+)
+resources_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'resources')
+)
+files_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'resources', 'files')
+)
+img_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'static', 'img')
+)
 verify_ssl = True  # Enables Jamf Pro SSL certificate verification
 
 blueprint = Blueprint('home_view', __name__, template_folder='templates')
 
 
 @blueprint.route('/login', methods=['GET', 'POST'])
-def login():
+def login() -> Response:
     if request.method == 'POST':
         if os.path.isfile(server_file):
             with open(server_file) as json_file:
@@ -62,63 +84,112 @@ def login():
             if request.form.get('active_url'):
                 session['url'] = str(request.form.get('active_url'))
             elif server_json.get('jps_url', 0):
-                if server_json['jps_url'] is not None and len(server_json['jps_url']) != 0:
+                if (
+                    server_json['jps_url'] is not None
+                    and len(server_json['jps_url']) != 0
+                ):
                     session['url'] = str(server_json['jps_url'])
-            elif request.form.get('url')[-1:] == "/":
-                session['url'] = str(request.form.get('url')).rstrip(request.form.get('url')[-1])
+            elif request.form.get('url')[-1:] == '/':
+                session['url'] = str(request.form.get('url')).rstrip(
+                    request.form.get('url')[-1]
+                )
             else:
                 session['url'] = request.form['url']
 
-        elif request.form.get('active_url')[-1:] == "/":
-            session['url'] = str(request.form.get('url')).rstrip(request.form.get('url')[-1])
+        elif request.form.get('active_url')[-1:] == '/':
+            session['url'] = str(request.form.get('url')).rstrip(
+                request.form.get('url')[-1]
+            )
         else:
             session['url'] = request.form['url']
         session['username'] = request.form['username']
         session['password'] = request.form['password']
-        session['b64_auth'] = base64.b64encode(str.encode(f"{session.get('username')}:{session.get('password')}"))
+        session['b64_auth'] = base64.b64encode(
+            str.encode(f'{session.get("username")}:{session.get("password")}')
+        )
         get_token()
-        logthis.info(f"[{session.get('url')}] Attempting login for: {session.get('username')}")
+        logthis.info(
+            f'[{session.get("url")}] Attempting login for: {session.get("username")}'
+        )
 
-        if request.form['password'] == "":
-            title = "Authentication error"
+        if request.form['password'] == '':
+            title = 'Authentication error'
             msg = "Passwords can't be blank"
-            return redirect(url_for('home_view.logout', error_title=title, error_message=msg))
+            return redirect(
+                url_for(
+                    'home_view.logout', error_title=title, error_message=msg
+                )
+            )
         if not session.get('token'):
-            return redirect(url_for('home_view.logout', error_title="Could not fetch token", error_message="try again"))
+            return redirect(
+                url_for(
+                    'home_view.logout',
+                    error_title='Could not fetch token',
+                    error_message='try again',
+                )
+            )
         try:
             resp = requests.get(
                 session['url'] + '/JSSResource/activationcode',
-                headers={'Accept': 'application/json', "Authorization": f"Bearer {session.get('token')}",
-                         'User-Agent': 'JAWA%20v3.1.1'},
-                verify=verify_ssl)
+                headers={
+                    'Accept': 'application/json',
+                    'Authorization': f'Bearer {session.get("token")}',
+                    'User-Agent': 'JAWA%20v3.1.1',
+                },
+                verify=verify_ssl,
+            )
 
             resp.raise_for_status()
 
         except requests.exceptions.HTTPError as err:
-            logthis.info(f"Error occurred: {err}")
-            return redirect(url_for('home_view.logout', error_title="Login error",
-                                    error_message="check account credentials and privileges"))
+            logthis.info(f'Error occurred: {err}')
+            return redirect(
+                url_for(
+                    'home_view.logout',
+                    error_title='Login error',
+                    error_message='check account credentials and privileges',
+                )
+            )
         except requests.exceptions.ConnectTimeout as err:
-            logthis.info(f"Error occurred: {err}")
-            return redirect(url_for('home_view.logout', error_title="Connection Timeout", error_message=err))
+            logthis.info(f'Error occurred: {err}')
+            return redirect(
+                url_for(
+                    'home_view.logout',
+                    error_title='Connection Timeout',
+                    error_message=err,
+                )
+            )
         except requests.exceptions.ConnectionError as err:
-            logthis.info(f"Error occurred: {err}")
-            return redirect(url_for('home_view.logout', error_title="HTTP Error", error_message=err))
+            logthis.info(f'Error occurred: {err}')
+            return redirect(
+                url_for(
+                    'home_view.logout',
+                    error_title='HTTP Error',
+                    error_message=err,
+                )
+            )
 
         logthis.info(
-            f"[{session.get('url')}] Logging In: " + str(escape(session['username'])))
+            f'[{session.get("url")}] Logging In: '
+            + str(escape(session['username']))
+        )
 
         return redirect(url_for('home_view.dashboard'))
 
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
 
     return redirect(url_for('home_view.dashboard'))
 
 
 @blueprint.route('/logout')
-def logout():
+def logout() -> Union[Response, str]:
     error_title = request.args.get('error_title')
     if error_title:
         error_title = escape(error_title)
@@ -127,95 +198,123 @@ def logout():
         error_message = escape(error_message)
     if session.get('username'):
         invalidate_token()
-        logthis.info("Logging Out: " + str(escape(session['username'])))
+        logthis.info('Logging Out: ' + str(escape(session['username'])))
         session.pop('username', None)
     return load_home(error_title, error_message)
 
 
-def load_home(error_title="", error_message=""):
+def load_home(
+    error_title: str = '', error_message: str = ''
+) -> Union[Response, str]:
     if 'username' in session:
         return redirect(url_for('home_view.dashboard'))
     if not os.path.isfile(server_file):
-        with open(server_file, "w") as fout:
+        with open(server_file, 'w') as fout:
             json.dump({}, fout)
 
-    with open(server_file, "r") as fin:
+    with open(server_file, 'r') as fin:
         server_json = json.load(fin)
     if not server_json:
         return render_template('home.html')
-    brand = server_json.get("brand")
+    brand = server_json.get('brand')
 
     if (
-            'jps_url' not in server_json
-            or server_json['jps_url'] is None
-            or len(server_json['jps_url']) == 0
+        'jps_url' not in server_json
+        or server_json['jps_url'] is None
+        or len(server_json['jps_url']) == 0
     ):
         return render_template('home.html', app_name=brand)
     if 'alternate_jps' not in server_json:
-        return render_template('home.html', app_name=brand, error_title=error_title, error_message=error_message)
-
-    if server_json['alternate_jps'] != "":
-        return render_template('home.html',
-                               jps_url=server_json['jps_url'],
-                               jps_url2=server_json['alternate_jps'],
-                               welcome="true", jsslock="true", app_name=brand, error_title=error_title,
-                               error_message=error_message)
+        return render_template(
+            'home.html',
+            app_name=brand,
+            error_title=error_title,
+            error_message=error_message,
+        )
+
+    if server_json['alternate_jps'] != '':
+        return render_template(
+            'home.html',
+            jps_url=server_json['jps_url'],
+            jps_url2=server_json['alternate_jps'],
+            welcome='true',
+            jsslock='true',
+            app_name=brand,
+            error_title=error_title,
+            error_message=error_message,
+        )
 
     session['url'] = server_json['jps_url']
-    return render_template('home.html',
-                           jps_url=str(escape(session['url'])),
-                           welcome="true", jsslock="true", app_name=brand, error_title=error_title,
-                           error_message=error_message)
-
-
-@blueprint.route("/dashboard")
-def dashboard():
+    return render_template(
+        'home.html',
+        jps_url=str(escape(session['url'])),
+        welcome='true',
+        jsslock='true',
+        app_name=brand,
+        error_title=error_title,
+        error_message=error_message,
+    )
+
+
+@blueprint.route('/dashboard')
+def dashboard() -> Union[Response, str]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.info(f"[{session.get('url')}] {session.get('username')} rendering /dashboard.")
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.info(
+        f'[{session.get("url")}] {session.get("username")} rendering /dashboard.'
+    )
     with open(webhooks_file) as webhook_json:
         webhooks_installed = json.load(webhook_json)
     jamf_pro_webhooks = []
     okta_webhooks = []
     custom_webhooks = []
     for each_webhook in webhooks_installed:
-        data = defaultdict(lambda: "MISSING", each_webhook)
+        data = defaultdict(lambda: 'MISSING', each_webhook)
         tag = data['tag']
-        if tag == "jamfpro":
+        if tag == 'jamfpro':
             jamf_pro_webhooks.append(each_webhook)
-        elif tag == "okta":
+        elif tag == 'okta':
             okta_webhooks.append(each_webhook)
-        elif tag == "custom":
+        elif tag == 'custom':
             custom_webhooks.append(each_webhook)
 
     data = []
 
     if not os.path.isfile(cron_file):
-        with open(cron_file, "w") as outfile:
+        with open(cron_file, 'w') as outfile:
             json.dump(data, outfile)
 
-    with open(cron_file, "r") as cron_json:
+    with open(cron_file, 'r') as cron_json:
         try:
             cron_list = json.load(cron_json)
-        except json.decoder.JSONDecodeError as err:
-            with open(cron_file, "w") as cron_json:
+        except json.decoder.JSONDecodeError:
+            with open(cron_file, 'w') as cron_json:
                 cron_list = []
                 json.dump(cron_list, cron_json, indent=4)
 
     cron_json = []
     for cron in cron_list:
         script = cron['script'].rsplit('/', 1)
-        cron_json.append({"name": cron['name'],
-                          "frequency": cron['frequency'],
-                          "script": script[1],
-                          "description": cron['description']})
+        cron_json.append(
+            {
+                'name': cron['name'],
+                'frequency': cron['frequency'],
+                'script': script[1],
+                'description': cron['description'],
+            }
+        )
 
     webhook_url = session['url']
 
     if not cron_json:
         cron_json = ''
-    logthis.info(f"Total webhooks managed by JAWA: {len(webhooks_installed)}")
+    logthis.info(f'Total webhooks managed by JAWA: {len(webhooks_installed)}')
     if webhook_json == cron_json:
         return redirect(url_for('first_automation'))
     return render_template(
@@ -228,10 +327,11 @@ def dashboard():
         custom_list=custom_webhooks,
         total_webhooks=len(webhooks_installed),
         total_cron=len(cron_json),
-        login="true",
-        username=str(escape(session['username'])))
+        login='true',
+        username=str(escape(session['username'])),
+    )
 
 
 @blueprint.route('/home.html')
-def index():
+def index() -> Union[Response, str]:
     return load_home()
diff --git a/views/jamf_webhook.py b/views/jamf_webhook.py
index 8b61e38..dcd7e6c 100644
--- a/views/jamf_webhook.py
+++ b/views/jamf_webhook.py
@@ -27,12 +27,21 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 from collections import defaultdict
-from flask import (Blueprint, redirect, render_template,
-                   request, session, url_for)
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
 from markupsafe import escape
 import json
 import os
 import re
+from typing import Any, Dict, Union
+
 import requests
 from werkzeug.utils import secure_filename
 
@@ -42,49 +51,72 @@
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-webhooks_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json'))
-scripts_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+webhooks_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+)
+scripts_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+)
 verify_ssl = True
 blueprint = Blueprint('jamf_pro_webhooks', __name__)
 
 
 @blueprint.route('/webhooks/jamf', methods=['GET'])
 @response(template_file='webhooks/jamf/home.html')
-def jamf_webhook():
+def jamf_webhook() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     with open(webhooks_file, 'r') as fin:
         webhooks_json = json.load(fin)
     jamf_pro_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
+        data = defaultdict(lambda: 'MISSING', each_webhook)
         tag = data['tag']
-        if tag == "jamfpro":
+        if tag == 'jamfpro':
             jamf_pro_list.append(each_webhook)
 
-    return {'username': session.get('username'),
-            'jamf_list': jamf_pro_list, 'url': session.get('url')}
+    return {
+        'username': session.get('username'),
+        'jamf_list': jamf_pro_list,
+        'url': session.get('url'),
+    }
 
 
 @blueprint.route('/webhooks/jamf/new', methods=['GET', 'POST'])
-def jamf_pro_new():
+def jamf_pro_new() -> Union[Response, str]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if not os.path.isfile(server_json_file):
-        return render_template('setup/setup.html',
-                               setup="setup",
-                               jps_url=str(escape(session['url'])),
-                               username=str(escape(session['username'])))
-    with open(server_json_file, "r") as fin:
+        return render_template(
+            'setup/setup.html',
+            setup='setup',
+            jps_url=str(escape(session['url'])),
+            username=str(escape(session['username'])),
+        )
+    with open(server_json_file, 'r') as fin:
         server_json = json.load(fin)
     if server_json == []:
-        return render_template('setup/setup.html',
-                               setup="setup",
-                               jps_url=str(escape(session['url'])),
-                               username=str(escape(session['username'])))
+        return render_template(
+            'setup/setup.html',
+            setup='setup',
+            jps_url=str(escape(session['url'])),
+            username=str(escape(session['username'])),
+        )
     if not server_json.get('jawa_address'):
         return redirect(url_for('setup'))
     if not os.path.isfile(webhooks_file):
@@ -94,22 +126,31 @@ def jamf_pro_new():
 
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if request.method != 'POST':
-        return render_template('webhooks/jamf/new.html',
-                               webhooks="webhooks",
-                               url=session['url'],
-                               username=str(escape(session['username'])))
+        return render_template(
+            'webhooks/jamf/new.html',
+            webhooks='webhooks',
+            url=session['url'],
+            username=str(escape(session['username'])),
+        )
     if not validate_token(session['expires']):
         get_token()
     if request.form.get('webhook_name') != '':
         check = 0
         if ' ' in request.form.get('webhook_name'):
-            error_message = "Single-string name only."
-            return render_template('error.html',
-                                   error_message=error_message,
-                                   error="error",
-                                   username=str(escape(session['username'])))
+            error_message = 'Single-string name only.'
+            return render_template(
+                'error.html',
+                error_message=error_message,
+                error='error',
+                username=str(escape(session['username'])),
+            )
 
         with open(webhooks_file) as json_file:
             data = json.load(json_file)
@@ -128,11 +169,13 @@ def jamf_pro_new():
             for id_name in id_list:
                 check = 1 if id_name == request.form.get('webhook_name') else 0
         if check != 0:
-            error_message = "Name already exists!"
-            return render_template('error.html',
-                                   error_message=error_message,
-                                   error="error",
-                                   username=str(escape(session['username'])))
+            error_message = 'Name already exists!'
+            return render_template(
+                'error.html',
+                error_message=error_message,
+                error='error',
+                username=str(escape(session['username'])),
+            )
 
         with open(server_json_file) as json_file:
             data = json.load(json_file)
@@ -146,14 +189,17 @@ def jamf_pro_new():
 
         new_file = request.files.get('new_file')
         if ' ' in new_file.filename:
-            new_file.filename = new_file.filename.replace(" ", "-")
+            new_file.filename = new_file.filename.replace(' ', '-')
 
         new_file.save(secure_filename(new_file.filename))
 
         old_script_file = os.path.abspath(
-            os.path.join(scripts_dir, f"{new_file.filename}"))
-        new_script_file = (os.path.join(scripts_dir,
-                                        f"{request.form.get('webhook_name')}-{new_file.filename}"))
+            os.path.join(scripts_dir, f'{new_file.filename}')
+        )
+        new_script_file = os.path.join(
+            scripts_dir,
+            f'{request.form.get("webhook_name")}-{new_file.filename}',
+        )
         os.rename(old_script_file, new_script_file)
 
         os.chmod(new_script_file, mode=0o0755)
@@ -161,20 +207,25 @@ def jamf_pro_new():
         if request.form.get('event') in [
             'SmartGroupMobileDeviceMembershipChange',
             'SmartGroupComputerMembershipChange',
-            'SmartGroupUserMembershipChange'
+            'SmartGroupUserMembershipChange',
         ]:
-
-            smart_group_notice = "NOTICE!  This webhook is not yet enabled."
-            smart_group_instructions = "Specify desired Smart Group and enable: "
+            smart_group_notice = 'NOTICE!  This webhook is not yet enabled.'
+            smart_group_instructions = (
+                'Specify desired Smart Group and enable: '
+            )
             webhook_enablement = 'false'
 
         else:
-            smart_group_notice = ""
-            smart_group_instructions = ""
+            smart_group_notice = ''
+            smart_group_instructions = ''
             webhook_enablement = 'true'
 
-        if request.form.get('event') == "SmartGroupMobileDeviceMembershipChange":
-            extra_xml = "<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
+        if (
+            request.form.get('event')
+            == 'SmartGroupMobileDeviceMembershipChange'
+        ):
+            extra_xml = (
+                '<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
                             <display_fields>\
                                 <display_field>\
                                     <name>Asset Tag</name>\
@@ -194,58 +245,77 @@ def jamf_pro_new():
                                 <display_field>\
                                     <name>Last Enrollment</name>\
                                 </display_field>\
-                            </display_fields>"
+                            </display_fields>'
+            )
         else:
-            extra_xml = ""
+            extra_xml = ''
 
         # Check for auth values
-        auth_xml = "<authentication_type>NONE</authentication_type>"
+        auth_xml = '<authentication_type>NONE</authentication_type>'
         if request.form.get('choice') == 'basic':
             if (
-                    request.form.get('basic_username') != '' or
-                    request.form.get('basic_password') != ''):
-                auth_xml = f"<authentication_type>BASIC</authentication_type>"
+                request.form.get('basic_username') != ''
+                or request.form.get('basic_password') != ''
+            ):
+                auth_xml = '<authentication_type>BASIC</authentication_type>'
                 if request.form.get('basic_username') == '':
-                    auth_xml += "<username>null</username>"
+                    auth_xml += '<username>null</username>'
                 else:
-                    auth_xml += f"<username>{request.form.get('basic_username')}</username>"
+                    auth_xml += f'<username>{request.form.get("basic_username")}</username>'
                 if request.form.get('basic_password') == '':
-                    auth_xml += "<password>null</password>"
+                    auth_xml += '<password>null</password>'
                 else:
-                    auth_xml += f"<password>{request.form.get('basic_password')}</password>"
-
-        data = f"<webhook>" \
-               f"<name>{request.form.get('webhook_name')}</name>" \
-               f"<enabled>{webhook_enablement}</enabled>" \
-               f"<url>{server_address}/hooks/{request.form.get('webhook_name')}</url>" \
-               f"<content_type>application/json</content_type>" \
-               f"<event>{request.form.get('event')}</event>" \
-               f"{auth_xml}" \
-               f"{extra_xml}" \
-               f"</webhook>"
+                    auth_xml += f'<password>{request.form.get("basic_password")}</password>'
+
+        data = (
+            f'<webhook>'
+            f'<name>{request.form.get("webhook_name")}</name>'
+            f'<enabled>{webhook_enablement}</enabled>'
+            f'<url>{server_address}/hooks/{request.form.get("webhook_name")}</url>'
+            f'<content_type>application/json</content_type>'
+            f'<event>{request.form.get("event")}</event>'
+            f'{auth_xml}'
+            f'{extra_xml}'
+            f'</webhook>'
+        )
 
         full_url = session['url'] + '/JSSResource/webhooks/id/0'
-        logthis.info(f"{session.get('username')} creating a new JPS webhook {request.form.get('webhook_name')}.")
-        webhook_response = requests.post(full_url,
-                                         headers={'Content-Type': 'application/xml',
-                                                  "Authorization": f"Bearer {session['token']}",
-                                                  'User-Agent': 'JAWA%20v3.1.1'}, data=data,
-                                         verify=verify_ssl)
-        logthis.info(f"[{webhook_response.status_code}]  {webhook_response.text}")
+        logthis.info(
+            f'{session.get("username")} creating a new JPS webhook {request.form.get("webhook_name")}.'
+        )
+        webhook_response = requests.post(
+            full_url,
+            headers={
+                'Content-Type': 'application/xml',
+                'Authorization': f'Bearer {session["token"]}',
+                'User-Agent': 'JAWA%20v3.1.1',
+            },
+            data=data,
+            verify=verify_ssl,
+        )
+        logthis.info(
+            f'[{webhook_response.status_code}]  {webhook_response.text}'
+        )
         if webhook_response.status_code == 409:
-            error_message = f"The webhooks name \"{request.form.get('webhook_name')}\" already exists in your Jamf Pro Server."
-            return render_template('error.html',
-                                   error_message=error_message,
-                                   error="error",
-                                   username=str(escape(session['username'])))
+            error_message = f'The webhooks name "{request.form.get("webhook_name")}" already exists in your Jamf Pro Server.'
+            return render_template(
+                'error.html',
+                error_message=error_message,
+                error='error',
+                username=str(escape(session['username'])),
+            )
 
         result = re.search('<id>(.*)</id>', webhook_response.text)
         jamf_id = result.group(1)
-        new_link = "{}/webhooks.html?id={}&o=r".format(session['url'], result.group(1))
-        logthis.info(f"{session.get('username')} created a new webhook. "
-                     f"Name: {request.form.get('webhook_name')} "
-                     f"Jamf link: {new_link}")
-        custom_header = ""
+        new_link = '{}/webhooks.html?id={}&o=r'.format(
+            session['url'], result.group(1)
+        )
+        logthis.info(
+            f'{session.get("username")} created a new webhook. '
+            f'Name: {request.form.get("webhook_name")} '
+            f'Jamf link: {new_link}'
+        )
+        custom_header = ''
         data = json.load(open(webhooks_file))
         if request.form.get('choice') == 'basic':
             webhook_username = request.form.get('basic_username', 'null')
@@ -256,53 +326,67 @@ def jamf_pro_new():
         if request.form.get('choice') == 'custom':
             webhook_apikey = request.form.get('api_key', 'null')
             extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:'
-            custom_header = {f"x-api-key": f"{webhook_apikey}"}
+            custom_header = {'x-api-key': f'{webhook_apikey}'}
         else:
             webhook_apikey = 'null'
             extra_notice = None
 
-        data.append({"url": str(session['url']),
-                     "jawa_admin": str(session['username']),
-                     "name": request.form.get('webhook_name'),
-                     "webhook_username": webhook_username,
-                     "webhook_password": webhook_password,
-                     "api_key": webhook_apikey,
-                     "event": request.form.get('event'),
-                     "script": new_script_file,
-                     "description": request.form.get('description'),
-                     "tag": "jamfpro",
-                     "jamf_id": jamf_id})
+        data.append(
+            {
+                'url': str(session['url']),
+                'jawa_admin': str(session['username']),
+                'name': request.form.get('webhook_name'),
+                'webhook_username': webhook_username,
+                'webhook_password': webhook_password,
+                'api_key': webhook_apikey,
+                'event': request.form.get('event'),
+                'script': new_script_file,
+                'description': request.form.get('description'),
+                'tag': 'jamfpro',
+                'jamf_id': jamf_id,
+            }
+        )
 
         with open(webhooks_file, 'w') as outfile:
             json.dump(data, outfile, indent=4)
 
         new_here = request.form.get('webhook_name')
-        success_msg = "New webhook created:"
-
-    return render_template('success.html',
-                           webhooks="success",
-                           smart_group_instructions=smart_group_instructions,
-                           smart_group_notice=smart_group_notice,
-                           new_link=new_link,
-                           new_here=new_here,
-                           success_msg=success_msg, extra_notice=extra_notice,
-                           custom_header=custom_header,
-                           username=str(escape(session['username'])))
+        success_msg = 'New webhook created:'
+
+    return render_template(
+        'success.html',
+        webhooks='success',
+        smart_group_instructions=smart_group_instructions,
+        smart_group_notice=smart_group_notice,
+        new_link=new_link,
+        new_here=new_here,
+        success_msg=success_msg,
+        extra_notice=extra_notice,
+        custom_header=custom_header,
+        username=str(escape(session['username'])),
+    )
 
 
 # Edit Existing Webhook
 @blueprint.route('/webhooks/jamf/edit', methods=['GET', 'POST'])
 @response(template_file='webhooks/jamf/edit.html')
-def jamf_pro_edit():
+def jamf_pro_edit() -> Union[Response, str, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     name = request.args.get('name')
     if name:
         name = escape(name)
     with open(webhooks_file) as fin:
         webhooks_json = json.load(fin)
-    check_for_name = [True for each_webhook in webhooks_json if each_webhook['name'] == name]
+    check_for_name = [
+        True for each_webhook in webhooks_json if each_webhook['name'] == name
+    ]
     if not check_for_name:
         logthis.info(f"Webhook '{name}' not in json")
         return redirect(url_for('jamf_pro_webhooks.jamf_webhook'))
@@ -312,11 +396,17 @@ def jamf_pro_edit():
     smart_group_notice = None
     smart_group_instructions = None
 
-    webhook_info = [each_webhook for each_webhook in webhooks_json if each_webhook['name'] == name]
+    webhook_info = [
+        each_webhook
+        for each_webhook in webhooks_json
+        if each_webhook['name'] == name
+    ]
     if request.method == 'POST':
         button_choice = request.form.get('button_choice')
         if button_choice == 'Delete':
-            return redirect(url_for('webhooks.delete_webhook', target_webhook=name))
+            return redirect(
+                url_for('webhooks.delete_webhook', target_webhook=name)
+            )
 
         if not validate_token(session['expires']):
             get_token()
@@ -327,7 +417,7 @@ def jamf_pro_edit():
                     new_webhook_name = name
                 description = request.form.get('description')
                 new_event = request.form.get('event')
-                custom_header = ""
+                custom_header = ''
                 if request.form.get('choice') == 'basic':
                     webhook_user = request.form.get('basic_username', 'null')
                     webhook_pass = request.form.get('basic_password', 'null')
@@ -337,7 +427,7 @@ def jamf_pro_edit():
                 if request.form.get('choice') == 'custom':
                     webhook_apikey = request.form.get('api_key', 'null')
                     extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks '
-                    custom_header = {"x-api-key": f"{webhook_apikey}"}
+                    custom_header = {'x-api-key': f'{webhook_apikey}'}
                 else:
                     webhook_apikey = 'null'
                     extra_notice = None
@@ -348,11 +438,16 @@ def jamf_pro_edit():
                     os.chdir(scripts_dir)
 
                     if ' ' in new_script.filename:
-                        new_script.filename = new_script.filename.replace(" ", "-")
+                        new_script.filename = new_script.filename.replace(
+                            ' ', '-'
+                        )
 
-                    new_filename = f"{new_webhook_name}-{new_script.filename}"
+                    new_filename = f'{new_webhook_name}-{new_script.filename}'
                     new_script.save(secure_filename(new_filename))
-                    new_filename = os.path.join(scripts_dir, f"{new_webhook_name}-{new_script.filename}")
+                    new_filename = os.path.join(
+                        scripts_dir,
+                        f'{new_webhook_name}-{new_script.filename}',
+                    )
                     os.chmod(new_filename, mode=0o0755)
                     os.chdir(owd)
                     each_webhook['script'] = new_filename
@@ -364,15 +459,15 @@ def jamf_pro_edit():
                     each_webhook['description'] = description
                 if new_event:
                     each_webhook['event'] = new_event
-                if webhook_user and webhook_user != "":
+                if webhook_user and webhook_user != '':
                     each_webhook['webhook_username'] = webhook_user
                 else:
                     each_webhook['webhook_username'] = 'null'
-                if webhook_pass and webhook_pass != "":
+                if webhook_pass and webhook_pass != '':
                     each_webhook['webhook_password'] = webhook_pass
                 else:
                     each_webhook['webhook_password'] = 'null'
-                if webhook_apikey and webhook_apikey != "":
+                if webhook_apikey and webhook_apikey != '':
                     each_webhook['api_key'] = webhook_apikey
                 else:
                     each_webhook['webhook_password'] = 'null'
@@ -380,20 +475,27 @@ def jamf_pro_edit():
                 if each_webhook.get('event') in [
                     'SmartGroupMobileDeviceMembershipChange',
                     'SmartGroupComputerMembershipChange',
-                    'SmartGroupUserMembershipChange'
+                    'SmartGroupUserMembershipChange',
                 ]:
-
-                    smart_group_notice = "NOTICE!  This webhook is currently disabled."
-                    smart_group_instructions = "Please verify the linked Smart Group and re-enable: "
+                    smart_group_notice = (
+                        'NOTICE!  This webhook is currently disabled.'
+                    )
+                    smart_group_instructions = (
+                        'Please verify the linked Smart Group and re-enable: '
+                    )
                     webhook_enablement = 'false'
 
                 else:
-                    smart_group_notice = ""
-                    smart_group_instructions = ""
+                    smart_group_notice = ''
+                    smart_group_instructions = ''
                     webhook_enablement = 'true'
 
-                if each_webhook.get('event') == "SmartGroupMobileDeviceMembershipChange":
-                    extra_xml = "<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
+                if (
+                    each_webhook.get('event')
+                    == 'SmartGroupMobileDeviceMembershipChange'
+                ):
+                    extra_xml = (
+                        '<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
                                     <display_fields>\
                                         <display_field>\
                                             <name>Asset Tag</name>\
@@ -413,86 +515,135 @@ def jamf_pro_edit():
                                         <display_field>\
                                             <name>Last Enrollment</name>\
                                         </display_field>\
-                                    </display_fields>"
+                                    </display_fields>'
+                    )
                 else:
-                    extra_xml = ""
+                    extra_xml = ''
                     # Check for auth values
-                auth_xml = "<authentication_type>NONE</authentication_type>"
+                auth_xml = '<authentication_type>NONE</authentication_type>'
                 if request.form.get('choice') == 'basic':
                     if (
-                            request.form.get('basic_username') != '' or
-                            request.form.get('basic_password') != ''):
-                        auth_xml = f"<authentication_type>BASIC</authentication_type>"
-                        if (request.form.get('basic_username') == 'null' and
-                                request.form.get('basic_password') == 'null'):
-                            auth_xml = "<authentication_type>NONE</authentication_type>"
+                        request.form.get('basic_username') != ''
+                        or request.form.get('basic_password') != ''
+                    ):
+                        auth_xml = (
+                            '<authentication_type>BASIC</authentication_type>'
+                        )
+                        if (
+                            request.form.get('basic_username') == 'null'
+                            and request.form.get('basic_password') == 'null'
+                        ):
+                            auth_xml = '<authentication_type>NONE</authentication_type>'
 
                         if request.form.get('basic_username') == '':
-                            auth_xml += "<username>null</username>"
+                            auth_xml += '<username>null</username>'
                         else:
-                            auth_xml += f"<username>{request.form.get('basic_username')}</username>"
+                            auth_xml += f'<username>{request.form.get("basic_username")}</username>'
                         if request.form.get('basic_password') == '':
-                            auth_xml += "<password>null</password>"
+                            auth_xml += '<password>null</password>'
                         else:
-                            auth_xml += f"<password>{request.form.get('basic_password')}</password>"
+                            auth_xml += f'<password>{request.form.get("basic_password")}</password>'
                 with open(server_json_file) as fin:
                     server_json = json.load(fin)
                 server_address = server_json['jawa_address']
-                data = f"<webhook>" \
-                       f"<name>{each_webhook.get('name')}</name>" \
-                       f"<enabled>{webhook_enablement}</enabled>" \
-                       f"<url>{server_address}/hooks/{each_webhook.get('name')}</url>" \
-                       f"<content_type>application/json</content_type>" \
-                       f"<event>{each_webhook.get('event')}</event>" \
-                       f"{auth_xml}" \
-                       f"{extra_xml}" \
-                       f"</webhook>"
-
-                full_url = f"{session['url']}/JSSResource/webhooks/id/{each_webhook.get('jamf_id')}"
-
-                logthis.debug(f"{session.get('username')} editing the JPS webhook {name}.")
+                data = (
+                    f'<webhook>'
+                    f'<name>{each_webhook.get("name")}</name>'
+                    f'<enabled>{webhook_enablement}</enabled>'
+                    f'<url>{server_address}/hooks/{each_webhook.get("name")}</url>'
+                    f'<content_type>application/json</content_type>'
+                    f'<event>{each_webhook.get("event")}</event>'
+                    f'{auth_xml}'
+                    f'{extra_xml}'
+                    f'</webhook>'
+                )
+
+                full_url = f'{session["url"]}/JSSResource/webhooks/id/{each_webhook.get("jamf_id")}'
+
+                logthis.debug(
+                    f'{session.get("username")} editing the JPS webhook {name}.'
+                )
                 try:
-                    webhook_response = requests.put(full_url,
-                                                    headers={'Content-Type': 'application/xml',
-                                                             "Authorization": f"Bearer {session['token']}",
-                                                             'User-Agent': 'JAWA%20v3.1.1'}, data=data,
-                                                    verify=verify_ssl)
-                except:
-                    error_message = f"The request could not be sent to your Jamf Pro server," \
-                                    f"check your network connection."
-                    return render_template('error.html',
-                                           error_message=error_message,
-                                           error="error",
-                                           username=str(escape(session['username'])))
-                logthis.debug(f"[{webhook_response.status_code}]  {webhook_response.text}")
+                    webhook_response = requests.put(
+                        full_url,
+                        headers={
+                            'Content-Type': 'application/xml',
+                            'Authorization': f'Bearer {session["token"]}',
+                            'User-Agent': 'JAWA%20v3.1.1',
+                        },
+                        data=data,
+                        verify=verify_ssl,
+                    )
+                except Exception as err:
+                    error_message = (
+                        f'The request could not be sent to your Jamf Pro server,'
+                        f'check your network connection. Details: {err}'
+                    )
+                    return render_template(
+                        'error.html',
+                        error_message=error_message,
+                        error='error',
+                        username=str(escape(session['username'])),
+                    )
+                logthis.debug(
+                    f'[{webhook_response.status_code}]  {webhook_response.text}'
+                )
                 if webhook_response.status_code == 409:
-                    error_message = f"The webhooks name \"{name}\" already exists in your Jamf Pro Server."
+                    error_message = f'The webhooks name "{name}" already exists in your Jamf Pro Server.'
                     logthis.info(
-                        f"[{session.get('url')}] {session.get('username').title()} - error editing webhook. {error_message}")
-                    return redirect(url_for('error', error="Duplicate", error_message=error_message,
-                                            username=session.get('username')))
+                        f'[{session.get("url")}] {session.get("username").title()} - error editing webhook. {error_message}'
+                    )
+                    return redirect(
+                        url_for(
+                            'error',
+                            error='Duplicate',
+                            error_message=error_message,
+                            username=session.get('username'),
+                        )
+                    )
                 elif webhook_response.status_code == 401:
-                    error_message = f"{session.get('username').title()} doesn't have privileges to update webhooks." \
-                                    f"Check your account privileges in Jamf Pro Settings"
-                    logthis.info(f"[{session.get('url')}] {error_message}")
-                    return redirect(url_for('error', error="Insufficient privileges", error_message=error_message,
-                                            username=session.get('username')))
+                    error_message = (
+                        f"{session.get('username').title()} doesn't have privileges to update webhooks."
+                        f'Check your account privileges in Jamf Pro Settings'
+                    )
+                    logthis.info(f'[{session.get("url")}] {error_message}')
+                    return redirect(
+                        url_for(
+                            'error',
+                            error='Insufficient privileges',
+                            error_message=error_message,
+                            username=session.get('username'),
+                        )
+                    )
                 with open(webhooks_file, 'w') as fout:
                     json.dump(webhooks_json, fout, indent=4)
                 result = re.search('<id>(.*)</id>', webhook_response.text)
                 jamf_id = result.group(1)
-                new_link = f"{format(session.get('url'))}/webhooks.html?id={jamf_id}&o=r"
-                success_msg = "Webhook edited:"
-                logthis.info(f"{session.get('username')} edited a Jamf webhook. "
-                             f"Name: {name} "
-                             f"Jamf link: {new_link}")
-                return {"webhooks": "success", "smart_group_instructions": smart_group_instructions,
-                        "smart_group_notice": smart_group_notice,
-                        "new_link": new_link,
-                        "new_here": new_webhook_name,
-                        "success_msg": success_msg, "extra_notice": extra_notice, "custom_header": custom_header,
-                        "username": session.get('username'), 'webhook_info': webhook_info, "webhook_name": name,
-                        "description": each_webhook.get('description')}
-
-    return {'username': session.get('username'), 'webhook_name': name, 'url': session.get('url'),
-            'webhook_info': webhook_info}
+                new_link = f'{format(session.get("url"))}/webhooks.html?id={jamf_id}&o=r'
+                success_msg = 'Webhook edited:'
+                logthis.info(
+                    f'{session.get("username")} edited a Jamf webhook. '
+                    f'Name: {name} '
+                    f'Jamf link: {new_link}'
+                )
+                return {
+                    'webhooks': 'success',
+                    'smart_group_instructions': smart_group_instructions,
+                    'smart_group_notice': smart_group_notice,
+                    'new_link': new_link,
+                    'new_here': new_webhook_name,
+                    'success_msg': success_msg,
+                    'extra_notice': extra_notice,
+                    'custom_header': custom_header,
+                    'username': session.get('username'),
+                    'webhook_info': webhook_info,
+                    'webhook_name': name,
+                    'description': each_webhook.get('description'),
+                }
+
+    return {
+        'username': session.get('username'),
+        'webhook_name': name,
+        'url': session.get('url'),
+        'webhook_info': webhook_info,
+    }
diff --git a/views/log_view.py b/views/log_view.py
index bfadba2..413f484 100644
--- a/views/log_view.py
+++ b/views/log_view.py
@@ -31,51 +31,93 @@
 import subprocess
 from datetime import datetime
 from time import sleep
-
-from flask import (Blueprint, current_app, redirect, render_template, Response,
-                   request, send_file, session, url_for)
+from typing import Union
+
+from flask import (
+    Blueprint,
+    current_app,
+    redirect,
+    render_template,
+    Response,
+    request,
+    send_file,
+    session,
+    url_for,
+)
 
 from bin import logger
 from bin.view_modifiers import response
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
-log_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log'))
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
+log_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log')
+)
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
 
 blueprint = Blueprint('log_view', __name__, template_folder='templates')
 
 
 @blueprint.route('/log/home.html', methods=['GET'])
-def log_home():
+def log_home() -> Union[Response, str]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+    )
     with open(log_file, 'r') as fin:
         lines = [re.sub('\n', '', line) for line in fin.readlines()]
         lines.reverse()
         view_lines = lines[:500]
-    return render_template('log/home.html', username=session.get('username'), log=view_lines)
+    return render_template(
+        'log/home.html', username=session.get('username'), log=view_lines
+    )
 
 
 @blueprint.route('/log/view', methods=['GET'])
-def log_view():
+def log_view() -> Union[Response, str]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+    )
     with open(log_file, 'r') as fin:
         lines = [re.sub('\n', '', line) for line in fin.readlines()]
         lines.reverse()
         view_lines = lines[:500]
-    return render_template('log/home.html', username=session.get('username'), log=view_lines)
+    return render_template(
+        'log/home.html', username=session.get('username'), log=view_lines
+    )
 
 
 @blueprint.route('/log/live.html', methods=['GET'])
-@response(template_file="log/live.html")
-def stream():
+@response(template_file='log/live.html')
+def stream() -> Response:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.debug(f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.debug(
+        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+    )
 
     def generate():
         with open(log_file) as f:
@@ -86,30 +128,52 @@ def generate():
 
 
 @blueprint.route('/log/yield')
-def yield_log():
+def yield_log() -> Response:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.info(f"/log/yield accessed by {session.get('username') or 'nobody'}")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.info(
+        f'/log/yield accessed by {session.get("username") or "nobody"}'
+    )
 
     def inner():
         proc = subprocess.Popen(
-            [f'tail -f {log_file}'],  # call something with a lot of output so we can see it
+            [
+                f'tail -f {log_file}'
+            ],  # call something with a lot of output so we can see it
             shell=True,
-            stdout=subprocess.PIPE
+            stdout=subprocess.PIPE,
         )
 
         for line in iter(proc.stdout.readline, ''):
-            sleep(.1)  # Don't need this just shows the text streaming
+            sleep(0.1)  # Don't need this just shows the text streaming
             yield line.rstrip().decode() + '<br/>\n'
 
     return Response(inner(), mimetype='text/html')
 
 
 @blueprint.route('/log/download')
-def download_logs():
+def download_logs() -> Response:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    logthis.info(f"[{session.get('url')}] {session.get('username')} used {request.path} to download the log.")
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    logthis.info(
+        f'[{session.get("url")}] {session.get("username")} used {request.path} to download the log.'
+    )
     timestamp = datetime.now()
-    logthis.info(f"Downloading log file...{timestamp}-jawa.log")
-    return send_file(log_file, as_attachment=True, download_name=f"{datetime.now()}-jawa.log")
+    logthis.info(f'Downloading log file...{timestamp}-jawa.log')
+    return send_file(
+        log_file,
+        as_attachment=True,
+        download_name=f'{datetime.now()}-jawa.log',
+    )
diff --git a/views/okta_webhook.py b/views/okta_webhook.py
index e797363..cedcada 100644
--- a/views/okta_webhook.py
+++ b/views/okta_webhook.py
@@ -28,10 +28,19 @@
 
 from collections import defaultdict
 import json
-from flask import (Blueprint, redirect, render_template,
-                   request, session, url_for)
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
 from markupsafe import escape
 import os
+from typing import Any, Dict, Union
+
 import requests
 from werkzeug.utils import secure_filename
 
@@ -42,34 +51,61 @@
 
 blueprint = Blueprint('okta_webhook', __name__)
 
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-okta_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json'))
-okta_verification_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'))
-webhooks_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json'))
-scripts_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+okta_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json')
+)
+okta_verification_file = os.path.abspath(
+    os.path.join(
+        os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'
+    )
+)
+webhooks_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+)
+scripts_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+)
 
 
 @blueprint.route('/webhooks/okta', methods=['GET', 'POST'])
 @response(template_file='webhooks/okta/home.html')
-def okta_webhook():
+def okta_webhook() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     with open(webhooks_file, 'r') as fin:
         webhooks_json = json.load(fin)
     okta_webhooks_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
+        data = defaultdict(lambda: 'MISSING', each_webhook)
         tag = data['tag']
-        if tag == "okta":
+        if tag == 'okta':
             okta_webhooks_list.append(each_webhook)
-    return {'key': "Have a good weekend my dude.", 'username': session.get('username'),
-            'okta_list': okta_webhooks_list}
+    return {
+        'key': 'Have a good weekend my dude.',
+        'username': session.get('username'),
+        'okta_list': okta_webhooks_list,
+    }
 
 
 @blueprint.route('/webhooks/okta/new', methods=['GET', 'POST'])
-def okta_new():
+def okta_new() -> Union[Response, str]:
     if 'username' not in session:
-        return redirect(url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+        return redirect(
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     os.chmod(okta_verification_file, mode=0o0755)
     if not os.path.isfile(webhooks_file):
         data = []
@@ -81,14 +117,19 @@ def okta_new():
         if not server_address:
             return redirect(url_for('setup'))
     if request.method != 'POST':
-        return render_template('webhooks/okta/new.html', setup="setup",
-                               username=str(escape(session['username'])))
+        return render_template(
+            'webhooks/okta/new.html',
+            setup='setup',
+            username=str(escape(session['username'])),
+        )
     if ' ' in request.form.get('webhookname'):
-        error_message = "Single-string name only."
-        return render_template('error.html',
-                               error_message=error_message,
-                               error="error",
-                               username=str(escape(session['username'])))
+        error_message = 'Single-string name only.'
+        return render_template(
+            'error.html',
+            error_message=error_message,
+            error='error',
+            username=str(escape(session['username'])),
+        )
     if not os.path.isdir(scripts_dir):
         os.mkdir(scripts_dir)
 
@@ -104,51 +145,48 @@ def okta_new():
 
     f = request.files['script']
     if ' ' in f.filename:
-        f.filename = f.filename.replace(" ", "-")
+        f.filename = f.filename.replace(' ', '-')
 
     f.save(secure_filename(f.filename))
 
     old_script_file = os.path.join(scripts_dir, f.filename)
     data = json.load(open(webhooks_file))
-    new_id = okta_name
-    script_file = os.path.join(scripts_dir, okta_name + "_" + f.filename)
+    script_file = os.path.join(scripts_dir, okta_name + '_' + f.filename)
     os.rename(old_script_file, script_file)
     new_file = script_file
     okta_info = json.load(open(webhooks_file))
     os.chdir(owd)
     for i in data:
         if str(i['name']) == okta_name:
-            error_message = "Name already exists!"
-            logthis.info("okta webhook erorr")
-            return render_template('error.html',
-                                   error_message=error_message,
-                                   error="error",
-                                   username=str(escape(session['username'])))
+            error_message = 'Name already exists!'
+            logthis.info('okta webhook erorr')
+            return render_template(
+                'error.html',
+                error_message=error_message,
+                error='error',
+                username=str(escape(session['username'])),
+            )
 
     os.chmod(os.path.join(scripts_dir, new_file), mode=0o0755)
 
     data = {
-        "name": okta_name,
-        "events": {
-            "type": "EVENT_TYPE",
-            "items": [okta_event]
+        'name': okta_name,
+        'events': {'type': 'EVENT_TYPE', 'items': [okta_event]},
+        'channel': {
+            'type': 'HTTP',
+            'version': '1.0.0',
+            'config': {
+                'uri': webhook_server_url,
+                'headers': [
+                    {'key': 'X-Other-Header', 'value': 'some-other-value'}
+                ],
+                'authScheme': {
+                    'type': 'HEADER',
+                    'key': 'Authorization',
+                    'value': '${api_key}',
+                },
+            },
         },
-        "channel": {
-            "type": "HTTP",
-            "version": "1.0.0",
-            "config": {
-                "uri": webhook_server_url,
-                "headers": [{
-                    "key": "X-Other-Header",
-                    "value": "some-other-value"
-                }],
-                "authScheme": {
-                    "type": "HEADER",
-                    "key": "Authorization",
-                    "value": "${api_key}"
-                }
-            }
-        }
     }
 
     data = json.dumps(data, indent=4)
@@ -158,7 +196,7 @@ def okta_new():
         f'{okta_server}/api/v1/eventHooks',
         headers={
             'Accept': 'application/json',
-            "Authorization": f"SSWS {okta_token}",
+            'Authorization': f'SSWS {okta_token}',
             'Content-Type': 'application/json',
         },
         data=data,
@@ -166,16 +204,20 @@ def okta_new():
     response_json = resp.json()
     okta_id = response_json.get('id')
 
-    okta_info.append({"name": okta_name,
-                      "okta_id": okta_id,
-                      "okta_event": okta_event,
-                      "okta_url": okta_server,
-                      "okta_token": okta_token,
-                      "script": script_file,
-                      "description": description,
-                      "webhook_username": "null",
-                      "webhook_password": "null",
-                      "tag": "okta"})
+    okta_info.append(
+        {
+            'name': okta_name,
+            'okta_id': okta_id,
+            'okta_event': okta_event,
+            'okta_url': okta_server,
+            'okta_token': okta_token,
+            'script': script_file,
+            'description': description,
+            'webhook_username': 'null',
+            'webhook_password': 'null',
+            'tag': 'okta',
+        }
+    )
     if okta_id:
         with open(webhooks_file, 'w') as outfile:
             json.dump(okta_info, outfile, indent=4)
@@ -183,14 +225,23 @@ def okta_new():
     # Verify/activate
     resp = requests.post(
         f'{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify',
-        headers={"Authorization": f"SSWS {okta_token}"})
+        headers={'Authorization': f'SSWS {okta_token}'},
+    )
     verification = resp.json()
     if 'errorCode' in verification:
-        error_message = "Okta was unable to verify the webhook.  Check network settings."
-        return render_template('error.html',
-                               error_message=error_message,
-                               error="Event Verification Error",
-                               username=str(escape(session['username'])))
-
-    return render_template('success.html', username=session.get('username'), login="true",
-                           success_msg="Okta Webhook Created.")
+        error_message = (
+            'Okta was unable to verify the webhook.  Check network settings.'
+        )
+        return render_template(
+            'error.html',
+            error_message=error_message,
+            error='Event Verification Error',
+            username=str(escape(session['username'])),
+        )
+
+    return render_template(
+        'success.html',
+        username=session.get('username'),
+        login='true',
+        success_msg='Okta Webhook Created.',
+    )
diff --git a/views/resource_view.py b/views/resource_view.py
index eb96f7c..c04d0d9 100644
--- a/views/resource_view.py
+++ b/views/resource_view.py
@@ -29,9 +29,18 @@
 import json
 import os
 from datetime import datetime
+from typing import Any, Dict, Tuple, Union
 
-from flask import (Blueprint, redirect, render_template,
-                   request, send_file, session, url_for)
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    send_file,
+    session,
+    url_for,
+)
 from markupsafe import escape
 from werkzeug.utils import secure_filename
 
@@ -40,20 +49,35 @@
 
 logthis = logger.setup_child_logger('jawa', __name__)
 
-log_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log'))
-server_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-resources_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'resources'))
-files_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'resources', 'files'))
-img_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'static', 'img'))
+log_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log')
+)
+server_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+resources_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'resources')
+)
+files_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'resources', 'files')
+)
+img_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'static', 'img')
+)
 
 blueprint = Blueprint('resources_view', __name__, template_folder='templates')
 
 
 @blueprint.route('/resources/files', methods=['GET', 'POST'])
-def files():
+def files() -> Union[Response, Tuple[str, int]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     target_file = request.args.get('target_file')
     if target_file:
         target_file = secure_filename(target_file)
@@ -61,29 +85,50 @@ def files():
     if button_choice:
         button_choice = escape(button_choice)
     if target_file:
-        target_file_dir = os.path.dirname(os.path.abspath(os.path.join(files_dir, target_file)))
-        target_file_path = os.path.abspath(os.path.join(files_dir, target_file))
-        if button_choice == "Download":
-            logthis.info(f"[{session.get('url')}] {session.get('username')} downloading file: {target_file}.")
+        target_file_dir = os.path.dirname(
+            os.path.abspath(os.path.join(files_dir, target_file))
+        )
+        target_file_path = os.path.abspath(
+            os.path.join(files_dir, target_file)
+        )
+        if button_choice == 'Download':
+            logthis.info(
+                f'[{session.get("url")}] {session.get("username")} downloading file: {target_file}.'
+            )
             if target_file_dir != files_dir:
                 logthis.info(
-                    f"WARNING: [{session.get('url')}] {session.get('username')} attempted to download a file from a forbidden path: {target_file_path}.")
-                return "Forbidden:  you are not allowed to download files from alternative paths.", 403
+                    f'WARNING: [{session.get("url")}] {session.get("username")} attempted to download a file from a forbidden path: {target_file_path}.'
+                )
+                return (
+                    'Forbidden:  you are not allowed to download files from alternative paths.',
+                    403,
+                )
             return send_file(f'{target_file_path}', as_attachment=True)
-        elif button_choice == "Delete":
+        elif button_choice == 'Delete':
             logthis.debug(
-                f"[{session.get('url')}] {session.get('username')} is considering deleting a Resource file ({target_file_path})...")
-            return redirect(url_for('resources_view.delete_file', target_file=target_file))
+                f'[{session.get("url")}] {session.get("username")} is considering deleting a Resource file ({target_file_path})...'
+            )
+            return redirect(
+                url_for('resources_view.delete_file', target_file=target_file)
+            )
 
-    if request.method == "POST":
-        logthis.info(f"[{session.get('url')}] {session.get('username')} {request.path} {request.method}")
+    if request.method == 'POST':
+        logthis.info(
+            f'[{session.get("url")}] {session.get("username")} {request.path} {request.method}'
+        )
         upload_files_list = request.files.getlist('upload')
         for each_upload in upload_files_list:
             if ' ' in each_upload.filename:
-                each_upload.filename = each_upload.filename.replace(" ", "-")
-            logthis.info(f"[{session.get('url')}] {session.get('username')} uploaded {each_upload.filename}.")
-            each_upload.save(os.path.join(files_dir, secure_filename(each_upload.filename)))
-    logthis.info(f"[{session.get('url')}] {session.get('username')} {request.path} {request.method}")
+                each_upload.filename = each_upload.filename.replace(' ', '-')
+            logthis.info(
+                f'[{session.get("url")}] {session.get("username")} uploaded {each_upload.filename}.'
+            )
+            each_upload.save(
+                os.path.join(files_dir, secure_filename(each_upload.filename))
+            )
+    logthis.info(
+        f'[{session.get("url")}] {session.get("username")} {request.path} {request.method}'
+    )
     file_list = os.listdir(files_dir)
     for file in file_list:
         if file[0] == '.':
@@ -91,56 +136,91 @@ def files():
     files_list = []
     for each_file in file_list:
         mtime = os.path.getmtime(os.path.join(files_dir, each_file))
-        pretty_mtime = datetime.fromtimestamp(mtime).strftime('%Y-%m-%d %H:%M:%S')
-        files_list.append({"name": each_file, "mtime": pretty_mtime})
-    return render_template('resources/files.html', username=session.get('username'), files_repo=files_dir,
-                           files=files_list)
+        pretty_mtime = datetime.fromtimestamp(mtime).strftime(
+            '%Y-%m-%d %H:%M:%S'
+        )
+        files_list.append({'name': each_file, 'mtime': pretty_mtime})
+    return render_template(
+        'resources/files.html',
+        username=session.get('username'),
+        files_repo=files_dir,
+        files=files_list,
+    )
 
 
 @blueprint.route('/resources/delete.html', methods=['GET', 'POST'])
-def delete_file():
+def delete_file() -> Union[Response, Tuple[str, int]]:
     target_file = request.args.get('target_file')
     if target_file:
         target_file = secure_filename(target_file)
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if request.method != 'POST':
-        return render_template('resources/delete.html',
-                               target_file=target_file, username=str(escape(session.get('username'))))
+        return render_template(
+            'resources/delete.html',
+            target_file=target_file,
+            username=str(escape(session.get('username'))),
+        )
     if target_file:
-        target_file_dir = os.path.dirname(os.path.abspath(os.path.join(files_dir, target_file)))
-        target_file_path = os.path.abspath(os.path.join(files_dir, target_file))
+        target_file_dir = os.path.dirname(
+            os.path.abspath(os.path.join(files_dir, target_file))
+        )
+        target_file_path = os.path.abspath(
+            os.path.join(files_dir, target_file)
+        )
 
     if target_file_dir != files_dir:
         logthis.info(
-            f"WARNING: [{session.get('url')}] {session.get('username')} attempted to delete a file from a forbidden path: {target_file_path}.")
-        return "Forbidden:  you are not allowed to download files from alternative paths.", 403
-    logthis.info(f"[{session.get('url')}] {session.get('username')} deleting file: {target_file}.")
+            f'WARNING: [{session.get("url")}] {session.get("username")} attempted to delete a file from a forbidden path: {target_file_path}.'
+        )
+        return (
+            'Forbidden:  you are not allowed to download files from alternative paths.',
+            403,
+        )
+    logthis.info(
+        f'[{session.get("url")}] {session.get("username")} deleting file: {target_file}.'
+    )
     if os.path.exists(os.path.join(files_dir, target_file)):
         os.remove(os.path.join(files_dir, target_file))
-        logthis.info(f"[{session.get('url')}] {session.get('username')} successfully deleted the Resource file: {target_file}.")
+        logthis.info(
+            f'[{session.get("url")}] {session.get("username")} successfully deleted the Resource file: {target_file}.'
+        )
         return redirect(url_for('resources_view.files'))
     else:
-        error = f"Error deleting file."
-        error_message = f"File does not exist {target_file}."
-        return render_template('error.html', error=error, error_message=error_message,
-                               username=str(escape(session['username'])))
+        error = 'Error deleting file.'
+        error_message = f'File does not exist {target_file}.'
+        return render_template(
+            'error.html',
+            error=error,
+            error_message=error_message,
+            username=str(escape(session['username'])),
+        )
 
 
 @blueprint.route('/branding', methods=['GET', 'POST'])
 @response(template_file='setup/branding.html')
-def rebrand():
+def rebrand() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     if not os.path.isfile(server_file):
-        with open(server_file, "w") as fout:
+        with open(server_file, 'w') as fout:
             json.dump({}, fout)
     with open(server_file) as fin:
         server_json = json.load(fin)
     brand = server_json.get('brand')
-    if request.method == "POST":
+    if request.method == 'POST':
         upload_files_list = request.files.getlist('upload')
         new_name = request.form.get('new_name')
         if new_name:
@@ -152,28 +232,41 @@ def rebrand():
         if upload_files_list:
             target_file = upload_files_list[0]
             if target_file:
-                os.rename(f"{img_dir}/jawa_icon.png", f"{img_dir}/old_jawa_icon_{datetime.now()}.png")
-                target_file.save(os.path.join(img_dir, "jawa_icon.png"))
+                os.rename(
+                    f'{img_dir}/jawa_icon.png',
+                    f'{img_dir}/old_jawa_icon_{datetime.now()}.png',
+                )
+                target_file.save(os.path.join(img_dir, 'jawa_icon.png'))
                 return redirect(url_for('resources_view.rebrand'))
-            return {'username': session.get('username'), "app_name": brand}
-        return {'username': session.get('username'), "app_name": brand}
+            return {'username': session.get('username'), 'app_name': brand}
+        return {'username': session.get('username'), 'app_name': brand}
 
-    return {'username': session.get('username'), "app_name": brand}
+    return {'username': session.get('username'), 'app_name': brand}
 
 
-@blueprint.route("/python")
-@response(template_file="resources/python.html")
-def python():
+@blueprint.route('/python')
+@response(template_file='resources/python.html')
+def python() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    return {"username": session.get('username')}
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    return {'username': session.get('username')}
 
 
-@blueprint.route("/bash")
-@response(template_file="resources/bash.html")
-def bash():
+@blueprint.route('/bash')
+@response(template_file='resources/bash.html')
+def bash() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
-    return {"username": session.get('username')}
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
+    return {'username': session.get('username')}
diff --git a/views/webhook_view.py b/views/webhook_view.py
index 8e88e11..004cb21 100644
--- a/views/webhook_view.py
+++ b/views/webhook_view.py
@@ -27,12 +27,14 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 from collections import defaultdict
-from flask import (Blueprint, redirect, request, session, url_for)
+from flask import Blueprint, Response, redirect, request, session, url_for
 import json
 from markupsafe import escape
 import os
-import requests
 import time
+from typing import Any, Dict, Union
+
+import requests
 
 from bin import logger
 from bin.tokens import validate_token, get_token
@@ -42,82 +44,139 @@
 
 blueprint = Blueprint('webhooks', __name__, template_folder='templates')
 
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-okta_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json'))
-okta_verification_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'))
-webhooks_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json'))
-scripts_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+okta_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json')
+)
+okta_verification_file = os.path.abspath(
+    os.path.join(
+        os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'
+    )
+)
+webhooks_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+)
+scripts_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+)
 
 
 @blueprint.route('/webhooks/delete', methods=['GET', 'POST'])
 @response(template_file='webhooks/delete.html')
-def delete_webhook():
+def delete_webhook() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     target_webhook = request.args.get('target_webhook')
     if not target_webhook:
         return redirect(url_for('custom_webhook.custom_webhook'))
     target_webhook = escape(target_webhook)
     with open(webhooks_file) as fin:
         webhook_json = json.load(fin)
-    tag = [each_webhook['tag'] for each_webhook in webhook_json if each_webhook['name'] == target_webhook]
+    tag = [
+        each_webhook['tag']
+        for each_webhook in webhook_json
+        if each_webhook['name'] == target_webhook
+    ]
 
     if request.method == 'POST':
-        logthis.info(f"Deleting {tag} webhook: {target_webhook}")
+        logthis.info(f'Deleting {tag} webhook: {target_webhook}')
         for each_webhook in webhook_json:
             if each_webhook['name'] == target_webhook:
                 script_file = each_webhook['script']
                 if os.path.exists(script_file):
-                    os.rename(script_file, f"{script_file}.old")
+                    os.rename(script_file, f'{script_file}.old')
                 if each_webhook['tag'] == 'jamfpro':
                     if not validate_token(session['expires']):
                         get_token()
-                    data = f"<webhook><name>{each_webhook['name']}.old.{time.time()}</name>" \
-                           f"<enabled>false</enabled></webhook>"
-                    full_url = f"{session['url']}/JSSResource/webhooks/name/{each_webhook['name']}"
-                    webhook_response = requests.put(full_url,
-                                                    headers={'Content-Type': 'application/xml',
-                                                             "Authorization": f"Bearer {session['token']}",
-                                                             'User-Agent': 'JAWA%20v3.1.1'},
-                                                    data=data)
+                    data = (
+                        f'<webhook><name>{each_webhook["name"]}.old.{time.time()}</name>'
+                        f'<enabled>false</enabled></webhook>'
+                    )
+                    full_url = f'{session["url"]}/JSSResource/webhooks/name/{each_webhook["name"]}'
+                    requests.put(
+                        full_url,
+                        headers={
+                            'Content-Type': 'application/xml',
+                            'Authorization': f'Bearer {session["token"]}',
+                            'User-Agent': 'JAWA%20v3.1.1',
+                        },
+                        data=data,
+                    )
                 elif each_webhook['tag'] == 'okta':
                     try:
-                        response = requests.post(
-                            f"{each_webhook.get('okta_url')}/api/v1/eventHooks/{each_webhook.get('okta_id')}/lifecycle/deactivate",
-                            headers={"Authorization": "SSWS {}".format(each_webhook.get('okta_token'))})
-                        response2 = requests.delete(
-                            f"{each_webhook.get('okta_url')}/api/v1/eventHooks/{each_webhook.get('okta_id')}",
-                            headers={"Authorization": "SSWS {}".format(each_webhook.get('okta_token'))})
+                        requests.post(
+                            f'{each_webhook.get("okta_url")}/api/v1/eventHooks/{each_webhook.get("okta_id")}/lifecycle/deactivate',
+                            headers={
+                                'Authorization': 'SSWS {}'.format(
+                                    each_webhook.get('okta_token')
+                                )
+                            },
+                        )
+                        requests.delete(
+                            f'{each_webhook.get("okta_url")}/api/v1/eventHooks/{each_webhook.get("okta_id")}',
+                            headers={
+                                'Authorization': 'SSWS {}'.format(
+                                    each_webhook.get('okta_token')
+                                )
+                            },
+                        )
                     except requests.exceptions.MissingSchema as err:
-                        return redirect(url_for('error', error=err, username=session.get('username')))
+                        return redirect(
+                            url_for(
+                                'error',
+                                error=err,
+                                username=session.get('username'),
+                            )
+                        )
 
                 webhook_json.remove(each_webhook)
                 with open(webhooks_file, 'w') as fout:
                     json.dump(webhook_json, fout, indent=4)
         return redirect(url_for('webhooks.webhooks'))
-    return {'username': session.get('username'), 'target_webhook': target_webhook, 'tag': tag[0]}
+    return {
+        'username': session.get('username'),
+        'target_webhook': target_webhook,
+        'tag': tag[0],
+    }
 
 
 @blueprint.route('/webhooks', methods=['GET', 'POST'])
 @response(template_file='webhooks/home.html')
-def webhooks():
+def webhooks() -> Union[Response, Dict[str, Any]]:
     if 'username' not in session:
         return redirect(
-            url_for('home_view.logout', error_title="Session Timed Out", error_message="Please sign in again"))
+            url_for(
+                'home_view.logout',
+                error_title='Session Timed Out',
+                error_message='Please sign in again',
+            )
+        )
     with open(webhooks_file, 'r') as fin:
         webhooks_json = json.load(fin)
     jamf_pro_webhooks_list = []
     okta_webhooks_list = []
     custom_webhooks_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
+        data = defaultdict(lambda: 'MISSING', each_webhook)
         tag = data['tag']
-        if tag == "custom":
+        if tag == 'custom':
             custom_webhooks_list.append(each_webhook)
         elif tag == 'jamfpro':
             jamf_pro_webhooks_list.append(each_webhook)
         elif tag == 'okta':
             okta_webhooks_list.append(each_webhook)
-    return {'username': session.get('username'), 'custom_list': custom_webhooks_list,
-            'jamf_list': jamf_pro_webhooks_list, 'okta_list': okta_webhooks_list, 'url': session.get('url')}
+    return {
+        'username': session.get('username'),
+        'custom_list': custom_webhooks_list,
+        'jamf_list': jamf_pro_webhooks_list,
+        'okta_list': okta_webhooks_list,
+        'url': session.get('url'),
+    }
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 64e286e..21b052a 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -39,27 +39,40 @@
 
 logthis = logger.setup_child_logger('jawa', 'webhook_receiver')
 
-server_json_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json'))
-jp_webhooks_file = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json'))
-scripts_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+server_json_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+)
+jp_webhooks_file = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+)
+scripts_dir = os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+)
 
 blueprint = Blueprint('jawa_receiver', __name__, template_folder='templates')
 
-def load_json(file_path: str) -> Any:
-    with open(file_path, "r") as fin:
+
+def load_json(file_path: str) -> Union[Dict[str, Any], List[Any]]:
+    with open(file_path, 'r') as fin:
         return json.load(fin)
-    
 
-def validate_webhook(webhook_data: JSONType, webhook_name: str, webhook_user: str, webhook_pass: str, webhook_apikey: str) -> bool:
+
+def validate_webhook(
+    webhook_name: str,
+    webhook_user: str,
+    webhook_pass: str,
+    webhook_apikey: str,
+) -> bool:
     webhooks_json = load_json(jp_webhooks_file)
     truth_test = False
     for each_webhook in webhooks_json:
         if each_webhook['name'] == webhook_name:
             truth_test = True
             if (
-                    each_webhook.get('webhook_username') != webhook_user or
-                    each_webhook.get('webhook_password') != webhook_pass or
-                    each_webhook.get('api_key', 'null') != webhook_apikey):
+                each_webhook.get('webhook_username') != webhook_user
+                or each_webhook.get('webhook_password') != webhook_pass
+                or each_webhook.get('api_key', 'null') != webhook_apikey
+            ):
                 truth_test = False
 
     return truth_test
@@ -74,16 +87,21 @@ def run_script(webhook_data: JSONType, webhook_name: str) -> Optional[bytes]:
 
 def script_results(webhook_data: JSONType, each_webhook: Dict) -> bytes:
     webhook_data = json.dumps(webhook_data)
-    proc = subprocess.Popen([each_webhook['script'], f"{webhook_data}"], stdout=subprocess.PIPE,
-                            stderr=subprocess.STDOUT)
+    proc = subprocess.Popen(
+        [each_webhook['script'], f'{webhook_data}'],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+    )
     output = proc.stdout.read()
     for each_line in output.decode().split('\n'):
         if each_line:
-            logthis.info(f"{each_webhook.get('name')} - {each_line}")
+            logthis.info(f'{each_webhook.get("name")} - {each_line}')
     return output
 
 
-def custom_output_options(webhook_name: str) -> Union[Tuple[Any, Any], Tuple[None, None]]:
+def custom_output_options(
+    webhook_name: str,
+) -> Union[Tuple[Any, Any], Tuple[None, None]]:
     webhooks_json = load_json(jp_webhooks_file)
     for each_webhook in webhooks_json:
         if each_webhook['name'] == webhook_name:
@@ -94,43 +112,68 @@ def custom_output_options(webhook_name: str) -> Union[Tuple[Any, Any], Tuple[Non
 
 
 @blueprint.route('/hooks/<webhook_name>', methods=['POST', 'GET'])
-def webhook_handler(webhook_name: str):
-    logthis.info(f"Incoming request at /hooks/{webhook_name} ...")
+def webhook_handler(
+    webhook_name: str,
+) -> Union[Dict[str, Any], Tuple[str, int]]:
+    logthis.info(f'Incoming request at /hooks/{webhook_name} ...')
     if request.headers.get('x-okta-verification-challenge'):
-        logthis.info("This is an Okta verification challenge...")
-        return okta_verification.verify_new_webhook(request.headers.get('x-okta-verification-challenge'))
+        logthis.info('This is an Okta verification challenge...')
+        return okta_verification.verify_new_webhook(
+            request.headers.get('x-okta-verification-challenge')
+        )
     try:
         webhook_data = request.get_json()
     except Exception as err:
-        logthis.debug(f"Error loading JSON ({err}). Trying to load from form payload.")
+        logthis.debug(
+            f'Error loading JSON ({err}). Trying to load from form payload.'
+        )
         webhook_data = json.loads(request.form.get('payload'))
     if not webhook_data:
-        logthis.info(f"418.  Error processing /hooks/{webhook_name} - no data provided. I'm a teapot.")
+        logthis.info(
+            f"418.  Error processing /hooks/{webhook_name} - no data provided. I'm a teapot."
+        )
         return "418 - I'm a teapot.", 418
-    logthis.debug(f"{webhook_name} payload: {webhook_data}")
+    logthis.debug(f'{webhook_name} payload: {webhook_data}')
     if request.method != 'POST':
-        logthis.info(f"Invalid request, {request.method} for /hooks/{webhook_name}.")
-        return "405 - Method not allowed. These aren't the droids you're looking for. You can go about your business. " \
-               "Move along.", 405
-    webhook_user = "null"
-    webhook_pass = "null"
-    webhook_apikey = "null"
+        logthis.info(
+            f'Invalid request, {request.method} for /hooks/{webhook_name}.'
+        )
+        return (
+            "405 - Method not allowed. These aren't the droids you're looking for. You can go about your business. "
+            'Move along.',
+            405,
+        )
+    webhook_user = 'null'
+    webhook_pass = 'null'
+    webhook_apikey = 'null'
     auth = request.authorization
     headers = request.headers
     apikey = headers.get('x-api-key')
     if auth:
-        webhook_user = auth.get("username")
-        webhook_pass = auth.get("password")
+        webhook_user = auth.get('username')
+        webhook_pass = auth.get('password')
     if apikey:
         webhook_apikey = request.headers.get('x-api-key')
-    if validate_webhook(webhook_data, webhook_name, webhook_user, webhook_pass, webhook_apikey):
-        logthis.info(f"Validated authentication for /hooks/{webhook_name}, running script...")
+    if validate_webhook(
+        webhook_name, webhook_user, webhook_pass, webhook_apikey
+    ):
+        logthis.info(
+            f'Validated authentication for /hooks/{webhook_name}, running script...'
+        )
         webhook_tag, custom_output = custom_output_options(webhook_name)
         output = run_script(webhook_data, webhook_name).decode('ascii')
-        if custom_output and webhook_tag == "custom":
-            return {"webhook": f"{webhook_name}", "result": f"{output}"}, 202
+        if custom_output and webhook_tag == 'custom':
+            return {'webhook': f'{webhook_name}', 'result': f'{output}'}, 202
         else:
-            return {"webhook": f"{webhook_name}", "result": "valid webhook received"}
+            return {
+                'webhook': f'{webhook_name}',
+                'result': 'valid webhook received',
+            }
     else:
-        logthis.info(f"401 - Incorrect authentication provided for /hooks/{webhook_name}.")
-        return f"Unauthorized - incorrect authentication provided for /hooks/{webhook_name}.", 401
+        logthis.info(
+            f'401 - Incorrect authentication provided for /hooks/{webhook_name}.'
+        )
+        return (
+            f'Unauthorized - incorrect authentication provided for /hooks/{webhook_name}.',
+            401,
+        )

From 8b2c0d2a5b7eda479d4102cefbfc10db7fe2573e Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Sat, 10 May 2025 12:21:10 -0400
Subject: [PATCH 05/84] chore: ignore ruff cache

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index fdfef48..da0bd44 100644
--- a/.gitignore
+++ b/.gitignore
@@ -148,3 +148,6 @@ dmypy.json
 .Spotlight-V100
 .Trashes
 /.idea
+
+# ruff
+.ruff_cache

From c64afb9cdc273b09b0c1d61c22aaa5febaf05da0 Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Sat, 10 May 2025 12:21:48 -0400
Subject: [PATCH 06/84] chore: default to double quotes instead of single
 quotes

---
 ruff.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ruff.toml b/ruff.toml
index c294fe0..c557e66 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -1,4 +1,4 @@
 line-length = 79
 
 [format]
-quote-style = "single"
\ No newline at end of file
+quote-style = "double"
\ No newline at end of file

From a2f6bf1f93e7c19039f4ffe08012739e9b382eb5 Mon Sep 17 00:00:00 2001
From: Andrew Lerman <aspeciale88@gmail.com>
Date: Sat, 10 May 2025 12:22:30 -0400
Subject: [PATCH 07/84] refactor: format codebase with double quotes for
 consistency

---
 app.py                   | 214 +++++++--------
 bin/load_home.py         |  52 ++--
 bin/logger.py            |  10 +-
 bin/okta_verification.py |   4 +-
 bin/tokens.py            |  38 +--
 bin/v2_upgrade.py        |  68 ++---
 bin/view_modifiers.py    |   4 +-
 views/cron_view.py       | 346 ++++++++++++------------
 views/custom_webhook.py  | 266 +++++++++----------
 views/home_view.py       | 234 ++++++++---------
 views/jamf_webhook.py    | 550 +++++++++++++++++++--------------------
 views/log_view.py        |  96 +++----
 views/okta_webhook.py    | 186 ++++++-------
 views/resource_view.py   | 172 ++++++------
 views/webhook_view.py    | 122 ++++-----
 webhook/jawa_receiver.py |  86 +++---
 16 files changed, 1224 insertions(+), 1224 deletions(-)

diff --git a/app.py b/app.py
index e067069..59b04d4 100644
--- a/app.py
+++ b/app.py
@@ -50,8 +50,8 @@
 from views.home_view import load_home
 
 # Flask logging
-logthis = logger.setup_child_logger('jawa', 'app')
-error_message = ''
+logthis = logger.setup_child_logger("jawa", "app")
+error_message = ""
 
 # Initiate Flask
 app = Flask(__name__)
@@ -65,32 +65,32 @@ def func() -> None:
 
 def main() -> None:
     base_dir = os.path.dirname(__file__)
-    logthis.info(f'JAWA initializing...\n Sandcrawler home:  {base_dir}')
+    logthis.info(f"JAWA initializing...\n Sandcrawler home:  {base_dir}")
     environment_setup(base_dir)
     register_blueprints()
     app.secret_key = str(uuid.uuid4())
     app.permanent_session_lifetime = timedelta(minutes=10)
     serve(
-        app, url_scheme='https', host='0.0.0.0', port=8000, threads=15
+        app, url_scheme="https", host="0.0.0.0", port=8000, threads=15
     )  # Serve me the sky with a big slice of lemon
 
 
 def environment_setup(project_dir: str) -> None:
     global webhooks_file, cron_file, server_json_file, scripts_directory
     webhooks_file = os.path.abspath(
-        os.path.join(project_dir, 'data', 'webhooks.json')
+        os.path.join(project_dir, "data", "webhooks.json")
     )
-    cron_file = os.path.abspath(os.path.join(project_dir, 'data', 'cron.json'))
+    cron_file = os.path.abspath(os.path.join(project_dir, "data", "cron.json"))
     server_json_file = os.path.abspath(
-        os.path.join(project_dir, 'data', 'server.json')
+        os.path.join(project_dir, "data", "server.json")
     )
-    scripts_directory = os.path.abspath(os.path.join(project_dir, 'scripts'))
+    scripts_directory = os.path.abspath(os.path.join(project_dir, "scripts"))
     logthis.info(
-        f'Detecting JAWA environment:\n'
-        f'Webhooks configuration file: {webhooks_file}\n'
-        f'Cron configuration file: {cron_file}\n'
-        f'Server configuration file: {server_json_file}\n'
-        f'Scripts directory: {scripts_directory}'
+        f"Detecting JAWA environment:\n"
+        f"Webhooks configuration file: {webhooks_file}\n"
+        f"Cron configuration file: {cron_file}\n"
+        f"Server configuration file: {server_json_file}\n"
+        f"Scripts directory: {scripts_directory}"
     )
 
 
@@ -134,187 +134,187 @@ def register_blueprints() -> None:
 
 
 # Server setup including making .json file necessary for webhooks
-@app.route('/setup', methods=['GET', 'POST'])
+@app.route("/setup", methods=["GET", "POST"])
 def setup() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    if request.method == 'POST':
+    if request.method == "POST":
         logthis.debug(
-            f'[{session.get("url")}] {session.get("username")} /setup - POST'
+            f"[{session.get('url')}] {session.get('username')} /setup - POST"
         )
-        server_url = request.form.get('address')
+        server_url = request.form.get("address")
         if not server_url:
-            return redirect(url_for('setup'))
-        jps_url = request.form.get('jss-lock')
-        jps2_check = request.form.get('alternate-jamf')
-        jps_url2 = request.form.get('alternate')
+            return redirect(url_for("setup"))
+        jps_url = request.form.get("jss-lock")
+        jps2_check = request.form.get("alternate-jamf")
+        jps_url2 = request.form.get("alternate")
         logthis.info(
-            f'{session.get("username")} made JAWA Setup Changes\n'
-            f'JAWA URL: {server_url}\n'
-            f'Primary JPS: {jps_url}\n'
-            f'Alternate JPS: {jps_url2}\n'
-            f'Alternate enabled?: {jps2_check}'
+            f"{session.get('username')} made JAWA Setup Changes\n"
+            f"JAWA URL: {server_url}\n"
+            f"Primary JPS: {jps_url}\n"
+            f"Alternate JPS: {jps_url2}\n"
+            f"Alternate enabled?: {jps2_check}"
         )
         new_json = {}
-        if server_url != '':
-            new_json['jawa_address'] = server_url
-        if jps_url != '':
-            new_json['jps_url'] = jps_url
+        if server_url != "":
+            new_json["jawa_address"] = server_url
+        if jps_url != "":
+            new_json["jps_url"] = jps_url
         if not os.path.isfile(server_json_file):
-            with open(server_json_file, 'w') as outfile:
+            with open(server_json_file, "w") as outfile:
                 server_json = {
-                    'jawa_address': server_url,
-                    'jps_url': jps_url,
-                    'alternate_jps': jps_url2,
+                    "jawa_address": server_url,
+                    "jps_url": jps_url,
+                    "alternate_jps": jps_url2,
                 }
                 json.dump(server_json, outfile)
         elif os.path.isfile(server_json_file):
-            with open(server_json_file, 'w') as outfile:
+            with open(server_json_file, "w") as outfile:
                 server_json = {
-                    'jawa_address': server_url,
-                    'jps_url': jps_url,
-                    'alternate_jps': jps_url2,
+                    "jawa_address": server_url,
+                    "jps_url": jps_url,
+                    "alternate_jps": jps_url2,
                 }
                 json.dump(server_json, outfile)
-            with open(server_json_file, 'r') as fin:
+            with open(server_json_file, "r") as fin:
                 data = json.load(fin)
             data.update(new_json)
-            with open(server_json_file, 'w+') as outfile:
+            with open(server_json_file, "w+") as outfile:
                 json.dump(data, outfile)
 
         return render_template(
-            'success.html',
-            webhooks='success',
-            success_msg='JAWA Setup Complete!',
-            username=str(escape(session['username'])),
+            "success.html",
+            webhooks="success",
+            success_msg="JAWA Setup Complete!",
+            username=str(escape(session["username"])),
         )
     else:
         logthis.debug(
-            f'[{session.get("url")}] {session.get("username")} - /setup - GET'
+            f"[{session.get('url')}] {session.get('username')} - /setup - GET"
         )
         if not os.path.isfile(server_json_file):
-            with open(server_json_file, 'w') as outfile:
+            with open(server_json_file, "w") as outfile:
                 server_json = {
-                    'jawa_address': '',
-                    'jps_url': '',
-                    'alternate_jps': '',
+                    "jawa_address": "",
+                    "jps_url": "",
+                    "alternate_jps": "",
                 }
                 json.dump(server_json, outfile)
-        with open(server_json_file, 'r') as fin:
+        with open(server_json_file, "r") as fin:
             server_json = json.load(fin)
-        jps_url2 = server_json.get('alternate_jps')
-        if jps_url2 == str(escape(session['url'])):
-            primary_jps = server_json['jps_url']
+        jps_url2 = server_json.get("alternate_jps")
+        if jps_url2 == str(escape(session["url"])):
+            primary_jps = server_json["jps_url"]
         else:
-            primary_jps = str(escape(session['url']))
-        jawa_url = server_json.get('jawa_address')
+            primary_jps = str(escape(session["url"]))
+        jawa_url = server_json.get("jawa_address")
         return render_template(
-            'setup/setup.html',
-            login='false',
+            "setup/setup.html",
+            login="false",
             jps_url=primary_jps,
             jps_url2=jps_url2,
             jawa_url=jawa_url,
-            username=session.get('username'),
+            username=session.get("username"),
         )
 
 
-@app.route('/cleanup', methods=['GET', 'POST'])
-@response(template_file='setup/cleanup.html')
+@app.route("/cleanup", methods=["GET", "POST"])
+@response(template_file="setup/cleanup.html")
 def cleanup() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    if request.method != 'POST':
+    if request.method != "POST":
         owd = os.getcwd()
         if not os.path.isdir(scripts_directory):
             os.mkdir(scripts_directory)
         os.chdir(scripts_directory)
-        old_scripts = glob.glob('*.old')
+        old_scripts = glob.glob("*.old")
         os.chdir(owd)
         return {
-            'username': session.get('username'),
-            'scripts_dir': scripts_directory,
-            'scripts': old_scripts,
+            "username": session.get("username"),
+            "scripts_dir": scripts_directory,
+            "scripts": old_scripts,
         }
     logthis.info(
-        f'[{session.get("url")}] {session.get("username")} is cleaning up scripts...'
+        f"[{session.get('url')}] {session.get('username')} is cleaning up scripts..."
     )
     owd = os.getcwd()
     if not os.path.isdir(scripts_directory):
         os.mkdir(scripts_directory)
     os.chdir(scripts_directory)
     del_list = []
-    for file in glob.glob('*.old'):
+    for file in glob.glob("*.old"):
         logthis.info(
-            f'[{session.get("url")}] {session.get("username")} removed the script {file}...'
+            f"[{session.get('url')}] {session.get('username')} removed the script {file}..."
         )
-        del_list.append(f'{file}')
+        del_list.append(f"{file}")
         os.remove(file)
     os.chdir(owd)
     if not del_list:
-        success_msg = 'No Script files found to clean up.'
+        success_msg = "No Script files found to clean up."
     else:
-        txt_list = 'Deleted: \n'
+        txt_list = "Deleted: \n"
         for file in del_list:
-            txt_list += f'{file}\n'
-        success_msg = txt_list or 'No script files found to clean up.'
-    return redirect(url_for('success', success_msg=success_msg))
+            txt_list += f"{file}\n"
+        success_msg = txt_list or "No script files found to clean up."
+    return redirect(url_for("success", success_msg=success_msg))
 
 
-@app.route('/')
+@app.route("/")
 def home() -> Union[Response, str]:
     return load_home()
 
 
-@app.route('/success', methods=['GET', 'POST'])
-def success(success_msg='') -> Union[Response, str]:
-    if 'username' not in session:
-        logthis.info('No user logged in - returning to login page.')
+@app.route("/success", methods=["GET", "POST"])
+def success(success_msg="") -> Union[Response, str]:
+    if "username" not in session:
+        logthis.info("No user logged in - returning to login page.")
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    success_msg = request.args.get('success_msg')
+    success_msg = request.args.get("success_msg")
     if success_msg:
         success_msg = escape(success_msg)
     return render_template(
-        'success.html',
+        "success.html",
         success_msg=success_msg,
-        login='true',
-        username=str(escape(session['username'])),
+        login="true",
+        username=str(escape(session["username"])),
     )
 
 
-@app.route('/error', methods=['GET', 'POST'])
+@app.route("/error", methods=["GET", "POST"])
 def error() -> Union[Response, str]:
-    error_title = request.args.get('error')
-    error_message = request.args.get('error_message')
+    error_title = request.args.get("error")
+    error_message = request.args.get("error_message")
     if error_title:
         error_title = escape(error_title)
     if error_message:
         error_message = escape(error_message)
-    if 'username' not in session:
-        return redirect(url_for('home_view.logout'))
+    if "username" not in session:
+        return redirect(url_for("home_view.logout"))
     logthis.info(
-        f'[{session.get("url")}] {session.get("username").title()} was a victim of a series of accidents, as are we all. (/error)'
+        f"[{session.get('url')}] {session.get('username').title()} was a victim of a series of accidents, as are we all. (/error)"
     )
     return render_template(
-        'error.html',
-        username=session.get('username'),
+        "error.html",
+        username=session.get("username"),
         error_message=error_title,
         error=error_message,
     )
@@ -322,16 +322,16 @@ def error() -> Union[Response, str]:
 
 @app.errorhandler(404)
 def page_not_found() -> Union[Response, str]:
-    if 'username' in session:
+    if "username" in session:
         logthis.info(
-            f'[{session.get("url")}] {session.get("username")} wandered off course  ({request.path}) - redirecting to /dashboard.'
+            f"[{session.get('url')}] {session.get('username')} wandered off course  ({request.path}) - redirecting to /dashboard."
         )
-        return redirect(url_for('home_view.dashboard'))
+        return redirect(url_for("home_view.dashboard"))
     logthis.info(
-        f'An invalid path ({request.path}) was provided and no user is logged in.  Returning login page.'
+        f"An invalid path ({request.path}) was provided and no user is logged in.  Returning login page."
     )
     return load_home()
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()
diff --git a/bin/load_home.py b/bin/load_home.py
index 2e730a5..c35db75 100644
--- a/bin/load_home.py
+++ b/bin/load_home.py
@@ -33,47 +33,47 @@
 
 from bin import logger
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 
 
 def load_home() -> Union[Response, str]:
-    if 'username' in session:
-        return redirect(url_for('dashboard'))
-    with open(server_json_file, 'r') as fin:
+    if "username" in session:
+        return redirect(url_for("dashboard"))
+    with open(server_json_file, "r") as fin:
         server_json = json.load(fin)
     if not server_json:
-        return render_template('home.html')
-    brand = server_json.get('brand')
+        return render_template("home.html")
+    brand = server_json.get("brand")
 
-    if 'jps_url' not in server_json:
-        return render_template('home.html', app_name=brand)
-    elif server_json['jps_url'] is None:
-        return render_template('home.html', app_name=brand)
-    elif len(server_json['jps_url']) == 0:
-        return render_template('home.html', app_name=brand)
+    if "jps_url" not in server_json:
+        return render_template("home.html", app_name=brand)
+    elif server_json["jps_url"] is None:
+        return render_template("home.html", app_name=brand)
+    elif len(server_json["jps_url"]) == 0:
+        return render_template("home.html", app_name=brand)
     else:
-        if 'alternate_jps' not in server_json:
-            return render_template('home.html', app_name=brand)
+        if "alternate_jps" not in server_json:
+            return render_template("home.html", app_name=brand)
 
-        if server_json['alternate_jps'] != '':
+        if server_json["alternate_jps"] != "":
             return render_template(
-                'home.html',
-                jps_url=server_json['jps_url'],
-                jps_url2=server_json['alternate_jps'],
-                welcome='true',
-                jsslock='true',
+                "home.html",
+                jps_url=server_json["jps_url"],
+                jps_url2=server_json["alternate_jps"],
+                welcome="true",
+                jsslock="true",
                 app_name=brand,
             )
 
-        session['url'] = server_json['jps_url']
+        session["url"] = server_json["jps_url"]
         return render_template(
-            'home.html',
-            jps_url=str(escape(session['url'])),
-            welcome='true',
-            jsslock='true',
+            "home.html",
+            jps_url=str(escape(session["url"])),
+            welcome="true",
+            jsslock="true",
             app_name=brand,
         )
diff --git a/bin/logger.py b/bin/logger.py
index 461593d..c1ac61c 100644
--- a/bin/logger.py
+++ b/bin/logger.py
@@ -32,9 +32,9 @@
 from typing import Optional
 
 formatter = logging.Formatter(
-    '%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+    "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
 )
-logger_name = 'jawa'
+logger_name = "jawa"
 default_log_level = logging.INFO
 log_roll_size = 1048576 * 100
 log_backupCount = 10
@@ -42,11 +42,11 @@
 
 def setup_logger(
     log_name: Optional[str] = logger_name,
-    log_filename: Optional[str] = f'{logger_name}.log',
+    log_filename: Optional[str] = f"{logger_name}.log",
     log_level: Optional[int] = default_log_level,
 ) -> logging.Logger:
     log_path = os.path.abspath(
-        os.path.join(os.path.dirname(__file__), '..', 'data')
+        os.path.join(os.path.dirname(__file__), "..", "data")
     )
     if not os.path.isdir(log_path):
         os.makedirs(log_path)
@@ -69,4 +69,4 @@ def setup_child_logger(
     return logging.getLogger(name_of_logger).getChild(name_of_child)
 
 
-logthis = setup_logger(logger_name, f'{logger_name}.log')
+logthis = setup_logger(logger_name, f"{logger_name}.log")
diff --git a/bin/okta_verification.py b/bin/okta_verification.py
index befe569..f4c29af 100755
--- a/bin/okta_verification.py
+++ b/bin/okta_verification.py
@@ -29,12 +29,12 @@
 
 
 def verify_new_webhook(challenge: Optional[str]) -> Dict[str, str]:
-    return {'verification': f'{challenge}'}
+    return {"verification": f"{challenge}"}
 
 
 def main() -> None:
     pass
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()
diff --git a/bin/tokens.py b/bin/tokens.py
index e49a2db..08cd0b9 100644
--- a/bin/tokens.py
+++ b/bin/tokens.py
@@ -33,68 +33,68 @@
 
 from bin import logger
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 
 def get_token() -> Optional[Response]:
     try:
         resp = requests.post(
-            f'{session["url"]}/api/v1/auth/token',
-            headers={'Authorization': f'Basic {session["b64_auth"].decode()}'},
+            f"{session['url']}/api/v1/auth/token",
+            headers={"Authorization": f"Basic {session['b64_auth'].decode()}"},
         )
         data = resp.json()
-        session['token'] = data.get('token')
-        session['expires'] = data.get('expires')
+        session["token"] = data.get("token")
+        session["expires"] = data.get("expires")
     except Exception as err:
         logthis.info(
-            f'[{session.get("url")}] Could not get a token using session credentials: {err}.  Logging out.'
+            f"[{session.get('url')}] Could not get a token using session credentials: {err}.  Logging out."
         )
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Error Fetching API Token',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Error Fetching API Token",
+                error_message="Please sign in again",
             )
         )
 
 
 def validate_token(expires: str) -> bool:
     time_to_expire = datetime.strptime(
-        expires, '%Y-%m-%dT%H:%M:%S.%f%z'
+        expires, "%Y-%m-%dT%H:%M:%S.%f%z"
     ) - datetime.strptime(
-        str(datetime.now(timezone.utc)), '%Y-%m-%d %H:%M:%S.%f%z'
+        str(datetime.now(timezone.utc)), "%Y-%m-%d %H:%M:%S.%f%z"
     )
     if time_to_expire > timedelta(0):
         return True
     else:
         logthis.info(
-            f'[{session.get("url")}] API token expired ({time_to_expire}). Attempting to fetch new token...'
+            f"[{session.get('url')}] API token expired ({time_to_expire}). Attempting to fetch new token..."
         )
         return False
 
 
 def invalidate_token() -> None:
-    if not session.get('token'):
+    if not session.get("token"):
         return
     try:
         resp = requests.post(
-            f'{session["url"]}/api/v1/auth/invalidate-token',
-            headers={'Authorization': f'Bearer {session.get("token")}'},
+            f"{session['url']}/api/v1/auth/invalidate-token",
+            headers={"Authorization": f"Bearer {session.get('token')}"},
         )
     except Exception as err:
         logthis.info(
-            f'[{session.get("url")}] Error accessing Jamf Pro API endpoint for token invalidation. {err}'
+            f"[{session.get('url')}] Error accessing Jamf Pro API endpoint for token invalidation. {err}"
         )
         return
     if resp.status_code == 204:
         logthis.info(
-            f'[{session.get("url")}] Successfully invalidated token for logout.'
+            f"[{session.get('url')}] Successfully invalidated token for logout."
         )
     elif resp.status_code == 401:
         logthis.info(
-            f'[{session.get("url")}] Token is already invalid.  Logging out.'
+            f"[{session.get('url')}] Token is already invalid.  Logging out."
         )
     else:
         logthis.info(
-            f'[{session.get("url")}] An unknown error occurred when invalidating the token.'
+            f"[{session.get('url')}] An unknown error occurred when invalidating the token."
         )
diff --git a/bin/v2_upgrade.py b/bin/v2_upgrade.py
index d194e61..bea1e0e 100644
--- a/bin/v2_upgrade.py
+++ b/bin/v2_upgrade.py
@@ -32,19 +32,19 @@
 
 try:
     backup_dir = sys.argv[1]
-    old_server_json_path = f'{backup_dir}/v2/server.json'
-    new_server_json_path = f'{backup_dir}/data/server.json'
-    jp_webhooks_path = f'{backup_dir}/v2/jp_webhooks.json'
-    webhook_conf = f'{backup_dir}/v2/webhook.conf'
-    new_webhooks_path = f'{backup_dir}/data/webhooks.json'
-    jawa_address = ''
+    old_server_json_path = f"{backup_dir}/v2/server.json"
+    new_server_json_path = f"{backup_dir}/data/server.json"
+    jp_webhooks_path = f"{backup_dir}/v2/jp_webhooks.json"
+    webhook_conf = f"{backup_dir}/v2/webhook.conf"
+    new_webhooks_path = f"{backup_dir}/data/webhooks.json"
+    jawa_address = ""
 except IndexError:
-    print('Backup directory not specified in program arguments.')
+    print("Backup directory not specified in program arguments.")
     exit(1)
 
 # Create data dir in backup dir if necessary
-if not os.path.isdir(f'{backup_dir}/data'):
-    os.mkdir(f'{backup_dir}/data')
+if not os.path.isdir(f"{backup_dir}/data"):
+    os.mkdir(f"{backup_dir}/data")
 
 # Check for server.json
 if os.path.isfile(old_server_json_path):
@@ -52,10 +52,10 @@
         server_json = json.load(fin)
     for each_entry in server_json:
         new_server_json = each_entry
-        jawa_address = each_entry.get('jawa_address')
-        jps_url = each_entry.get('jps_url')
-        new_server_json['alternate_jps'] = ''
-    with open(new_server_json_path, 'w') as fout:
+        jawa_address = each_entry.get("jawa_address")
+        jps_url = each_entry.get("jps_url")
+        new_server_json["alternate_jps"] = ""
+    with open(new_server_json_path, "w") as fout:
         json.dump(new_server_json, fout, indent=4)
 
 new_webhooks_json = []
@@ -66,20 +66,20 @@
         jp_webhooks_json = json.load(fin)
     for each_entry in jp_webhooks_json:
         new_entry = {
-            'url': each_entry['url'],
-            'jawa_admin': each_entry['username'],
-            'name': each_entry['name'],
-            'webhook_username': 'null',
-            'webhook_password': 'null',
-            'event': each_entry['event'],
-            'script': each_entry['script'],
-            'description': each_entry['description'],
-            'tag': 'jamfpro',
-            'jamf_id': '',
+            "url": each_entry["url"],
+            "jawa_admin": each_entry["username"],
+            "name": each_entry["name"],
+            "webhook_username": "null",
+            "webhook_password": "null",
+            "event": each_entry["event"],
+            "script": each_entry["script"],
+            "description": each_entry["description"],
+            "tag": "jamfpro",
+            "jamf_id": "",
         }
         new_webhooks_json.append(new_entry)
 
-names = [each_entry['name'] for each_entry in new_webhooks_json]
+names = [each_entry["name"] for each_entry in new_webhooks_json]
 
 # Checking for all other webhooks
 if os.path.isfile(webhook_conf):
@@ -88,19 +88,19 @@
 
     for each_entry in webhooks_json:
         # Checking for unique entries
-        if each_entry['id'] not in names:
+        if each_entry["id"] not in names:
             new_entry = {
-                'url': jps_url,
-                'jawa_admin': 'Guy Incognito',
-                'name': each_entry['id'],
-                'webhook_username': 'null',
-                'webhook_password': 'null',
-                'script': each_entry['execute-command'],
-                'description': '',
-                'tag': 'custom',
+                "url": jps_url,
+                "jawa_admin": "Guy Incognito",
+                "name": each_entry["id"],
+                "webhook_username": "null",
+                "webhook_password": "null",
+                "script": each_entry["execute-command"],
+                "description": "",
+                "tag": "custom",
             }
             new_webhooks_json.append(new_entry)
 
 # Writing new webhook file
-with open(new_webhooks_path, 'w+') as fout:
+with open(new_webhooks_path, "w+") as fout:
     json.dump(new_webhooks_json, fout, indent=4)
diff --git a/bin/view_modifiers.py b/bin/view_modifiers.py
index f71b13e..997246f 100644
--- a/bin/view_modifiers.py
+++ b/bin/view_modifiers.py
@@ -5,7 +5,7 @@
 import werkzeug
 import werkzeug.wrappers
 
-F = TypeVar('F', bound=Callable[..., Any])
+F = TypeVar("F", bound=Callable[..., Any])
 
 
 def response(
@@ -31,7 +31,7 @@ def view_method(*args, **kwargs) -> flask.Response:
 
             if template_file and not isinstance(response_val, dict):
                 raise Exception(
-                    'Invalid return type {}, we expected a dict as the return value.'.format(
+                    "Invalid return type {}, we expected a dict as the return value.".format(
                         type(response_val)
                     )
                 )
diff --git a/views/cron_view.py b/views/cron_view.py
index 3060e6f..250b642 100644
--- a/views/cron_view.py
+++ b/views/cron_view.py
@@ -47,198 +47,198 @@
 from bin import logger
 from bin.view_modifiers import response
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 cron_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'cron.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "cron.json")
 )
 time_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'time.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "time.json")
 )
 scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+    os.path.join(os.path.dirname(__file__), "..", "scripts")
 )
 
-blueprint = Blueprint('cron', __name__)
+blueprint = Blueprint("cron", __name__)
 
 
-@blueprint.route('/cron', methods=['GET', 'POST'])
-@response(template_file='cron/home.html')
+@blueprint.route("/cron", methods=["GET", "POST"])
+@response(template_file="cron/home.html")
 def cron_home() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    with open(cron_json_file, 'r') as fin:
+    with open(cron_json_file, "r") as fin:
         cron_json = json.load(fin)
-    return {'username': session.get('username'), 'cron_list': cron_json}
+    return {"username": session.get("username"), "cron_list": cron_json}
 
 
-@blueprint.route('/cron/new', methods=['GET', 'POST'])
+@blueprint.route("/cron/new", methods=["GET", "POST"])
 def new_cron() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
     days, frequencies, hours = time_definitions()
 
-    if request.method != 'POST':
+    if request.method != "POST":
         return render_template(
-            'cron/new.html',
-            cron='cron',
+            "cron/new.html",
+            cron="cron",
             frequencies=frequencies,
             days=days,
             hours=hours,
-            username=str(escape(session['username'])),
+            username=str(escape(session["username"])),
         )
 
-    if ' ' in request.form.get('cron_name'):
-        error_message = 'Single-string name only.'
+    if " " in request.form.get("cron_name"):
+        error_message = "Single-string name only."
         return render_template(
-            'error.html',
+            "error.html",
             error_message=error_message,
-            error='error',
-            username=str(escape(session['username'])),
+            error="error",
+            username=str(escape(session["username"])),
         )
 
-    cron_description = request.form.get('description')
-    cron_name = request.form.get('cron_name')
+    cron_description = request.form.get("description")
+    cron_name = request.form.get("cron_name")
 
     if not os.path.isdir(scripts_dir):
         os.mkdir(scripts_dir)
     owd = os.getcwd()
     os.chdir(scripts_dir)
-    script = request.files['script']
-    if ' ' in script.filename:
-        script.filename = script.filename.replace(' ', '-')
-    new_script_name = f'cron_{cron_name}_{script.filename}'
+    script = request.files["script"]
+    if " " in script.filename:
+        script.filename = script.filename.replace(" ", "-")
+    new_script_name = f"cron_{cron_name}_{script.filename}"
     script.save(secure_filename(new_script_name))
     script_file = os.path.join(scripts_dir, new_script_name)
 
     os.chmod(script_file, mode=0o0755)
     os.chdir(owd)
-    frequency = request.form.get('frequency')
+    frequency = request.form.get("frequency")
 
     if not os.path.isfile(cron_json_file):
         data = []
-        with open(cron_json_file, 'w') as outfile:
+        with open(cron_json_file, "w") as outfile:
             json.dump(data, outfile, indent=4)
 
     data = json.load(open(cron_json_file))
 
     for i in data:
         # Mister Krabs
-        if str(i['name']) == cron_name:
-            error_message = 'Name already exists!'
+        if str(i["name"]) == cron_name:
+            error_message = "Name already exists!"
             return render_template(
-                'error.html',
+                "error.html",
                 error_message=error_message,
-                error='error',
-                username=str(escape(session['username'])),
+                error="error",
+                username=str(escape(session["username"])),
             )
     try:
         cron = CronTab(user=True)
     except IOError as err:
         logthis.info(
-            f'Error accessing crontab for {getpass.getuser()} - {err}'
+            f"Error accessing crontab for {getpass.getuser()} - {err}"
         )
         os.remove(script_file)
         return render_template(
-            'error.html', error=err, username=session.get('username')
+            "error.html", error=err, username=session.get("username")
         )
 
-    if frequency == 'everyhour':
+    if frequency == "everyhour":
         job1 = cron.new(command=script_file, comment=cron_name)
         job1.every().hours()
         job1.minute.on(0)
         cron.write()
 
-    if frequency == 'everyday':
-        time = request.form.get('daytime')
+    if frequency == "everyday":
+        time = request.form.get("daytime")
         job1 = cron.new(command=script_file, comment=cron_name)
         job1.day.every(1)
         job1.hour.on(time)
         job1.minute.on(0)
         cron.write()
 
-    if frequency == 'everyweek':
-        day = request.form.get('weekday')
-        time = request.form.get('weektime')
+    if frequency == "everyweek":
+        day = request.form.get("weekday")
+        time = request.form.get("weektime")
         job1 = cron.new(command=script_file, comment=cron_name)
         job1.dow.on(day)
         job1.hour.on(time)
         job1.minute.on(0)
         cron.write()
 
-    if frequency == 'everymonth':
-        day = request.form.get('monthday')
-        time = request.form.get('monthtime')
+    if frequency == "everymonth":
+        day = request.form.get("monthday")
+        time = request.form.get("monthtime")
         job1 = cron.new(command=script_file, comment=cron_name)
         job1.day.on(day)
         job1.hour.on(time)
         job1.minute.on(0)
         cron.write()
 
-    if frequency == 'custom':
-        custom_frequency = request.form.get('customfreq')
+    if frequency == "custom":
+        custom_frequency = request.form.get("customfreq")
         try:
             job1 = cron.new(command=script_file, comment=cron_name)
-            job1.setall(f'{custom_frequency}')
+            job1.setall(f"{custom_frequency}")
             cron.write()
         except (KeyError, ValueError) as err:
             return render_template(
-                'error.html',
-                error='Custom Crontab Frequency Error',
+                "error.html",
+                error="Custom Crontab Frequency Error",
                 error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  Please check your syntax and try again.\nCheck your syntax:  ",
-                link=f'https://crontab.guru/#{custom_frequency}',
-                username=str(escape(session['username'])),
+                link=f"https://crontab.guru/#{custom_frequency}",
+                username=str(escape(session["username"])),
             )
 
-        frequency = f'Custom [ {custom_frequency} ]'
+        frequency = f"Custom [ {custom_frequency} ]"
 
     data.append(
         {
-            'name': cron_name,
-            'description': cron_description,
-            'frequency': frequency,
-            'script': script_file,
+            "name": cron_name,
+            "description": cron_description,
+            "frequency": frequency,
+            "script": script_file,
         }
     )
 
-    with open(cron_json_file, 'w') as outfile:
+    with open(cron_json_file, "w") as outfile:
         json.dump(data, outfile, indent=4)
-    success_msg = f'[{session.get("url")}] {session.get("username")} created {cron_name} to run at the frequency:\n {frequency}.'
-    logthis.info(f'{success_msg}')
+    success_msg = f"[{session.get('url')}] {session.get('username')} created {cron_name} to run at the frequency:\n {frequency}."
+    logthis.info(f"{success_msg}")
 
     return render_template(
-        'success.html',
-        webhooks='success',
+        "success.html",
+        webhooks="success",
         success_msg=success_msg,
-        username=str(escape(session['username'])),
+        username=str(escape(session["username"])),
     )
 
 
 def time_definitions() -> Tuple[List, List, List]:
-    with open(time_json_file, 'r+') as fin:
+    with open(time_json_file, "r+") as fin:
         content = fin.read()
         time_data = json.loads(content)
-    days_data = time_data['days']
-    hours_data = time_data['hours']
-    frequencies_data = time_data['frequencies']
+    days_data = time_data["days"]
+    hours_data = time_data["hours"]
+    frequencies_data = time_data["frequencies"]
     i = 0
     days = []
     for item in days_data:
@@ -257,44 +257,44 @@ def time_definitions() -> Tuple[List, List, List]:
     return days, frequencies, hours
 
 
-@blueprint.route('/cron/delete', methods=['GET', 'POST'])
+@blueprint.route("/cron/delete", methods=["GET", "POST"])
 def delete_cron() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username")} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username')} viewed {request.path}"
     )
-    target_job = request.args.get('target_job')
+    target_job = request.args.get("target_job")
     with open(cron_json_file) as fin:
         cron_json = json.load(fin)
-    names = [str(cron_json[i]['name']) for i, item in enumerate(cron_json)]
+    names = [str(cron_json[i]["name"]) for i, item in enumerate(cron_json)]
     if not names:
         return render_template(
-            'cron/home.html', username=str(escape(session['username']))
+            "cron/home.html", username=str(escape(session["username"]))
         )
 
-    if request.method != 'POST':
+    if request.method != "POST":
         return render_template(
-            'cron/delete.html',
+            "cron/delete.html",
             content=names,
             target_job=target_job,
-            delete_cron='delete_cron',
-            username=str(escape(session['username'])),
+            delete_cron="delete_cron",
+            username=str(escape(session["username"])),
         )
-    target_job = request.args.get('target_job')
+    target_job = request.args.get("target_job")
 
     data = json.load(open(cron_json_file))
 
     for d in data:
-        if d['name'] == target_job:
-            script_path = d['script']
-            new_script_path = f'{script_path}.old'
+        if d["name"] == target_job:
+            script_path = d["script"]
+            new_script_path = f"{script_path}.old"
             if os.path.exists(script_path):
                 os.rename(script_path, new_script_path)
 
@@ -302,70 +302,70 @@ def delete_cron() -> Union[Response, str]:
         cron = CronTab(user=True)
     except IOError as err:
         logthis.info(
-            f'Error accessing crontab for {getpass.getuser()} - {err}'
+            f"Error accessing crontab for {getpass.getuser()} - {err}"
         )
         return render_template(
-            'error.html', error=err, username=session.get('username')
+            "error.html", error=err, username=session.get("username")
         )
 
     for job in cron:
         if job.comment == target_job:
             logthis.info(
-                f'[{session.get("url")}] {session.get("username")} removed cron job {target_job}'
+                f"[{session.get('url')}] {session.get('username')} removed cron job {target_job}"
             )
             cron.remove(job)
             cron.write()
 
-    data[:] = [d for d in data if d.get('name') != target_job]
+    data[:] = [d for d in data if d.get("name") != target_job]
 
-    with open(cron_json_file, 'w') as outfile:
+    with open(cron_json_file, "w") as outfile:
         json.dump(data, outfile, indent=4)
-    success_msg = f'[{session.get("url")}] {session.get("username")} successfully deleted the Timed Automation: {target_job}.'
+    success_msg = f"[{session.get('url')}] {session.get('username')} successfully deleted the Timed Automation: {target_job}."
     return render_template(
-        'success.html',
+        "success.html",
         success_msg=success_msg,
-        username=str(escape(session['username'])),
+        username=str(escape(session["username"])),
     )
 
 
-@blueprint.route('/cron/edit', methods=['GET', 'POST'])
+@blueprint.route("/cron/edit", methods=["GET", "POST"])
 def edit_cron() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username")} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username')} viewed {request.path}"
     )
 
     try:
         cron = CronTab(user=True)
     except IOError as err:
         logthis.info(
-            f'Error accessing crontab for {getpass.getuser()} - {err}'
+            f"Error accessing crontab for {getpass.getuser()} - {err}"
         )
         return render_template(
-            'error.html', error=err, username=session.get('username')
+            "error.html", error=err, username=session.get("username")
         )
 
     with open(cron_json_file) as fin:
         cron_json = json.load(fin)
     names = []
-    name = request.args.get('name')
+    name = request.args.get("name")
     for i, item in enumerate(cron_json):
-        names.append(str(cron_json[i]['name']))
-        if item.get('name') == name:
-            description = item.get('description')
+        names.append(str(cron_json[i]["name"]))
+        if item.get("name") == name:
+            description = item.get("description")
     if not name:
         logthis.info(
-            f'{request.path} - Warning: No name provided for editing, redirecting to cron home'
+            f"{request.path} - Warning: No name provided for editing, redirecting to cron home"
         )
 
-        return redirect(url_for('cron.cron_home'))
+        return redirect(url_for("cron.cron_home"))
     logthis.debug(
         f"[{session.get('url')}] {session.get('username').title()} checking for job '{name}' in {cron.user}'s crontab"
     )
@@ -379,137 +379,137 @@ def edit_cron() -> Union[Response, str]:
         logthis.debug(
             f"JAWA is not aware of any job named {name} in {cron.user}'s crontab"
         )
-        return redirect(url_for('cron.cron_home'))
+        return redirect(url_for("cron.cron_home"))
 
     if not names:
         return render_template(
-            'cron/home.html', username=str(escape(session['username']))
+            "cron/home.html", username=str(escape(session["username"]))
         )
 
-    if request.method != 'POST':
+    if request.method != "POST":
         days, frequencies, hours = time_definitions()
         return render_template(
-            'cron/edit.html',
+            "cron/edit.html",
             content=names,
             edit_name=name,
             description=description,
             days=days,
             hours=hours,
             frequencies=frequencies,
-            username=str(escape(session['username'])),
+            username=str(escape(session["username"])),
         )
 
-    if ' ' in request.form.get('cron_name'):
-        error_message = 'Single-string name only.'
+    if " " in request.form.get("cron_name"):
+        error_message = "Single-string name only."
         return render_template(
-            'error.html',
+            "error.html",
             error_message=error_message,
-            error='error',
-            username=str(escape(session['username'])),
+            error="error",
+            username=str(escape(session["username"])),
         )
 
-    button_choice = request.form.get('button_choice')
-    if button_choice == 'Delete':
+    button_choice = request.form.get("button_choice")
+    if button_choice == "Delete":
         logthis.debug(
-            f'[{session.get("url")}] {session.get("username")} is considering deleting a Timed Automation ({name})...'
+            f"[{session.get('url')}] {session.get('username')} is considering deleting a Timed Automation ({name})..."
         )
-        return redirect(url_for('cron.delete_cron', target_job=name))
+        return redirect(url_for("cron.delete_cron", target_job=name))
 
     for each_cron in cron_json:
-        if each_cron.get('name') == name:
-            new_cron_name = request.form.get('cron_name')
+        if each_cron.get("name") == name:
+            new_cron_name = request.form.get("cron_name")
             if not new_cron_name:
                 new_cron_name = name
-            each_cron['name'] = new_cron_name
-            description = request.form.get('description')
+            each_cron["name"] = new_cron_name
+            description = request.form.get("description")
             if not description:
-                description = each_cron.get('description')
-            each_cron['description'] = description
-            frequency = request.form.get('frequency')
+                description = each_cron.get("description")
+            each_cron["description"] = description
+            frequency = request.form.get("frequency")
             frequency_change = False
             if not frequency:
-                frequency = each_cron.get('frequency')
+                frequency = each_cron.get("frequency")
             else:
                 frequency_change = True
-            if frequency == 'custom':
+            if frequency == "custom":
                 frequency_change = True
-                custom_frequency = request.form.get('customfreq')
-                each_cron['frequency'] = f'Custom [ {custom_frequency} ]'
+                custom_frequency = request.form.get("customfreq")
+                each_cron["frequency"] = f"Custom [ {custom_frequency} ]"
             else:
-                each_cron['frequency'] = frequency
-            if request.files.get('script'):
-                script = request.files.get('script')
-                if ' ' in script.filename:
-                    script.filename = script.filename.replace(' ', '-')
+                each_cron["frequency"] = frequency
+            if request.files.get("script"):
+                script = request.files.get("script")
+                if " " in script.filename:
+                    script.filename = script.filename.replace(" ", "-")
                 if script.filename:
                     if not os.path.isdir(scripts_dir):
                         os.mkdir(scripts_dir)
                     owd = os.getcwd()
                     os.chdir(scripts_dir)
-                    new_script_name = f'cron_{new_cron_name}_{script.filename}'
+                    new_script_name = f"cron_{new_cron_name}_{script.filename}"
                     script.save(secure_filename(new_script_name))
                     script_file = os.path.join(scripts_dir, new_script_name)
                     os.chmod(script_file, mode=0o0755)
                     os.chdir(owd)
-                    each_cron['script'] = script_file
+                    each_cron["script"] = script_file
                 else:
-                    script_file = each_cron.get('script')
+                    script_file = each_cron.get("script")
             else:
-                script_file = each_cron.get('script')
+                script_file = each_cron.get("script")
 
     for each_job in cron:
         if each_job.comment == name:
             each_job.command = script_file
             each_job.comment = new_cron_name
             if frequency_change:
-                if frequency == 'everyhour':
+                if frequency == "everyhour":
                     each_job.every().hours()
                     each_job.minute.on(0)
 
-                if frequency == 'everyday':
-                    time = request.form.get('daytime')
+                if frequency == "everyday":
+                    time = request.form.get("daytime")
                     each_job.day.every(1)
                     each_job.hour.on(time)
                     each_job.minute.on(0)
 
-                if frequency == 'everyweek':
-                    day = request.form.get('weekday')
-                    time = request.form.get('weektime')
+                if frequency == "everyweek":
+                    day = request.form.get("weekday")
+                    time = request.form.get("weektime")
                     each_job.dow.on(day)
                     each_job.hour.on(time)
                     each_job.minute.on(0)
 
-                if frequency == 'everymonth':
-                    day = request.form.get('monthday')
-                    time = request.form.get('monthtime')
+                if frequency == "everymonth":
+                    day = request.form.get("monthday")
+                    time = request.form.get("monthtime")
                     each_job.day.on(day)
                     each_job.hour.on(time)
                     each_job.minute.on(0)
-                if frequency == 'custom':
-                    custom_frequency = request.form.get('customfreq')
+                if frequency == "custom":
+                    custom_frequency = request.form.get("customfreq")
                     try:
-                        each_job.setall(f'{custom_frequency}')
+                        each_job.setall(f"{custom_frequency}")
                     except (KeyError, ValueError) as err:
-                        custom_frequency = custom_frequency.replace(' ', '_')
+                        custom_frequency = custom_frequency.replace(" ", "_")
                         return render_template(
-                            'error.html',
-                            error='Custom Crontab Frequency Error',
+                            "error.html",
+                            error="Custom Crontab Frequency Error",
                             error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  "
-                            f'Please check your syntax and try again.\n'
-                            f'Check your syntax:  ',
-                            link=f'https://crontab.guru/#{custom_frequency}',
-                            username=str(escape(session['username'])),
+                            f"Please check your syntax and try again.\n"
+                            f"Check your syntax:  ",
+                            link=f"https://crontab.guru/#{custom_frequency}",
+                            username=str(escape(session["username"])),
                         )
             cron.write()
 
-    with open(cron_json_file, 'w') as outfile:
+    with open(cron_json_file, "w") as outfile:
         json.dump(cron_json, outfile, indent=4)
-    success_msg = f'[{session.get("url")}] {session.get("username")} edited {new_cron_name} to run at the frequency:  {frequency}.'
-    logthis.info(f'{success_msg}')
+    success_msg = f"[{session.get('url')}] {session.get('username')} edited {new_cron_name} to run at the frequency:  {frequency}."
+    logthis.info(f"{success_msg}")
 
     return render_template(
-        'success.html',
+        "success.html",
         success_msg=success_msg,
-        webhooks='success',
-        username=str(escape(session['username'])),
+        webhooks="success",
+        username=str(escape(session["username"])),
     )
diff --git a/views/custom_webhook.py b/views/custom_webhook.py
index f0b450a..5f3e04f 100644
--- a/views/custom_webhook.py
+++ b/views/custom_webhook.py
@@ -46,273 +46,273 @@
 from bin.view_modifiers import response
 from bin import logger
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
-blueprint = Blueprint('custom_webhook', __name__, template_folder='templates')
+blueprint = Blueprint("custom_webhook", __name__, template_folder="templates")
 
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 okta_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "okta_json.json")
 )
 okta_verification_file = os.path.abspath(
     os.path.join(
-        os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'
+        os.path.dirname(__file__), "..", "bin", "okta_verification.py"
     )
 )
 webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
 )
 scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+    os.path.join(os.path.dirname(__file__), "..", "scripts")
 )
 
 
-@blueprint.route('/webhooks/custom', methods=['GET', 'POST'])
-@response(template_file='webhooks/custom/home.html')
+@blueprint.route("/webhooks/custom", methods=["GET", "POST"])
+@response(template_file="webhooks/custom/home.html")
 def custom_webhook() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    with open(webhooks_file, 'r') as fin:
+    with open(webhooks_file, "r") as fin:
         webhooks_json = json.load(fin)
     custom_webhooks_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: 'MISSING', each_webhook)
-        tag = data['tag']
-        if tag == 'custom':
+        data = defaultdict(lambda: "MISSING", each_webhook)
+        tag = data["tag"]
+        if tag == "custom":
             custom_webhooks_list.append(each_webhook)
 
     return {
-        'username': session.get('username'),
-        'custom_list': custom_webhooks_list,
+        "username": session.get("username"),
+        "custom_list": custom_webhooks_list,
     }
 
 
-@blueprint.route('/webhooks/custom/edit', methods=['GET', 'POST'])
-@response(template_file='webhooks/custom/edit.html')
+@blueprint.route("/webhooks/custom/edit", methods=["GET", "POST"])
+@response(template_file="webhooks/custom/edit.html")
 def edit_webhook() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    name = request.args.get('name')
+    name = request.args.get("name")
     if name:
         name = escape(name)
     logthis.info(f"Checking for custom webhook '{name}'")
     with open(webhooks_file) as fin:
         webhooks_json = json.load(fin)
     check_for_name = [
-        True for each_webhook in webhooks_json if each_webhook['name'] == name
+        True for each_webhook in webhooks_json if each_webhook["name"] == name
     ]
-    logthis.info(f'Name exists? {check_for_name}')
+    logthis.info(f"Name exists? {check_for_name}")
     if not check_for_name:
-        logthis.info(f'JAWA is not aware of any custom webhook named {name}')
-        return redirect(url_for('custom_webhook.custom_webhook'))
+        logthis.info(f"JAWA is not aware of any custom webhook named {name}")
+        return redirect(url_for("custom_webhook.custom_webhook"))
 
     extra_notice = None
     custom_header = None
 
-    if request.method == 'POST':
-        button_choice = request.form.get('button_choice')
-        if button_choice == 'Delete':
+    if request.method == "POST":
+        button_choice = request.form.get("button_choice")
+        if button_choice == "Delete":
             logthis.info(
-                f'{session.get("username")} is considering deleting a custom webhook ({name})...'
+                f"{session.get('username')} is considering deleting a custom webhook ({name})..."
             )
             return redirect(
-                url_for('webhooks.delete_webhook', target_webhook=name)
+                url_for("webhooks.delete_webhook", target_webhook=name)
             )
         for each_webhook in webhooks_json:
-            if each_webhook['name'] == name:
+            if each_webhook["name"] == name:
                 logthis.info(
-                    f'{session.get("username")} is editing a custom webhook ({name})...'
+                    f"{session.get('username')} is editing a custom webhook ({name})..."
                 )
-                output = request.form.get('output')
-                new_custom_name = request.form.get('custom_name')
+                output = request.form.get("output")
+                new_custom_name = request.form.get("custom_name")
                 if not new_custom_name:
                     new_custom_name = name
-                description = request.form.get('description')
-                if request.form.get('basic'):
+                description = request.form.get("description")
+                if request.form.get("basic"):
                     new_webhook_user = request.form.get(
-                        'basic_username', 'null'
+                        "basic_username", "null"
                     )
-                    new_webhook_pass = request.form.get('new-password', 'null')
+                    new_webhook_pass = request.form.get("new-password", "null")
                 else:
-                    new_webhook_user = 'null'
-                    new_webhook_pass = 'null'
-                if request.form.get('custom'):
-                    new_webhook_apikey = request.form.get('api_key', 'null')
-                    extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:'
-                    custom_header = {'x-api-key': f'{new_webhook_apikey}'}
+                    new_webhook_user = "null"
+                    new_webhook_pass = "null"
+                if request.form.get("custom"):
+                    new_webhook_apikey = request.form.get("api_key", "null")
+                    extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:"
+                    custom_header = {"x-api-key": f"{new_webhook_apikey}"}
                 else:
-                    new_webhook_apikey = 'null'
-                if new_webhook_user and new_webhook_user != '':
-                    each_webhook['webhook_username'] = new_webhook_user
+                    new_webhook_apikey = "null"
+                if new_webhook_user and new_webhook_user != "":
+                    each_webhook["webhook_username"] = new_webhook_user
                 else:
-                    each_webhook['webhook_username'] = 'null'
-                if new_webhook_pass and new_webhook_pass != '':
-                    each_webhook['webhook_password'] = new_webhook_pass
+                    each_webhook["webhook_username"] = "null"
+                if new_webhook_pass and new_webhook_pass != "":
+                    each_webhook["webhook_password"] = new_webhook_pass
                 else:
-                    each_webhook['webhook_password'] = 'null'
-                if new_webhook_apikey and new_webhook_apikey != '':
-                    each_webhook['api_key'] = new_webhook_apikey
+                    each_webhook["webhook_password"] = "null"
+                if new_webhook_apikey and new_webhook_apikey != "":
+                    each_webhook["api_key"] = new_webhook_apikey
                 else:
-                    each_webhook['webhook_password'] = 'null'
-                if request.files.get('new_file'):
-                    new_script = request.files.get('new_file')
+                    each_webhook["webhook_password"] = "null"
+                if request.files.get("new_file"):
+                    new_script = request.files.get("new_file")
                     owd = os.getcwd()
                     os.chdir(scripts_dir)
 
-                    if ' ' in new_script.filename:
+                    if " " in new_script.filename:
                         new_script.filename = new_script.filename.replace(
-                            ' ', '-'
+                            " ", "-"
                         )
 
-                    new_filename = f'{new_custom_name}-{new_script.filename}'
+                    new_filename = f"{new_custom_name}-{new_script.filename}"
                     new_script.save(secure_filename(new_filename))
                     new_filename = os.path.join(
-                        scripts_dir, f'{new_custom_name}-{new_script.filename}'
+                        scripts_dir, f"{new_custom_name}-{new_script.filename}"
                     )
                     os.chmod(new_filename, mode=0o0755)
                     os.chdir(owd)
-                    each_webhook['script'] = new_filename
+                    each_webhook["script"] = new_filename
 
-                each_webhook['name'] = new_custom_name
+                each_webhook["name"] = new_custom_name
                 if description:
-                    each_webhook['description'] = description
-                each_webhook['webhook_username'] = new_webhook_user
-                each_webhook['webhook_password'] = new_webhook_pass
-                each_webhook['output'] = output
+                    each_webhook["description"] = description
+                each_webhook["webhook_username"] = new_webhook_user
+                each_webhook["webhook_password"] = new_webhook_pass
+                each_webhook["output"] = output
 
-                with open(webhooks_file, 'w') as fout:
+                with open(webhooks_file, "w") as fout:
                     json.dump(webhooks_json, fout, indent=4)
                 webhook_info = [each_webhook]
                 return {
-                    'webhooks': 'success',
-                    'success_msg': f'Edited custom webhook {new_custom_name}.',
-                    'username': session.get('username'),
-                    'webhook_info': webhook_info,
-                    'webhook_name': new_custom_name,
-                    'description': each_webhook.get('description'),
-                    'extra_notice': extra_notice,
-                    'custom_header': custom_header,
+                    "webhooks": "success",
+                    "success_msg": f"Edited custom webhook {new_custom_name}.",
+                    "username": session.get("username"),
+                    "webhook_info": webhook_info,
+                    "webhook_name": new_custom_name,
+                    "description": each_webhook.get("description"),
+                    "extra_notice": extra_notice,
+                    "custom_header": custom_header,
                 }
     webhook_info = [
         each_webhook
         for each_webhook in webhooks_json
-        if each_webhook['name'] == name
+        if each_webhook["name"] == name
     ]
     return {
-        'username': session.get('username'),
-        'webhook_name': name,
-        'webhook_info': webhook_info,
+        "username": session.get("username"),
+        "webhook_name": name,
+        "webhook_info": webhook_info,
     }
 
 
-@blueprint.route('/webhooks/custom/new', methods=['GET', 'POST'])
+@blueprint.route("/webhooks/custom/new", methods=["GET", "POST"])
 def new_webhook() -> Union[Response, Dict[str, Any], str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    if request.method == 'POST':
-        new_custom_name = request.form.get('custom_name')
-        description = request.form.get('description')
-        output = request.form.get('output')
+    if request.method == "POST":
+        new_custom_name = request.form.get("custom_name")
+        description = request.form.get("description")
+        output = request.form.get("output")
 
-        if request.form.get('custom_name') != '':
+        if request.form.get("custom_name") != "":
             check = 0
             logthis.info(
-                f'New webhook name: {request.form.get("custom_name")}'
+                f"New webhook name: {request.form.get('custom_name')}"
             )
 
-            with open(webhooks_file, 'r') as json_file:
+            with open(webhooks_file, "r") as json_file:
                 webhooks_json = json.load(json_file)
             if webhooks_json:
                 for each_webhook in webhooks_json:
-                    if each_webhook.get('name') == new_custom_name:
+                    if each_webhook.get("name") == new_custom_name:
                         check = 1
             owd = os.getcwd()
             if not os.path.isdir(scripts_dir):
                 os.mkdir(scripts_dir)
             os.chdir(scripts_dir)
-            target_file = request.files.get('new_file')
+            target_file = request.files.get("new_file")
 
-            if ' ' in target_file.filename:
-                target_file.filename = target_file.filename.replace(' ', '-')
+            if " " in target_file.filename:
+                target_file.filename = target_file.filename.replace(" ", "-")
 
-            new_filename = f'{new_custom_name}-{target_file.filename}'
+            new_filename = f"{new_custom_name}-{target_file.filename}"
             target_file.save(secure_filename(new_filename))
             new_filename = os.path.join(
-                scripts_dir, f'{new_custom_name}-{target_file.filename}'
+                scripts_dir, f"{new_custom_name}-{target_file.filename}"
             )
             os.chmod(new_filename, mode=0o0755)
             os.chdir(owd)
             if check != 0:
-                error_message = 'Name already exists!'
+                error_message = "Name already exists!"
                 logthis.info(
-                    f'Could not create new webhook. Message: {error_message}'
+                    f"Could not create new webhook. Message: {error_message}"
                 )
                 return {
-                    'error': error_message,
-                    'username': session.get('username'),
-                    'name': new_custom_name,
-                    'description': description,
+                    "error": error_message,
+                    "username": session.get("username"),
+                    "name": new_custom_name,
+                    "description": description,
                 }
-            new_webhook_user = request.form.get('basic_username', 'null')
+            new_webhook_user = request.form.get("basic_username", "null")
             if not new_webhook_user:
-                new_webhook_user = 'null'
-            new_webhook_pass = request.form.get('new-password', 'null')
+                new_webhook_user = "null"
+            new_webhook_pass = request.form.get("new-password", "null")
             if not new_webhook_pass:
-                new_webhook_pass = 'null'
-            if request.form.get('custom'):
-                api_key = request.form.get('api_key', 'null')
-                extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:'
-                custom_header = {'x-api-key': f'{api_key}'}
+                new_webhook_pass = "null"
+            if request.form.get("custom"):
+                api_key = request.form.get("api_key", "null")
+                extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:"
+                custom_header = {"x-api-key": f"{api_key}"}
             else:
                 extra_notice = None
                 custom_header = None
-                api_key = 'null'
+                api_key = "null"
             webhooks_json.append(
                 {
-                    'url': str(session['url']),
-                    'jawa_admin': str(session['username']),
-                    'name': new_custom_name,
-                    'webhook_username': new_webhook_user,
-                    'webhook_password': new_webhook_pass,
-                    'api_key': api_key,
-                    'script': new_filename,
-                    'description': description,
-                    'tag': 'custom',
-                    'output': output,
+                    "url": str(session["url"]),
+                    "jawa_admin": str(session["username"]),
+                    "name": new_custom_name,
+                    "webhook_username": new_webhook_user,
+                    "webhook_password": new_webhook_pass,
+                    "api_key": api_key,
+                    "script": new_filename,
+                    "description": description,
+                    "tag": "custom",
+                    "output": output,
                 }
             )
 
-            with open(webhooks_file, 'w') as outfile:
+            with open(webhooks_file, "w") as outfile:
                 json.dump(webhooks_json, outfile, indent=4)
-            success_msg = 'New webhook created:'
+            success_msg = "New webhook created:"
             return render_template(
-                'success.html',
-                webhooks='success',
+                "success.html",
+                webhooks="success",
                 success_msg=success_msg,
                 extra_notice=extra_notice,
                 custom_header=custom_header,
-                username=str(escape(session['username'])),
+                username=str(escape(session["username"])),
             )
     return render_template(
-        'webhooks/custom/new.html', username=session.get('username')
+        "webhooks/custom/new.html", username=session.get("username")
     )
diff --git a/views/home_view.py b/views/home_view.py
index 1ad5238..cf4356e 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -47,94 +47,94 @@
 from bin import logger
 from bin.tokens import get_token, invalidate_token
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 log_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log')
+    os.path.join(os.path.dirname(__file__), "..", "data", "jawa.log")
 )
 server_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
 )
 cron_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'cron.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "cron.json")
 )
 resources_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'resources')
+    os.path.join(os.path.dirname(__file__), "..", "resources")
 )
 files_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'resources', 'files')
+    os.path.join(os.path.dirname(__file__), "..", "resources", "files")
 )
 img_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'static', 'img')
+    os.path.join(os.path.dirname(__file__), "..", "static", "img")
 )
 verify_ssl = True  # Enables Jamf Pro SSL certificate verification
 
-blueprint = Blueprint('home_view', __name__, template_folder='templates')
+blueprint = Blueprint("home_view", __name__, template_folder="templates")
 
 
-@blueprint.route('/login', methods=['GET', 'POST'])
+@blueprint.route("/login", methods=["GET", "POST"])
 def login() -> Response:
-    if request.method == 'POST':
+    if request.method == "POST":
         if os.path.isfile(server_file):
             with open(server_file) as json_file:
                 server_json = json.load(json_file)
-            if request.form.get('active_url'):
-                session['url'] = str(request.form.get('active_url'))
-            elif server_json.get('jps_url', 0):
+            if request.form.get("active_url"):
+                session["url"] = str(request.form.get("active_url"))
+            elif server_json.get("jps_url", 0):
                 if (
-                    server_json['jps_url'] is not None
-                    and len(server_json['jps_url']) != 0
+                    server_json["jps_url"] is not None
+                    and len(server_json["jps_url"]) != 0
                 ):
-                    session['url'] = str(server_json['jps_url'])
-            elif request.form.get('url')[-1:] == '/':
-                session['url'] = str(request.form.get('url')).rstrip(
-                    request.form.get('url')[-1]
+                    session["url"] = str(server_json["jps_url"])
+            elif request.form.get("url")[-1:] == "/":
+                session["url"] = str(request.form.get("url")).rstrip(
+                    request.form.get("url")[-1]
                 )
             else:
-                session['url'] = request.form['url']
+                session["url"] = request.form["url"]
 
-        elif request.form.get('active_url')[-1:] == '/':
-            session['url'] = str(request.form.get('url')).rstrip(
-                request.form.get('url')[-1]
+        elif request.form.get("active_url")[-1:] == "/":
+            session["url"] = str(request.form.get("url")).rstrip(
+                request.form.get("url")[-1]
             )
         else:
-            session['url'] = request.form['url']
-        session['username'] = request.form['username']
-        session['password'] = request.form['password']
-        session['b64_auth'] = base64.b64encode(
-            str.encode(f'{session.get("username")}:{session.get("password")}')
+            session["url"] = request.form["url"]
+        session["username"] = request.form["username"]
+        session["password"] = request.form["password"]
+        session["b64_auth"] = base64.b64encode(
+            str.encode(f"{session.get('username')}:{session.get('password')}")
         )
         get_token()
         logthis.info(
-            f'[{session.get("url")}] Attempting login for: {session.get("username")}'
+            f"[{session.get('url')}] Attempting login for: {session.get('username')}"
         )
 
-        if request.form['password'] == '':
-            title = 'Authentication error'
+        if request.form["password"] == "":
+            title = "Authentication error"
             msg = "Passwords can't be blank"
             return redirect(
                 url_for(
-                    'home_view.logout', error_title=title, error_message=msg
+                    "home_view.logout", error_title=title, error_message=msg
                 )
             )
-        if not session.get('token'):
+        if not session.get("token"):
             return redirect(
                 url_for(
-                    'home_view.logout',
-                    error_title='Could not fetch token',
-                    error_message='try again',
+                    "home_view.logout",
+                    error_title="Could not fetch token",
+                    error_message="try again",
                 )
             )
         try:
             resp = requests.get(
-                session['url'] + '/JSSResource/activationcode',
+                session["url"] + "/JSSResource/activationcode",
                 headers={
-                    'Accept': 'application/json',
-                    'Authorization': f'Bearer {session.get("token")}',
-                    'User-Agent': 'JAWA%20v3.1.1',
+                    "Accept": "application/json",
+                    "Authorization": f"Bearer {session.get('token')}",
+                    "User-Agent": "JAWA%20v3.1.1",
                 },
                 verify=verify_ssl,
             )
@@ -142,132 +142,132 @@ def login() -> Response:
             resp.raise_for_status()
 
         except requests.exceptions.HTTPError as err:
-            logthis.info(f'Error occurred: {err}')
+            logthis.info(f"Error occurred: {err}")
             return redirect(
                 url_for(
-                    'home_view.logout',
-                    error_title='Login error',
-                    error_message='check account credentials and privileges',
+                    "home_view.logout",
+                    error_title="Login error",
+                    error_message="check account credentials and privileges",
                 )
             )
         except requests.exceptions.ConnectTimeout as err:
-            logthis.info(f'Error occurred: {err}')
+            logthis.info(f"Error occurred: {err}")
             return redirect(
                 url_for(
-                    'home_view.logout',
-                    error_title='Connection Timeout',
+                    "home_view.logout",
+                    error_title="Connection Timeout",
                     error_message=err,
                 )
             )
         except requests.exceptions.ConnectionError as err:
-            logthis.info(f'Error occurred: {err}')
+            logthis.info(f"Error occurred: {err}")
             return redirect(
                 url_for(
-                    'home_view.logout',
-                    error_title='HTTP Error',
+                    "home_view.logout",
+                    error_title="HTTP Error",
                     error_message=err,
                 )
             )
 
         logthis.info(
-            f'[{session.get("url")}] Logging In: '
-            + str(escape(session['username']))
+            f"[{session.get('url')}] Logging In: "
+            + str(escape(session["username"]))
         )
 
-        return redirect(url_for('home_view.dashboard'))
+        return redirect(url_for("home_view.dashboard"))
 
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
 
-    return redirect(url_for('home_view.dashboard'))
+    return redirect(url_for("home_view.dashboard"))
 
 
-@blueprint.route('/logout')
+@blueprint.route("/logout")
 def logout() -> Union[Response, str]:
-    error_title = request.args.get('error_title')
+    error_title = request.args.get("error_title")
     if error_title:
         error_title = escape(error_title)
-    error_message = request.args.get('error_message')
+    error_message = request.args.get("error_message")
     if error_message:
         error_message = escape(error_message)
-    if session.get('username'):
+    if session.get("username"):
         invalidate_token()
-        logthis.info('Logging Out: ' + str(escape(session['username'])))
-        session.pop('username', None)
+        logthis.info("Logging Out: " + str(escape(session["username"])))
+        session.pop("username", None)
     return load_home(error_title, error_message)
 
 
 def load_home(
-    error_title: str = '', error_message: str = ''
+    error_title: str = "", error_message: str = ""
 ) -> Union[Response, str]:
-    if 'username' in session:
-        return redirect(url_for('home_view.dashboard'))
+    if "username" in session:
+        return redirect(url_for("home_view.dashboard"))
     if not os.path.isfile(server_file):
-        with open(server_file, 'w') as fout:
+        with open(server_file, "w") as fout:
             json.dump({}, fout)
 
-    with open(server_file, 'r') as fin:
+    with open(server_file, "r") as fin:
         server_json = json.load(fin)
     if not server_json:
-        return render_template('home.html')
-    brand = server_json.get('brand')
+        return render_template("home.html")
+    brand = server_json.get("brand")
 
     if (
-        'jps_url' not in server_json
-        or server_json['jps_url'] is None
-        or len(server_json['jps_url']) == 0
+        "jps_url" not in server_json
+        or server_json["jps_url"] is None
+        or len(server_json["jps_url"]) == 0
     ):
-        return render_template('home.html', app_name=brand)
-    if 'alternate_jps' not in server_json:
+        return render_template("home.html", app_name=brand)
+    if "alternate_jps" not in server_json:
         return render_template(
-            'home.html',
+            "home.html",
             app_name=brand,
             error_title=error_title,
             error_message=error_message,
         )
 
-    if server_json['alternate_jps'] != '':
+    if server_json["alternate_jps"] != "":
         return render_template(
-            'home.html',
-            jps_url=server_json['jps_url'],
-            jps_url2=server_json['alternate_jps'],
-            welcome='true',
-            jsslock='true',
+            "home.html",
+            jps_url=server_json["jps_url"],
+            jps_url2=server_json["alternate_jps"],
+            welcome="true",
+            jsslock="true",
             app_name=brand,
             error_title=error_title,
             error_message=error_message,
         )
 
-    session['url'] = server_json['jps_url']
+    session["url"] = server_json["jps_url"]
     return render_template(
-        'home.html',
-        jps_url=str(escape(session['url'])),
-        welcome='true',
-        jsslock='true',
+        "home.html",
+        jps_url=str(escape(session["url"])),
+        welcome="true",
+        jsslock="true",
         app_name=brand,
         error_title=error_title,
         error_message=error_message,
     )
 
 
-@blueprint.route('/dashboard')
+@blueprint.route("/dashboard")
 def dashboard() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.info(
-        f'[{session.get("url")}] {session.get("username")} rendering /dashboard.'
+        f"[{session.get('url')}] {session.get('username')} rendering /dashboard."
     )
     with open(webhooks_file) as webhook_json:
         webhooks_installed = json.load(webhook_json)
@@ -275,63 +275,63 @@ def dashboard() -> Union[Response, str]:
     okta_webhooks = []
     custom_webhooks = []
     for each_webhook in webhooks_installed:
-        data = defaultdict(lambda: 'MISSING', each_webhook)
-        tag = data['tag']
-        if tag == 'jamfpro':
+        data = defaultdict(lambda: "MISSING", each_webhook)
+        tag = data["tag"]
+        if tag == "jamfpro":
             jamf_pro_webhooks.append(each_webhook)
-        elif tag == 'okta':
+        elif tag == "okta":
             okta_webhooks.append(each_webhook)
-        elif tag == 'custom':
+        elif tag == "custom":
             custom_webhooks.append(each_webhook)
 
     data = []
 
     if not os.path.isfile(cron_file):
-        with open(cron_file, 'w') as outfile:
+        with open(cron_file, "w") as outfile:
             json.dump(data, outfile)
 
-    with open(cron_file, 'r') as cron_json:
+    with open(cron_file, "r") as cron_json:
         try:
             cron_list = json.load(cron_json)
         except json.decoder.JSONDecodeError:
-            with open(cron_file, 'w') as cron_json:
+            with open(cron_file, "w") as cron_json:
                 cron_list = []
                 json.dump(cron_list, cron_json, indent=4)
 
     cron_json = []
     for cron in cron_list:
-        script = cron['script'].rsplit('/', 1)
+        script = cron["script"].rsplit("/", 1)
         cron_json.append(
             {
-                'name': cron['name'],
-                'frequency': cron['frequency'],
-                'script': script[1],
-                'description': cron['description'],
+                "name": cron["name"],
+                "frequency": cron["frequency"],
+                "script": script[1],
+                "description": cron["description"],
             }
         )
 
-    webhook_url = session['url']
+    webhook_url = session["url"]
 
     if not cron_json:
-        cron_json = ''
-    logthis.info(f'Total webhooks managed by JAWA: {len(webhooks_installed)}')
+        cron_json = ""
+    logthis.info(f"Total webhooks managed by JAWA: {len(webhooks_installed)}")
     if webhook_json == cron_json:
-        return redirect(url_for('first_automation'))
+        return redirect(url_for("first_automation"))
     return render_template(
-        'dashboard.html',
+        "dashboard.html",
         webhook_url=webhook_url,
         jamfpro_list=jamf_pro_webhooks,
-        url=session.get('url'),
+        url=session.get("url"),
         cron_list=cron_json,
         okta_list=okta_webhooks,
         custom_list=custom_webhooks,
         total_webhooks=len(webhooks_installed),
         total_cron=len(cron_json),
-        login='true',
-        username=str(escape(session['username'])),
+        login="true",
+        username=str(escape(session["username"])),
     )
 
 
-@blueprint.route('/home.html')
+@blueprint.route("/home.html")
 def index() -> Union[Response, str]:
     return load_home()
diff --git a/views/jamf_webhook.py b/views/jamf_webhook.py
index dcd7e6c..efe9902 100644
--- a/views/jamf_webhook.py
+++ b/views/jamf_webhook.py
@@ -49,107 +49,107 @@
 from bin.view_modifiers import response
 from bin import logger
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
 )
 scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+    os.path.join(os.path.dirname(__file__), "..", "scripts")
 )
 verify_ssl = True
-blueprint = Blueprint('jamf_pro_webhooks', __name__)
+blueprint = Blueprint("jamf_pro_webhooks", __name__)
 
 
-@blueprint.route('/webhooks/jamf', methods=['GET'])
-@response(template_file='webhooks/jamf/home.html')
+@blueprint.route("/webhooks/jamf", methods=["GET"])
+@response(template_file="webhooks/jamf/home.html")
 def jamf_webhook() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    with open(webhooks_file, 'r') as fin:
+    with open(webhooks_file, "r") as fin:
         webhooks_json = json.load(fin)
     jamf_pro_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: 'MISSING', each_webhook)
-        tag = data['tag']
-        if tag == 'jamfpro':
+        data = defaultdict(lambda: "MISSING", each_webhook)
+        tag = data["tag"]
+        if tag == "jamfpro":
             jamf_pro_list.append(each_webhook)
 
     return {
-        'username': session.get('username'),
-        'jamf_list': jamf_pro_list,
-        'url': session.get('url'),
+        "username": session.get("username"),
+        "jamf_list": jamf_pro_list,
+        "url": session.get("url"),
     }
 
 
-@blueprint.route('/webhooks/jamf/new', methods=['GET', 'POST'])
+@blueprint.route("/webhooks/jamf/new", methods=["GET", "POST"])
 def jamf_pro_new() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     if not os.path.isfile(server_json_file):
         return render_template(
-            'setup/setup.html',
-            setup='setup',
-            jps_url=str(escape(session['url'])),
-            username=str(escape(session['username'])),
+            "setup/setup.html",
+            setup="setup",
+            jps_url=str(escape(session["url"])),
+            username=str(escape(session["username"])),
         )
-    with open(server_json_file, 'r') as fin:
+    with open(server_json_file, "r") as fin:
         server_json = json.load(fin)
     if server_json == []:
         return render_template(
-            'setup/setup.html',
-            setup='setup',
-            jps_url=str(escape(session['url'])),
-            username=str(escape(session['username'])),
+            "setup/setup.html",
+            setup="setup",
+            jps_url=str(escape(session["url"])),
+            username=str(escape(session["username"])),
         )
-    if not server_json.get('jawa_address'):
-        return redirect(url_for('setup'))
+    if not server_json.get("jawa_address"):
+        return redirect(url_for("setup"))
     if not os.path.isfile(webhooks_file):
         data = []
-        with open(webhooks_file, 'w') as outfile:
+        with open(webhooks_file, "w") as outfile:
             json.dump(data, outfile, indent=4)
 
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    if request.method != 'POST':
+    if request.method != "POST":
         return render_template(
-            'webhooks/jamf/new.html',
-            webhooks='webhooks',
-            url=session['url'],
-            username=str(escape(session['username'])),
+            "webhooks/jamf/new.html",
+            webhooks="webhooks",
+            url=session["url"],
+            username=str(escape(session["username"])),
         )
-    if not validate_token(session['expires']):
+    if not validate_token(session["expires"]):
         get_token()
-    if request.form.get('webhook_name') != '':
+    if request.form.get("webhook_name") != "":
         check = 0
-        if ' ' in request.form.get('webhook_name'):
-            error_message = 'Single-string name only.'
+        if " " in request.form.get("webhook_name"):
+            error_message = "Single-string name only."
             return render_template(
-                'error.html',
+                "error.html",
                 error_message=error_message,
-                error='error',
-                username=str(escape(session['username'])),
+                error="error",
+                username=str(escape(session["username"])),
             )
 
         with open(webhooks_file) as json_file:
@@ -159,7 +159,7 @@ def jamf_pro_new() -> Union[Response, str]:
             id_list = []
             while True:
                 try:
-                    id_list.append(data[x]['name'])
+                    id_list.append(data[x]["name"])
                     x += 1
                     str_error = None
                 except Exception as str_error:
@@ -167,65 +167,65 @@ def jamf_pro_new() -> Union[Response, str]:
                         continue
                     break
             for id_name in id_list:
-                check = 1 if id_name == request.form.get('webhook_name') else 0
+                check = 1 if id_name == request.form.get("webhook_name") else 0
         if check != 0:
-            error_message = 'Name already exists!'
+            error_message = "Name already exists!"
             return render_template(
-                'error.html',
+                "error.html",
                 error_message=error_message,
-                error='error',
-                username=str(escape(session['username'])),
+                error="error",
+                username=str(escape(session["username"])),
             )
 
         with open(server_json_file) as json_file:
             data = json.load(json_file)
-            server_address = data.get('jawa_address')
+            server_address = data.get("jawa_address")
             if not server_address:
-                return redirect(url_for('setup'))
+                return redirect(url_for("setup"))
         if not os.path.isdir(scripts_dir):
             os.mkdir(scripts_dir)
         owd = os.getcwd()
         os.chdir(scripts_dir)
 
-        new_file = request.files.get('new_file')
-        if ' ' in new_file.filename:
-            new_file.filename = new_file.filename.replace(' ', '-')
+        new_file = request.files.get("new_file")
+        if " " in new_file.filename:
+            new_file.filename = new_file.filename.replace(" ", "-")
 
         new_file.save(secure_filename(new_file.filename))
 
         old_script_file = os.path.abspath(
-            os.path.join(scripts_dir, f'{new_file.filename}')
+            os.path.join(scripts_dir, f"{new_file.filename}")
         )
         new_script_file = os.path.join(
             scripts_dir,
-            f'{request.form.get("webhook_name")}-{new_file.filename}',
+            f"{request.form.get('webhook_name')}-{new_file.filename}",
         )
         os.rename(old_script_file, new_script_file)
 
         os.chmod(new_script_file, mode=0o0755)
         os.chdir(owd)
-        if request.form.get('event') in [
-            'SmartGroupMobileDeviceMembershipChange',
-            'SmartGroupComputerMembershipChange',
-            'SmartGroupUserMembershipChange',
+        if request.form.get("event") in [
+            "SmartGroupMobileDeviceMembershipChange",
+            "SmartGroupComputerMembershipChange",
+            "SmartGroupUserMembershipChange",
         ]:
-            smart_group_notice = 'NOTICE!  This webhook is not yet enabled.'
+            smart_group_notice = "NOTICE!  This webhook is not yet enabled."
             smart_group_instructions = (
-                'Specify desired Smart Group and enable: '
+                "Specify desired Smart Group and enable: "
             )
-            webhook_enablement = 'false'
+            webhook_enablement = "false"
 
         else:
-            smart_group_notice = ''
-            smart_group_instructions = ''
-            webhook_enablement = 'true'
+            smart_group_notice = ""
+            smart_group_instructions = ""
+            webhook_enablement = "true"
 
         if (
-            request.form.get('event')
-            == 'SmartGroupMobileDeviceMembershipChange'
+            request.form.get("event")
+            == "SmartGroupMobileDeviceMembershipChange"
         ):
             extra_xml = (
-                '<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
+                "<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
                             <display_fields>\
                                 <display_field>\
                                     <name>Asset Tag</name>\
@@ -245,117 +245,117 @@ def jamf_pro_new() -> Union[Response, str]:
                                 <display_field>\
                                     <name>Last Enrollment</name>\
                                 </display_field>\
-                            </display_fields>'
+                            </display_fields>"
             )
         else:
-            extra_xml = ''
+            extra_xml = ""
 
         # Check for auth values
-        auth_xml = '<authentication_type>NONE</authentication_type>'
-        if request.form.get('choice') == 'basic':
+        auth_xml = "<authentication_type>NONE</authentication_type>"
+        if request.form.get("choice") == "basic":
             if (
-                request.form.get('basic_username') != ''
-                or request.form.get('basic_password') != ''
+                request.form.get("basic_username") != ""
+                or request.form.get("basic_password") != ""
             ):
-                auth_xml = '<authentication_type>BASIC</authentication_type>'
-                if request.form.get('basic_username') == '':
-                    auth_xml += '<username>null</username>'
+                auth_xml = "<authentication_type>BASIC</authentication_type>"
+                if request.form.get("basic_username") == "":
+                    auth_xml += "<username>null</username>"
                 else:
-                    auth_xml += f'<username>{request.form.get("basic_username")}</username>'
-                if request.form.get('basic_password') == '':
-                    auth_xml += '<password>null</password>'
+                    auth_xml += f"<username>{request.form.get('basic_username')}</username>"
+                if request.form.get("basic_password") == "":
+                    auth_xml += "<password>null</password>"
                 else:
-                    auth_xml += f'<password>{request.form.get("basic_password")}</password>'
+                    auth_xml += f"<password>{request.form.get('basic_password')}</password>"
 
         data = (
-            f'<webhook>'
-            f'<name>{request.form.get("webhook_name")}</name>'
-            f'<enabled>{webhook_enablement}</enabled>'
-            f'<url>{server_address}/hooks/{request.form.get("webhook_name")}</url>'
-            f'<content_type>application/json</content_type>'
-            f'<event>{request.form.get("event")}</event>'
-            f'{auth_xml}'
-            f'{extra_xml}'
-            f'</webhook>'
+            f"<webhook>"
+            f"<name>{request.form.get('webhook_name')}</name>"
+            f"<enabled>{webhook_enablement}</enabled>"
+            f"<url>{server_address}/hooks/{request.form.get('webhook_name')}</url>"
+            f"<content_type>application/json</content_type>"
+            f"<event>{request.form.get('event')}</event>"
+            f"{auth_xml}"
+            f"{extra_xml}"
+            f"</webhook>"
         )
 
-        full_url = session['url'] + '/JSSResource/webhooks/id/0'
+        full_url = session["url"] + "/JSSResource/webhooks/id/0"
         logthis.info(
-            f'{session.get("username")} creating a new JPS webhook {request.form.get("webhook_name")}.'
+            f"{session.get('username')} creating a new JPS webhook {request.form.get('webhook_name')}."
         )
         webhook_response = requests.post(
             full_url,
             headers={
-                'Content-Type': 'application/xml',
-                'Authorization': f'Bearer {session["token"]}',
-                'User-Agent': 'JAWA%20v3.1.1',
+                "Content-Type": "application/xml",
+                "Authorization": f"Bearer {session['token']}",
+                "User-Agent": "JAWA%20v3.1.1",
             },
             data=data,
             verify=verify_ssl,
         )
         logthis.info(
-            f'[{webhook_response.status_code}]  {webhook_response.text}'
+            f"[{webhook_response.status_code}]  {webhook_response.text}"
         )
         if webhook_response.status_code == 409:
             error_message = f'The webhooks name "{request.form.get("webhook_name")}" already exists in your Jamf Pro Server.'
             return render_template(
-                'error.html',
+                "error.html",
                 error_message=error_message,
-                error='error',
-                username=str(escape(session['username'])),
+                error="error",
+                username=str(escape(session["username"])),
             )
 
-        result = re.search('<id>(.*)</id>', webhook_response.text)
+        result = re.search("<id>(.*)</id>", webhook_response.text)
         jamf_id = result.group(1)
-        new_link = '{}/webhooks.html?id={}&o=r'.format(
-            session['url'], result.group(1)
+        new_link = "{}/webhooks.html?id={}&o=r".format(
+            session["url"], result.group(1)
         )
         logthis.info(
-            f'{session.get("username")} created a new webhook. '
-            f'Name: {request.form.get("webhook_name")} '
-            f'Jamf link: {new_link}'
+            f"{session.get('username')} created a new webhook. "
+            f"Name: {request.form.get('webhook_name')} "
+            f"Jamf link: {new_link}"
         )
-        custom_header = ''
+        custom_header = ""
         data = json.load(open(webhooks_file))
-        if request.form.get('choice') == 'basic':
-            webhook_username = request.form.get('basic_username', 'null')
-            webhook_password = request.form.get('basic_password', 'null')
+        if request.form.get("choice") == "basic":
+            webhook_username = request.form.get("basic_username", "null")
+            webhook_password = request.form.get("basic_password", "null")
         else:
-            webhook_username = 'null'
-            webhook_password = 'null'
-        if request.form.get('choice') == 'custom':
-            webhook_apikey = request.form.get('api_key', 'null')
-            extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:'
-            custom_header = {'x-api-key': f'{webhook_apikey}'}
+            webhook_username = "null"
+            webhook_password = "null"
+        if request.form.get("choice") == "custom":
+            webhook_apikey = request.form.get("api_key", "null")
+            extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:"
+            custom_header = {"x-api-key": f"{webhook_apikey}"}
         else:
-            webhook_apikey = 'null'
+            webhook_apikey = "null"
             extra_notice = None
 
         data.append(
             {
-                'url': str(session['url']),
-                'jawa_admin': str(session['username']),
-                'name': request.form.get('webhook_name'),
-                'webhook_username': webhook_username,
-                'webhook_password': webhook_password,
-                'api_key': webhook_apikey,
-                'event': request.form.get('event'),
-                'script': new_script_file,
-                'description': request.form.get('description'),
-                'tag': 'jamfpro',
-                'jamf_id': jamf_id,
+                "url": str(session["url"]),
+                "jawa_admin": str(session["username"]),
+                "name": request.form.get("webhook_name"),
+                "webhook_username": webhook_username,
+                "webhook_password": webhook_password,
+                "api_key": webhook_apikey,
+                "event": request.form.get("event"),
+                "script": new_script_file,
+                "description": request.form.get("description"),
+                "tag": "jamfpro",
+                "jamf_id": jamf_id,
             }
         )
 
-        with open(webhooks_file, 'w') as outfile:
+        with open(webhooks_file, "w") as outfile:
             json.dump(data, outfile, indent=4)
 
-        new_here = request.form.get('webhook_name')
-        success_msg = 'New webhook created:'
+        new_here = request.form.get("webhook_name")
+        success_msg = "New webhook created:"
 
     return render_template(
-        'success.html',
-        webhooks='success',
+        "success.html",
+        webhooks="success",
         smart_group_instructions=smart_group_instructions,
         smart_group_notice=smart_group_notice,
         new_link=new_link,
@@ -363,33 +363,33 @@ def jamf_pro_new() -> Union[Response, str]:
         success_msg=success_msg,
         extra_notice=extra_notice,
         custom_header=custom_header,
-        username=str(escape(session['username'])),
+        username=str(escape(session["username"])),
     )
 
 
 # Edit Existing Webhook
-@blueprint.route('/webhooks/jamf/edit', methods=['GET', 'POST'])
-@response(template_file='webhooks/jamf/edit.html')
+@blueprint.route("/webhooks/jamf/edit", methods=["GET", "POST"])
+@response(template_file="webhooks/jamf/edit.html")
 def jamf_pro_edit() -> Union[Response, str, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    name = request.args.get('name')
+    name = request.args.get("name")
     if name:
         name = escape(name)
     with open(webhooks_file) as fin:
         webhooks_json = json.load(fin)
     check_for_name = [
-        True for each_webhook in webhooks_json if each_webhook['name'] == name
+        True for each_webhook in webhooks_json if each_webhook["name"] == name
     ]
     if not check_for_name:
         logthis.info(f"Webhook '{name}' not in json")
-        return redirect(url_for('jamf_pro_webhooks.jamf_webhook'))
+        return redirect(url_for("jamf_pro_webhooks.jamf_webhook"))
 
     extra_notice = None
     custom_header = None
@@ -399,103 +399,103 @@ def jamf_pro_edit() -> Union[Response, str, Dict[str, Any]]:
     webhook_info = [
         each_webhook
         for each_webhook in webhooks_json
-        if each_webhook['name'] == name
+        if each_webhook["name"] == name
     ]
-    if request.method == 'POST':
-        button_choice = request.form.get('button_choice')
-        if button_choice == 'Delete':
+    if request.method == "POST":
+        button_choice = request.form.get("button_choice")
+        if button_choice == "Delete":
             return redirect(
-                url_for('webhooks.delete_webhook', target_webhook=name)
+                url_for("webhooks.delete_webhook", target_webhook=name)
             )
 
-        if not validate_token(session['expires']):
+        if not validate_token(session["expires"]):
             get_token()
         for each_webhook in webhooks_json:
-            if each_webhook['name'] == name:
-                new_webhook_name = request.form.get('webhook_name')
+            if each_webhook["name"] == name:
+                new_webhook_name = request.form.get("webhook_name")
                 if not new_webhook_name:
                     new_webhook_name = name
-                description = request.form.get('description')
-                new_event = request.form.get('event')
-                custom_header = ''
-                if request.form.get('choice') == 'basic':
-                    webhook_user = request.form.get('basic_username', 'null')
-                    webhook_pass = request.form.get('basic_password', 'null')
+                description = request.form.get("description")
+                new_event = request.form.get("event")
+                custom_header = ""
+                if request.form.get("choice") == "basic":
+                    webhook_user = request.form.get("basic_username", "null")
+                    webhook_pass = request.form.get("basic_password", "null")
                 else:
-                    webhook_user = 'null'
-                    webhook_pass = 'null'
-                if request.form.get('choice') == 'custom':
-                    webhook_apikey = request.form.get('api_key', 'null')
-                    extra_notice = 'Copy and paste the following into the Header Authentication section of Jamf Pro webhooks '
-                    custom_header = {'x-api-key': f'{webhook_apikey}'}
+                    webhook_user = "null"
+                    webhook_pass = "null"
+                if request.form.get("choice") == "custom":
+                    webhook_apikey = request.form.get("api_key", "null")
+                    extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks "
+                    custom_header = {"x-api-key": f"{webhook_apikey}"}
                 else:
-                    webhook_apikey = 'null'
+                    webhook_apikey = "null"
                     extra_notice = None
 
-                if request.files.get('new_file'):
-                    new_script = request.files.get('new_file')
+                if request.files.get("new_file"):
+                    new_script = request.files.get("new_file")
                     owd = os.getcwd()
                     os.chdir(scripts_dir)
 
-                    if ' ' in new_script.filename:
+                    if " " in new_script.filename:
                         new_script.filename = new_script.filename.replace(
-                            ' ', '-'
+                            " ", "-"
                         )
 
-                    new_filename = f'{new_webhook_name}-{new_script.filename}'
+                    new_filename = f"{new_webhook_name}-{new_script.filename}"
                     new_script.save(secure_filename(new_filename))
                     new_filename = os.path.join(
                         scripts_dir,
-                        f'{new_webhook_name}-{new_script.filename}',
+                        f"{new_webhook_name}-{new_script.filename}",
                     )
                     os.chmod(new_filename, mode=0o0755)
                     os.chdir(owd)
-                    each_webhook['script'] = new_filename
+                    each_webhook["script"] = new_filename
                 else:
-                    new_filename = each_webhook['script']
+                    new_filename = each_webhook["script"]
                 if new_webhook_name:
-                    each_webhook['name'] = new_webhook_name
+                    each_webhook["name"] = new_webhook_name
                 if description:
-                    each_webhook['description'] = description
+                    each_webhook["description"] = description
                 if new_event:
-                    each_webhook['event'] = new_event
-                if webhook_user and webhook_user != '':
-                    each_webhook['webhook_username'] = webhook_user
+                    each_webhook["event"] = new_event
+                if webhook_user and webhook_user != "":
+                    each_webhook["webhook_username"] = webhook_user
                 else:
-                    each_webhook['webhook_username'] = 'null'
-                if webhook_pass and webhook_pass != '':
-                    each_webhook['webhook_password'] = webhook_pass
+                    each_webhook["webhook_username"] = "null"
+                if webhook_pass and webhook_pass != "":
+                    each_webhook["webhook_password"] = webhook_pass
                 else:
-                    each_webhook['webhook_password'] = 'null'
-                if webhook_apikey and webhook_apikey != '':
-                    each_webhook['api_key'] = webhook_apikey
+                    each_webhook["webhook_password"] = "null"
+                if webhook_apikey and webhook_apikey != "":
+                    each_webhook["api_key"] = webhook_apikey
                 else:
-                    each_webhook['webhook_password'] = 'null'
-                each_webhook['jawa_admin'] = session.get('username')
-                if each_webhook.get('event') in [
-                    'SmartGroupMobileDeviceMembershipChange',
-                    'SmartGroupComputerMembershipChange',
-                    'SmartGroupUserMembershipChange',
+                    each_webhook["webhook_password"] = "null"
+                each_webhook["jawa_admin"] = session.get("username")
+                if each_webhook.get("event") in [
+                    "SmartGroupMobileDeviceMembershipChange",
+                    "SmartGroupComputerMembershipChange",
+                    "SmartGroupUserMembershipChange",
                 ]:
                     smart_group_notice = (
-                        'NOTICE!  This webhook is currently disabled.'
+                        "NOTICE!  This webhook is currently disabled."
                     )
                     smart_group_instructions = (
-                        'Please verify the linked Smart Group and re-enable: '
+                        "Please verify the linked Smart Group and re-enable: "
                     )
-                    webhook_enablement = 'false'
+                    webhook_enablement = "false"
 
                 else:
-                    smart_group_notice = ''
-                    smart_group_instructions = ''
-                    webhook_enablement = 'true'
+                    smart_group_notice = ""
+                    smart_group_instructions = ""
+                    webhook_enablement = "true"
 
                 if (
-                    each_webhook.get('event')
-                    == 'SmartGroupMobileDeviceMembershipChange'
+                    each_webhook.get("event")
+                    == "SmartGroupMobileDeviceMembershipChange"
                 ):
                     extra_xml = (
-                        '<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
+                        "<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
                                     <display_fields>\
                                         <display_field>\
                                             <name>Asset Tag</name>\
@@ -515,135 +515,135 @@ def jamf_pro_edit() -> Union[Response, str, Dict[str, Any]]:
                                         <display_field>\
                                             <name>Last Enrollment</name>\
                                         </display_field>\
-                                    </display_fields>'
+                                    </display_fields>"
                     )
                 else:
-                    extra_xml = ''
+                    extra_xml = ""
                     # Check for auth values
-                auth_xml = '<authentication_type>NONE</authentication_type>'
-                if request.form.get('choice') == 'basic':
+                auth_xml = "<authentication_type>NONE</authentication_type>"
+                if request.form.get("choice") == "basic":
                     if (
-                        request.form.get('basic_username') != ''
-                        or request.form.get('basic_password') != ''
+                        request.form.get("basic_username") != ""
+                        or request.form.get("basic_password") != ""
                     ):
                         auth_xml = (
-                            '<authentication_type>BASIC</authentication_type>'
+                            "<authentication_type>BASIC</authentication_type>"
                         )
                         if (
-                            request.form.get('basic_username') == 'null'
-                            and request.form.get('basic_password') == 'null'
+                            request.form.get("basic_username") == "null"
+                            and request.form.get("basic_password") == "null"
                         ):
-                            auth_xml = '<authentication_type>NONE</authentication_type>'
+                            auth_xml = "<authentication_type>NONE</authentication_type>"
 
-                        if request.form.get('basic_username') == '':
-                            auth_xml += '<username>null</username>'
+                        if request.form.get("basic_username") == "":
+                            auth_xml += "<username>null</username>"
                         else:
-                            auth_xml += f'<username>{request.form.get("basic_username")}</username>'
-                        if request.form.get('basic_password') == '':
-                            auth_xml += '<password>null</password>'
+                            auth_xml += f"<username>{request.form.get('basic_username')}</username>"
+                        if request.form.get("basic_password") == "":
+                            auth_xml += "<password>null</password>"
                         else:
-                            auth_xml += f'<password>{request.form.get("basic_password")}</password>'
+                            auth_xml += f"<password>{request.form.get('basic_password')}</password>"
                 with open(server_json_file) as fin:
                     server_json = json.load(fin)
-                server_address = server_json['jawa_address']
+                server_address = server_json["jawa_address"]
                 data = (
-                    f'<webhook>'
-                    f'<name>{each_webhook.get("name")}</name>'
-                    f'<enabled>{webhook_enablement}</enabled>'
-                    f'<url>{server_address}/hooks/{each_webhook.get("name")}</url>'
-                    f'<content_type>application/json</content_type>'
-                    f'<event>{each_webhook.get("event")}</event>'
-                    f'{auth_xml}'
-                    f'{extra_xml}'
-                    f'</webhook>'
+                    f"<webhook>"
+                    f"<name>{each_webhook.get('name')}</name>"
+                    f"<enabled>{webhook_enablement}</enabled>"
+                    f"<url>{server_address}/hooks/{each_webhook.get('name')}</url>"
+                    f"<content_type>application/json</content_type>"
+                    f"<event>{each_webhook.get('event')}</event>"
+                    f"{auth_xml}"
+                    f"{extra_xml}"
+                    f"</webhook>"
                 )
 
-                full_url = f'{session["url"]}/JSSResource/webhooks/id/{each_webhook.get("jamf_id")}'
+                full_url = f"{session['url']}/JSSResource/webhooks/id/{each_webhook.get('jamf_id')}"
 
                 logthis.debug(
-                    f'{session.get("username")} editing the JPS webhook {name}.'
+                    f"{session.get('username')} editing the JPS webhook {name}."
                 )
                 try:
                     webhook_response = requests.put(
                         full_url,
                         headers={
-                            'Content-Type': 'application/xml',
-                            'Authorization': f'Bearer {session["token"]}',
-                            'User-Agent': 'JAWA%20v3.1.1',
+                            "Content-Type": "application/xml",
+                            "Authorization": f"Bearer {session['token']}",
+                            "User-Agent": "JAWA%20v3.1.1",
                         },
                         data=data,
                         verify=verify_ssl,
                     )
                 except Exception as err:
                     error_message = (
-                        f'The request could not be sent to your Jamf Pro server,'
-                        f'check your network connection. Details: {err}'
+                        f"The request could not be sent to your Jamf Pro server,"
+                        f"check your network connection. Details: {err}"
                     )
                     return render_template(
-                        'error.html',
+                        "error.html",
                         error_message=error_message,
-                        error='error',
-                        username=str(escape(session['username'])),
+                        error="error",
+                        username=str(escape(session["username"])),
                     )
                 logthis.debug(
-                    f'[{webhook_response.status_code}]  {webhook_response.text}'
+                    f"[{webhook_response.status_code}]  {webhook_response.text}"
                 )
                 if webhook_response.status_code == 409:
                     error_message = f'The webhooks name "{name}" already exists in your Jamf Pro Server.'
                     logthis.info(
-                        f'[{session.get("url")}] {session.get("username").title()} - error editing webhook. {error_message}'
+                        f"[{session.get('url')}] {session.get('username').title()} - error editing webhook. {error_message}"
                     )
                     return redirect(
                         url_for(
-                            'error',
-                            error='Duplicate',
+                            "error",
+                            error="Duplicate",
                             error_message=error_message,
-                            username=session.get('username'),
+                            username=session.get("username"),
                         )
                     )
                 elif webhook_response.status_code == 401:
                     error_message = (
                         f"{session.get('username').title()} doesn't have privileges to update webhooks."
-                        f'Check your account privileges in Jamf Pro Settings'
+                        f"Check your account privileges in Jamf Pro Settings"
                     )
-                    logthis.info(f'[{session.get("url")}] {error_message}')
+                    logthis.info(f"[{session.get('url')}] {error_message}")
                     return redirect(
                         url_for(
-                            'error',
-                            error='Insufficient privileges',
+                            "error",
+                            error="Insufficient privileges",
                             error_message=error_message,
-                            username=session.get('username'),
+                            username=session.get("username"),
                         )
                     )
-                with open(webhooks_file, 'w') as fout:
+                with open(webhooks_file, "w") as fout:
                     json.dump(webhooks_json, fout, indent=4)
-                result = re.search('<id>(.*)</id>', webhook_response.text)
+                result = re.search("<id>(.*)</id>", webhook_response.text)
                 jamf_id = result.group(1)
-                new_link = f'{format(session.get("url"))}/webhooks.html?id={jamf_id}&o=r'
-                success_msg = 'Webhook edited:'
+                new_link = f"{format(session.get('url'))}/webhooks.html?id={jamf_id}&o=r"
+                success_msg = "Webhook edited:"
                 logthis.info(
-                    f'{session.get("username")} edited a Jamf webhook. '
-                    f'Name: {name} '
-                    f'Jamf link: {new_link}'
+                    f"{session.get('username')} edited a Jamf webhook. "
+                    f"Name: {name} "
+                    f"Jamf link: {new_link}"
                 )
                 return {
-                    'webhooks': 'success',
-                    'smart_group_instructions': smart_group_instructions,
-                    'smart_group_notice': smart_group_notice,
-                    'new_link': new_link,
-                    'new_here': new_webhook_name,
-                    'success_msg': success_msg,
-                    'extra_notice': extra_notice,
-                    'custom_header': custom_header,
-                    'username': session.get('username'),
-                    'webhook_info': webhook_info,
-                    'webhook_name': name,
-                    'description': each_webhook.get('description'),
+                    "webhooks": "success",
+                    "smart_group_instructions": smart_group_instructions,
+                    "smart_group_notice": smart_group_notice,
+                    "new_link": new_link,
+                    "new_here": new_webhook_name,
+                    "success_msg": success_msg,
+                    "extra_notice": extra_notice,
+                    "custom_header": custom_header,
+                    "username": session.get("username"),
+                    "webhook_info": webhook_info,
+                    "webhook_name": name,
+                    "description": each_webhook.get("description"),
                 }
 
     return {
-        'username': session.get('username'),
-        'webhook_name': name,
-        'url': session.get('url'),
-        'webhook_info': webhook_info,
+        "username": session.get("username"),
+        "webhook_name": name,
+        "url": session.get("url"),
+        "webhook_info": webhook_info,
     }
diff --git a/views/log_view.py b/views/log_view.py
index 413f484..7cb3a2e 100644
--- a/views/log_view.py
+++ b/views/log_view.py
@@ -48,75 +48,75 @@
 from bin import logger
 from bin.view_modifiers import response
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 log_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log')
+    os.path.join(os.path.dirname(__file__), "..", "data", "jawa.log")
 )
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 
-blueprint = Blueprint('log_view', __name__, template_folder='templates')
+blueprint = Blueprint("log_view", __name__, template_folder="templates")
 
 
-@blueprint.route('/log/home.html', methods=['GET'])
+@blueprint.route("/log/home.html", methods=["GET"])
 def log_home() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    with open(log_file, 'r') as fin:
-        lines = [re.sub('\n', '', line) for line in fin.readlines()]
+    with open(log_file, "r") as fin:
+        lines = [re.sub("\n", "", line) for line in fin.readlines()]
         lines.reverse()
         view_lines = lines[:500]
     return render_template(
-        'log/home.html', username=session.get('username'), log=view_lines
+        "log/home.html", username=session.get("username"), log=view_lines
     )
 
 
-@blueprint.route('/log/view', methods=['GET'])
+@blueprint.route("/log/view", methods=["GET"])
 def log_view() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    with open(log_file, 'r') as fin:
-        lines = [re.sub('\n', '', line) for line in fin.readlines()]
+    with open(log_file, "r") as fin:
+        lines = [re.sub("\n", "", line) for line in fin.readlines()]
         lines.reverse()
         view_lines = lines[:500]
     return render_template(
-        'log/home.html', username=session.get('username'), log=view_lines
+        "log/home.html", username=session.get("username"), log=view_lines
     )
 
 
-@blueprint.route('/log/live.html', methods=['GET'])
-@response(template_file='log/live.html')
+@blueprint.route("/log/live.html", methods=["GET"])
+@response(template_file="log/live.html")
 def stream() -> Response:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.debug(
-        f'[{session.get("url")}] {session.get("username").title()} viewed {request.path}'
+        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
 
     def generate():
@@ -124,56 +124,56 @@ def generate():
             while True:
                 yield f.read()
 
-    return current_app.response_class(generate(), mimetype='text/plain')
+    return current_app.response_class(generate(), mimetype="text/plain")
 
 
-@blueprint.route('/log/yield')
+@blueprint.route("/log/yield")
 def yield_log() -> Response:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.info(
-        f'/log/yield accessed by {session.get("username") or "nobody"}'
+        f"/log/yield accessed by {session.get('username') or 'nobody'}"
     )
 
     def inner():
         proc = subprocess.Popen(
             [
-                f'tail -f {log_file}'
+                f"tail -f {log_file}"
             ],  # call something with a lot of output so we can see it
             shell=True,
             stdout=subprocess.PIPE,
         )
 
-        for line in iter(proc.stdout.readline, ''):
+        for line in iter(proc.stdout.readline, ""):
             sleep(0.1)  # Don't need this just shows the text streaming
-            yield line.rstrip().decode() + '<br/>\n'
+            yield line.rstrip().decode() + "<br/>\n"
 
-    return Response(inner(), mimetype='text/html')
+    return Response(inner(), mimetype="text/html")
 
 
-@blueprint.route('/log/download')
+@blueprint.route("/log/download")
 def download_logs() -> Response:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     logthis.info(
-        f'[{session.get("url")}] {session.get("username")} used {request.path} to download the log.'
+        f"[{session.get('url')}] {session.get('username')} used {request.path} to download the log."
     )
     timestamp = datetime.now()
-    logthis.info(f'Downloading log file...{timestamp}-jawa.log')
+    logthis.info(f"Downloading log file...{timestamp}-jawa.log")
     return send_file(
         log_file,
         as_attachment=True,
-        download_name=f'{datetime.now()}-jawa.log',
+        download_name=f"{datetime.now()}-jawa.log",
     )
diff --git a/views/okta_webhook.py b/views/okta_webhook.py
index cedcada..9ed8771 100644
--- a/views/okta_webhook.py
+++ b/views/okta_webhook.py
@@ -47,143 +47,143 @@
 from bin.view_modifiers import response
 from bin import logger
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
-blueprint = Blueprint('okta_webhook', __name__)
+blueprint = Blueprint("okta_webhook", __name__)
 
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 okta_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "okta_json.json")
 )
 okta_verification_file = os.path.abspath(
     os.path.join(
-        os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'
+        os.path.dirname(__file__), "..", "bin", "okta_verification.py"
     )
 )
 webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
 )
 scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+    os.path.join(os.path.dirname(__file__), "..", "scripts")
 )
 
 
-@blueprint.route('/webhooks/okta', methods=['GET', 'POST'])
-@response(template_file='webhooks/okta/home.html')
+@blueprint.route("/webhooks/okta", methods=["GET", "POST"])
+@response(template_file="webhooks/okta/home.html")
 def okta_webhook() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    with open(webhooks_file, 'r') as fin:
+    with open(webhooks_file, "r") as fin:
         webhooks_json = json.load(fin)
     okta_webhooks_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: 'MISSING', each_webhook)
-        tag = data['tag']
-        if tag == 'okta':
+        data = defaultdict(lambda: "MISSING", each_webhook)
+        tag = data["tag"]
+        if tag == "okta":
             okta_webhooks_list.append(each_webhook)
     return {
-        'key': 'Have a good weekend my dude.',
-        'username': session.get('username'),
-        'okta_list': okta_webhooks_list,
+        "key": "Have a good weekend my dude.",
+        "username": session.get("username"),
+        "okta_list": okta_webhooks_list,
     }
 
 
-@blueprint.route('/webhooks/okta/new', methods=['GET', 'POST'])
+@blueprint.route("/webhooks/okta/new", methods=["GET", "POST"])
 def okta_new() -> Union[Response, str]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     os.chmod(okta_verification_file, mode=0o0755)
     if not os.path.isfile(webhooks_file):
         data = []
-        with open(webhooks_file, 'w') as outfile:
+        with open(webhooks_file, "w") as outfile:
             json.dump(data, outfile, indent=4)
     with open(server_json_file) as json_file:
         data = json.load(json_file)
-        server_address = data.get('jawa_address')
+        server_address = data.get("jawa_address")
         if not server_address:
-            return redirect(url_for('setup'))
-    if request.method != 'POST':
+            return redirect(url_for("setup"))
+    if request.method != "POST":
         return render_template(
-            'webhooks/okta/new.html',
-            setup='setup',
-            username=str(escape(session['username'])),
+            "webhooks/okta/new.html",
+            setup="setup",
+            username=str(escape(session["username"])),
         )
-    if ' ' in request.form.get('webhookname'):
-        error_message = 'Single-string name only.'
+    if " " in request.form.get("webhookname"):
+        error_message = "Single-string name only."
         return render_template(
-            'error.html',
+            "error.html",
             error_message=error_message,
-            error='error',
-            username=str(escape(session['username'])),
+            error="error",
+            username=str(escape(session["username"])),
         )
     if not os.path.isdir(scripts_dir):
         os.mkdir(scripts_dir)
 
-    okta_server = request.form.get('okta_server')
-    okta_token = request.form.get('token')
-    okta_name = request.form.get('webhookname')
-    okta_event = request.form.get('event')
-    description = request.form.get('description')
-    webhook_server_url = server_address + '/hooks/' + okta_name
+    okta_server = request.form.get("okta_server")
+    okta_token = request.form.get("token")
+    okta_name = request.form.get("webhookname")
+    okta_event = request.form.get("event")
+    description = request.form.get("description")
+    webhook_server_url = server_address + "/hooks/" + okta_name
     logthis.info(webhook_server_url)
     owd = os.getcwd()
     os.chdir(scripts_dir)
 
-    f = request.files['script']
-    if ' ' in f.filename:
-        f.filename = f.filename.replace(' ', '-')
+    f = request.files["script"]
+    if " " in f.filename:
+        f.filename = f.filename.replace(" ", "-")
 
     f.save(secure_filename(f.filename))
 
     old_script_file = os.path.join(scripts_dir, f.filename)
     data = json.load(open(webhooks_file))
-    script_file = os.path.join(scripts_dir, okta_name + '_' + f.filename)
+    script_file = os.path.join(scripts_dir, okta_name + "_" + f.filename)
     os.rename(old_script_file, script_file)
     new_file = script_file
     okta_info = json.load(open(webhooks_file))
     os.chdir(owd)
     for i in data:
-        if str(i['name']) == okta_name:
-            error_message = 'Name already exists!'
-            logthis.info('okta webhook erorr')
+        if str(i["name"]) == okta_name:
+            error_message = "Name already exists!"
+            logthis.info("okta webhook erorr")
             return render_template(
-                'error.html',
+                "error.html",
                 error_message=error_message,
-                error='error',
-                username=str(escape(session['username'])),
+                error="error",
+                username=str(escape(session["username"])),
             )
 
     os.chmod(os.path.join(scripts_dir, new_file), mode=0o0755)
 
     data = {
-        'name': okta_name,
-        'events': {'type': 'EVENT_TYPE', 'items': [okta_event]},
-        'channel': {
-            'type': 'HTTP',
-            'version': '1.0.0',
-            'config': {
-                'uri': webhook_server_url,
-                'headers': [
-                    {'key': 'X-Other-Header', 'value': 'some-other-value'}
+        "name": okta_name,
+        "events": {"type": "EVENT_TYPE", "items": [okta_event]},
+        "channel": {
+            "type": "HTTP",
+            "version": "1.0.0",
+            "config": {
+                "uri": webhook_server_url,
+                "headers": [
+                    {"key": "X-Other-Header", "value": "some-other-value"}
                 ],
-                'authScheme': {
-                    'type': 'HEADER',
-                    'key': 'Authorization',
-                    'value': '${api_key}',
+                "authScheme": {
+                    "type": "HEADER",
+                    "key": "Authorization",
+                    "value": "${api_key}",
                 },
             },
         },
@@ -193,55 +193,55 @@ def okta_new() -> Union[Response, str]:
 
     # Makes hook in Okta, gets id
     resp = requests.post(
-        f'{okta_server}/api/v1/eventHooks',
+        f"{okta_server}/api/v1/eventHooks",
         headers={
-            'Accept': 'application/json',
-            'Authorization': f'SSWS {okta_token}',
-            'Content-Type': 'application/json',
+            "Accept": "application/json",
+            "Authorization": f"SSWS {okta_token}",
+            "Content-Type": "application/json",
         },
         data=data,
     )
     response_json = resp.json()
-    okta_id = response_json.get('id')
+    okta_id = response_json.get("id")
 
     okta_info.append(
         {
-            'name': okta_name,
-            'okta_id': okta_id,
-            'okta_event': okta_event,
-            'okta_url': okta_server,
-            'okta_token': okta_token,
-            'script': script_file,
-            'description': description,
-            'webhook_username': 'null',
-            'webhook_password': 'null',
-            'tag': 'okta',
+            "name": okta_name,
+            "okta_id": okta_id,
+            "okta_event": okta_event,
+            "okta_url": okta_server,
+            "okta_token": okta_token,
+            "script": script_file,
+            "description": description,
+            "webhook_username": "null",
+            "webhook_password": "null",
+            "tag": "okta",
         }
     )
     if okta_id:
-        with open(webhooks_file, 'w') as outfile:
+        with open(webhooks_file, "w") as outfile:
             json.dump(okta_info, outfile, indent=4)
 
     # Verify/activate
     resp = requests.post(
-        f'{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify',
-        headers={'Authorization': f'SSWS {okta_token}'},
+        f"{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify",
+        headers={"Authorization": f"SSWS {okta_token}"},
     )
     verification = resp.json()
-    if 'errorCode' in verification:
+    if "errorCode" in verification:
         error_message = (
-            'Okta was unable to verify the webhook.  Check network settings.'
+            "Okta was unable to verify the webhook.  Check network settings."
         )
         return render_template(
-            'error.html',
+            "error.html",
             error_message=error_message,
-            error='Event Verification Error',
-            username=str(escape(session['username'])),
+            error="Event Verification Error",
+            username=str(escape(session["username"])),
         )
 
     return render_template(
-        'success.html',
-        username=session.get('username'),
-        login='true',
-        success_msg='Okta Webhook Created.',
+        "success.html",
+        username=session.get("username"),
+        login="true",
+        success_msg="Okta Webhook Created.",
     )
diff --git a/views/resource_view.py b/views/resource_view.py
index c04d0d9..56d2dbd 100644
--- a/views/resource_view.py
+++ b/views/resource_view.py
@@ -47,41 +47,41 @@
 from bin import logger
 from bin.view_modifiers import response
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
 log_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'jawa.log')
+    os.path.join(os.path.dirname(__file__), "..", "data", "jawa.log")
 )
 server_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 resources_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'resources')
+    os.path.join(os.path.dirname(__file__), "..", "resources")
 )
 files_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'resources', 'files')
+    os.path.join(os.path.dirname(__file__), "..", "resources", "files")
 )
 img_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'static', 'img')
+    os.path.join(os.path.dirname(__file__), "..", "static", "img")
 )
 
-blueprint = Blueprint('resources_view', __name__, template_folder='templates')
+blueprint = Blueprint("resources_view", __name__, template_folder="templates")
 
 
-@blueprint.route('/resources/files', methods=['GET', 'POST'])
+@blueprint.route("/resources/files", methods=["GET", "POST"])
 def files() -> Union[Response, Tuple[str, int]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    target_file = request.args.get('target_file')
+    target_file = request.args.get("target_file")
     if target_file:
         target_file = secure_filename(target_file)
-    button_choice = request.args.get('button_choice')
+    button_choice = request.args.get("button_choice")
     if button_choice:
         button_choice = escape(button_choice)
     if target_file:
@@ -91,81 +91,81 @@ def files() -> Union[Response, Tuple[str, int]]:
         target_file_path = os.path.abspath(
             os.path.join(files_dir, target_file)
         )
-        if button_choice == 'Download':
+        if button_choice == "Download":
             logthis.info(
-                f'[{session.get("url")}] {session.get("username")} downloading file: {target_file}.'
+                f"[{session.get('url')}] {session.get('username')} downloading file: {target_file}."
             )
             if target_file_dir != files_dir:
                 logthis.info(
-                    f'WARNING: [{session.get("url")}] {session.get("username")} attempted to download a file from a forbidden path: {target_file_path}.'
+                    f"WARNING: [{session.get('url')}] {session.get('username')} attempted to download a file from a forbidden path: {target_file_path}."
                 )
                 return (
-                    'Forbidden:  you are not allowed to download files from alternative paths.',
+                    "Forbidden:  you are not allowed to download files from alternative paths.",
                     403,
                 )
-            return send_file(f'{target_file_path}', as_attachment=True)
-        elif button_choice == 'Delete':
+            return send_file(f"{target_file_path}", as_attachment=True)
+        elif button_choice == "Delete":
             logthis.debug(
-                f'[{session.get("url")}] {session.get("username")} is considering deleting a Resource file ({target_file_path})...'
+                f"[{session.get('url')}] {session.get('username')} is considering deleting a Resource file ({target_file_path})..."
             )
             return redirect(
-                url_for('resources_view.delete_file', target_file=target_file)
+                url_for("resources_view.delete_file", target_file=target_file)
             )
 
-    if request.method == 'POST':
+    if request.method == "POST":
         logthis.info(
-            f'[{session.get("url")}] {session.get("username")} {request.path} {request.method}'
+            f"[{session.get('url')}] {session.get('username')} {request.path} {request.method}"
         )
-        upload_files_list = request.files.getlist('upload')
+        upload_files_list = request.files.getlist("upload")
         for each_upload in upload_files_list:
-            if ' ' in each_upload.filename:
-                each_upload.filename = each_upload.filename.replace(' ', '-')
+            if " " in each_upload.filename:
+                each_upload.filename = each_upload.filename.replace(" ", "-")
             logthis.info(
-                f'[{session.get("url")}] {session.get("username")} uploaded {each_upload.filename}.'
+                f"[{session.get('url')}] {session.get('username')} uploaded {each_upload.filename}."
             )
             each_upload.save(
                 os.path.join(files_dir, secure_filename(each_upload.filename))
             )
     logthis.info(
-        f'[{session.get("url")}] {session.get("username")} {request.path} {request.method}'
+        f"[{session.get('url')}] {session.get('username')} {request.path} {request.method}"
     )
     file_list = os.listdir(files_dir)
     for file in file_list:
-        if file[0] == '.':
+        if file[0] == ".":
             file_list.remove(file)
     files_list = []
     for each_file in file_list:
         mtime = os.path.getmtime(os.path.join(files_dir, each_file))
         pretty_mtime = datetime.fromtimestamp(mtime).strftime(
-            '%Y-%m-%d %H:%M:%S'
+            "%Y-%m-%d %H:%M:%S"
         )
-        files_list.append({'name': each_file, 'mtime': pretty_mtime})
+        files_list.append({"name": each_file, "mtime": pretty_mtime})
     return render_template(
-        'resources/files.html',
-        username=session.get('username'),
+        "resources/files.html",
+        username=session.get("username"),
         files_repo=files_dir,
         files=files_list,
     )
 
 
-@blueprint.route('/resources/delete.html', methods=['GET', 'POST'])
+@blueprint.route("/resources/delete.html", methods=["GET", "POST"])
 def delete_file() -> Union[Response, Tuple[str, int]]:
-    target_file = request.args.get('target_file')
+    target_file = request.args.get("target_file")
     if target_file:
         target_file = secure_filename(target_file)
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    if request.method != 'POST':
+    if request.method != "POST":
         return render_template(
-            'resources/delete.html',
+            "resources/delete.html",
             target_file=target_file,
-            username=str(escape(session.get('username'))),
+            username=str(escape(session.get("username"))),
         )
     if target_file:
         target_file_dir = os.path.dirname(
@@ -177,96 +177,96 @@ def delete_file() -> Union[Response, Tuple[str, int]]:
 
     if target_file_dir != files_dir:
         logthis.info(
-            f'WARNING: [{session.get("url")}] {session.get("username")} attempted to delete a file from a forbidden path: {target_file_path}.'
+            f"WARNING: [{session.get('url')}] {session.get('username')} attempted to delete a file from a forbidden path: {target_file_path}."
         )
         return (
-            'Forbidden:  you are not allowed to download files from alternative paths.',
+            "Forbidden:  you are not allowed to download files from alternative paths.",
             403,
         )
     logthis.info(
-        f'[{session.get("url")}] {session.get("username")} deleting file: {target_file}.'
+        f"[{session.get('url')}] {session.get('username')} deleting file: {target_file}."
     )
     if os.path.exists(os.path.join(files_dir, target_file)):
         os.remove(os.path.join(files_dir, target_file))
         logthis.info(
-            f'[{session.get("url")}] {session.get("username")} successfully deleted the Resource file: {target_file}.'
+            f"[{session.get('url')}] {session.get('username')} successfully deleted the Resource file: {target_file}."
         )
-        return redirect(url_for('resources_view.files'))
+        return redirect(url_for("resources_view.files"))
     else:
-        error = 'Error deleting file.'
-        error_message = f'File does not exist {target_file}.'
+        error = "Error deleting file."
+        error_message = f"File does not exist {target_file}."
         return render_template(
-            'error.html',
+            "error.html",
             error=error,
             error_message=error_message,
-            username=str(escape(session['username'])),
+            username=str(escape(session["username"])),
         )
 
 
-@blueprint.route('/branding', methods=['GET', 'POST'])
-@response(template_file='setup/branding.html')
+@blueprint.route("/branding", methods=["GET", "POST"])
+@response(template_file="setup/branding.html")
 def rebrand() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
     if not os.path.isfile(server_file):
-        with open(server_file, 'w') as fout:
+        with open(server_file, "w") as fout:
             json.dump({}, fout)
     with open(server_file) as fin:
         server_json = json.load(fin)
-    brand = server_json.get('brand')
-    if request.method == 'POST':
-        upload_files_list = request.files.getlist('upload')
-        new_name = request.form.get('new_name')
+    brand = server_json.get("brand")
+    if request.method == "POST":
+        upload_files_list = request.files.getlist("upload")
+        new_name = request.form.get("new_name")
         if new_name:
-            server_json['brand'] = new_name
+            server_json["brand"] = new_name
             brand = new_name
 
-            with open(server_file, 'w') as fout:
+            with open(server_file, "w") as fout:
                 json.dump(server_json, fout, indent=4)
         if upload_files_list:
             target_file = upload_files_list[0]
             if target_file:
                 os.rename(
-                    f'{img_dir}/jawa_icon.png',
-                    f'{img_dir}/old_jawa_icon_{datetime.now()}.png',
+                    f"{img_dir}/jawa_icon.png",
+                    f"{img_dir}/old_jawa_icon_{datetime.now()}.png",
                 )
-                target_file.save(os.path.join(img_dir, 'jawa_icon.png'))
-                return redirect(url_for('resources_view.rebrand'))
-            return {'username': session.get('username'), 'app_name': brand}
-        return {'username': session.get('username'), 'app_name': brand}
+                target_file.save(os.path.join(img_dir, "jawa_icon.png"))
+                return redirect(url_for("resources_view.rebrand"))
+            return {"username": session.get("username"), "app_name": brand}
+        return {"username": session.get("username"), "app_name": brand}
 
-    return {'username': session.get('username'), 'app_name': brand}
+    return {"username": session.get("username"), "app_name": brand}
 
 
-@blueprint.route('/python')
-@response(template_file='resources/python.html')
+@blueprint.route("/python")
+@response(template_file="resources/python.html")
 def python() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    return {'username': session.get('username')}
+    return {"username": session.get("username")}
 
 
-@blueprint.route('/bash')
-@response(template_file='resources/bash.html')
+@blueprint.route("/bash")
+@response(template_file="resources/bash.html")
 def bash() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    return {'username': session.get('username')}
+    return {"username": session.get("username")}
diff --git a/views/webhook_view.py b/views/webhook_view.py
index 004cb21..16bb9d6 100644
--- a/views/webhook_view.py
+++ b/views/webhook_view.py
@@ -40,143 +40,143 @@
 from bin.tokens import validate_token, get_token
 from bin.view_modifiers import response
 
-logthis = logger.setup_child_logger('jawa', __name__)
+logthis = logger.setup_child_logger("jawa", __name__)
 
-blueprint = Blueprint('webhooks', __name__, template_folder='templates')
+blueprint = Blueprint("webhooks", __name__, template_folder="templates")
 
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 okta_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'okta_json.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "okta_json.json")
 )
 okta_verification_file = os.path.abspath(
     os.path.join(
-        os.path.dirname(__file__), '..', 'bin', 'okta_verification.py'
+        os.path.dirname(__file__), "..", "bin", "okta_verification.py"
     )
 )
 webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
 )
 scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+    os.path.join(os.path.dirname(__file__), "..", "scripts")
 )
 
 
-@blueprint.route('/webhooks/delete', methods=['GET', 'POST'])
-@response(template_file='webhooks/delete.html')
+@blueprint.route("/webhooks/delete", methods=["GET", "POST"])
+@response(template_file="webhooks/delete.html")
 def delete_webhook() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    target_webhook = request.args.get('target_webhook')
+    target_webhook = request.args.get("target_webhook")
     if not target_webhook:
-        return redirect(url_for('custom_webhook.custom_webhook'))
+        return redirect(url_for("custom_webhook.custom_webhook"))
     target_webhook = escape(target_webhook)
     with open(webhooks_file) as fin:
         webhook_json = json.load(fin)
     tag = [
-        each_webhook['tag']
+        each_webhook["tag"]
         for each_webhook in webhook_json
-        if each_webhook['name'] == target_webhook
+        if each_webhook["name"] == target_webhook
     ]
 
-    if request.method == 'POST':
-        logthis.info(f'Deleting {tag} webhook: {target_webhook}')
+    if request.method == "POST":
+        logthis.info(f"Deleting {tag} webhook: {target_webhook}")
         for each_webhook in webhook_json:
-            if each_webhook['name'] == target_webhook:
-                script_file = each_webhook['script']
+            if each_webhook["name"] == target_webhook:
+                script_file = each_webhook["script"]
                 if os.path.exists(script_file):
-                    os.rename(script_file, f'{script_file}.old')
-                if each_webhook['tag'] == 'jamfpro':
-                    if not validate_token(session['expires']):
+                    os.rename(script_file, f"{script_file}.old")
+                if each_webhook["tag"] == "jamfpro":
+                    if not validate_token(session["expires"]):
                         get_token()
                     data = (
-                        f'<webhook><name>{each_webhook["name"]}.old.{time.time()}</name>'
-                        f'<enabled>false</enabled></webhook>'
+                        f"<webhook><name>{each_webhook['name']}.old.{time.time()}</name>"
+                        f"<enabled>false</enabled></webhook>"
                     )
-                    full_url = f'{session["url"]}/JSSResource/webhooks/name/{each_webhook["name"]}'
+                    full_url = f"{session['url']}/JSSResource/webhooks/name/{each_webhook['name']}"
                     requests.put(
                         full_url,
                         headers={
-                            'Content-Type': 'application/xml',
-                            'Authorization': f'Bearer {session["token"]}',
-                            'User-Agent': 'JAWA%20v3.1.1',
+                            "Content-Type": "application/xml",
+                            "Authorization": f"Bearer {session['token']}",
+                            "User-Agent": "JAWA%20v3.1.1",
                         },
                         data=data,
                     )
-                elif each_webhook['tag'] == 'okta':
+                elif each_webhook["tag"] == "okta":
                     try:
                         requests.post(
-                            f'{each_webhook.get("okta_url")}/api/v1/eventHooks/{each_webhook.get("okta_id")}/lifecycle/deactivate',
+                            f"{each_webhook.get('okta_url')}/api/v1/eventHooks/{each_webhook.get('okta_id')}/lifecycle/deactivate",
                             headers={
-                                'Authorization': 'SSWS {}'.format(
-                                    each_webhook.get('okta_token')
+                                "Authorization": "SSWS {}".format(
+                                    each_webhook.get("okta_token")
                                 )
                             },
                         )
                         requests.delete(
-                            f'{each_webhook.get("okta_url")}/api/v1/eventHooks/{each_webhook.get("okta_id")}',
+                            f"{each_webhook.get('okta_url')}/api/v1/eventHooks/{each_webhook.get('okta_id')}",
                             headers={
-                                'Authorization': 'SSWS {}'.format(
-                                    each_webhook.get('okta_token')
+                                "Authorization": "SSWS {}".format(
+                                    each_webhook.get("okta_token")
                                 )
                             },
                         )
                     except requests.exceptions.MissingSchema as err:
                         return redirect(
                             url_for(
-                                'error',
+                                "error",
                                 error=err,
-                                username=session.get('username'),
+                                username=session.get("username"),
                             )
                         )
 
                 webhook_json.remove(each_webhook)
-                with open(webhooks_file, 'w') as fout:
+                with open(webhooks_file, "w") as fout:
                     json.dump(webhook_json, fout, indent=4)
-        return redirect(url_for('webhooks.webhooks'))
+        return redirect(url_for("webhooks.webhooks"))
     return {
-        'username': session.get('username'),
-        'target_webhook': target_webhook,
-        'tag': tag[0],
+        "username": session.get("username"),
+        "target_webhook": target_webhook,
+        "tag": tag[0],
     }
 
 
-@blueprint.route('/webhooks', methods=['GET', 'POST'])
-@response(template_file='webhooks/home.html')
+@blueprint.route("/webhooks", methods=["GET", "POST"])
+@response(template_file="webhooks/home.html")
 def webhooks() -> Union[Response, Dict[str, Any]]:
-    if 'username' not in session:
+    if "username" not in session:
         return redirect(
             url_for(
-                'home_view.logout',
-                error_title='Session Timed Out',
-                error_message='Please sign in again',
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
             )
         )
-    with open(webhooks_file, 'r') as fin:
+    with open(webhooks_file, "r") as fin:
         webhooks_json = json.load(fin)
     jamf_pro_webhooks_list = []
     okta_webhooks_list = []
     custom_webhooks_list = []
     for each_webhook in webhooks_json:
-        data = defaultdict(lambda: 'MISSING', each_webhook)
-        tag = data['tag']
-        if tag == 'custom':
+        data = defaultdict(lambda: "MISSING", each_webhook)
+        tag = data["tag"]
+        if tag == "custom":
             custom_webhooks_list.append(each_webhook)
-        elif tag == 'jamfpro':
+        elif tag == "jamfpro":
             jamf_pro_webhooks_list.append(each_webhook)
-        elif tag == 'okta':
+        elif tag == "okta":
             okta_webhooks_list.append(each_webhook)
     return {
-        'username': session.get('username'),
-        'custom_list': custom_webhooks_list,
-        'jamf_list': jamf_pro_webhooks_list,
-        'okta_list': okta_webhooks_list,
-        'url': session.get('url'),
+        "username": session.get("username"),
+        "custom_list": custom_webhooks_list,
+        "jamf_list": jamf_pro_webhooks_list,
+        "okta_list": okta_webhooks_list,
+        "url": session.get("url"),
     }
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 21b052a..7aad87a 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -37,23 +37,23 @@
 
 JSONType = Union[Dict[str, Any], List[Any], str, int, float, bool, None]
 
-logthis = logger.setup_child_logger('jawa', 'webhook_receiver')
+logthis = logger.setup_child_logger("jawa", "webhook_receiver")
 
 server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'server.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
 )
 jp_webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'data', 'webhooks.json')
+    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
 )
 scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'scripts')
+    os.path.join(os.path.dirname(__file__), "..", "scripts")
 )
 
-blueprint = Blueprint('jawa_receiver', __name__, template_folder='templates')
+blueprint = Blueprint("jawa_receiver", __name__, template_folder="templates")
 
 
 def load_json(file_path: str) -> Union[Dict[str, Any], List[Any]]:
-    with open(file_path, 'r') as fin:
+    with open(file_path, "r") as fin:
         return json.load(fin)
 
 
@@ -66,12 +66,12 @@ def validate_webhook(
     webhooks_json = load_json(jp_webhooks_file)
     truth_test = False
     for each_webhook in webhooks_json:
-        if each_webhook['name'] == webhook_name:
+        if each_webhook["name"] == webhook_name:
             truth_test = True
             if (
-                each_webhook.get('webhook_username') != webhook_user
-                or each_webhook.get('webhook_password') != webhook_pass
-                or each_webhook.get('api_key', 'null') != webhook_apikey
+                each_webhook.get("webhook_username") != webhook_user
+                or each_webhook.get("webhook_password") != webhook_pass
+                or each_webhook.get("api_key", "null") != webhook_apikey
             ):
                 truth_test = False
 
@@ -81,21 +81,21 @@ def validate_webhook(
 def run_script(webhook_data: JSONType, webhook_name: str) -> Optional[bytes]:
     webhooks_json = load_json(jp_webhooks_file)
     for each_webhook in webhooks_json:
-        if each_webhook['name'] == webhook_name:
+        if each_webhook["name"] == webhook_name:
             return script_results(webhook_data, each_webhook)
 
 
 def script_results(webhook_data: JSONType, each_webhook: Dict) -> bytes:
     webhook_data = json.dumps(webhook_data)
     proc = subprocess.Popen(
-        [each_webhook['script'], f'{webhook_data}'],
+        [each_webhook["script"], f"{webhook_data}"],
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
     )
     output = proc.stdout.read()
-    for each_line in output.decode().split('\n'):
+    for each_line in output.decode().split("\n"):
         if each_line:
-            logthis.info(f'{each_webhook.get("name")} - {each_line}')
+            logthis.info(f"{each_webhook.get('name')} - {each_line}")
     return output
 
 
@@ -104,76 +104,76 @@ def custom_output_options(
 ) -> Union[Tuple[Any, Any], Tuple[None, None]]:
     webhooks_json = load_json(jp_webhooks_file)
     for each_webhook in webhooks_json:
-        if each_webhook['name'] == webhook_name:
-            webhook_tag = each_webhook.get('tag')
-            send_output = each_webhook.get('output')
+        if each_webhook["name"] == webhook_name:
+            webhook_tag = each_webhook.get("tag")
+            send_output = each_webhook.get("output")
             return webhook_tag, send_output
     return None, None
 
 
-@blueprint.route('/hooks/<webhook_name>', methods=['POST', 'GET'])
+@blueprint.route("/hooks/<webhook_name>", methods=["POST", "GET"])
 def webhook_handler(
     webhook_name: str,
 ) -> Union[Dict[str, Any], Tuple[str, int]]:
-    logthis.info(f'Incoming request at /hooks/{webhook_name} ...')
-    if request.headers.get('x-okta-verification-challenge'):
-        logthis.info('This is an Okta verification challenge...')
+    logthis.info(f"Incoming request at /hooks/{webhook_name} ...")
+    if request.headers.get("x-okta-verification-challenge"):
+        logthis.info("This is an Okta verification challenge...")
         return okta_verification.verify_new_webhook(
-            request.headers.get('x-okta-verification-challenge')
+            request.headers.get("x-okta-verification-challenge")
         )
     try:
         webhook_data = request.get_json()
     except Exception as err:
         logthis.debug(
-            f'Error loading JSON ({err}). Trying to load from form payload.'
+            f"Error loading JSON ({err}). Trying to load from form payload."
         )
-        webhook_data = json.loads(request.form.get('payload'))
+        webhook_data = json.loads(request.form.get("payload"))
     if not webhook_data:
         logthis.info(
             f"418.  Error processing /hooks/{webhook_name} - no data provided. I'm a teapot."
         )
         return "418 - I'm a teapot.", 418
-    logthis.debug(f'{webhook_name} payload: {webhook_data}')
-    if request.method != 'POST':
+    logthis.debug(f"{webhook_name} payload: {webhook_data}")
+    if request.method != "POST":
         logthis.info(
-            f'Invalid request, {request.method} for /hooks/{webhook_name}.'
+            f"Invalid request, {request.method} for /hooks/{webhook_name}."
         )
         return (
             "405 - Method not allowed. These aren't the droids you're looking for. You can go about your business. "
-            'Move along.',
+            "Move along.",
             405,
         )
-    webhook_user = 'null'
-    webhook_pass = 'null'
-    webhook_apikey = 'null'
+    webhook_user = "null"
+    webhook_pass = "null"
+    webhook_apikey = "null"
     auth = request.authorization
     headers = request.headers
-    apikey = headers.get('x-api-key')
+    apikey = headers.get("x-api-key")
     if auth:
-        webhook_user = auth.get('username')
-        webhook_pass = auth.get('password')
+        webhook_user = auth.get("username")
+        webhook_pass = auth.get("password")
     if apikey:
-        webhook_apikey = request.headers.get('x-api-key')
+        webhook_apikey = request.headers.get("x-api-key")
     if validate_webhook(
         webhook_name, webhook_user, webhook_pass, webhook_apikey
     ):
         logthis.info(
-            f'Validated authentication for /hooks/{webhook_name}, running script...'
+            f"Validated authentication for /hooks/{webhook_name}, running script..."
         )
         webhook_tag, custom_output = custom_output_options(webhook_name)
-        output = run_script(webhook_data, webhook_name).decode('ascii')
-        if custom_output and webhook_tag == 'custom':
-            return {'webhook': f'{webhook_name}', 'result': f'{output}'}, 202
+        output = run_script(webhook_data, webhook_name).decode("ascii")
+        if custom_output and webhook_tag == "custom":
+            return {"webhook": f"{webhook_name}", "result": f"{output}"}, 202
         else:
             return {
-                'webhook': f'{webhook_name}',
-                'result': 'valid webhook received',
+                "webhook": f"{webhook_name}",
+                "result": "valid webhook received",
             }
     else:
         logthis.info(
-            f'401 - Incorrect authentication provided for /hooks/{webhook_name}.'
+            f"401 - Incorrect authentication provided for /hooks/{webhook_name}."
         )
         return (
-            f'Unauthorized - incorrect authentication provided for /hooks/{webhook_name}.',
+            f"Unauthorized - incorrect authentication provided for /hooks/{webhook_name}.",
             401,
         )

From 361e2d674c7a08cd46784d6800b610bdb8259171 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 30 Jul 2025 15:40:12 -0500
Subject: [PATCH 08/84] fix: corrected notice info for custom webhooks with
 custom auth

---
 views/custom_webhook.py | 404 +++++++++++++++++++++-------------------
 1 file changed, 212 insertions(+), 192 deletions(-)

diff --git a/views/custom_webhook.py b/views/custom_webhook.py
index 5f3e04f..0bfeab5 100644
--- a/views/custom_webhook.py
+++ b/views/custom_webhook.py
@@ -1,6 +1,6 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 #
-# Copyright (c) 2024 Jamf.  All rights reserved.
+# Copyright (c) 2025 Jamf.  All rights reserved.
 #
 #       Redistribution and use in source and binary forms, with or without
 #       modification, are permitted provided that the following conditions are met:
@@ -46,6 +46,10 @@
 from bin.view_modifiers import response
 from bin import logger
 
+ERROR_TITLE = "Session Timed Out"
+LOGOUT_ENDPOINT = "home_view.logout"
+ERROR_MESSAGE = "Please sign in again"
+
 logthis = logger.setup_child_logger("jawa", __name__)
 
 blueprint = Blueprint("custom_webhook", __name__, template_folder="templates")
@@ -75,9 +79,9 @@ def custom_webhook() -> Union[Response, Dict[str, Any]]:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MESSAGE,
             )
         )
     with open(webhooks_file, "r") as fin:
@@ -98,115 +102,21 @@ def custom_webhook() -> Union[Response, Dict[str, Any]]:
 @blueprint.route("/webhooks/custom/edit", methods=["GET", "POST"])
 @response(template_file="webhooks/custom/edit.html")
 def edit_webhook() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
+    session_check = validate_session()
+    if session_check:
+        return session_check
     name = request.args.get("name")
-    if name:
-        name = escape(name)
-    logthis.info(f"Checking for custom webhook '{name}'")
-    with open(webhooks_file) as fin:
-        webhooks_json = json.load(fin)
-    check_for_name = [
-        True for each_webhook in webhooks_json if each_webhook["name"] == name
-    ]
-    logthis.info(f"Name exists? {check_for_name}")
+    check_for_name, name, webhooks_json = check_for_dupes(name)
     if not check_for_name:
         logthis.info(f"JAWA is not aware of any custom webhook named {name}")
         return redirect(url_for("custom_webhook.custom_webhook"))
-
-    extra_notice = None
-    custom_header = None
-
     if request.method == "POST":
-        button_choice = request.form.get("button_choice")
-        if button_choice == "Delete":
-            logthis.info(
-                f"{session.get('username')} is considering deleting a custom webhook ({name})..."
-            )
-            return redirect(
-                url_for("webhooks.delete_webhook", target_webhook=name)
-            )
-        for each_webhook in webhooks_json:
-            if each_webhook["name"] == name:
-                logthis.info(
-                    f"{session.get('username')} is editing a custom webhook ({name})..."
-                )
-                output = request.form.get("output")
-                new_custom_name = request.form.get("custom_name")
-                if not new_custom_name:
-                    new_custom_name = name
-                description = request.form.get("description")
-                if request.form.get("basic"):
-                    new_webhook_user = request.form.get(
-                        "basic_username", "null"
-                    )
-                    new_webhook_pass = request.form.get("new-password", "null")
-                else:
-                    new_webhook_user = "null"
-                    new_webhook_pass = "null"
-                if request.form.get("custom"):
-                    new_webhook_apikey = request.form.get("api_key", "null")
-                    extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:"
-                    custom_header = {"x-api-key": f"{new_webhook_apikey}"}
-                else:
-                    new_webhook_apikey = "null"
-                if new_webhook_user and new_webhook_user != "":
-                    each_webhook["webhook_username"] = new_webhook_user
-                else:
-                    each_webhook["webhook_username"] = "null"
-                if new_webhook_pass and new_webhook_pass != "":
-                    each_webhook["webhook_password"] = new_webhook_pass
-                else:
-                    each_webhook["webhook_password"] = "null"
-                if new_webhook_apikey and new_webhook_apikey != "":
-                    each_webhook["api_key"] = new_webhook_apikey
-                else:
-                    each_webhook["webhook_password"] = "null"
-                if request.files.get("new_file"):
-                    new_script = request.files.get("new_file")
-                    owd = os.getcwd()
-                    os.chdir(scripts_dir)
-
-                    if " " in new_script.filename:
-                        new_script.filename = new_script.filename.replace(
-                            " ", "-"
-                        )
-
-                    new_filename = f"{new_custom_name}-{new_script.filename}"
-                    new_script.save(secure_filename(new_filename))
-                    new_filename = os.path.join(
-                        scripts_dir, f"{new_custom_name}-{new_script.filename}"
-                    )
-                    os.chmod(new_filename, mode=0o0755)
-                    os.chdir(owd)
-                    each_webhook["script"] = new_filename
-
-                each_webhook["name"] = new_custom_name
-                if description:
-                    each_webhook["description"] = description
-                each_webhook["webhook_username"] = new_webhook_user
-                each_webhook["webhook_password"] = new_webhook_pass
-                each_webhook["output"] = output
-
-                with open(webhooks_file, "w") as fout:
-                    json.dump(webhooks_json, fout, indent=4)
-                webhook_info = [each_webhook]
-                return {
-                    "webhooks": "success",
-                    "success_msg": f"Edited custom webhook {new_custom_name}.",
-                    "username": session.get("username"),
-                    "webhook_info": webhook_info,
-                    "webhook_name": new_custom_name,
-                    "description": each_webhook.get("description"),
-                    "extra_notice": extra_notice,
-                    "custom_header": custom_header,
-                }
+        result = process_edit_webhook(
+            request.form, request.files, session, name, webhooks_json
+        )
+        if "redirect" in result:
+            return redirect(result["redirect"])
+        return result
     webhook_info = [
         each_webhook
         for each_webhook in webhooks_json
@@ -221,98 +131,208 @@ def edit_webhook() -> Union[Response, Dict[str, Any]]:
 
 @blueprint.route("/webhooks/custom/new", methods=["GET", "POST"])
 def new_webhook() -> Union[Response, Dict[str, Any], str]:
+    session_check = validate_session()
+    if session_check:
+        return session_check
+    if request.method == "POST":
+        result = process_new_webhook(request.form, request.files, session)
+        if not result:
+            return render_template(
+                "webhooks/custom/new.html", username=session.get("username")
+            )
+        if "template" in result:
+            return render_template(
+                result["template"],
+                webhooks=result["webhooks"],
+                success_msg=result["success_msg"],
+                extra_notice=result["extra_notice"],
+                custom_header=result["custom_header"],
+                username=result["username"],
+            )
+        return result
+    return render_template(
+        "webhooks/custom/new.html", username=session.get("username")
+    )
+
+
+def check_for_dupes(name):
+    if name:
+        name = escape(name)
+    logthis.info(f"Checking for custom webhook '{name}'")
+    with open(webhooks_file) as fin:
+        webhooks_json = json.load(fin)
+    check_for_name = [
+        True for each_webhook in webhooks_json if each_webhook["name"] == name
+    ]
+    logthis.info(f"Name exists? {check_for_name}")
+    return check_for_name, name, webhooks_json
+
+
+def validate_session():
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MESSAGE,
             )
         )
-    if request.method == "POST":
-        new_custom_name = request.form.get("custom_name")
-        description = request.form.get("description")
-        output = request.form.get("output")
+    return None
 
-        if request.form.get("custom_name") != "":
-            check = 0
-            logthis.info(
-                f"New webhook name: {request.form.get('custom_name')}"
-            )
 
-            with open(webhooks_file, "r") as json_file:
-                webhooks_json = json.load(json_file)
-            if webhooks_json:
-                for each_webhook in webhooks_json:
-                    if each_webhook.get("name") == new_custom_name:
-                        check = 1
-            owd = os.getcwd()
-            if not os.path.isdir(scripts_dir):
-                os.mkdir(scripts_dir)
-            os.chdir(scripts_dir)
-            target_file = request.files.get("new_file")
+def get_form_value(form, key, default="null"):
+    value = form.get(key)
+    return value if value else default
 
-            if " " in target_file.filename:
-                target_file.filename = target_file.filename.replace(" ", "-")
 
-            new_filename = f"{new_custom_name}-{target_file.filename}"
-            target_file.save(secure_filename(new_filename))
-            new_filename = os.path.join(
-                scripts_dir, f"{new_custom_name}-{target_file.filename}"
-            )
-            os.chmod(new_filename, mode=0o0755)
-            os.chdir(owd)
-            if check != 0:
-                error_message = "Name already exists!"
-                logthis.info(
-                    f"Could not create new webhook. Message: {error_message}"
-                )
-                return {
-                    "error": error_message,
-                    "username": session.get("username"),
-                    "name": new_custom_name,
-                    "description": description,
-                }
-            new_webhook_user = request.form.get("basic_username", "null")
-            if not new_webhook_user:
-                new_webhook_user = "null"
-            new_webhook_pass = request.form.get("new-password", "null")
-            if not new_webhook_pass:
-                new_webhook_pass = "null"
-            if request.form.get("custom"):
-                api_key = request.form.get("api_key", "null")
-                extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:"
-                custom_header = {"x-api-key": f"{api_key}"}
-            else:
-                extra_notice = None
-                custom_header = None
-                api_key = "null"
-            webhooks_json.append(
-                {
-                    "url": str(session["url"]),
-                    "jawa_admin": str(session["username"]),
-                    "name": new_custom_name,
-                    "webhook_username": new_webhook_user,
-                    "webhook_password": new_webhook_pass,
-                    "api_key": api_key,
-                    "script": new_filename,
-                    "description": description,
-                    "tag": "custom",
-                    "output": output,
-                }
-            )
+def handle_file_upload(file, custom_name, scripts_dir):
+    if not file:
+        return None
+    owd = os.getcwd()
+    if not os.path.isdir(scripts_dir):
+        os.mkdir(scripts_dir)
+    os.chdir(scripts_dir)
+    if " " in file.filename:
+        file.filename = file.filename.replace(" ", "-")
+    new_filename = f"{custom_name}-{file.filename}"
+    file.save(secure_filename(new_filename))
+    new_filename = os.path.join(scripts_dir, new_filename)
+    os.chmod(new_filename, mode=0o0755)
+    os.chdir(owd)
+    return new_filename
 
-            with open(webhooks_file, "w") as outfile:
-                json.dump(webhooks_json, outfile, indent=4)
-            success_msg = "New webhook created:"
-            return render_template(
-                "success.html",
-                webhooks="success",
-                success_msg=success_msg,
-                extra_notice=extra_notice,
-                custom_header=custom_header,
-                username=str(escape(session["username"])),
-            )
-    return render_template(
-        "webhooks/custom/new.html", username=session.get("username")
+
+def process_new_webhook(form, files, session):
+    new_custom_name = form.get("custom_name")
+    description = form.get("description")
+    output = form.get("output")
+    if not new_custom_name:
+        return None
+    with open(webhooks_file, "r") as json_file:
+        webhooks_json = json.load(json_file)
+    if any(each.get("name") == new_custom_name for each in webhooks_json):
+        error_message = "Name already exists!"
+        logthis.info(f"Could not create new webhook. Message: {error_message}")
+        return {
+            "error": error_message,
+            "username": session.get("username"),
+            "name": new_custom_name,
+            "description": description,
+        }
+    new_filename = handle_file_upload(
+        files.get("new_file"), new_custom_name, scripts_dir
+    )
+    new_webhook_user = get_form_value(form, "basic_username")
+    new_webhook_pass = get_form_value(form, "new-password")
+    if form.get("custom"):
+        api_key = get_form_value(form, "api_key")
+        extra_notice = (
+            "Use the following in your request headers for authentication: "
+        )
+        custom_header = {"x-api-key": f"{api_key}"}
+    else:
+        extra_notice = None
+        custom_header = None
+        api_key = "null"
+    webhooks_json.append(
+        {
+            "url": str(session["url"]),
+            "jawa_admin": str(session["username"]),
+            "name": new_custom_name,
+            "webhook_username": new_webhook_user,
+            "webhook_password": new_webhook_pass,
+            "api_key": api_key,
+            "script": new_filename,
+            "description": description,
+            "tag": "custom",
+            "output": output,
+        }
+    )
+    with open(webhooks_file, "w") as outfile:
+        json.dump(webhooks_json, outfile, indent=4)
+    success_msg = "New webhook created:"
+    return {
+        "template": "success.html",
+        "webhooks": "success",
+        "success_msg": success_msg,
+        "extra_notice": extra_notice,
+        "custom_header": custom_header,
+        "username": str(escape(session["username"])),
+    }
+
+
+def update_webhook(each_webhook, form, files, name):
+    output = form.get("output")
+    new_custom_name = get_form_value(form, "custom_name", name)
+    description = form.get("description")
+    new_webhook_user = (
+        get_form_value(form, "basic_username") if form.get("basic") else "null"
     )
+    new_webhook_pass = (
+        get_form_value(form, "new-password") if form.get("basic") else "null"
+    )
+    if form.get("custom"):
+        new_webhook_apikey = get_form_value(form, "api_key")
+        extra_notice = (
+            "Use the following in your request headers for authentication: "
+        )
+        custom_header = {"x-api-key": f"{new_webhook_apikey}"}
+    else:
+        new_webhook_apikey = "null"
+        extra_notice = None
+        custom_header = None
+    each_webhook["webhook_username"] = new_webhook_user
+    each_webhook["webhook_password"] = new_webhook_pass
+    each_webhook["api_key"] = new_webhook_apikey
+    new_filename = handle_file_upload(
+        files.get("new_file"), new_custom_name, scripts_dir
+    )
+    if new_filename:
+        each_webhook["script"] = new_filename
+    each_webhook["name"] = new_custom_name
+    if description:
+        each_webhook["description"] = description
+    each_webhook["output"] = output
+    return extra_notice, custom_header, new_custom_name
+
+
+def process_edit_webhook(form, files, session, name, webhooks_json):
+    button_choice = form.get("button_choice")
+    if button_choice == "Delete":
+        logthis.info(
+            f"{session.get('username')} is considering deleting a custom webhook ({name})..."
+        )
+        return {
+            "redirect": url_for("webhooks.delete_webhook", target_webhook=name)
+        }
+    for each_webhook in webhooks_json:
+        if each_webhook["name"] == name:
+            logthis.info(
+                f"{session.get('username')} is editing a custom webhook ({name})..."
+            )
+            extra_notice, custom_header, new_custom_name = update_webhook(
+                each_webhook, form, files, name
+            )
+            with open(webhooks_file, "w") as fout:
+                json.dump(webhooks_json, fout, indent=4)
+            webhook_info = [each_webhook]
+            return {
+                "webhooks": "success",
+                "success_msg": f"Edited custom webhook {new_custom_name}.",
+                "username": session.get("username"),
+                "webhook_info": webhook_info,
+                "webhook_name": new_custom_name,
+                "description": each_webhook.get("description"),
+                "extra_notice": extra_notice,
+                "custom_header": custom_header,
+            }
+    webhook_info = [
+        each_webhook
+        for each_webhook in webhooks_json
+        if each_webhook["name"] == name
+    ]
+    return {
+        "username": session.get("username"),
+        "webhook_name": name,
+        "webhook_info": webhook_info,
+    }

From dd486fb90299a1cb756505f40991a42d90ea88ad Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Wed, 11 Feb 2026 12:13:02 -0600
Subject: [PATCH 09/84] feature: templates (#58)

* chore: update .gitignore to exclude JAWA runtime data files

* feat: add template catalog and enable/import functionality
---
 .gitignore                                    |   7 +
 data/workflows/scripts/device_naming.py       | 137 ++++++
 data/workflows/scripts/ea_update.py           |  92 ++++
 data/workflows/scripts/enrollment_pipeline.py |  76 +++
 .../workflows/scripts/event_tracker_sqlite.py | 119 +++++
 data/workflows/scripts/return_to_service.py   | 150 ++++++
 data/workflows/scripts/smart_group_appletv.py |  38 ++
 data/workflows/scripts/smart_group_slack.py   |  48 ++
 data/workflows/scripts/teams_notification.py  | 108 ++++
 data/workflows/workflow_config.json           | 304 ++++++++++++
 templates/workflows/catalog.html              |  57 +++
 templates/workflows/enable.html               |  64 +++
 templates/workflows/import.html               |  27 +
 views/template_view.py                        | 462 ++++++++++++++++++
 14 files changed, 1689 insertions(+)
 create mode 100644 data/workflows/scripts/device_naming.py
 create mode 100644 data/workflows/scripts/ea_update.py
 create mode 100644 data/workflows/scripts/enrollment_pipeline.py
 create mode 100644 data/workflows/scripts/event_tracker_sqlite.py
 create mode 100644 data/workflows/scripts/return_to_service.py
 create mode 100644 data/workflows/scripts/smart_group_appletv.py
 create mode 100644 data/workflows/scripts/smart_group_slack.py
 create mode 100644 data/workflows/scripts/teams_notification.py
 create mode 100644 data/workflows/workflow_config.json
 create mode 100644 templates/workflows/catalog.html
 create mode 100644 templates/workflows/enable.html
 create mode 100644 templates/workflows/import.html
 create mode 100644 views/template_view.py

diff --git a/.gitignore b/.gitignore
index da0bd44..17b625b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -151,3 +151,10 @@ dmypy.json
 
 # ruff
 .ruff_cache
+
+# JAWA runtime data
+data/server.json
+data/credentials.json
+data/cron.json
+data/webhooks.json
+resources/files/
diff --git a/data/workflows/scripts/device_naming.py b/data/workflows/scripts/device_naming.py
new file mode 100644
index 0000000..27f39bb
--- /dev/null
+++ b/data/workflows/scripts/device_naming.py
@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""Auto-rename mobile devices by asset tag on enrollment.
+
+Webhook event: MobileDeviceEnrolled
+API privileges: Read Mobile Devices, Send Mobile Device Set Device Name Command
+"""
+
+import json
+import logging
+import requests
+import sys
+import time
+
+token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
+
+
+class Config:
+    def __init__(self):
+        self.server_url = "https://example.jamfcloud.com"  # Your Jamf Pro URL
+        self.token_url = f"{self.server_url}/api/oauth/token"
+        self.client_id = "your_client_id"
+        self.client_secret = "your_client_secret"
+        self.scope = ""  # e.g., api-role:5
+
+
+def get_oauth_token():
+    global token_cache
+    current_time = time.time()
+    config = Config()
+    if (
+        token_cache["access_token"]
+        and (current_time - token_cache["timestamp"])
+        < token_cache["expires_in"]
+    ):
+        return token_cache["access_token"]
+    data = {
+        "client_id": config.client_id,
+        "grant_type": "client_credentials",
+        "client_secret": config.client_secret,
+    }
+    if config.scope:
+        data["scope"] = config.scope
+    response = requests.post(
+        config.token_url,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        data=data,
+    )
+    response_data = response.json()
+    token_cache = {
+        "access_token": response_data["access_token"],
+        "expires_in": response_data["expires_in"],
+        "timestamp": current_time,
+    }
+    return token_cache["access_token"]
+
+
+def api_get(endpoint):
+    config = Config()
+    token = get_oauth_token()
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/json",
+    }
+    resp = requests.get(
+        f"{config.server_url}/JSSResource/{endpoint}", headers=headers
+    )
+    resp.raise_for_status()
+    return resp.json()
+
+
+def api_post(endpoint):
+    config = Config()
+    token = get_oauth_token()
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/json",
+    }
+    resp = requests.post(
+        f"{config.server_url}/JSSResource/{endpoint}", headers=headers
+    )
+    resp.raise_for_status()
+    return resp
+
+
+def main():
+    # 1. Parse webhook event
+    try:
+        event_data = json.loads(sys.argv[1])
+    except (json.JSONDecodeError, IndexError) as err:
+        print(f"Error parsing webhook JSON: {err}")
+        sys.exit(1)
+
+    event = event_data["event"]
+    jss_id = str(event["jssID"])
+    old_name = event.get("deviceName", "Unknown")
+    serial = event.get("serialNumber", "Unknown")
+    room = event.get("room", "")
+
+    # 2. Filter: skip bedside devices (those with room assignments)
+    if room:
+        print(f"Device has room assignment ({room}) - skipping rename.")
+        sys.exit(5)
+
+    # 3. Wait for device record to populate, then look up asset tag
+    time.sleep(30)
+    try:
+        device_record = api_get(f"mobiledevices/id/{jss_id}")
+        asset_tag = device_record["mobile_device"]["general"].get("asset_tag")
+    except Exception as err:
+        print(f"Could not GET device record for ID {jss_id}: {err}")
+        sys.exit(2)
+
+    if not asset_tag:
+        print(f"No asset tag for ID {jss_id}. Exiting.")
+        sys.exit(3)
+
+    # 4. Send DeviceName command
+    try:
+        api_post(
+            f"mobiledevicecommands/command/DeviceName/{asset_tag}/id/{jss_id}"
+        )
+        print(
+            f"Renamed {old_name} -> {asset_tag} (SN: {serial}, ID: {jss_id})"
+        )
+    except Exception as err:
+        print(f"Failed to rename device ID {jss_id}: {err}")
+        sys.exit(4)
+
+    # 5. Send blank push to speed up command delivery
+    try:
+        api_post(f"mobiledevicecommands/command/BlankPush/id/{jss_id}")
+    except Exception:
+        pass  # Non-critical
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/ea_update.py b/data/workflows/scripts/ea_update.py
new file mode 100644
index 0000000..d1cb246
--- /dev/null
+++ b/data/workflows/scripts/ea_update.py
@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+"""Update mobile device extension attribute from webhook event.
+
+Handles both Jamf Pro standard webhook events and custom JSON posts.
+"""
+
+import json
+import requests
+import sys
+import time
+
+token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
+
+
+class Config:
+    def __init__(self):
+        self.server_url = "https://example.jamfcloud.com"
+        self.token_url = f"{self.server_url}/api/oauth/token"
+        self.client_id = "your_client_id"
+        self.client_secret = "your_client_secret"
+        self.scope = ""
+
+
+def get_oauth_token():
+    global token_cache
+    config = Config()
+    current_time = time.time()
+    if (
+        token_cache["access_token"]
+        and (current_time - token_cache["timestamp"])
+        < token_cache["expires_in"]
+    ):
+        return token_cache["access_token"]
+    response = requests.post(
+        config.token_url,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        data={
+            "client_id": config.client_id,
+            "grant_type": "client_credentials",
+            "client_secret": config.client_secret,
+        },
+    )
+    rd = response.json()
+    token_cache = {
+        "access_token": rd["access_token"],
+        "expires_in": rd["expires_in"],
+        "timestamp": current_time,
+    }
+    return token_cache["access_token"]
+
+
+def build_ea_xml(ea_name, value):
+    return (
+        f"<mobile_device><extension_attributes><extension_attribute>"
+        f"<name>{ea_name}</name><value>{value}</value>"
+        f"</extension_attribute></extension_attributes></mobile_device>"
+    )
+
+
+def main():
+    config = Config()
+    event_data = json.loads(sys.argv[1])
+
+    # Support both custom and standard webhook formats
+    if "DeviceID" in event_data:
+        # Custom webhook format
+        device_id = event_data["DeviceID"]
+        ea_name = event_data["EaName"]
+        value = event_data["Value"]
+    else:
+        # Standard Jamf Pro webhook
+        device_id = event_data["event"]["jssID"]
+        ea_name = "Last Webhook Action"
+        value = event_data["webhook"]["webhookEvent"]
+
+    # Build XML and send PUT
+    xml_data = build_ea_xml(ea_name, value)
+    token = get_oauth_token()
+    resp = requests.put(
+        f"{config.server_url}/JSSResource/mobiledevices/id/{device_id}",
+        headers={
+            "Content-Type": "application/xml",
+            "Authorization": f"Bearer {token}",
+        },
+        data=xml_data,
+    )
+    resp.raise_for_status()
+    print(f"Updated EA '{ea_name}' = '{value}' for device {device_id}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/enrollment_pipeline.py b/data/workflows/scripts/enrollment_pipeline.py
new file mode 100644
index 0000000..be3a0ae
--- /dev/null
+++ b/data/workflows/scripts/enrollment_pipeline.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Multi-step enrollment pipeline.
+
+Supports multiple webhook trigger events:
+  - MobileDeviceEnrolled (single device)
+  - ComputerAdded (single device)
+  - SmartGroupMobileDeviceMembershipChange (batch of devices)
+"""
+
+import csv, json, logging, requests, sys, time
+
+# ... (Config, OAuth, perform_api_call from foundations) ...
+
+CSV_FILE = "/usr/local/JAWA/resources/files/DeviceAssignments.csv"
+
+
+def extract_device_ids(event_data):
+    """Extract device ID(s) from any supported webhook event type."""
+    event = event_data.get("event", {})
+    webhook_event = event_data.get("webhook", {}).get("webhookEvent", "")
+
+    # Smart group events provide a list of added device IDs
+    if "SmartGroup" in webhook_event:
+        ids = event.get("groupAddedDevicesIds", [])
+        return [int(i) for i in ids] if ids else []
+
+    # Enrollment and add events provide a single device ID
+    jss_id = event.get("jssID")
+    if jss_id:
+        return [int(jss_id)]
+
+    return []
+
+
+def main():
+    # Stage 1-2: Parse event
+    event_data = json.loads(sys.argv[1])
+    id_list = extract_device_ids(event_data)
+    if not id_list:
+        sys.exit(12)
+
+    for jss_id in id_list:
+        # Stage 3: Get device serial, match to CSV
+        time.sleep(30)
+        device = api_get(f"api/v2/mobile-devices/{jss_id}/detail")
+        serial = device.get("serialNumber")
+        model = device.get("model", "")
+
+        # Apple TV fork
+        if "appletv" in model.lower():
+            handle_apple_tv(jss_id, serial)
+            continue
+
+        assignment = lookup_csv(serial, CSV_FILE)
+        if not assignment:
+            print(f"{serial} not in spreadsheet.")
+            continue
+
+        # Stage 4: Update device record
+        update_record(jss_id, assignment)
+
+        # Stage 5: Queue commands
+        set_device_name(jss_id, assignment["name"])
+
+        # Stage 6: Poll for DeviceConfigured
+        completed = poll_command(jss_id, "DeviceConfigured")
+
+        if completed:
+            print(f"ID {jss_id} ({serial}) completed setup.")
+        else:
+            print(f"ID {jss_id} ({serial}) failed - erasing.")
+            send_erase(jss_id)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/event_tracker_sqlite.py b/data/workflows/scripts/event_tracker_sqlite.py
new file mode 100644
index 0000000..850854b
--- /dev/null
+++ b/data/workflows/scripts/event_tracker_sqlite.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""Track webhook events in a SQLite database with cooldown logic.
+
+Webhook event: ComputerCheckIn, MobileDeviceCheckIn
+API privileges: None (logging only)
+"""
+
+import datetime
+import json
+import sqlite3
+import sys
+
+DB_PATH = "placeholder_value"  # Path to SQLite database file
+COOLDOWN_HOURS = 12  # Hours between recording repeat check-ins
+
+
+def create_check_in_db(db_path):
+    """Create SQLite database for check-in tracking."""
+    conn = sqlite3.connect(db_path)
+    conn.execute("""CREATE TABLE IF NOT EXISTS check_in_stats (
+        jps_id INTEGER NOT NULL PRIMARY KEY,
+        serial_number TEXT NOT NULL,
+        device_name TEXT,
+        last_check_in TEXT NOT NULL,
+        total_check_ins INTEGER NOT NULL DEFAULT 1
+    )""")
+    conn.commit()
+    return conn
+
+
+def record_check_in(
+    conn, jss_id, serial, device_name, event_time, cooldown_hours=12
+):
+    """Record a device check-in with cooldown logic.
+
+    Returns True if the check-in was recorded (outside cooldown).
+    Returns False if within cooldown window.
+    """
+    cur = conn.cursor()
+    cur.execute(
+        "SELECT last_check_in, total_check_ins FROM check_in_stats WHERE jps_id=?",
+        (jss_id,),
+    )
+    row = cur.fetchone()
+
+    if not row:
+        conn.execute(
+            "INSERT INTO check_in_stats "
+            "(jps_id, serial_number, device_name, last_check_in, total_check_ins) "
+            "VALUES (?, ?, ?, ?, 1)",
+            (jss_id, serial, device_name, event_time),
+        )
+        conn.commit()
+        return True
+
+    last_time = datetime.datetime.strptime(row[0], "%Y-%m-%d %H:%M:%S")
+    current_time = datetime.datetime.strptime(event_time, "%Y-%m-%d %H:%M:%S")
+    delta = current_time - last_time
+    total = row[1]
+
+    if delta.total_seconds() >= (cooldown_hours * 3600):
+        conn.execute(
+            "UPDATE check_in_stats SET last_check_in=?, total_check_ins=?, "
+            "device_name=? WHERE jps_id=?",
+            (event_time, total + 1, device_name, jss_id),
+        )
+        conn.commit()
+        print(
+            f"  {device_name}: check-in recorded (total: {total + 1}, delta: {delta})"
+        )
+        return True
+    else:
+        conn.execute(
+            "UPDATE check_in_stats SET total_check_ins=? WHERE jps_id=?",
+            (total + 1, jss_id),
+        )
+        conn.commit()
+        print(
+            f"  {device_name}: within cooldown ({delta} < {cooldown_hours}h)"
+        )
+        return False
+
+
+def main():
+    # 1. Parse webhook event
+    try:
+        event_data = json.loads(sys.argv[1])
+    except (json.JSONDecodeError, IndexError) as err:
+        print(f"Error parsing webhook JSON: {err}")
+        sys.exit(1)
+
+    event = event_data.get("event", {})
+    jss_id = event.get("jssID") or event.get("computer", {}).get("jssID")
+    serial = event.get("serialNumber", "Unknown")
+    device_name = event.get("deviceName") or event.get("computer", {}).get(
+        "deviceName", "Unknown"
+    )
+
+    if not jss_id:
+        print("No device ID found in event data.")
+        sys.exit(2)
+
+    event_time = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+
+    # 2. Open database and record
+    conn = create_check_in_db(DB_PATH)
+    recorded = record_check_in(
+        conn, jss_id, serial, device_name, event_time, COOLDOWN_HOURS
+    )
+    conn.close()
+
+    if recorded:
+        print(f"Check-in recorded for {device_name} (ID: {jss_id})")
+    else:
+        print(f"Check-in within cooldown for {device_name} (ID: {jss_id})")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/return_to_service.py b/data/workflows/scripts/return_to_service.py
new file mode 100644
index 0000000..7a1038e
--- /dev/null
+++ b/data/workflows/scripts/return_to_service.py
@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""Return to Service automation via smart group webhook.
+
+Webhook event: SmartGroupMobileDeviceMembershipChange
+When devices enter the target smart group, this script:
+1. Sets an EA to track RtS status
+2. Looks up the device managementId
+3. Sends ERASE_DEVICE with returnToService enabled
+
+"""
+
+import base64
+import json
+import logging
+import requests
+import sys
+import time
+
+token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
+
+
+class Config:
+    def __init__(self):
+        self.server_url = "https://example.jamfcloud.com"
+        self.token_url = f"{self.server_url}/api/oauth/token"
+        self.client_id = "your_client_id"
+        self.client_secret = "your_client_secret"
+        self.scope = ""
+
+
+# WiFi profile XML (base64 will be encoded at runtime)
+WIFI_PAYLOAD = b"""<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1"><dict>
+  <key>PayloadUUID</key><string>RTS-UNIQUE-UUID</string>
+  <key>PayloadType</key><string>Configuration</string>
+  <key>PayloadIdentifier</key><string>RTS-UNIQUE-UUID</string>
+  <key>PayloadContent</key><array><dict>
+    <key>PayloadType</key><string>com.apple.wifi.managed</string>
+    <key>SSID_STR</key><string>Your-WiFi-SSID</string>
+    <key>AutoJoin</key><true/>
+    <key>CaptiveBypass</key><true/>
+  </dict></array>
+</dict></plist>"""
+
+EA_NAME = "RtS Status"
+
+
+def get_oauth_token():
+    global token_cache
+    current_time = time.time()
+    config = Config()
+    if (
+        token_cache["access_token"]
+        and (current_time - token_cache["timestamp"])
+        < token_cache["expires_in"]
+    ):
+        return token_cache["access_token"]
+    response = requests.post(
+        config.token_url,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        data={
+            "client_id": config.client_id,
+            "grant_type": "client_credentials",
+            "client_secret": config.client_secret,
+            "scope": config.scope,
+        },
+    )
+    rd = response.json()
+    token_cache = {
+        "access_token": rd["access_token"],
+        "expires_in": rd["expires_in"],
+        "timestamp": current_time,
+    }
+    return token_cache["access_token"]
+
+
+def get_headers(content_type="json"):
+    token = get_oauth_token()
+    return {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/json",
+        "Content-Type": "application/json"
+        if content_type == "json"
+        else "application/xml",
+    }
+
+
+def build_ea_xml(ea_name, value):
+    return (
+        f"<mobile_device><extension_attributes><extension_attribute>"
+        f"<name>{ea_name}</name><value>{value}</value>"
+        f"</extension_attribute></extension_attributes></mobile_device>"
+    )
+
+
+def main():
+    config = Config()
+    # 1. Parse event
+    event_data = json.loads(sys.argv[1])
+    id_list = event_data["event"]["groupAddedDevicesIds"]
+    if not id_list:
+        print("No devices entered the group.")
+        sys.exit(12)
+
+    # 2. Encode WiFi payload
+    wifi_b64 = base64.b64encode(WIFI_PAYLOAD).decode("ascii")
+
+    # 3. Process each device
+    for jss_id in id_list:
+        # Set EA to prevent re-triggering
+        ea_xml = build_ea_xml(EA_NAME, "Enrolled")
+        headers = get_headers("xml")
+        requests.put(
+            f"{config.server_url}/JSSResource/mobiledevices/id/{jss_id}",
+            headers=headers,
+            data=ea_xml,
+        )
+
+        # Look up managementId
+        headers = get_headers()
+        resp = requests.get(
+            f"{config.server_url}/api/v2/mobile-devices/{jss_id}",
+            headers=headers,
+        )
+        mgmt_id = resp.json().get("managementId")
+
+        # Send erase with RtS
+        erase_json = {
+            "clientData": [{"managementId": mgmt_id}],
+            "commandData": {
+                "commandType": "ERASE_DEVICE",
+                "preserveDataPlan": True,
+                "disallowProximitySetup": False,
+                "returnToService": {
+                    "enabled": True,
+                    "wifiProfileData": wifi_b64,
+                },
+            },
+        }
+        resp = requests.post(
+            f"{config.server_url}/api/v2/mdm/commands",
+            headers=get_headers(),
+            json=erase_json,
+        )
+        resp.raise_for_status()
+        print(f"Device {jss_id}: RtS command sent.")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/smart_group_appletv.py b/data/workflows/scripts/smart_group_appletv.py
new file mode 100644
index 0000000..dae5584
--- /dev/null
+++ b/data/workflows/scripts/smart_group_appletv.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Restart Apple TVs that join a smart group.
+
+Webhook event: SmartGroupMobileDeviceMembershipChange
+"""
+
+import json
+import requests
+import sys
+import time
+
+# ... (Config, OAuth, perform_api_call from foundations) ...
+
+
+def main():
+    event_data = json.loads(sys.argv[1])
+    id_list = event_data["event"]["groupAddedDevicesIds"]
+
+    if not id_list:
+        print("No devices entered the group.")
+        sys.exit(12)
+
+    for jss_id in id_list:
+        print(f"Restarting device ID {jss_id}...")
+        time.sleep(200)  # Wait for Apple TV to be responsive
+        perform_api_call(
+            f"mobiledevicecommands/command/RestartDevice/id/{jss_id}",
+            method="POST",
+        )
+        time.sleep(10)
+        perform_api_call(
+            f"mobiledevicecommands/command/UpdateInventory/id/{jss_id}",
+            method="POST",
+        )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/smart_group_slack.py b/data/workflows/scripts/smart_group_slack.py
new file mode 100644
index 0000000..a6fe095
--- /dev/null
+++ b/data/workflows/scripts/smart_group_slack.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Send Slack notification on smart group membership change.
+
+Webhook event: SmartGroupComputerMembershipChange
+"""
+
+import json
+import requests
+import sys
+from datetime import datetime
+
+SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+
+
+def main():
+    event_data = json.loads(sys.argv[1])
+    event = event_data["event"]
+
+    id_list = event.get("groupAddedDevicesIds", [])
+    if not id_list:
+        print("No devices entered the group.")
+        sys.exit(12)
+
+    group_name = event.get("name", "Unknown Group")
+    _device_names = event.get("groupAddedDevices", [])
+
+    slack_data = {
+        "attachments": [
+            {
+                "color": "#056ae6",
+                "title": f"Smart Group Update: {group_name}",
+                "text": f"{len(id_list)} device(s) added to {group_name}",
+                "footer": "JAWA Webhook Automation",
+                "ts": datetime.timestamp(datetime.now()),
+            }
+        ]
+    }
+
+    resp = requests.post(
+        SLACK_WEBHOOK_URL,
+        data=json.dumps(slack_data),
+        headers={"Content-Type": "application/json"},
+    )
+    print(f"Slack notification: {resp.status_code}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/scripts/teams_notification.py b/data/workflows/scripts/teams_notification.py
new file mode 100644
index 0000000..86e6bea
--- /dev/null
+++ b/data/workflows/scripts/teams_notification.py
@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""Send Microsoft Teams notifications for Jamf Pro webhook events.
+
+Webhook event: Any Jamf Pro webhook event
+API privileges: None (outbound notification only)
+"""
+
+import json
+import requests
+import sys
+
+TEAMS_WEBHOOK_URL = "placeholder_value"  # Teams incoming webhook URL
+
+
+def send_teams_notification(webhook_url, title, message, facts=None):
+    """Send a notification to Microsoft Teams via incoming webhook.
+
+    Uses Adaptive Card format for rich messages.
+
+    Args:
+        webhook_url: Teams incoming webhook URL
+        title: Card title
+        message: Card body text
+        facts: List of {"name": str, "value": str} dicts
+    """
+    body = [
+        {
+            "type": "TextBlock",
+            "size": "Medium",
+            "weight": "Bolder",
+            "text": title,
+        },
+        {"type": "TextBlock", "text": message, "wrap": True},
+    ]
+
+    if facts:
+        body.append({"type": "FactSet", "facts": facts})
+
+    card = {
+        "type": "message",
+        "attachments": [
+            {
+                "contentType": "application/vnd.microsoft.card.adaptive",
+                "contentUrl": None,
+                "content": {
+                    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
+                    "type": "AdaptiveCard",
+                    "version": "1.4",
+                    "body": body,
+                },
+            }
+        ],
+    }
+
+    response = requests.post(
+        webhook_url,
+        data=json.dumps(card),
+        headers={"Content-Type": "application/json"},
+    )
+    return response.status_code == 200
+
+
+def main():
+    # 1. Parse webhook event
+    try:
+        event_data = json.loads(sys.argv[1])
+    except (json.JSONDecodeError, IndexError) as err:
+        print(f"Error parsing webhook JSON: {err}")
+        sys.exit(1)
+
+    webhook_name = event_data.get("webhook", {}).get(
+        "webhookEvent", "Unknown Event"
+    )
+    event = event_data.get("event", {})
+
+    # 2. Build notification details
+    device_name = event.get("deviceName") or event.get("computer", {}).get(
+        "deviceName", "Unknown"
+    )
+    serial = event.get("serialNumber") or event.get("computer", {}).get(
+        "serialNumber", "Unknown"
+    )
+    jss_id = event.get("jssID") or event.get("computer", {}).get(
+        "jssID", "Unknown"
+    )
+
+    title = f"Jamf Pro: {webhook_name}"
+    message = f"Event received for device **{device_name}**."
+
+    facts = [
+        {"name": "Event", "value": webhook_name},
+        {"name": "Device", "value": device_name},
+        {"name": "Serial", "value": str(serial)},
+        {"name": "JSS ID", "value": str(jss_id)},
+    ]
+
+    # 3. Send notification
+    success = send_teams_notification(TEAMS_WEBHOOK_URL, title, message, facts)
+
+    if success:
+        print(f"Teams notification sent for {webhook_name}: {device_name}")
+    else:
+        print(f"Failed to send Teams notification for {webhook_name}")
+        sys.exit(3)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/data/workflows/workflow_config.json b/data/workflows/workflow_config.json
new file mode 100644
index 0000000..0991e6c
--- /dev/null
+++ b/data/workflows/workflow_config.json
@@ -0,0 +1,304 @@
+[
+    {
+        "slug": "device-naming",
+        "title": "Device Naming by Asset Tag",
+        "description": "Automatically rename mobile devices using their Inventory Preload asset tag when they enroll.",
+        "category": "provisioning",
+        "trigger_type": "webhook",
+        "trigger_event": "MobileDeviceEnrolled",
+        "script_file": "device_naming.py",
+        "notebook_slug": "device-naming",
+        "api_privileges": [
+            "Read Mobile Devices",
+            "Send Mobile Device Set Device Name Command"
+        ],
+        "config_params": [
+            {
+                "key": "server_url",
+                "label": "Jamf Pro URL",
+                "placeholder": "https://example.jamfcloud.com",
+                "type": "text"
+            },
+            {
+                "key": "client_id",
+                "label": "OAuth Client ID",
+                "placeholder": "your_client_id",
+                "type": "text"
+            },
+            {
+                "key": "client_secret",
+                "label": "OAuth Client Secret",
+                "placeholder": "your_client_secret",
+                "type": "password"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — device renamed"},
+            {"code": 1, "meaning": "Invalid webhook JSON"},
+            {"code": 2, "meaning": "Could not retrieve device record"},
+            {"code": 3, "meaning": "No asset tag found"},
+            {"code": 4, "meaning": "Rename command failed"},
+            {"code": 5, "meaning": "Device has room assignment (skipped)"}
+        ],
+        "tags": ["enrollment", "mobile", "naming", "asset-tag"],
+        "order": 1
+    },
+    {
+        "slug": "smart-group-slack",
+        "title": "Smart Group Slack Notification",
+        "description": "Send a Slack message when devices are added to a smart group.",
+        "category": "observability",
+        "trigger_type": "webhook",
+        "trigger_event": "SmartGroupComputerMembershipChange",
+        "script_file": "smart_group_slack.py",
+        "notebook_slug": "smart-group-actions",
+        "api_privileges": [],
+        "config_params": [
+            {
+                "key": "SLACK_WEBHOOK_URL",
+                "label": "Slack Webhook URL",
+                "placeholder": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL",
+                "type": "text"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — notification sent"},
+            {"code": 12, "meaning": "No devices entered the group"}
+        ],
+        "tags": ["smart-group", "slack", "notification"],
+        "order": 2
+    },
+    {
+        "slug": "smart-group-appletv",
+        "title": "Apple TV Restart on Smart Group",
+        "description": "Automatically restart Apple TV devices and update inventory when they join a smart group.",
+        "category": "provisioning",
+        "trigger_type": "webhook",
+        "trigger_event": "SmartGroupMobileDeviceMembershipChange",
+        "script_file": "smart_group_appletv.py",
+        "notebook_slug": "smart-group-actions",
+        "api_privileges": [
+            "Send Mobile Device Restart Device Command",
+            "Send Mobile Device Update Inventory Command"
+        ],
+        "config_params": [
+            {
+                "key": "server_url",
+                "label": "Jamf Pro URL",
+                "placeholder": "https://example.jamfcloud.com",
+                "type": "text"
+            },
+            {
+                "key": "client_id",
+                "label": "OAuth Client ID",
+                "placeholder": "your_client_id",
+                "type": "text"
+            },
+            {
+                "key": "client_secret",
+                "label": "OAuth Client Secret",
+                "placeholder": "your_client_secret",
+                "type": "password"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — devices restarted"},
+            {"code": 12, "meaning": "No devices entered the group"}
+        ],
+        "tags": ["smart-group", "apple-tv", "restart", "mobile"],
+        "order": 3
+    },
+    {
+        "slug": "return-to-service",
+        "title": "Return to Service",
+        "description": "Erase and re-enroll mobile devices with WiFi profile when they enter a smart group, enabling zero-touch device recycling.",
+        "category": "provisioning",
+        "trigger_type": "webhook",
+        "trigger_event": "SmartGroupMobileDeviceMembershipChange",
+        "script_file": "return_to_service.py",
+        "notebook_slug": "return-to-service",
+        "api_privileges": [
+            "Read Mobile Devices",
+            "Update Mobile Devices",
+            "Send Mobile Device Erase Device Command"
+        ],
+        "config_params": [
+            {
+                "key": "server_url",
+                "label": "Jamf Pro URL",
+                "placeholder": "https://example.jamfcloud.com",
+                "type": "text"
+            },
+            {
+                "key": "client_id",
+                "label": "OAuth Client ID",
+                "placeholder": "your_client_id",
+                "type": "text"
+            },
+            {
+                "key": "client_secret",
+                "label": "OAuth Client Secret",
+                "placeholder": "your_client_secret",
+                "type": "password"
+            },
+            {
+                "key": "wifi_ssid",
+                "label": "WiFi SSID",
+                "placeholder": "Your-WiFi-SSID",
+                "type": "text"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — erase with RtS sent"},
+            {"code": 12, "meaning": "No devices entered the group"}
+        ],
+        "tags": ["smart-group", "mobile", "erase", "return-to-service", "wipe"],
+        "order": 4
+    },
+    {
+        "slug": "enrollment-pipeline",
+        "title": "Enrollment Pipeline",
+        "description": "Multi-stage enrollment workflow that matches devices to a CSV assignment list, updates records, and provisions automatically.",
+        "category": "provisioning",
+        "trigger_type": "webhook",
+        "trigger_event": "MobileDeviceEnrolled / ComputerAdded",
+        "script_file": "enrollment_pipeline.py",
+        "notebook_slug": "enrollment-pipeline",
+        "api_privileges": [
+            "Read Mobile Devices",
+            "Update Mobile Devices",
+            "Send Mobile Device Set Device Name Command",
+            "Send Mobile Device Erase Device Command"
+        ],
+        "config_params": [
+            {
+                "key": "server_url",
+                "label": "Jamf Pro URL",
+                "placeholder": "https://example.jamfcloud.com",
+                "type": "text"
+            },
+            {
+                "key": "client_id",
+                "label": "OAuth Client ID",
+                "placeholder": "your_client_id",
+                "type": "text"
+            },
+            {
+                "key": "client_secret",
+                "label": "OAuth Client Secret",
+                "placeholder": "your_client_secret",
+                "type": "password"
+            },
+            {
+                "key": "CSV_FILE",
+                "label": "CSV Assignment File Path",
+                "placeholder": "/usr/local/JAWA/resources/files/DeviceAssignments.csv",
+                "type": "text"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — pipeline completed"},
+            {"code": 12, "meaning": "No devices entered the group"}
+        ],
+        "tags": ["enrollment", "mobile", "pipeline", "csv", "provisioning"],
+        "order": 5
+    },
+    {
+        "slug": "event-tracker-sqlite",
+        "title": "Event Tracker (SQLite)",
+        "description": "Log webhook check-in events to a SQLite database with configurable cooldown to prevent duplicate processing.",
+        "category": "observability",
+        "trigger_type": "webhook",
+        "trigger_event": "ComputerCheckIn",
+        "script_file": "event_tracker_sqlite.py",
+        "notebook_slug": "event-tracking",
+        "api_privileges": [],
+        "config_params": [
+            {
+                "key": "DB_PATH",
+                "label": "SQLite Database Path",
+                "placeholder": "placeholder_value",
+                "type": "text"
+            },
+            {
+                "key": "COOLDOWN_HOURS",
+                "label": "Cooldown Hours",
+                "placeholder": "12",
+                "type": "number"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — event recorded or within cooldown"},
+            {"code": 1, "meaning": "Invalid webhook JSON"},
+            {"code": 2, "meaning": "No device ID found in event"}
+        ],
+        "tags": ["check-in", "logging", "sqlite", "cooldown"],
+        "order": 6
+    },
+    {
+        "slug": "teams-notification",
+        "title": "Teams Notification",
+        "description": "Send Microsoft Teams Adaptive Card notifications for any Jamf Pro webhook event.",
+        "category": "observability",
+        "trigger_type": "webhook",
+        "trigger_event": "Any Event",
+        "script_file": "teams_notification.py",
+        "notebook_slug": "event-tracking",
+        "api_privileges": [],
+        "config_params": [
+            {
+                "key": "TEAMS_WEBHOOK_URL",
+                "label": "Teams Webhook URL",
+                "placeholder": "placeholder_value",
+                "type": "text"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — notification sent"},
+            {"code": 1, "meaning": "Invalid webhook JSON"},
+            {"code": 3, "meaning": "Failed to send notification"}
+        ],
+        "tags": ["teams", "notification", "adaptive-card"],
+        "order": 7
+    },
+    {
+        "slug": "ea-update",
+        "title": "Extension Attribute Update",
+        "description": "Update a mobile device extension attribute from webhook events, supporting both standard Jamf Pro and custom JSON formats.",
+        "category": "extensions",
+        "trigger_type": "webhook",
+        "trigger_event": "ComputerInventoryCompleted",
+        "script_file": "ea_update.py",
+        "notebook_slug": "extension-attributes",
+        "api_privileges": [
+            "Read Mobile Devices",
+            "Update Mobile Devices"
+        ],
+        "config_params": [
+            {
+                "key": "server_url",
+                "label": "Jamf Pro URL",
+                "placeholder": "https://example.jamfcloud.com",
+                "type": "text"
+            },
+            {
+                "key": "client_id",
+                "label": "OAuth Client ID",
+                "placeholder": "your_client_id",
+                "type": "text"
+            },
+            {
+                "key": "client_secret",
+                "label": "OAuth Client Secret",
+                "placeholder": "your_client_secret",
+                "type": "password"
+            }
+        ],
+        "exit_codes": [
+            {"code": 0, "meaning": "Success — EA updated"},
+            {"code": 1, "meaning": "Invalid webhook JSON"}
+        ],
+        "tags": ["extension-attribute", "mobile", "classic-api"],
+        "order": 8
+    }
+]
diff --git a/templates/workflows/catalog.html b/templates/workflows/catalog.html
new file mode 100644
index 0000000..77292c7
--- /dev/null
+++ b/templates/workflows/catalog.html
@@ -0,0 +1,57 @@
+{% extends "shared/_layout.html" %}
+{% block title %}Templates - JAWA{% endblock %}
+{% block content %}
+<div class="hero-section">
+    <div class="container">
+        <h2>Template Catalog</h2>
+        <p>Pre-built automation templates for Jamf Pro webhooks.</p>
+        <div class="hero-cta">
+            <a href="/templates/import" class="btn btn-hero-primary">Import Template</a>
+            <a href="/webhooks" class="btn btn-hero-secondary">View Webhooks</a>
+        </div>
+    </div>
+</div>
+<div class="container" style="max-width: 1100px;">
+    <div class="text-center mb-4">
+        <button class="filter-btn active" onclick="filterWorkflows('all', this)">All</button>
+        <button class="filter-btn" onclick="filterWorkflows('provisioning', this)">Provisioning</button>
+        <button class="filter-btn" onclick="filterWorkflows('observability', this)">Observability</button>
+        <button class="filter-btn" onclick="filterWorkflows('extensions', this)">Extensions</button>
+    </div>
+
+    <div class="row g-3">
+        {% for wf in workflows %}
+        <div class="col-md-6 col-lg-4 workflow-item" data-category="{{ wf.category }}">
+            <a href="/templates/{{ wf.slug }}" style="text-decoration: none;">
+                <div class="workflow-card">
+                    <span class="badge badge-{{ wf.category }} mb-2">{{ wf.category }}</span>
+                    <h5 class="card-title">{{ wf.title }}</h5>
+                    <p class="card-text">{{ wf.description }}</p>
+                    <div style="font-size: 0.75rem; color: var(--color-text-muted);">
+                        {{ wf.trigger_event }}
+                    </div>
+                </div>
+            </a>
+        </div>
+        {% endfor %}
+    </div>
+</div>
+{% endblock %}
+
+{% block additional_js %}
+<script>
+function filterWorkflows(category, btn) {
+    var items = document.querySelectorAll('.workflow-item');
+    items.forEach(function(item) {
+        if (category === 'all' || item.dataset.category === category) {
+            item.style.display = '';
+        } else {
+            item.style.display = 'none';
+        }
+    });
+    var btns = document.querySelectorAll('.filter-btn');
+    btns.forEach(function(b) { b.classList.remove('active'); });
+    btn.classList.add('active');
+}
+</script>
+{% endblock %}
diff --git a/templates/workflows/enable.html b/templates/workflows/enable.html
new file mode 100644
index 0000000..c969e2c
--- /dev/null
+++ b/templates/workflows/enable.html
@@ -0,0 +1,64 @@
+{% extends "shared/_layout.html" %}
+{% block title %}Enable {{ workflow.title }} - JAWA{% endblock %}
+{% block content %}
+<div class="container" style="max-width: 750px; padding-top: 2rem;">
+    <div class="mb-3">
+        <a href="/templates/{{ workflow.slug }}" style="color: var(--color-primary); font-size: 0.88rem;">&larr; Back to {{ workflow.title }}</a>
+    </div>
+
+    <h2 style="font-size: 1.6rem; text-align: left; letter-spacing: -0.5px; margin-top: 0.5rem;">Enable Template</h2>
+    <p style="color: var(--color-text-secondary); font-size: 0.92rem;">
+        Configure and install <strong>{{ workflow.title }}</strong> as a webhook automation.
+    </p>
+
+    <div class="form-section mt-4">
+        <form method="post" action="/templates/{{ workflow.slug }}/enable">
+            <div class="mb-3">
+                <label for="webhook-name" class="form-label" style="font-weight: 500;">Webhook Name</label>
+                <input type="text" name="webhook_name" id="webhook-name" class="form-control"
+                       value="{{ workflow.title }}" required>
+            </div>
+
+            {% if credentials %}
+            <div class="mb-4">
+                <label for="credential-set" class="form-label" style="font-weight: 500;">Credential Set</label>
+                <select name="credential_set" id="credential-set" class="form-control">
+                    <option value="">-- None (configure manually below) --</option>
+                    {% for cred in credentials %}
+                    <option value="{{ loop.index0 }}">{{ cred.name }} ({{ cred.server_url }})</option>
+                    {% endfor %}
+                </select>
+                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
+                    Select a saved credential set to auto-fill server URL, client ID, and client secret.
+                </div>
+            </div>
+            {% else %}
+            <div class="mb-4" style="font-size: 0.85rem; color: var(--color-text-muted);">
+                No saved credential sets. <a href="/setup/credentials">Add one in Setup</a> or configure values below.
+            </div>
+            {% endif %}
+
+            {% if workflow.config_params %}
+            <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bottom: 0.75rem;">Template Configuration</h6>
+            {% for param in workflow.config_params %}
+            <div class="mb-3">
+                <label for="param-{{ param.key }}" class="form-label" style="font-weight: 500; font-size: 0.88rem;">{{ param.label }}</label>
+                <input type="{{ param.type or 'text' }}" name="{{ param.key }}" id="param-{{ param.key }}"
+                       class="form-control" placeholder="{{ param.placeholder }}">
+            </div>
+            {% endfor %}
+            {% endif %}
+
+            <div class="d-flex justify-content-center mt-4">
+                <button type="submit" class="btn btn-jawa">Enable Template</button>
+            </div>
+        </form>
+    </div>
+
+    {% if workflow.trigger_event %}
+    <div class="mt-3 mb-5" style="font-size: 0.82rem; color: var(--color-text-muted); text-align: center;">
+        This template listens for: <strong>{{ workflow.trigger_event }}</strong>
+    </div>
+    {% endif %}
+</div>
+{% endblock %}
diff --git a/templates/workflows/import.html b/templates/workflows/import.html
new file mode 100644
index 0000000..ca97e33
--- /dev/null
+++ b/templates/workflows/import.html
@@ -0,0 +1,27 @@
+{% extends "shared/_layout.html" %}
+{% block title %}Import Template - JAWA{% endblock %}
+{% block content %}
+<div class="container" style="max-width: 700px; padding-top: 2rem;">
+    <div class="mb-3">
+        <a href="/templates" style="color: var(--color-primary); font-size: 0.88rem;">&larr; Back to Catalog</a>
+    </div>
+
+    <h2 style="font-size: 1.8rem; letter-spacing: -1px;">Import Template</h2>
+    <p style="color: var(--color-text-secondary);">
+        Upload a <code>.jawa.json</code> package to install a new template.
+    </p>
+
+    <div class="form-section mt-4">
+        <form method="post" enctype="multipart/form-data">
+            <div class="mb-3">
+                <label for="package" class="form-label" style="font-weight: 500;">Template Package</label>
+                <input type="file" name="package" id="package" accept=".json" class="form-control">
+                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
+                    Select a <code>.jawa.json</code> file exported from the template documentation site.
+                </div>
+            </div>
+            <button type="submit" class="btn btn-jawa mt-2">Import</button>
+        </form>
+    </div>
+</div>
+{% endblock %}
diff --git a/views/template_view.py b/views/template_view.py
new file mode 100644
index 0000000..4a0d15f
--- /dev/null
+++ b/views/template_view.py
@@ -0,0 +1,462 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import json
+import os
+from typing import Any, Dict, List, Union
+
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    send_file,
+    session,
+    url_for,
+)
+from markupsafe import escape
+
+from bin import logger
+from bin.view_modifiers import response
+
+blueprint = Blueprint(
+    "template_view",
+    __name__,
+    template_folder="../templates",
+)
+
+logthis = logger.setup_child_logger("jawa", "template_view")
+
+ERROR_TITLE = "Session Timed Out"
+ERROR_MSG_SIGN_IN = "Please sign in again"
+ERROR_INVALID_PKG = "Invalid Package"
+LOGOUT_ENDPOINT = "home_view.logout"
+CATALOG_ENDPOINT = "template_view.catalog"
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+WORKFLOW_CONFIG = os.path.join(
+    BASE_DIR, "data", "workflows", "workflow_config.json"
+)
+TEMPLATE_SCRIPTS_DIR = os.path.join(BASE_DIR, "data", "workflows", "scripts")
+SCRIPTS_DIR = os.path.join(BASE_DIR, "scripts")
+WEBHOOKS_FILE = os.path.join(BASE_DIR, "data", "webhooks.json")
+CREDENTIALS_FILE = os.path.join(BASE_DIR, "data", "credentials.json")
+
+
+def _load_config() -> list:
+    """Load the workflow configuration file."""
+    try:
+        with open(WORKFLOW_CONFIG, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError):
+        logthis.warning("Could not load workflow_config.json")
+        return []
+
+
+def _get_workflow_by_slug(slug: str) -> Union[Dict[str, Any], None]:
+    """Look up a workflow by its URL slug."""
+    workflows = _load_config()
+    for wf in workflows:
+        if wf.get("slug") == slug:
+            return wf
+    return None
+
+
+def _load_credentials() -> List[Dict[str, Any]]:
+    """Load saved credential sets."""
+    if not os.path.isfile(CREDENTIALS_FILE):
+        return []
+    try:
+        with open(CREDENTIALS_FILE, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (json.JSONDecodeError, IOError):
+        return []
+
+
+def _install_package(package: dict) -> None:
+    """Install a .jawa.json workflow package into JAWA."""
+    script = package["script"]
+    script_path = os.path.join(SCRIPTS_DIR, script["filename"])
+    with open(script_path, "w", encoding="utf-8") as f:
+        f.write(script["content"])
+    os.chmod(script_path, 0o755)
+
+    _register_webhook(
+        {
+            "name": package["name"],
+            "event": package["trigger"]["event"],
+            "script": script["filename"],
+            "enabled": True,
+        }
+    )
+
+    logthis.info(
+        f"Installed workflow package: {package['name']} "
+        f"(script: {script['filename']})"
+    )
+
+
+def _load_webhooks() -> list:
+    """Load the current webhooks list from disk."""
+    if not os.path.isfile(WEBHOOKS_FILE):
+        return []
+    try:
+        with open(WEBHOOKS_FILE, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (json.JSONDecodeError, IOError):
+        return []
+
+
+def _register_webhook(entry: dict) -> None:
+    """Append a webhook entry and save to disk."""
+    webhooks = _load_webhooks()
+    webhooks.append(entry)
+    with open(WEBHOOKS_FILE, "w", encoding="utf-8") as f:
+        json.dump(webhooks, f, indent=2)
+
+
+def _apply_credentials(
+    script_content: str,
+    workflow: dict,
+    credential_index: str,
+    credentials: list,
+) -> str:
+    """Substitute credential placeholders in script content."""
+    if not credential_index or not credentials:
+        return script_content
+    try:
+        cred = credentials[int(credential_index)]
+    except (ValueError, IndexError):
+        return script_content
+
+    cred_keys = ("server_url", "client_id", "client_secret")
+    for param in workflow.get("config_params", []):
+        key = param.get("key", "")
+        if key in cred_keys and cred.get(key):
+            script_content = script_content.replace(
+                param["placeholder"], cred[key]
+            )
+    return script_content
+
+
+def _apply_form_params(script_content: str, workflow: dict) -> str:
+    """Substitute remaining form-supplied placeholders."""
+    for param in workflow.get("config_params", []):
+        key = param.get("key", "")
+        form_value = request.form.get(key, "")
+        if form_value:
+            form_value = str(escape(form_value))
+            script_content = script_content.replace(
+                param["placeholder"], form_value
+            )
+    return script_content
+
+
+def _write_script(name: str, content: str) -> str:
+    """Write script content to a unique file and return the filename."""
+    safe_name = name.replace(" ", "_").replace("/", "_").lower()
+    dest_filename = f"{safe_name}.py"
+    dest_path = os.path.join(SCRIPTS_DIR, dest_filename)
+
+    counter = 1
+    while os.path.isfile(dest_path):
+        dest_filename = f"{safe_name}_{counter}.py"
+        dest_path = os.path.join(SCRIPTS_DIR, dest_filename)
+        counter += 1
+
+    with open(dest_path, "w", encoding="utf-8") as f:
+        f.write(content)
+    os.chmod(dest_path, 0o755)
+    return dest_filename
+
+
+def _validate_package(package: dict) -> Union[str, None]:
+    """Validate a .jawa.json package. Returns error message or None."""
+    for field in ("name", "trigger", "script"):
+        if field not in package:
+            return f"Missing required field: {field}"
+
+    if (
+        "filename" not in package["script"]
+        or "content" not in package["script"]
+    ):
+        return "Script must have filename and content."
+
+    if "event" not in package["trigger"]:
+        return "Trigger must have an event field."
+
+    return None
+
+
+# ---- Backward-compat redirects from /workflows ----
+
+
+@blueprint.route("/workflows")
+def workflows_redirect() -> Response:
+    return redirect(url_for(CATALOG_ENDPOINT), code=301)
+
+
+@blueprint.route("/workflows/<path:rest>")
+def workflows_rest_redirect(rest: str) -> Response:
+    return redirect(f"/templates/{rest}", code=301)
+
+
+# ---- Template routes ----
+
+
+@blueprint.route("/templates")
+@response(template_file="workflows/catalog.html")
+def catalog() -> Union[Response, Dict[str, Any]]:
+    """Template catalog page showing all bundled templates."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+    workflows = _load_config()
+    workflows.sort(key=lambda w: w.get("order", 99))
+
+    categories: Dict[str, list] = {}
+    for wf in workflows:
+        cat = wf.get("category", "other")
+        categories.setdefault(cat, []).append(wf)
+
+    return {
+        "username": session.get("username"),
+        "workflows": workflows,
+        "categories": categories,
+    }
+
+
+@blueprint.route("/templates/<slug>")
+@response(template_file="workflows/detail.html")
+def detail(slug: str) -> Union[Response, Dict[str, Any]]:
+    """Template detail page with description and script preview."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+    slug = str(escape(slug))
+    workflow = _get_workflow_by_slug(slug)
+    if not workflow:
+        return redirect(url_for(CATALOG_ENDPOINT))
+
+    script_content = ""
+    script_path = os.path.join(TEMPLATE_SCRIPTS_DIR, workflow["script_file"])
+    if os.path.isfile(script_path):
+        with open(script_path, "r", encoding="utf-8") as f:
+            script_content = f.read()
+
+    credentials = _load_credentials()
+
+    return {
+        "username": session.get("username"),
+        "workflow": workflow,
+        "script_content": script_content,
+        "credentials": credentials,
+    }
+
+
+@blueprint.route("/templates/<slug>/script")
+def download_script(slug: str) -> Union[Response, str]:
+    """Download the template script file."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+    slug = str(escape(slug))
+    workflow = _get_workflow_by_slug(slug)
+    if not workflow:
+        return redirect(url_for(CATALOG_ENDPOINT))
+
+    script_path = os.path.join(TEMPLATE_SCRIPTS_DIR, workflow["script_file"])
+    if not os.path.isfile(script_path):
+        return redirect(
+            url_for(
+                "error",
+                error="Script not found",
+                error_message=f"Script {workflow['script_file']} not found.",
+            )
+        )
+
+    return send_file(
+        script_path,
+        as_attachment=True,
+        download_name=workflow["script_file"],
+    )
+
+
+@blueprint.route("/templates/<slug>/enable", methods=["GET", "POST"])
+def enable_template(slug: str) -> Union[Response, str]:
+    """Enable a template: configure and install as a webhook."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+
+    slug = str(escape(slug))
+    workflow = _get_workflow_by_slug(slug)
+    if not workflow:
+        return redirect(url_for(CATALOG_ENDPOINT))
+
+    credentials = _load_credentials()
+
+    if request.method == "GET":
+        return render_template(
+            "workflows/enable.html",
+            username=session.get("username"),
+            workflow=workflow,
+            credentials=credentials,
+        )
+
+    # POST: enable the template
+    webhook_name = str(
+        escape(request.form.get("webhook_name", workflow["title"]))
+    )
+
+    src_path = os.path.join(TEMPLATE_SCRIPTS_DIR, workflow["script_file"])
+    if not os.path.isfile(src_path):
+        return redirect(
+            url_for(
+                "error",
+                error="Script not found",
+                error_message=f"Script {workflow['script_file']} not found.",
+            )
+        )
+
+    with open(src_path, "r", encoding="utf-8") as f:
+        script_content = f.read()
+
+    script_content = _apply_credentials(
+        script_content,
+        workflow,
+        request.form.get("credential_set", ""),
+        credentials,
+    )
+    script_content = _apply_form_params(script_content, workflow)
+    dest_filename = _write_script(webhook_name, script_content)
+
+    _register_webhook(
+        {
+            "name": webhook_name,
+            "tag": "custom",
+            "url": session.get("url", ""),
+            "event": workflow.get("trigger_event", ""),
+            "script": dest_filename,
+            "description": workflow.get("description", ""),
+            "enabled": True,
+        }
+    )
+
+    logthis.info(
+        f"[{session.get('url')}] {session.get('username')} "
+        f"enabled template: {webhook_name} (script: {dest_filename})"
+    )
+
+    return redirect(
+        url_for(
+            "success",
+            success_msg=f"Enabled template: {webhook_name}",
+        )
+    )
+
+
+@blueprint.route("/templates/import", methods=["GET", "POST"])
+@response(template_file="workflows/import.html")
+def import_template() -> Union[Response, Dict[str, Any]]:
+    """Upload a .jawa.json package to install a new template."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+
+    if request.method != "POST":
+        return {"username": session.get("username")}
+
+    uploaded = request.files.get("package")
+    if not uploaded or not uploaded.filename.endswith(".jawa.json"):
+        return redirect(
+            url_for(
+                "error",
+                error="Invalid File",
+                error_message="Please upload a .jawa.json file.",
+            )
+        )
+
+    try:
+        package = json.load(uploaded)
+    except json.JSONDecodeError:
+        return redirect(
+            url_for(
+                "error",
+                error="Invalid JSON",
+                error_message="The uploaded file is not valid JSON.",
+            )
+        )
+
+    validation_error = _validate_package(package)
+    if validation_error:
+        return redirect(
+            url_for(
+                "error",
+                error=ERROR_INVALID_PKG,
+                error_message=validation_error,
+            )
+        )
+
+    _install_package(package)
+    logthis.info(
+        f"[{session.get('url')}] {session.get('username')} "
+        f"imported template: {package['name']}"
+    )
+    return redirect(
+        url_for(
+            "success",
+            success_msg=f"Installed template: {package['name']}",
+        )
+    )

From f398b8429b3e7621a345fe4c9bce06f84766a605 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Wed, 11 Feb 2026 12:14:06 -0600
Subject: [PATCH 10/84] feature: unified automations (#61)

* feat: add shared infrastructure modules

* feat: implement automation handlers for various services

* feat: add unified automation templates and views
---
 bin/auth.py                                   |  52 +++
 bin/context_processors.py                     |  37 ++
 bin/data_store.py                             | 214 +++++++++
 .../automations/_partials/_cron_fields.html   |  72 +++
 .../automations/_partials/_custom_fields.html |  14 +
 .../automations/_partials/_jamf_fields.html   |  52 +++
 .../automations/_partials/_okta_fields.html   |  15 +
 templates/automations/create.html             |  86 ++++
 templates/automations/delete.html             |  19 +
 templates/automations/detail.html             |  46 ++
 templates/automations/edit.html               |  90 ++++
 templates/automations/list.html               |  38 ++
 templates/automations/list_all.html           |  50 ++
 templates/shared/_macros.html                 | 167 +++++++
 templates/workflows/detail.html               |  84 ++++
 views/_type_handlers/__init__.py              |  46 ++
 views/_type_handlers/base.py                  | 102 +++++
 views/_type_handlers/cron_handler.py          | 243 ++++++++++
 views/_type_handlers/custom_handler.py        | 183 ++++++++
 views/_type_handlers/jamf_handler.py          | 429 ++++++++++++++++++
 views/_type_handlers/okta_handler.py          | 210 +++++++++
 views/automation_view.py                      | 375 +++++++++++++++
 22 files changed, 2624 insertions(+)
 create mode 100644 bin/auth.py
 create mode 100644 bin/context_processors.py
 create mode 100644 bin/data_store.py
 create mode 100644 templates/automations/_partials/_cron_fields.html
 create mode 100644 templates/automations/_partials/_custom_fields.html
 create mode 100644 templates/automations/_partials/_jamf_fields.html
 create mode 100644 templates/automations/_partials/_okta_fields.html
 create mode 100644 templates/automations/create.html
 create mode 100644 templates/automations/delete.html
 create mode 100644 templates/automations/detail.html
 create mode 100644 templates/automations/edit.html
 create mode 100644 templates/automations/list.html
 create mode 100644 templates/automations/list_all.html
 create mode 100644 templates/shared/_macros.html
 create mode 100644 templates/workflows/detail.html
 create mode 100644 views/_type_handlers/__init__.py
 create mode 100644 views/_type_handlers/base.py
 create mode 100644 views/_type_handlers/cron_handler.py
 create mode 100644 views/_type_handlers/custom_handler.py
 create mode 100644 views/_type_handlers/jamf_handler.py
 create mode 100644 views/_type_handlers/okta_handler.py
 create mode 100644 views/automation_view.py

diff --git a/bin/auth.py b/bin/auth.py
new file mode 100644
index 0000000..dfe61b6
--- /dev/null
+++ b/bin/auth.py
@@ -0,0 +1,52 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from functools import wraps
+from typing import Any, Callable, TypeVar
+
+from flask import redirect, session, url_for
+
+F = TypeVar("F", bound=Callable[..., Any])
+
+
+def login_required(f: F) -> F:
+    """Decorator that redirects to logout if no active session."""
+
+    @wraps(f)
+    def decorated(*args: Any, **kwargs: Any) -> Any:
+        if "username" not in session:
+            return redirect(
+                url_for(
+                    "home_view.logout",
+                    error_title="Session Timed Out",
+                    error_message="Please sign in again",
+                )
+            )
+        return f(*args, **kwargs)
+
+    return decorated  # type: ignore
diff --git a/bin/context_processors.py b/bin/context_processors.py
new file mode 100644
index 0000000..34f0a67
--- /dev/null
+++ b/bin/context_processors.py
@@ -0,0 +1,37 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from flask import session
+
+
+def inject_common_vars() -> dict:
+    """Auto-inject session variables into all templates."""
+    return {
+        "username": session.get("username"),
+        "session_url": session.get("url"),
+    }
diff --git a/bin/data_store.py b/bin/data_store.py
new file mode 100644
index 0000000..ac3db43
--- /dev/null
+++ b/bin/data_store.py
@@ -0,0 +1,214 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import json
+import os
+from typing import Any, Dict, List, Optional
+
+from werkzeug.utils import secure_filename
+
+from bin import logger
+
+logthis = logger.setup_child_logger("jawa", "data_store")
+
+_base_dir = os.path.dirname(os.path.dirname(__file__))
+
+WEBHOOKS_FILE = os.path.abspath(
+    os.path.join(_base_dir, "data", "webhooks.json")
+)
+CRON_FILE = os.path.abspath(os.path.join(_base_dir, "data", "cron.json"))
+SERVER_FILE = os.path.abspath(os.path.join(_base_dir, "data", "server.json"))
+TIME_FILE = os.path.abspath(os.path.join(_base_dir, "data", "time.json"))
+SCRIPTS_DIR = os.path.abspath(os.path.join(_base_dir, "scripts"))
+
+
+# --- Low-level I/O ---
+
+
+def _read_json(filepath: str, default: Any = None) -> Any:
+    if default is None:
+        default = []
+    if not os.path.isfile(filepath):
+        with open(filepath, "w") as f:
+            json.dump(default, f)
+        return default
+    with open(filepath, "r") as f:
+        try:
+            return json.load(f)
+        except json.JSONDecodeError:
+            return default
+
+
+def _write_json(filepath: str, data: Any) -> None:
+    with open(filepath, "w") as f:
+        json.dump(data, f, indent=4)
+
+
+# --- Webhooks ---
+
+
+def get_all_webhooks() -> List[Dict]:
+    return _read_json(WEBHOOKS_FILE)
+
+
+def get_webhooks_by_tag(tag: str) -> List[Dict]:
+    return [w for w in get_all_webhooks() if w.get("tag") == tag]
+
+
+def get_webhook_by_name(name: str) -> Optional[Dict]:
+    for w in get_all_webhooks():
+        if w.get("name") == name:
+            return w
+    return None
+
+
+def webhook_name_exists(name: str) -> bool:
+    return any(w.get("name") == name for w in get_all_webhooks())
+
+
+def add_webhook(entry: Dict) -> None:
+    data = get_all_webhooks()
+    data.append(entry)
+    _write_json(WEBHOOKS_FILE, data)
+
+
+def update_webhook_in_list(
+    webhooks: List[Dict], name: str, updates: Dict
+) -> None:
+    """Update a webhook entry in an already-loaded list (in-place)."""
+    for w in webhooks:
+        if w.get("name") == name:
+            w.update(updates)
+            break
+
+
+def save_all_webhooks(data: List[Dict]) -> None:
+    _write_json(WEBHOOKS_FILE, data)
+
+
+def remove_webhook(name: str) -> Optional[Dict]:
+    data = get_all_webhooks()
+    removed = None
+    for w in data:
+        if w.get("name") == name:
+            removed = dict(w)
+            data.remove(w)
+            break
+    _write_json(WEBHOOKS_FILE, data)
+    return removed
+
+
+# --- Crons ---
+
+
+def get_all_crons() -> List[Dict]:
+    return _read_json(CRON_FILE)
+
+
+def get_cron_by_name(name: str) -> Optional[Dict]:
+    for c in get_all_crons():
+        if c.get("name") == name:
+            return c
+    return None
+
+
+def cron_name_exists(name: str) -> bool:
+    return any(c.get("name") == name for c in get_all_crons())
+
+
+def add_cron(entry: Dict) -> None:
+    data = get_all_crons()
+    data.append(entry)
+    _write_json(CRON_FILE, data)
+
+
+def save_all_crons(data: List[Dict]) -> None:
+    _write_json(CRON_FILE, data)
+
+
+def remove_cron(name: str) -> Optional[Dict]:
+    data = get_all_crons()
+    removed = None
+    for c in data:
+        if c.get("name") == name:
+            removed = dict(c)
+            data.remove(c)
+            break
+    _write_json(CRON_FILE, data)
+    return removed
+
+
+# --- Server Config ---
+
+
+def get_server_config() -> Dict:
+    if not os.path.isfile(SERVER_FILE):
+        return {}
+    with open(SERVER_FILE, "r") as f:
+        try:
+            return json.load(f)
+        except json.JSONDecodeError:
+            return {}
+
+
+def get_jawa_address() -> Optional[str]:
+    return get_server_config().get("jawa_address")
+
+
+def get_time_data() -> Dict:
+    with open(TIME_FILE, "r") as f:
+        return json.load(f)
+
+
+# --- Script Management ---
+
+
+def save_script(
+    file_storage: Any, name_prefix: str, separator: str = "-"
+) -> str:
+    """Save an uploaded script with a prefixed filename.
+
+    Returns the absolute path to the saved file.
+    """
+    if not os.path.isdir(SCRIPTS_DIR):
+        os.mkdir(SCRIPTS_DIR)
+    filename = file_storage.filename
+    if " " in filename:
+        filename = filename.replace(" ", "-")
+    new_filename = f"{name_prefix}{separator}{filename}"
+    safe_name = secure_filename(new_filename)
+    filepath = os.path.join(SCRIPTS_DIR, safe_name)
+    file_storage.save(filepath)
+    os.chmod(filepath, mode=0o0755)
+    return filepath
+
+
+def retire_script(path: str) -> None:
+    """Rename a script to .old instead of deleting it."""
+    if os.path.exists(path):
+        os.rename(path, f"{path}.old")
diff --git a/templates/automations/_partials/_cron_fields.html b/templates/automations/_partials/_cron_fields.html
new file mode 100644
index 0000000..8a82707
--- /dev/null
+++ b/templates/automations/_partials/_cron_fields.html
@@ -0,0 +1,72 @@
+{% from "shared/_macros.html" import description_field, script_upload %}
+
+<input type="text" class="form-control text-center" placeholder="Name of Timed Job (cron task)" name="cron_name"
+       {% if not edit_mode %}required{% endif %} autofocus pattern="[^' ']+"
+       value="{{ cron_info.name if cron_info else '' }}"
+       oninvalid="this.setCustomValidity('Single-string name required. (i.e. single_string or string)')">
+
+{{ description_field(cron_info.description if cron_info else '') }}
+
+<label class="form-check-label text-center" for="frequency">Frequency:</label>
+<select name="frequency" id="frequency" class="form-control text-center"
+        onchange="showFrequencyFields(this.value)">
+    <option value="">{{ '-- Keep current --' if edit_mode else '' }}</option>
+    <option value="everyhour">Every Hour</option>
+    <option value="everyday">Every Day</option>
+    <option value="everyweek">Every Week</option>
+    <option value="everymonth">Every Month</option>
+    <option value="custom">Custom</option>
+</select>
+
+<div id="freq-everyday" style="display:none">
+    <label for="daytime">At what time?</label>
+    <select name="daytime" id="daytime">
+        <option value=""></option>
+        {% for hour in hours %}
+            <option value="{{ hour.id }}">{{ hour.value }}</option>
+        {% endfor %}
+    </select>
+</div>
+
+<div id="freq-everyweek" style="display:none">
+    <label for="weekday">On what day?</label>
+    <select name="weekday" id="weekday">
+        <option value=""></option>
+        {% for day in days %}
+            <option value="{{ day.cron }}">{{ day.value }}</option>
+        {% endfor %}
+    </select>
+    <label for="weektime">At what time?</label>
+    <select name="weektime" id="weektime">
+        <option value=""></option>
+        {% for hour in hours %}
+            <option value="{{ hour.id }}">{{ hour.value }}</option>
+        {% endfor %}
+    </select>
+</div>
+
+<div id="freq-everymonth" style="display:none">
+    <label for="monthday">On what day of the month?</label>
+    <select name="monthday" id="monthday">
+        <option value=""></option>
+        {% for d in range(1, 32) %}
+            <option value="{{ d }}">{{ d }}</option>
+        {% endfor %}
+    </select>
+    <label for="monthtime">At what time?</label>
+    <select name="monthtime" id="monthtime">
+        <option value=""></option>
+        {% for hour in hours %}
+            <option value="{{ hour.id }}">{{ hour.value }}</option>
+        {% endfor %}
+    </select>
+</div>
+
+<div id="freq-custom" style="display:none">
+    <label for="customfreq">Cron expression (<a href="https://crontab.guru" target="_blank">example</a>):</label>
+    <input type="text" name="customfreq" id="customfreq"
+           pattern="^((((\d+,)+\d+|(\d+(\/|-|#)\d+)|\d+L?|\*(\/\d+)?|L(-\d+)?|\?|[A-Z]{3}(-[A-Z]{3})?) ?){5,7})$"
+           title="Use a valid cron expression.">
+</div>
+
+{{ script_upload("script", required=not edit_mode) }}
diff --git a/templates/automations/_partials/_custom_fields.html b/templates/automations/_partials/_custom_fields.html
new file mode 100644
index 0000000..b95dd51
--- /dev/null
+++ b/templates/automations/_partials/_custom_fields.html
@@ -0,0 +1,14 @@
+{% from "shared/_macros.html" import description_field, script_upload, auth_fields %}
+
+<input name="custom_name" type="text" pattern="[^' ']+" placeholder="New Webhook Name (no spaces)"
+       {% if not edit_mode %}required{% endif %}
+       title="No spaces, please." class="form-control text-center"
+       value="{{ webhook_info[0].name if webhook_info else '' }}" autofocus>
+
+{% if error %}
+    <div class="alert-danger text-center">{{ error }}</div>
+{% endif %}
+
+{{ description_field(webhook_info[0].description if webhook_info else '') }}
+{{ script_upload("new_file", required=not edit_mode) }}
+{{ auth_fields(show_basic=true, show_custom=true, show_output=true, webhook_info=webhook_info) }}
diff --git a/templates/automations/_partials/_jamf_fields.html b/templates/automations/_partials/_jamf_fields.html
new file mode 100644
index 0000000..74fb1fe
--- /dev/null
+++ b/templates/automations/_partials/_jamf_fields.html
@@ -0,0 +1,52 @@
+{% from "shared/_macros.html" import description_field, script_upload, jamf_auth_fields %}
+
+<input name="webhook_name" type="text" pattern="[^' ']+" placeholder="New Webhook Name (no spaces)"
+       {% if not edit_mode %}required{% endif %}
+       title="No spaces, please." class="form-control text-center"
+       value="{{ webhook_info[0].name if webhook_info else '' }}" autofocus>
+
+{% if error %}
+    <div class="alert-danger text-center">{{ error }}</div>
+{% endif %}
+
+<div class="d-flex justify-content-center text-center">
+    <b>Jamf Event:</b>
+</div>
+<select class="form-control text-center" name="event"
+        onchange="showSmartGroupNote(this.value)"
+        {% if not edit_mode %}required{% endif %}>
+    <option value="">{{ '-- Keep current --' if edit_mode else '' }}</option>
+    <option value="ComputerAdded" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerAdded' }}>ComputerAdded</option>
+    <option value="ComputerCheckIn" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerCheckIn' }}>ComputerCheckIn</option>
+    <option value="ComputerInventoryCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerInventoryCompleted' }}>ComputerInventoryCompleted</option>
+    <option value="ComputerPatchPolicyCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerPatchPolicyCompleted' }}>ComputerPatchPolicyCompleted</option>
+    <option value="ComputerPolicyFinished" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerPolicyFinished' }}>ComputerPolicyFinished</option>
+    <option value="ComputerPushCapabilityChanged" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerPushCapabilityChanged' }}>ComputerPushCapabilityChanged</option>
+    <option value="DeviceAddedToDEP" {{ 'selected' if webhook_info and webhook_info[0].event == 'DeviceAddedToDEP' }}>DeviceAddedToDEP</option>
+    <option value="DeviceRateLimited" {{ 'selected' if webhook_info and webhook_info[0].event == 'DeviceRateLimited' }}>DeviceRateLimited</option>
+    <option value="JSSShutdown" {{ 'selected' if webhook_info and webhook_info[0].event == 'JSSShutdown' }}>JSSShutdown</option>
+    <option value="JSSStartup" {{ 'selected' if webhook_info and webhook_info[0].event == 'JSSStartup' }}>JSSStartup</option>
+    <option value="MobileDeviceCheckIn" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceCheckIn' }}>MobileDeviceCheckIn</option>
+    <option value="MobileDeviceCommandCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceCommandCompleted' }}>MobileDeviceCommandCompleted</option>
+    <option value="MobileDeviceEnrolled" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceEnrolled' }}>MobileDeviceEnrolled</option>
+    <option value="MobileDeviceInventoryCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceInventoryCompleted' }}>MobileDeviceInventoryCompleted</option>
+    <option value="MobileDevicePushSent" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDevicePushSent' }}>MobileDevicePushSent</option>
+    <option value="MobileDeviceUnEnrolled" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceUnEnrolled' }}>MobileDeviceUnEnrolled</option>
+    <option value="PatchSoftwareTitleUpdated" {{ 'selected' if webhook_info and webhook_info[0].event == 'PatchSoftwareTitleUpdated' }}>PatchSoftwareTitleUpdated</option>
+    <option value="PushSent" {{ 'selected' if webhook_info and webhook_info[0].event == 'PushSent' }}>PushSent</option>
+    <option value="RestAPIOperation" {{ 'selected' if webhook_info and webhook_info[0].event == 'RestAPIOperation' }}>RestAPIOperation</option>
+    <option value="SCEPChallenge" {{ 'selected' if webhook_info and webhook_info[0].event == 'SCEPChallenge' }}>SCEPChallenge</option>
+    <option value="SmartGroupComputerMembershipChange" {{ 'selected' if webhook_info and webhook_info[0].event == 'SmartGroupComputerMembershipChange' }}>SmartGroupComputerMembershipChange</option>
+    <option value="SmartGroupMobileDeviceMembershipChange" {{ 'selected' if webhook_info and webhook_info[0].event == 'SmartGroupMobileDeviceMembershipChange' }}>SmartGroupMobileDeviceMembershipChange</option>
+    <option value="SmartGroupUserMembershipChange" {{ 'selected' if webhook_info and webhook_info[0].event == 'SmartGroupUserMembershipChange' }}>SmartGroupUserMembershipChange</option>
+</select>
+
+<div id="smartGroupNote" class="text-center" style="display:none">
+    * Note: If utilizing the event for Smart Group Membership Change, after submitting, navigate to the
+    <a href="{{ session_url }}/webhooks.html" style="color:#3c6aa7;" target="_blank">Webhooks</a> setting in Jamf Pro
+    and adjust the proper Smart Group for this Webhook.
+</div>
+
+{{ description_field(webhook_info[0].description if webhook_info else '') }}
+{{ script_upload("new_file", required=not edit_mode) }}
+{{ jamf_auth_fields(webhook_info) }}
diff --git a/templates/automations/_partials/_okta_fields.html b/templates/automations/_partials/_okta_fields.html
new file mode 100644
index 0000000..1700c67
--- /dev/null
+++ b/templates/automations/_partials/_okta_fields.html
@@ -0,0 +1,15 @@
+{% from "shared/_macros.html" import description_field, script_upload %}
+
+<input name="webhookname" type="text" pattern="[^' ']+" placeholder="New Webhook Name (no spaces)" required
+       title="No spaces, please." class="form-control text-center" value="{{ name }}" autofocus>
+<input type="text" name="okta_server" class="form-control text-center" value="{{ okta_server }}"
+       placeholder="Okta Server URI" required pattern="https?://.+" title="Use https://">
+<input type="text" name="token" class="form-control text-center" value="{{ token }}"
+       placeholder="Okta Token" required>
+<input type="text" name="event" class="form-control text-center" value="{{ event }}"
+       placeholder="Okta Event" required>
+<a href="https://developer.okta.com/docs/reference/api/event-types/" style="color:#3c6aa7;" target="_blank">Okta Event Types</a>
+(example: user.lifecycle.deactivate)
+
+{{ description_field() }}
+{{ script_upload("script") }}
diff --git a/templates/automations/create.html b/templates/automations/create.html
new file mode 100644
index 0000000..424b68c
--- /dev/null
+++ b/templates/automations/create.html
@@ -0,0 +1,86 @@
+{% extends "shared/_layout.html" %}
+
+{% block title %}New {{ handler.display_name }} | JAWA{% endblock %}
+
+{% block content %}
+<div class="container" style="padding-top: 5rem;">
+    <div class="page-sub-nav">
+        <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
+        <a href="/automations/{{ auto_type }}/new" class="active">Create</a>
+    </div>
+    <div class="form-container">
+        <form method="POST" action="/automations/{{ auto_type }}/new"
+              class="form-section overflow-auto" enctype="multipart/form-data">
+            <h1>New {{ handler.display_name }}
+                {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h1>
+
+            {% if auto_type == 'jamfpro' %}
+                {% include "automations/_partials/_jamf_fields.html" %}
+            {% elif auto_type == 'okta' %}
+                {% include "automations/_partials/_okta_fields.html" %}
+            {% elif auto_type == 'custom' %}
+                {% include "automations/_partials/_custom_fields.html" %}
+            {% elif auto_type == 'cron' %}
+                {% include "automations/_partials/_cron_fields.html" %}
+            {% endif %}
+
+            <div class="d-flex justify-content-center">
+                <button type="submit" class="btn btn-jawa"
+                        style="margin: 5px; padding: 5px; width: 150px">Create</button>
+            </div>
+        </form>
+    </div>
+</div>
+{% endblock %}
+
+{% block additional_js %}
+<script>
+function toggleAuthField(divId) {
+    var el = document.getElementById(divId);
+    if (el) {
+        el.style.display = el.style.display === 'none' ? 'inline-block' : 'none';
+    }
+}
+
+function showSmartGroupNote(event) {
+    var note = document.getElementById('smartGroupNote');
+    if (note) {
+        var smartGroupEvents = [
+            'SmartGroupComputerMembershipChange',
+            'SmartGroupMobileDeviceMembershipChange',
+            'SmartGroupUserMembershipChange'
+        ];
+        note.style.display = smartGroupEvents.includes(event) ? 'inline-block' : 'none';
+    }
+}
+
+function showFrequencyFields(val) {
+    var ids = ['freq-everyday', 'freq-everyweek', 'freq-everymonth', 'freq-custom'];
+    ids.forEach(function(id) {
+        var el = document.getElementById(id);
+        if (el) el.style.display = 'none';
+    });
+    var mapping = {
+        'everyday': 'freq-everyday',
+        'everyweek': 'freq-everyweek',
+        'everymonth': 'freq-everymonth',
+        'custom': 'freq-custom'
+    };
+    if (mapping[val]) {
+        var target = document.getElementById(mapping[val]);
+        if (target) target.style.display = 'inline-block';
+    }
+}
+
+document.querySelectorAll('input[type="file"]').forEach(function(input) {
+    input.addEventListener('change', function(e) {
+        var label = this.closest('.custom-file')
+            ? this.closest('.custom-file').querySelector('.custom-file-label')
+            : null;
+        if (label && e.target.files[0]) {
+            label.textContent = e.target.files[0].name;
+        }
+    });
+});
+</script>
+{% endblock %}
diff --git a/templates/automations/delete.html b/templates/automations/delete.html
new file mode 100644
index 0000000..1a2d6dc
--- /dev/null
+++ b/templates/automations/delete.html
@@ -0,0 +1,19 @@
+{% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section, delete_confirmation %}
+
+{% block title %}Delete {{ automation_name }} | JAWA{% endblock %}
+
+{% block content %}
+{{ hero_section(
+    title="Delete " ~ handler.display_name,
+    subtitle="Confirm deletion of " ~ automation_name
+) }}
+
+<div class="container">
+    {{ delete_confirmation(
+        automation_name,
+        handler.display_name,
+        "/automations/" ~ auto_type ~ "/" ~ automation_name ~ "/delete"
+    ) }}
+</div>
+{% endblock %}
diff --git a/templates/automations/detail.html b/templates/automations/detail.html
new file mode 100644
index 0000000..50caa7b
--- /dev/null
+++ b/templates/automations/detail.html
@@ -0,0 +1,46 @@
+{% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section, detail_field %}
+
+{% block title %}{{ automation.name }} | JAWA{% endblock %}
+
+{% block content %}
+{{ hero_section(
+    title=automation.name,
+    subtitle=handler.display_name ~ " automation"
+) }}
+
+<div class="container">
+    <div class="page-sub-nav">
+        <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
+        <a href="/automations/{{ auto_type }}/{{ automation.name }}" class="active">Detail</a>
+        {% if handler.supports_edit %}
+        <a href="/automations/{{ auto_type }}/{{ automation.name }}/edit">Edit</a>
+        {% endif %}
+    </div>
+
+    <div class="form-section" style="max-width: 700px; margin: 0 auto;">
+        <div class="d-flex align-items-center mb-3">
+            <span class="badge {{ handler.badge_class }} me-2">{{ handler.display_name }}</span>
+            <h4 class="mb-0">{{ automation.name }}</h4>
+        </div>
+
+        {% for label, value in detail_fields %}
+            {{ detail_field(label, value) }}
+        {% endfor %}
+
+        {% if automation.jamf_id and auto_type == 'jamfpro' %}
+        <div class="overflow-auto log-frame text-break" style="max-width: 100%; max-height: 10vh">
+            <b>View in Jamf</b>: <a href="{{ session_url }}/webhooks.html?id={{ automation.jamf_id }}" target="_blank">Open in Jamf Pro</a>
+        </div>
+        {% endif %}
+
+        <div class="d-flex justify-content-center mt-4 gap-2">
+            <a href="/automations/{{ auto_type }}" class="btn btn-secondary" style="border-radius: 1rem;">Back</a>
+            {% if handler.supports_edit %}
+            <a href="/automations/{{ auto_type }}/{{ automation.name }}/edit" class="btn btn-jawa">Edit</a>
+            {% endif %}
+            <a href="/automations/{{ auto_type }}/{{ automation.name }}/delete" class="btn btn-danger">Delete</a>
+        </div>
+    </div>
+</div>
+{% endblock %}
diff --git a/templates/automations/edit.html b/templates/automations/edit.html
new file mode 100644
index 0000000..3e32f9b
--- /dev/null
+++ b/templates/automations/edit.html
@@ -0,0 +1,90 @@
+{% extends "shared/_layout.html" %}
+
+{% block title %}Edit {{ automation_name }} | JAWA{% endblock %}
+
+{% block content %}
+<div class="container" style="padding-top: 5rem;">
+    <div class="page-sub-nav">
+        <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
+        <a href="/automations/{{ auto_type }}/{{ automation_name }}">Detail</a>
+        <a href="/automations/{{ auto_type }}/{{ automation_name }}/edit" class="active">Edit</a>
+    </div>
+    <div class="form-container">
+        <form method="POST" action="/automations/{{ auto_type }}/{{ automation_name }}/edit"
+              class="form-section overflow-auto" enctype="multipart/form-data">
+            <h1>Edit {{ handler.display_name }}
+                {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h1>
+
+            {% set edit_mode = true %}
+            {% if auto_type == 'jamfpro' %}
+                {% include "automations/_partials/_jamf_fields.html" %}
+            {% elif auto_type == 'custom' %}
+                {% include "automations/_partials/_custom_fields.html" %}
+            {% elif auto_type == 'cron' %}
+                {% include "automations/_partials/_cron_fields.html" %}
+            {% endif %}
+
+            <div class="d-flex justify-content-center gap-2">
+                <a href="/automations/{{ auto_type }}/{{ automation_name }}"
+                   class="btn btn-secondary" style="margin: 5px; padding: 5px; width: 150px; border-radius: 1rem;">Cancel</a>
+                <button type="submit" name="button_choice" value="Save" class="btn btn-jawa"
+                        style="margin: 5px; padding: 5px; width: 150px">Save</button>
+                <button type="submit" name="button_choice" value="Delete" class="btn btn-danger"
+                        style="margin: 5px; padding: 5px; width: 150px">Delete</button>
+            </div>
+        </form>
+    </div>
+</div>
+{% endblock %}
+
+{% block additional_js %}
+<script>
+function toggleAuthField(divId) {
+    var el = document.getElementById(divId);
+    if (el) {
+        el.style.display = el.style.display === 'none' ? 'inline-block' : 'none';
+    }
+}
+
+function showSmartGroupNote(event) {
+    var note = document.getElementById('smartGroupNote');
+    if (note) {
+        var smartGroupEvents = [
+            'SmartGroupComputerMembershipChange',
+            'SmartGroupMobileDeviceMembershipChange',
+            'SmartGroupUserMembershipChange'
+        ];
+        note.style.display = smartGroupEvents.includes(event) ? 'inline-block' : 'none';
+    }
+}
+
+function showFrequencyFields(val) {
+    var ids = ['freq-everyday', 'freq-everyweek', 'freq-everymonth', 'freq-custom'];
+    ids.forEach(function(id) {
+        var el = document.getElementById(id);
+        if (el) el.style.display = 'none';
+    });
+    var mapping = {
+        'everyday': 'freq-everyday',
+        'everyweek': 'freq-everyweek',
+        'everymonth': 'freq-everymonth',
+        'custom': 'freq-custom'
+    };
+    if (mapping[val]) {
+        var target = document.getElementById(mapping[val]);
+        if (target) target.style.display = 'inline-block';
+    }
+}
+
+document.querySelectorAll('input[type="file"]').forEach(function(input) {
+    input.addEventListener('change', function(e) {
+        var label = this.closest('.custom-file')
+            ? this.closest('.custom-file').querySelector('.custom-file-label')
+            : null;
+        if (label && e.target.files[0]) {
+            label.textContent = e.target.files[0].name;
+        }
+    });
+});
+</script>
+{% endblock %}
diff --git a/templates/automations/list.html b/templates/automations/list.html
new file mode 100644
index 0000000..29dd8a5
--- /dev/null
+++ b/templates/automations/list.html
@@ -0,0 +1,38 @@
+{% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section, automation_card, empty_state %}
+
+{% block title %}{{ handler.display_name }} | JAWA{% endblock %}
+
+{% block content %}
+{{ hero_section(
+    title=handler.display_name,
+    subtitle=(items|length|string) ~ " " ~ ("automation" if items|length == 1 else "automations"),
+    create_url="/automations/" ~ auto_type ~ "/new",
+    create_label="Create " ~ handler.display_name,
+    secondary_url="/automations",
+    secondary_label="All Automations"
+) }}
+
+<div class="container">
+    <div class="page-sub-nav">
+        <a href="/automations">All</a>
+        <a href="/automations/jamfpro" {% if auto_type == 'jamfpro' %}class="active"{% endif %}>Jamf Pro</a>
+        <a href="/automations/okta" {% if auto_type == 'okta' %}class="active"{% endif %}>Okta</a>
+        <a href="/automations/custom" {% if auto_type == 'custom' %}class="active"{% endif %}>Custom</a>
+        <a href="/automations/cron" {% if auto_type == 'cron' %}class="active"{% endif %}>Cron</a>
+    </div>
+
+    {% if not items %}
+        {{ empty_state(
+            "No " ~ handler.display_name ~ " automations to display.",
+            create_url="/automations/" ~ auto_type ~ "/new"
+        ) }}
+    {% else %}
+    <div class="row dash-list justify-content-center" style="margin-right: 0; margin-left: 0">
+        {% for item in items %}
+            {{ automation_card(item, handler, loop.index, auto_type) }}
+        {% endfor %}
+    </div>
+    {% endif %}
+</div>
+{% endblock %}
diff --git a/templates/automations/list_all.html b/templates/automations/list_all.html
new file mode 100644
index 0000000..c4efcb4
--- /dev/null
+++ b/templates/automations/list_all.html
@@ -0,0 +1,50 @@
+{% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section, automation_card, empty_state %}
+
+{% block title %}All Automations | JAWA{% endblock %}
+
+{% block content %}
+{{ hero_section(
+    title="All Automations",
+    subtitle="Manage all webhooks and timed automations",
+    create_url="/automations/jamfpro/new",
+    create_label="Create Webhook",
+    secondary_url="/automations/cron/new",
+    secondary_label="Create Timed Job"
+) }}
+
+<div class="container">
+    <div class="page-sub-nav">
+        <a href="/automations" class="active">All</a>
+        <a href="/automations/jamfpro">Jamf Pro</a>
+        <a href="/automations/okta">Okta</a>
+        <a href="/automations/custom">Custom</a>
+        <a href="/automations/cron">Cron</a>
+    </div>
+
+    {% set ns = namespace(has_any=false) %}
+    {% for tag, data in categorized.items() %}
+        {% if data.get('items', []) %}
+            {% set ns.has_any = true %}
+        {% endif %}
+    {% endfor %}
+
+    {% if not ns.has_any %}
+        {{ empty_state("No automations to display.", create_url="/automations/jamfpro/new") }}
+    {% else %}
+        {% for tag, data in categorized.items() %}
+            {% if data.get('items', []) %}
+            <div class="section-header {% if not loop.first %}mt-4{% endif %}">
+                <h3>{{ data.handler.display_name }}</h3>
+                <a href="/automations/{{ tag }}" style="font-size: 0.85rem; color: var(--color-primary);">View all</a>
+            </div>
+            <div class="row dash-list justify-content-center" style="margin-right: 0; margin-left: 0">
+                {% for item in data.get('items', []) %}
+                    {{ automation_card(item, data.handler, loop.index, tag) }}
+                {% endfor %}
+            </div>
+            {% endif %}
+        {% endfor %}
+    {% endif %}
+</div>
+{% endblock %}
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
new file mode 100644
index 0000000..f24452b
--- /dev/null
+++ b/templates/shared/_macros.html
@@ -0,0 +1,167 @@
+{# Shared Jinja2 macros for JAWA automation templates #}
+
+{% macro hero_section(title, subtitle="", create_url="", create_label="Create", secondary_url="", secondary_label="") %}
+<div class="hero-section">
+    <div class="container">
+        <h2>{{ title }}</h2>
+        {% if subtitle %}
+        <p>{{ subtitle|safe }}</p>
+        {% endif %}
+        {% if create_url or secondary_url %}
+        <div class="hero-cta">
+            {% if create_url %}
+            <a href="{{ create_url }}" class="btn btn-hero-primary">{{ create_label }}</a>
+            {% endif %}
+            {% if secondary_url %}
+            <a href="{{ secondary_url }}" class="btn btn-hero-secondary">{{ secondary_label }}</a>
+            {% endif %}
+        </div>
+        {% endif %}
+    </div>
+</div>
+{% endmacro %}
+
+{% macro automation_card(item, handler, loop_index, auto_type, session_url="") %}
+<div class="card col-md-6 col-lg-3 webhooks-list container-bg border-info d-flex flex-column">
+    <span class="badge {{ handler.badge_class }} mb-2">{{ handler.display_name }}</span>
+    <img src="/static/img/{{ handler.icon }}" class="card-img mx-auto" alt="{{ handler.display_name }}">
+    <div class="card-body flex-column d-flex webhooks-list">
+        <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
+        <a class="btn btn-jawa text-white overflow-hidden mt-auto"
+           href="/automations/{{ auto_type }}/{{ item.name }}">
+            View
+        </a>
+    </div>
+</div>
+{% endmacro %}
+
+{% macro detail_field(label, value) %}
+<div class="overflow-auto log-frame text-break" style="max-width: 100%; max-height: 10vh">
+    <b>{{ label }}</b>: {{ value }}
+</div>
+{% endmacro %}
+
+{% macro empty_state(message, create_url="", create_label="Create one now") %}
+<div class="form-section" style="max-width: fit-content; text-align: center; margin: 1rem auto;">
+    <div class="table-responsive">
+        {{ message }}
+        {% if create_url %}
+        <a href="{{ create_url }}">{{ create_label }}</a>
+        {% endif %}
+    </div>
+</div>
+{% endmacro %}
+
+{% macro delete_confirmation(item_name, item_type, delete_url) %}
+<div class="confirm-delete-box">
+    <h4>Delete {{ item_type }}: {{ item_name }}?</h4>
+    <p>This action cannot be undone.</p>
+    <form method="POST" action="{{ delete_url }}">
+        <a href="javascript:history.back()" class="btn btn-secondary" style="margin: 5px; padding: 5px; width: 150px;">Cancel</a>
+        <button type="submit" class="btn btn-danger">Delete</button>
+    </form>
+</div>
+{% endmacro %}
+
+{% macro description_field(value="") %}
+<textarea name="description" rows="3" type="text" placeholder="Description (optional)"
+          class="form-control text-center">{{ value }}</textarea>
+{% endmacro %}
+
+{% macro script_upload(field_name="new_file", required=true) %}
+<div class="d-flex justify-content-center text-center custom-file">
+    <input type="file" name="{{ field_name }}" id="{{ field_name }}" pattern="[^' ']+"
+           {% if required %}required{% endif %}
+           class="custom-file-input text-center"
+           title="No Spaces in the filename!"
+           accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
+    <label class="custom-file-label text-center" for="{{ field_name }}">Upload a script</label>
+</div>
+<div class="d-flex justify-content-center">
+    <p>Examples: [<a href="{{ url_for('resources_view.python') }}" class="alert-link">Python</a>,
+    <a href="{{ url_for('resources_view.bash') }}" class="alert-link">Bash</a>]</p>
+</div>
+{% endmacro %}
+
+{% macro auth_fields(show_basic=true, show_custom=true, show_output=false, webhook_info=none) %}
+{% if show_basic %}
+<div class="d-flex justify-content-center">
+    <label>
+        <input type="checkbox" class="form-check-input" name="basic" value="basic"
+               onchange="toggleAuthField('auth-basic-fields')">
+        <b>&nbsp;Basic Authentication (optional):</b>
+    </label>
+</div>
+<div class="d-flex justify-content-center">
+    <div id="auth-basic-fields" style="display:none" class="center_box">
+        <div class="d-flex justify-content-center">
+            <input class="form-control-sm" name="basic_username" title="Username (optional)"
+                   autocomplete="off" placeholder="Username (optional)"
+                   {% if webhook_info and webhook_info[0].webhook_username != 'null' %}value="{{ webhook_info[0].webhook_username }}"{% endif %}>
+            <input name="new-password" autocomplete="off" class="form-control-sm" type="password"
+                   title="Password (optional)" placeholder="Password (optional)">
+        </div>
+    </div>
+</div>
+{% endif %}
+{% if show_custom %}
+<div class="d-flex justify-content-center">
+    <label>
+        <input type="checkbox" class="form-check-input" name="custom" value="custom"
+               onchange="toggleAuthField('auth-custom-fields')">
+        <b>&nbsp;Custom Authentication (optional):</b>
+    </label>
+</div>
+<div class="d-flex justify-content-center">
+    <div id="auth-custom-fields" style="display:none">
+        <input name="api_key" class="form-control-sm" title="x-api-key (optional)"
+               placeholder="x-api-key value (optional)" autocomplete="off"
+               {% if webhook_info and webhook_info[0].api_key != 'null' %}value="{{ webhook_info[0].api_key }}"{% endif %}>
+    </div>
+</div>
+{% endif %}
+{% if show_output %}
+<div class="d-flex justify-content-center">
+    <label>
+        <input name="output" class="form-check-input" type="checkbox"
+               {% if webhook_info and webhook_info[0].output %}checked{% endif %}>
+        <b>&nbsp;Send script output in response?</b>
+    </label>
+</div>
+{% endif %}
+{% endmacro %}
+
+{% macro jamf_auth_fields(webhook_info=none) %}
+<div class="d-flex justify-content-center">
+    <label>
+        <input type="radio" name="choice" value="basic"
+               onchange="toggleAuthField('jamf-auth-basic-fields')">
+        <b>&nbsp;Basic Authentication (optional):</b>
+    </label>
+</div>
+<div class="d-flex justify-content-center">
+    <div id="jamf-auth-basic-fields" style="display:none" class="center_box">
+        <div class="d-flex justify-content-center">
+            <input class="form-control-sm" name="basic_username" title="Username (optional)"
+                   autocomplete="off" placeholder="Username (optional)" style="padding: unset"
+                   {% if webhook_info and webhook_info[0].webhook_username != 'null' %}value="{{ webhook_info[0].webhook_username }}"{% endif %}>
+            <input name="basic_password" autocomplete="off" class="form-control-sm" type="password"
+                   title="Password (optional)" placeholder="Password (optional)" style="padding: unset">
+        </div>
+    </div>
+</div>
+<div class="d-flex justify-content-center">
+    <label>
+        <input type="radio" name="choice" value="custom"
+               onchange="toggleAuthField('jamf-auth-custom-fields')">
+        <b>&nbsp;Custom Authentication (optional):</b>
+    </label>
+</div>
+<div class="d-flex justify-content-center">
+    <div id="jamf-auth-custom-fields" style="display:none">
+        <input name="api_key" class="form-control-sm" title="x-api-key (optional)"
+               placeholder="x-api-key value (optional)" autocomplete="off"
+               {% if webhook_info and webhook_info[0].api_key != 'null' %}value="{{ webhook_info[0].api_key }}"{% endif %}>
+    </div>
+</div>
+{% endmacro %}
diff --git a/templates/workflows/detail.html b/templates/workflows/detail.html
new file mode 100644
index 0000000..ba1484b
--- /dev/null
+++ b/templates/workflows/detail.html
@@ -0,0 +1,84 @@
+{% extends "shared/_layout.html" %}
+{% block title %}{{ workflow.title }} - JAWA{% endblock %}
+{% block content %}
+<div class="container" style="max-width: 1100px; padding-top: 2rem;">
+    <div class="mb-3">
+        <a href="/templates" style="color: var(--color-primary); font-size: 0.88rem;">&larr; Back to Catalog</a>
+    </div>
+
+    <div class="row">
+        <div class="col-lg-8">
+            <span class="badge badge-{{ workflow.category }} mb-2">{{ workflow.category }}</span>
+            <h2 style="font-size: 1.8rem; text-align: left; letter-spacing: -1px; margin-top: 0.5rem;">{{ workflow.title }}</h2>
+            <p style="color: var(--color-text-secondary); font-size: 0.95rem;">{{ workflow.description }}</p>
+
+            {% if workflow.exit_codes %}
+            <h5 style="font-size: 1rem; font-weight: 600; margin-top: 2rem;">Exit Codes</h5>
+            <table class="hippocrates" style="max-width: 600px;">
+                <thead>
+                    <tr><th>Code</th><th>Meaning</th></tr>
+                </thead>
+                <tbody>
+                    {% for ec in workflow.exit_codes %}
+                    <tr><td>{{ ec.code }}</td><td>{{ ec.meaning }}</td></tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+            {% endif %}
+
+            <h5 style="font-size: 1rem; font-weight: 600; margin-top: 2rem;">Script Preview</h5>
+            <div class="script-preview">
+                <pre><code class="language-python">{{ script_content }}</code></pre>
+            </div>
+
+            <div class="mt-3 mb-5 d-flex gap-2">
+                <a href="/templates/{{ workflow.slug }}/enable" class="btn btn-jawa">Enable Template</a>
+                <a href="/templates/{{ workflow.slug }}/script" class="btn btn-outline-secondary" style="border-radius: var(--radius-sm);">Download Script</a>
+            </div>
+        </div>
+
+        <div class="col-lg-4">
+            <div class="workflow-detail-sidebar">
+                <dl>
+                    <dt>Trigger Event</dt>
+                    <dd>{{ workflow.trigger_event }}</dd>
+
+                    <dt>Script File</dt>
+                    <dd><code>{{ workflow.script_file }}</code></dd>
+
+                    {% if workflow.api_privileges %}
+                    <dt>API Privileges</dt>
+                    <dd>
+                        <ul style="padding-left: 1.2rem; margin: 0;">
+                            {% for priv in workflow.api_privileges %}
+                            <li>{{ priv }}</li>
+                            {% endfor %}
+                        </ul>
+                    </dd>
+                    {% endif %}
+
+                    {% if workflow.config_params %}
+                    <dt>Configuration</dt>
+                    <dd>
+                        <ul style="padding-left: 1.2rem; margin: 0;">
+                            {% for param in workflow.config_params %}
+                            <li>{{ param.label }}</li>
+                            {% endfor %}
+                        </ul>
+                    </dd>
+                    {% endif %}
+
+                    {% if workflow.tags %}
+                    <dt>Tags</dt>
+                    <dd>
+                        {% for tag in workflow.tags %}
+                        <span class="badge" style="background-color: var(--color-surface-raised); color: var(--color-text-secondary); font-size: 0.7rem; margin-right: 0.25rem;">{{ tag }}</span>
+                        {% endfor %}
+                    </dd>
+                    {% endif %}
+                </dl>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}
diff --git a/views/_type_handlers/__init__.py b/views/_type_handlers/__init__.py
new file mode 100644
index 0000000..2c8b205
--- /dev/null
+++ b/views/_type_handlers/__init__.py
@@ -0,0 +1,46 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from typing import Dict, Optional
+
+from views._type_handlers.base import AutomationHandler
+from views._type_handlers.jamf_handler import JamfHandler
+from views._type_handlers.okta_handler import OktaHandler
+from views._type_handlers.custom_handler import CustomHandler
+from views._type_handlers.cron_handler import CronHandler
+
+HANDLERS: Dict[str, AutomationHandler] = {
+    "jamfpro": JamfHandler(),
+    "okta": OktaHandler(),
+    "custom": CustomHandler(),
+    "cron": CronHandler(),
+}
+
+
+def get_handler(auto_type: str) -> Optional[AutomationHandler]:
+    return HANDLERS.get(auto_type)
diff --git a/views/_type_handlers/base.py b/views/_type_handlers/base.py
new file mode 100644
index 0000000..d990adc
--- /dev/null
+++ b/views/_type_handlers/base.py
@@ -0,0 +1,102 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from abc import ABC, abstractmethod
+from typing import Any, Dict, List, Optional, Tuple
+
+
+class AutomationError(Exception):
+    """Raised when an automation operation fails."""
+
+    def __init__(
+        self, title: str, message: str, link: Optional[str] = None
+    ) -> None:
+        self.title = title
+        self.message = message
+        self.link = link
+        super().__init__(message)
+
+
+class AutomationHandler(ABC):
+    """Base class for automation type handlers."""
+
+    tag: str = ""
+    display_name: str = ""
+    badge_class: str = ""
+    icon: str = "webhook.png"
+    supports_edit: bool = True
+    supports_auth: bool = False
+
+    @abstractmethod
+    def get_create_context(self, session_data: Dict) -> Dict[str, Any]:
+        """Return extra template context for the create form."""
+
+    @abstractmethod
+    def process_create(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+    ) -> Dict[str, Any]:
+        """Process a create form submission.
+
+        Returns a dict with:
+          - 'entry': the dict to persist
+          - 'success_msg': message for success page
+          - any extra keys for the success template
+
+        Raises AutomationError on failure.
+        """
+
+    @abstractmethod
+    def process_edit(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+        existing: Dict,
+        all_items: Any,
+    ) -> Dict[str, Any]:
+        """Process an edit form submission.
+
+        Returns a dict with success info.
+        Raises AutomationError on failure.
+        """
+
+    @abstractmethod
+    def process_delete(
+        self, automation: Dict, session_data: Dict
+    ) -> Optional[str]:
+        """Perform type-specific cleanup on delete.
+
+        Returns an error message string on failure, None on success.
+        """
+
+    @abstractmethod
+    def get_detail_fields(self, automation: Dict) -> List[Tuple[str, str]]:
+        """Return (label, value) pairs for the detail view."""
diff --git a/views/_type_handlers/cron_handler.py b/views/_type_handlers/cron_handler.py
new file mode 100644
index 0000000..44dc7af
--- /dev/null
+++ b/views/_type_handlers/cron_handler.py
@@ -0,0 +1,243 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import getpass
+from typing import Any, Dict, List, Optional, Tuple
+
+from crontab import CronTab
+
+from bin import logger
+from bin.data_store import (
+    get_time_data,
+    save_script,
+    save_all_crons,
+    retire_script,
+)
+from views._type_handlers.base import AutomationError, AutomationHandler
+
+logthis = logger.setup_child_logger("jawa", "cron_handler")
+
+
+def _get_crontab() -> CronTab:
+    try:
+        return CronTab(user=True)
+    except IOError as err:
+        logthis.info(
+            f"Error accessing crontab for {getpass.getuser()} - {err}"
+        )
+        raise AutomationError("Crontab Error", str(err))
+
+
+def _apply_frequency(job: Any, frequency: str, form: Any) -> str:
+    """Apply the chosen frequency to a cron job. Returns display frequency."""
+    if frequency == "everyhour":
+        job.every().hours()
+        job.minute.on(0)
+    elif frequency == "everyday":
+        time_val = form.get("daytime")
+        job.day.every(1)
+        job.hour.on(time_val)
+        job.minute.on(0)
+    elif frequency == "everyweek":
+        day = form.get("weekday")
+        time_val = form.get("weektime")
+        job.dow.on(day)
+        job.hour.on(time_val)
+        job.minute.on(0)
+    elif frequency == "everymonth":
+        day = form.get("monthday")
+        time_val = form.get("monthtime")
+        job.day.on(day)
+        job.hour.on(time_val)
+        job.minute.on(0)
+    elif frequency == "custom":
+        custom_freq = form.get("customfreq", "")
+        try:
+            job.setall(f"{custom_freq}")
+        except (KeyError, ValueError) as err:
+            safe_freq = custom_freq.replace(" ", "_")
+            raise AutomationError(
+                "Custom Crontab Frequency Error",
+                f"The custom job frequency that was presented is invalid: "
+                f"'{err}'. Please check your syntax and try again.\n"
+                f"Check your syntax:  ",
+                link=f"https://crontab.guru/#{safe_freq}",
+            )
+        return f"Custom [ {custom_freq} ]"
+    return frequency
+
+
+class CronHandler(AutomationHandler):
+    tag = "cron"
+    display_name = "Timed Automation"
+    badge_class = "badge-observability"
+    icon = "timed_automation.png"
+    supports_edit = True
+    supports_auth = False
+
+    def get_create_context(self, session_data: Dict) -> Dict[str, Any]:
+        time_data = get_time_data()
+        return {
+            "frequencies": time_data["frequencies"],
+            "days": time_data["days"],
+            "hours": time_data["hours"],
+        }
+
+    def process_create(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+    ) -> Dict[str, Any]:
+        cron_name = form.get("cron_name", "")
+        description = form.get("description", "")
+        frequency = form.get("frequency", "")
+
+        if not cron_name:
+            raise AutomationError("Error", "Automation name is required.")
+        if " " in cron_name:
+            raise AutomationError("Error", "Single-string name only.")
+
+        # Save script
+        script_file = files.get("script")
+        if not script_file or not script_file.filename:
+            raise AutomationError("Error", "A script file is required.")
+        script_path = save_script(script_file, f"cron_{cron_name}", "_")
+
+        # Create crontab entry
+        cron = _get_crontab()
+        job = cron.new(command=script_path, comment=cron_name)
+        display_freq = _apply_frequency(job, frequency, form)
+        cron.write()
+
+        entry = {
+            "name": cron_name,
+            "description": description,
+            "frequency": display_freq,
+            "script": script_path,
+        }
+
+        success_msg = (
+            f"[{session_data.get('url')}] "
+            f"{session_data.get('username')} created {cron_name} "
+            f"to run at the frequency:\n {display_freq}."
+        )
+        logthis.info(success_msg)
+
+        return {
+            "entry": entry,
+            "success_msg": success_msg,
+        }
+
+    def process_edit(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+        existing: Dict,
+        all_items: Any,
+    ) -> Dict[str, Any]:
+        name = existing["name"]
+        new_name = form.get("cron_name") or name
+        description = form.get("description") or existing.get("description")
+        frequency = form.get("frequency")
+        frequency_change = bool(frequency)
+
+        if not frequency:
+            frequency = existing.get("frequency")
+
+        # Update the entry
+        existing["name"] = new_name
+        existing["description"] = description
+
+        # Handle script upload
+        if files.get("script") and files["script"].filename:
+            script_path = save_script(files["script"], f"cron_{new_name}", "_")
+            existing["script"] = script_path
+        else:
+            script_path = existing.get("script", "")
+
+        # Update crontab
+        cron = _get_crontab()
+        display_freq = frequency
+
+        for job in cron:
+            if job.comment == name:
+                job.command = script_path
+                job.comment = new_name
+                if frequency_change:
+                    display_freq = _apply_frequency(job, frequency, form)
+                cron.write()
+                break
+
+        if frequency == "custom":
+            custom_freq = form.get("customfreq", "")
+            existing["frequency"] = f"Custom [ {custom_freq} ]"
+        else:
+            existing["frequency"] = display_freq
+
+        save_all_crons(all_items)
+
+        success_msg = (
+            f"[{session_data.get('url')}] "
+            f"{session_data.get('username')} edited {new_name} "
+            f"to run at the frequency:  {display_freq}."
+        )
+        logthis.info(success_msg)
+
+        return {
+            "success_msg": success_msg,
+        }
+
+    def process_delete(
+        self, automation: Dict, session_data: Dict
+    ) -> Optional[str]:
+        name = automation["name"]
+        script_path = automation.get("script", "")
+        retire_script(script_path)
+
+        cron = _get_crontab()
+        for job in cron:
+            if job.comment == name:
+                logthis.info(
+                    f"[{session_data.get('url')}] "
+                    f"{session_data.get('username')} removed cron job "
+                    f"{name}"
+                )
+                cron.remove(job)
+                cron.write()
+                break
+        return None
+
+    def get_detail_fields(self, automation: Dict) -> List[Tuple[str, str]]:
+        return [
+            ("Automation name", automation.get("name", "")),
+            ("Frequency", automation.get("frequency", "")),
+            ("Script path", automation.get("script", "")),
+            ("Description", automation.get("description", "")),
+        ]
diff --git a/views/_type_handlers/custom_handler.py b/views/_type_handlers/custom_handler.py
new file mode 100644
index 0000000..29cebba
--- /dev/null
+++ b/views/_type_handlers/custom_handler.py
@@ -0,0 +1,183 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from typing import Any, Dict, List, Optional, Tuple
+
+from bin import logger
+from bin.data_store import save_script, save_all_webhooks, retire_script
+from views._type_handlers.base import AutomationError, AutomationHandler
+
+logthis = logger.setup_child_logger("jawa", "custom_handler")
+
+
+def _get_form_value(form: Any, key: str, default: str = "null") -> str:
+    value = form.get(key)
+    return value if value else default
+
+
+class CustomHandler(AutomationHandler):
+    tag = "custom"
+    display_name = "Custom"
+    badge_class = "badge-provisioning"
+    icon = "webhook.png"
+    supports_edit = True
+    supports_auth = True
+
+    def get_create_context(self, session_data: Dict) -> Dict[str, Any]:
+        return {}
+
+    def process_create(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+    ) -> Dict[str, Any]:
+        custom_name = form.get("custom_name", "")
+        description = form.get("description", "")
+        output = form.get("output")
+
+        if not custom_name:
+            raise AutomationError("Error", "Webhook name is required.")
+        if " " in custom_name:
+            raise AutomationError("Error", "Single-string name only.")
+
+        # Save script
+        new_file = files.get("new_file")
+        if not new_file or not new_file.filename:
+            raise AutomationError("Error", "A script file is required.")
+        script_path = save_script(new_file, custom_name)
+
+        # Auth fields
+        webhook_user = _get_form_value(form, "basic_username")
+        webhook_pass = _get_form_value(form, "new-password")
+
+        if form.get("custom"):
+            api_key = _get_form_value(form, "api_key")
+            extra_notice = (
+                "Use the following in your request headers "
+                "for authentication: "
+            )
+            custom_header = {"x-api-key": f"{api_key}"}
+        else:
+            api_key = "null"
+            extra_notice = None
+            custom_header = None
+
+        entry = {
+            "url": str(session_data["url"]),
+            "jawa_admin": str(session_data["username"]),
+            "name": custom_name,
+            "webhook_username": webhook_user,
+            "webhook_password": webhook_pass,
+            "api_key": api_key,
+            "script": script_path,
+            "description": description,
+            "tag": "custom",
+            "output": output,
+        }
+
+        return {
+            "entry": entry,
+            "success_msg": "New webhook created:",
+            "extra_notice": extra_notice,
+            "custom_header": custom_header,
+        }
+
+    def process_edit(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+        existing: Dict,
+        all_items: Any,
+    ) -> Dict[str, Any]:
+        name = existing["name"]
+        new_name = _get_form_value(form, "custom_name", name)
+        description = form.get("description")
+        output = form.get("output")
+
+        # Auth fields
+        if form.get("basic"):
+            webhook_user = _get_form_value(form, "basic_username")
+            webhook_pass = _get_form_value(form, "new-password")
+        else:
+            webhook_user = "null"
+            webhook_pass = "null"
+
+        if form.get("custom"):
+            api_key = _get_form_value(form, "api_key")
+            extra_notice = (
+                "Use the following in your request headers "
+                "for authentication: "
+            )
+            custom_header = {"x-api-key": f"{api_key}"}
+        else:
+            api_key = "null"
+            extra_notice = None
+            custom_header = None
+
+        existing["webhook_username"] = webhook_user
+        existing["webhook_password"] = webhook_pass
+        existing["api_key"] = api_key
+        existing["name"] = new_name
+        existing["output"] = output
+        if description:
+            existing["description"] = description
+
+        # Handle script upload
+        if files.get("new_file") and files["new_file"].filename:
+            script_path = save_script(files["new_file"], new_name)
+            existing["script"] = script_path
+
+        save_all_webhooks(all_items)
+
+        logthis.info(
+            f"{session_data.get('username')} edited a custom webhook ({name})."
+        )
+
+        return {
+            "success_msg": f"Edited custom webhook {new_name}.",
+            "extra_notice": extra_notice,
+            "custom_header": custom_header,
+        }
+
+    def process_delete(
+        self, automation: Dict, session_data: Dict
+    ) -> Optional[str]:
+        retire_script(automation.get("script", ""))
+        return None
+
+    def get_detail_fields(self, automation: Dict) -> List[Tuple[str, str]]:
+        fields = [
+            ("Automation name", automation.get("name", "")),
+            ("Script path", automation.get("script", "")),
+            ("Description", automation.get("description", "")),
+        ]
+        if automation.get("output"):
+            fields.append(("Script output in response", automation["output"]))
+        return fields
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
new file mode 100644
index 0000000..424c36b
--- /dev/null
+++ b/views/_type_handlers/jamf_handler.py
@@ -0,0 +1,429 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import re
+import time
+from typing import Any, Dict, List, Optional, Tuple
+
+import requests
+
+from bin import logger
+from bin.data_store import (
+    get_jawa_address,
+    save_script,
+    save_all_webhooks,
+    retire_script,
+)
+from bin.tokens import validate_token, get_token
+from views._type_handlers.base import AutomationError, AutomationHandler
+
+USER_AGENT_STRING = "JAWA%20v3.1.1"
+
+XML = "application/xml"
+
+logthis = logger.setup_child_logger("jawa", "jamf_handler")
+VERIFY_SSL = True
+
+SMART_GROUP_EVENTS = [
+    "SmartGroupMobileDeviceMembershipChange",
+    "SmartGroupComputerMembershipChange",
+    "SmartGroupUserMembershipChange",
+]
+
+MOBILE_DISPLAY_FIELDS_XML = (
+    "<enable_display_fields_for_group_object>true"
+    "</enable_display_fields_for_group_object>"
+    "<display_fields>"
+    "<display_field><name>Asset Tag</name></display_field>"
+    "<display_field><name>Building</name></display_field>"
+    "<display_field><name>Department</name></display_field>"
+    "<display_field><name>Email Address</name></display_field>"
+    "<display_field><name>Last Inventory Update</name></display_field>"
+    "<display_field><name>Last Enrollment</name></display_field>"
+    "</display_fields>"
+)
+
+
+def _build_auth_xml(form: Any) -> str:
+    auth_xml = "<authentication_type>NONE</authentication_type>"
+    if form.get("choice") == "basic":
+        basic_user = form.get("basic_username", "")
+        basic_pass = form.get("basic_password", "")
+        if basic_user or basic_pass:
+            auth_xml = "<authentication_type>BASIC</authentication_type>"
+            if basic_user == "null" and basic_pass == "null":
+                auth_xml = "<authentication_type>NONE</authentication_type>"
+            else:
+                auth_xml += f"<username>{basic_user or 'null'}</username>"
+                auth_xml += f"<password>{basic_pass or 'null'}</password>"
+    return auth_xml
+
+
+def _build_webhook_xml(
+    name: str,
+    enabled: str,
+    server_address: str,
+    event: str,
+    auth_xml: str,
+    extra_xml: str,
+) -> str:
+    return (
+        f"<webhook>"
+        f"<name>{name}</name>"
+        f"<enabled>{enabled}</enabled>"
+        f"<url>{server_address}/hooks/{name}</url>"
+        f"<content_type>application/json</content_type>"
+        f"<event>{event}</event>"
+        f"{auth_xml}"
+        f"{extra_xml}"
+        f"</webhook>"
+    )
+
+
+def _smart_group_info(event: str) -> Tuple[str, str, str, str]:
+    """Returns (notice, instructions, enablement, extra_xml)."""
+    if event in SMART_GROUP_EVENTS:
+        notice = "NOTICE!  This webhook is not yet enabled."
+        instructions = "Specify desired Smart Group and enable: "
+        enablement = "false"
+    else:
+        notice = ""
+        instructions = ""
+        enablement = "true"
+
+    if event == "SmartGroupMobileDeviceMembershipChange":
+        extra_xml = MOBILE_DISPLAY_FIELDS_XML
+    else:
+        extra_xml = ""
+
+    return notice, instructions, enablement, extra_xml
+
+
+def _extract_auth_fields(form: Any) -> Tuple[str, str, str, Any, Any]:
+    """Extract auth fields from form. Returns (user, pass, apikey, extra_notice, custom_header)."""
+    if form.get("choice") == "basic":
+        webhook_user = form.get("basic_username", "null")
+        webhook_pass = form.get("basic_password", "null")
+    else:
+        webhook_user = "null"
+        webhook_pass = "null"
+
+    if form.get("choice") == "custom":
+        webhook_apikey = form.get("api_key", "null")
+        extra_notice = (
+            "Copy and paste the following into the Header "
+            "Authentication section of Jamf Pro webhooks:"
+        )
+        custom_header = {"x-api-key": f"{webhook_apikey}"}
+    else:
+        webhook_apikey = "null"
+        extra_notice = None
+        custom_header = None
+
+    return (
+        webhook_user,
+        webhook_pass,
+        webhook_apikey,
+        extra_notice,
+        custom_header,
+    )
+
+
+class JamfHandler(AutomationHandler):
+    tag = "jamfpro"
+    display_name = "Jamf Pro"
+    badge_class = "badge-extensions"
+    icon = "webhook.png"
+    supports_edit = True
+    supports_auth = True
+
+    def get_create_context(self, session_data: Dict) -> Dict[str, Any]:
+        return {"url": session_data.get("url")}
+
+    def process_create(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+    ) -> Dict[str, Any]:
+        webhook_name = form.get("webhook_name", "")
+        event = form.get("event", "")
+        description = form.get("description", "")
+
+        if not webhook_name:
+            raise AutomationError("Error", "Webhook name is required.")
+        if " " in webhook_name:
+            raise AutomationError("Error", "Single-string name only.")
+
+        server_address = get_jawa_address()
+        if not server_address:
+            raise AutomationError(
+                "Setup Required", "Please configure JAWA address first."
+            )
+
+        # Ensure token is valid
+        if not validate_token(session_data.get("expires")):
+            get_token()
+
+        # Save script
+        new_file = files.get("new_file")
+        if not new_file or not new_file.filename:
+            raise AutomationError("Error", "A script file is required.")
+        script_path = save_script(new_file, webhook_name)
+
+        # Smart group handling
+        notice, instructions, enablement, extra_xml = _smart_group_info(event)
+
+        # Auth
+        auth_xml = _build_auth_xml(form)
+        (
+            webhook_user,
+            webhook_pass,
+            webhook_apikey,
+            extra_notice,
+            custom_header,
+        ) = _extract_auth_fields(form)
+
+        # Build XML and POST to Jamf
+        xml_data = _build_webhook_xml(
+            webhook_name,
+            enablement,
+            server_address,
+            event,
+            auth_xml,
+            extra_xml,
+        )
+        full_url = session_data["url"] + "/JSSResource/webhooks/id/0"
+        logthis.info(
+            f"{session_data.get('username')} creating a new JPS webhook "
+            f"{webhook_name}."
+        )
+
+        resp = requests.post(
+            full_url,
+            headers={
+                "Content-Type": XML,
+                "Authorization": f"Bearer {session_data['token']}",
+                "User-Agent": USER_AGENT_STRING,
+            },
+            data=xml_data,
+            verify=VERIFY_SSL,
+        )
+        logthis.info(f"[{resp.status_code}]  {resp.text}")
+
+        if resp.status_code == 409:
+            raise AutomationError(
+                "Duplicate",
+                f'The webhook name "{webhook_name}" already exists in '
+                f"your Jamf Pro Server.",
+            )
+
+        result = re.search("<id>(.*)</id>", resp.text)
+        jamf_id = result.group(1) if result else ""
+        new_link = f"{session_data['url']}/webhooks.html?id={jamf_id}&o=r"
+
+        entry = {
+            "url": str(session_data["url"]),
+            "jawa_admin": str(session_data["username"]),
+            "name": webhook_name,
+            "webhook_username": webhook_user,
+            "webhook_password": webhook_pass,
+            "api_key": webhook_apikey,
+            "event": event,
+            "script": script_path,
+            "description": description,
+            "tag": "jamfpro",
+            "jamf_id": jamf_id,
+        }
+
+        return {
+            "entry": entry,
+            "success_msg": "New webhook created:",
+            "new_link": new_link,
+            "new_here": webhook_name,
+            "smart_group_notice": notice,
+            "smart_group_instructions": instructions,
+            "extra_notice": extra_notice,
+            "custom_header": custom_header,
+        }
+
+    def process_edit(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+        existing: Dict,
+        all_items: Any,
+    ) -> Dict[str, Any]:
+        if not validate_token(session_data.get("expires")):
+            get_token()
+
+        name = existing["name"]
+        new_name = form.get("webhook_name") or name
+        description = form.get("description", existing.get("description"))
+        new_event = form.get("event") or existing.get("event")
+
+        (
+            webhook_user,
+            webhook_pass,
+            webhook_apikey,
+            extra_notice,
+            custom_header,
+        ) = _extract_auth_fields(form)
+
+        # Handle script upload
+        if files.get("new_file") and files["new_file"].filename:
+            script_path = save_script(files["new_file"], new_name)
+        else:
+            script_path = existing.get("script", "")
+
+        # Update the entry in the list
+        existing["name"] = new_name
+        existing["description"] = description
+        existing["event"] = new_event
+        existing["webhook_username"] = webhook_user
+        existing["webhook_password"] = webhook_pass
+        existing["api_key"] = webhook_apikey
+        existing["script"] = script_path
+        existing["jawa_admin"] = session_data.get("username")
+
+        # Smart group handling
+        notice, instructions, enablement, extra_xml = _smart_group_info(
+            new_event
+        )
+
+        # Auth XML
+        auth_xml = _build_auth_xml(form)
+
+        # Build XML and PUT to Jamf
+        server_address = get_jawa_address()
+        xml_data = _build_webhook_xml(
+            new_name,
+            enablement,
+            server_address,
+            new_event,
+            auth_xml,
+            extra_xml,
+        )
+        full_url = (
+            f"{session_data['url']}/JSSResource/webhooks/id/"
+            f"{existing.get('jamf_id')}"
+        )
+
+        try:
+            resp = requests.put(
+                full_url,
+                headers={
+                    "Content-Type": XML,
+                    "Authorization": f"Bearer {session_data['token']}",
+                    "User-Agent": USER_AGENT_STRING,
+                },
+                data=xml_data,
+                verify=VERIFY_SSL,
+            )
+        except Exception as err:
+            raise AutomationError(
+                "Connection Error",
+                f"The request could not be sent to your Jamf Pro server, "
+                f"check your network connection. Details: {err}",
+            )
+
+        if resp.status_code == 409:
+            raise AutomationError(
+                "Duplicate",
+                f'The webhook name "{new_name}" already exists in '
+                f"your Jamf Pro Server.",
+            )
+        elif resp.status_code == 401:
+            raise AutomationError(
+                "Insufficient privileges",
+                f"{session_data.get('username')} doesn't have privileges "
+                f"to update webhooks. Check your account privileges in "
+                f"Jamf Pro Settings.",
+            )
+
+        # Save updated list
+        save_all_webhooks(all_items)
+
+        result = re.search("<id>(.*)</id>", resp.text)
+        jamf_id = result.group(1) if result else existing.get("jamf_id")
+        new_link = f"{session_data['url']}/webhooks.html?id={jamf_id}&o=r"
+
+        logthis.info(
+            f"{session_data.get('username')} edited a Jamf webhook. "
+            f"Name: {name} Jamf link: {new_link}"
+        )
+
+        return {
+            "success_msg": "Webhook edited:",
+            "new_link": new_link,
+            "new_here": new_name,
+            "smart_group_notice": notice,
+            "smart_group_instructions": instructions,
+            "extra_notice": extra_notice,
+            "custom_header": custom_header,
+        }
+
+    def process_delete(
+        self, automation: Dict, session_data: Dict
+    ) -> Optional[str]:
+        if not validate_token(session_data.get("expires")):
+            get_token()
+        # Disable and rename in Jamf Pro
+        data = (
+            f"<webhook><name>{automation['name']}.old.{time.time()}</name>"
+            f"<enabled>false</enabled></webhook>"
+        )
+        full_url = (
+            f"{session_data['url']}/JSSResource/webhooks/name/"
+            f"{automation['name']}"
+        )
+        requests.put(
+            full_url,
+            headers={
+                "Content-Type": XML,
+                "Authorization": f"Bearer {session_data['token']}",
+                "User-Agent": USER_AGENT_STRING,
+            },
+            data=data,
+        )
+        retire_script(automation.get("script", ""))
+        return None
+
+    def get_detail_fields(self, automation: Dict) -> List[Tuple[str, str]]:
+        fields = [
+            ("Automation name", automation.get("name", "")),
+            ("Event", automation.get("event", "")),
+            ("Script path", automation.get("script", "")),
+            ("Description", automation.get("description", "")),
+            ("Jamf Pro Server", automation.get("url", "")),
+            ("Created by", automation.get("jawa_admin", "")),
+        ]
+        if automation.get("jamf_id"):
+            fields.append(("Jamf ID", automation["jamf_id"]))
+        return fields
diff --git a/views/_type_handlers/okta_handler.py b/views/_type_handlers/okta_handler.py
new file mode 100644
index 0000000..5a4b9a2
--- /dev/null
+++ b/views/_type_handlers/okta_handler.py
@@ -0,0 +1,210 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import json
+import os
+from typing import Any, Dict, List, Optional, Tuple
+
+import requests
+
+from bin import logger
+from bin.data_store import get_jawa_address, save_script, retire_script
+from views._type_handlers.base import AutomationError, AutomationHandler
+
+logthis = logger.setup_child_logger("jawa", "okta_handler")
+
+_base_dir = os.path.dirname(os.path.dirname(os.path.dirname(__file__)))
+OKTA_VERIFICATION_FILE = os.path.abspath(
+    os.path.join(_base_dir, "bin", "okta_verification.py")
+)
+
+
+class OktaHandler(AutomationHandler):
+    tag = "okta"
+    display_name = "Okta"
+    badge_class = "badge-observability"
+    icon = "webhook.png"
+    supports_edit = False
+    supports_auth = False
+
+    def get_create_context(self, session_data: Dict) -> Dict[str, Any]:
+        return {}
+
+    def process_create(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+    ) -> Dict[str, Any]:
+        okta_name = form.get("webhookname", "")
+        okta_server = form.get("okta_server", "")
+        okta_token = form.get("token", "")
+        okta_event = form.get("event", "")
+        description = form.get("description", "")
+
+        if not okta_name:
+            raise AutomationError("Error", "Webhook name is required.")
+        if " " in okta_name:
+            raise AutomationError("Error", "Single-string name only.")
+
+        server_address = get_jawa_address()
+        if not server_address:
+            raise AutomationError(
+                "Setup Required", "Please configure JAWA address first."
+            )
+
+        # Ensure okta verification file is executable
+        if os.path.isfile(OKTA_VERIFICATION_FILE):
+            os.chmod(OKTA_VERIFICATION_FILE, mode=0o0755)
+
+        # Save script
+        script_file_obj = files.get("script")
+        if not script_file_obj or not script_file_obj.filename:
+            raise AutomationError("Error", "A script file is required.")
+        script_path = save_script(script_file_obj, okta_name, "_")
+
+        # Build Okta event hook payload
+        webhook_url = f"{server_address}/hooks/{okta_name}"
+        logthis.info(webhook_url)
+
+        payload = {
+            "name": okta_name,
+            "events": {"type": "EVENT_TYPE", "items": [okta_event]},
+            "channel": {
+                "type": "HTTP",
+                "version": "1.0.0",
+                "config": {
+                    "uri": webhook_url,
+                    "headers": [
+                        {
+                            "key": "X-Other-Header",
+                            "value": "some-other-value",
+                        }
+                    ],
+                    "authScheme": {
+                        "type": "HEADER",
+                        "key": "Authorization",
+                        "value": "${api_key}",
+                    },
+                },
+            },
+        }
+
+        # Create hook in Okta
+        resp = requests.post(
+            f"{okta_server}/api/v1/eventHooks",
+            headers={
+                "Accept": "application/json",
+                "Authorization": f"SSWS {okta_token}",
+                "Content-Type": "application/json",
+            },
+            data=json.dumps(payload, indent=4),
+        )
+        response_json = resp.json()
+        okta_id = response_json.get("id")
+
+        if not okta_id:
+            raise AutomationError(
+                "Okta Error",
+                "Failed to create the event hook in Okta. "
+                "Check your Okta server URL and token.",
+            )
+
+        entry = {
+            "name": okta_name,
+            "okta_id": okta_id,
+            "okta_event": okta_event,
+            "okta_url": okta_server,
+            "okta_token": okta_token,
+            "script": script_path,
+            "description": description,
+            "webhook_username": "null",
+            "webhook_password": "null",
+            "tag": "okta",
+        }
+
+        # Verify/activate the hook
+        verify_resp = requests.post(
+            f"{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify",
+            headers={"Authorization": f"SSWS {okta_token}"},
+        )
+        verification = verify_resp.json()
+        if "errorCode" in verification:
+            raise AutomationError(
+                "Event Verification Error",
+                "Okta was unable to verify the webhook. "
+                "Check network settings.",
+            )
+
+        return {
+            "entry": entry,
+            "success_msg": "Okta Webhook Created.",
+        }
+
+    def process_edit(
+        self,
+        form: Any,
+        files: Any,
+        session_data: Dict,
+        existing: Dict,
+        all_items: Any,
+    ) -> Dict[str, Any]:
+        raise AutomationError(
+            "Not Supported",
+            "Okta webhooks cannot be edited. Delete and recreate instead.",
+        )
+
+    def process_delete(
+        self, automation: Dict, session_data: Dict
+    ) -> Optional[str]:
+        try:
+            okta_url = automation.get("okta_url", "")
+            okta_id = automation.get("okta_id", "")
+            okta_token = automation.get("okta_token", "")
+            # Deactivate then delete
+            requests.post(
+                f"{okta_url}/api/v1/eventHooks/{okta_id}/lifecycle/deactivate",
+                headers={"Authorization": f"SSWS {okta_token}"},
+            )
+            requests.delete(
+                f"{okta_url}/api/v1/eventHooks/{okta_id}",
+                headers={"Authorization": f"SSWS {okta_token}"},
+            )
+        except requests.exceptions.MissingSchema as err:
+            return str(err)
+        retire_script(automation.get("script", ""))
+        return None
+
+    def get_detail_fields(self, automation: Dict) -> List[Tuple[str, str]]:
+        return [
+            ("Automation name", automation.get("name", "")),
+            ("Event", automation.get("okta_event", "")),
+            ("Script path", automation.get("script", "")),
+            ("Okta URL", automation.get("okta_url", "")),
+            ("Description", automation.get("description", "")),
+        ]
diff --git a/views/automation_view.py b/views/automation_view.py
new file mode 100644
index 0000000..8f2fc65
--- /dev/null
+++ b/views/automation_view.py
@@ -0,0 +1,375 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from typing import Union
+
+from flask import (
+    Blueprint,
+    Response,
+    abort,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
+from markupsafe import escape
+
+from bin import logger
+from bin.auth import login_required
+from bin.data_store import (
+    add_cron,
+    add_webhook,
+    get_all_crons,
+    get_all_webhooks,
+    get_cron_by_name,
+    get_webhook_by_name,
+    get_webhooks_by_tag,
+    remove_cron,
+    remove_webhook,
+    webhook_name_exists,
+    cron_name_exists,
+)
+from views._type_handlers import HANDLERS, get_handler
+from views._type_handlers.base import AutomationError
+
+logthis = logger.setup_child_logger("jawa", "automation_view")
+
+blueprint = Blueprint("automations", __name__)
+
+SUCCESS_TEMPLATE = "success.html"
+LIST_TYPE_ENDPOINT = "automations.list_type"
+
+
+def _get_session_data() -> dict:
+    return {
+        "url": session.get("url"),
+        "username": session.get("username"),
+        "password": session.get("password"),
+        "token": session.get("token"),
+        "expires": session.get("expires"),
+        "b64_auth": session.get("b64_auth"),
+    }
+
+
+def _error_page(title: str, message: str, link: str = None) -> str:
+    return render_template(
+        "error.html",
+        error=title,
+        error_message=message,
+        link=link,
+        username=session.get("username"),
+    )
+
+
+# --- List routes ---
+
+
+@blueprint.route("/automations")
+@login_required
+def list_all() -> Union[Response, str]:
+    """List all automations across all types."""
+    logthis.debug(
+        f"[{session.get('url')}] {session.get('username')} viewed /automations"
+    )
+    all_webhooks = get_all_webhooks()
+    all_crons = get_all_crons()
+    categorized = {}
+    for tag, handler in HANDLERS.items():
+        if tag == "cron":
+            items = all_crons
+        else:
+            items = [w for w in all_webhooks if w.get("tag") == tag]
+        categorized[tag] = {"handler": handler, "items": items}
+
+    return render_template(
+        "automations/list_all.html",
+        categorized=categorized,
+        handlers=HANDLERS,
+    )
+
+
+@blueprint.route("/automations/<auto_type>")
+@login_required
+def list_type(auto_type: str) -> Union[Response, str]:
+    """List automations for a specific type."""
+    handler = get_handler(auto_type)
+    if not handler:
+        abort(404)
+    logthis.debug(
+        f"[{session.get('url')}] {session.get('username')} "
+        f"viewed /automations/{auto_type}"
+    )
+    if auto_type == "cron":
+        items = get_all_crons()
+    else:
+        items = get_webhooks_by_tag(auto_type)
+
+    return render_template(
+        "automations/list.html",
+        handler=handler,
+        auto_type=auto_type,
+        items=items,
+    )
+
+
+# --- Create ---
+
+
+@blueprint.route("/automations/<auto_type>/new", methods=["GET", "POST"])
+@login_required
+def create(auto_type: str) -> Union[Response, str]:
+    handler = get_handler(auto_type)
+    if not handler:
+        abort(404)
+
+    session_data = _get_session_data()
+
+    if request.method == "GET":
+        ctx = handler.get_create_context(session_data)
+        return render_template(
+            "automations/create.html",
+            handler=handler,
+            auto_type=auto_type,
+            **ctx,
+        )
+
+    # POST — process creation
+    try:
+        # Check for duplicate name
+        name = _extract_name(auto_type, request.form)
+        if name:
+            if auto_type == "cron":
+                exists = cron_name_exists(name)
+            else:
+                exists = webhook_name_exists(name)
+            if exists:
+                raise AutomationError("Error", "Name already exists!")
+
+        result = handler.process_create(
+            request.form, request.files, session_data
+        )
+    except AutomationError as err:
+        return _error_page(err.title, err.message, err.link)
+
+    # Persist the entry
+    entry = result.get("entry")
+    if entry:
+        if auto_type == "cron":
+            add_cron(entry)
+        else:
+            add_webhook(entry)
+
+    return render_template(
+        SUCCESS_TEMPLATE,
+        webhooks="success",
+        success_msg=result.get("success_msg", "Created successfully."),
+        new_link=result.get("new_link"),
+        new_here=result.get("new_here"),
+        smart_group_notice=result.get("smart_group_notice"),
+        smart_group_instructions=result.get("smart_group_instructions"),
+        extra_notice=result.get("extra_notice"),
+        custom_header=result.get("custom_header"),
+        username=session.get("username"),
+    )
+
+
+# --- Detail ---
+
+
+@blueprint.route("/automations/<auto_type>/<name>")
+@login_required
+def detail(auto_type: str, name: str) -> Union[Response, str]:
+    handler = get_handler(auto_type)
+    if not handler:
+        abort(404)
+
+    name = str(escape(name))
+    if auto_type == "cron":
+        automation = get_cron_by_name(name)
+    else:
+        automation = get_webhook_by_name(name)
+
+    if not automation:
+        logthis.info(f"Automation '{name}' not found")
+        return redirect(url_for(LIST_TYPE_ENDPOINT, auto_type=auto_type))
+
+    detail_fields = handler.get_detail_fields(automation)
+
+    return render_template(
+        "automations/detail.html",
+        handler=handler,
+        auto_type=auto_type,
+        automation=automation,
+        detail_fields=detail_fields,
+    )
+
+
+# --- Edit ---
+
+
+@blueprint.route(
+    "/automations/<auto_type>/<name>/edit", methods=["GET", "POST"]
+)
+@login_required
+def edit(auto_type: str, name: str) -> Union[Response, str]:
+    handler = get_handler(auto_type)
+    if not handler or not handler.supports_edit:
+        abort(404)
+
+    name = str(escape(name))
+    session_data = _get_session_data()
+
+    if auto_type == "cron":
+        all_items = get_all_crons()
+        existing = next((c for c in all_items if c.get("name") == name), None)
+    else:
+        all_items = get_all_webhooks()
+        existing = next((w for w in all_items if w.get("name") == name), None)
+
+    if not existing:
+        logthis.info(f"Automation '{name}' not found for edit")
+        return redirect(url_for(LIST_TYPE_ENDPOINT, auto_type=auto_type))
+
+    if request.method == "GET":
+        ctx = handler.get_create_context(session_data)
+        webhook_info = [existing]
+        return render_template(
+            "automations/edit.html",
+            handler=handler,
+            auto_type=auto_type,
+            automation_name=name,
+            webhook_info=webhook_info,
+            cron_info=existing if auto_type == "cron" else None,
+            **ctx,
+        )
+
+    # POST — check for delete button
+    if request.form.get("button_choice") == "Delete":
+        return redirect(
+            url_for(
+                "automations.delete",
+                auto_type=auto_type,
+                name=name,
+            )
+        )
+
+    try:
+        result = handler.process_edit(
+            request.form,
+            request.files,
+            session_data,
+            existing,
+            all_items,
+        )
+    except AutomationError as err:
+        return _error_page(err.title, err.message, err.link)
+
+    return render_template(
+        SUCCESS_TEMPLATE,
+        webhooks="success",
+        success_msg=result.get("success_msg", "Updated successfully."),
+        new_link=result.get("new_link"),
+        new_here=result.get("new_here"),
+        smart_group_notice=result.get("smart_group_notice"),
+        smart_group_instructions=result.get("smart_group_instructions"),
+        extra_notice=result.get("extra_notice"),
+        custom_header=result.get("custom_header"),
+        username=session.get("username"),
+    )
+
+
+# --- Delete ---
+
+
+@blueprint.route(
+    "/automations/<auto_type>/<name>/delete", methods=["GET", "POST"]
+)
+@login_required
+def delete(auto_type: str, name: str) -> Union[Response, str]:
+    handler = get_handler(auto_type)
+    if not handler:
+        abort(404)
+
+    name = str(escape(name))
+
+    if auto_type == "cron":
+        automation = get_cron_by_name(name)
+    else:
+        automation = get_webhook_by_name(name)
+
+    if not automation:
+        return redirect(url_for(LIST_TYPE_ENDPOINT, auto_type=auto_type))
+
+    if request.method == "GET":
+        return render_template(
+            "automations/delete.html",
+            handler=handler,
+            auto_type=auto_type,
+            automation_name=name,
+        )
+
+    # POST — perform deletion
+    session_data = _get_session_data()
+    error = handler.process_delete(automation, session_data)
+    if error:
+        return _error_page("Delete Error", error)
+
+    if auto_type == "cron":
+        remove_cron(name)
+    else:
+        remove_webhook(name)
+
+    logthis.info(
+        f"[{session.get('url')}] {session.get('username')} deleted "
+        f"{auto_type} automation: {name}"
+    )
+
+    success_msg = (
+        f"Successfully deleted the {handler.display_name} automation: {name}."
+    )
+    return render_template(
+        SUCCESS_TEMPLATE,
+        success_msg=success_msg,
+        username=session.get("username"),
+    )
+
+
+# --- Helpers ---
+
+
+def _extract_name(auto_type: str, form) -> str:
+    """Extract the automation name from the form based on type."""
+    name_fields = {
+        "jamfpro": "webhook_name",
+        "okta": "webhookname",
+        "custom": "custom_name",
+        "cron": "cron_name",
+    }
+    field = name_fields.get(auto_type, "name")
+    return form.get(field, "")

From b2008f70c4f579ae40e66390d3ae8febbdaa2e3f Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Wed, 11 Feb 2026 12:14:30 -0600
Subject: [PATCH 11/84] feat: add credential management and search
 functionality (#60)

---
 static/js/search.js              |  93 ++++++++++
 templates/search_results.html    |  49 ++++++
 templates/setup/credentials.html |  79 +++++++++
 views/credential_view.py         | 165 ++++++++++++++++++
 views/search_view.py             | 286 +++++++++++++++++++++++++++++++
 5 files changed, 672 insertions(+)
 create mode 100644 static/js/search.js
 create mode 100644 templates/search_results.html
 create mode 100644 templates/setup/credentials.html
 create mode 100644 views/credential_view.py
 create mode 100644 views/search_view.py

diff --git a/static/js/search.js b/static/js/search.js
new file mode 100644
index 0000000..01c5f1a
--- /dev/null
+++ b/static/js/search.js
@@ -0,0 +1,93 @@
+"use strict";
+
+function escapeHtml(text) {
+    const div = document.createElement("div");
+    div.textContent = text;
+    return div.innerHTML;
+}
+
+function escapeAttr(text) {
+    return text
+        .replaceAll("&", "&amp;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;");
+}
+
+const BADGE_STYLES = {
+    webhook: "background:var(--color-navbar);color:#fff;",
+    cron: "background:var(--color-accent-light);color:#fff;",
+    template: "background:var(--color-primary);color:#fff;",
+    page: "background:#6c757d;color:#fff;",
+};
+
+function buildBadge(resultType) {
+    const style = BADGE_STYLES[resultType];
+    if (!style) return "";
+    const label = resultType.charAt(0).toUpperCase() + resultType.slice(1);
+    return ' <span style="font-size:0.65rem;' + style + 'padding:1px 5px;border-radius:3px;">' + label + "</span>";
+}
+
+function buildResultHtml(results, query) {
+    let html = "";
+    results.slice(0, 8).forEach(function (result) {
+        html += '<a class="search-result-item" href="' + escapeAttr(result.url) + '">';
+        html += '<div class="search-result-title">' + escapeHtml(result.title) + buildBadge(result.result_type) + "</div>";
+        if (result.description) {
+            html += '<div style="font-size:0.78rem;color:#666;padding-top:2px;">' + escapeHtml(result.description).substring(0, 80) + "</div>";
+        }
+        html += "</a>";
+    });
+
+    html += '<a class="search-result-item" href="/search?q=' + encodeURIComponent(query) + '" style="text-align:center;color:var(--color-primary);font-weight:600;">View all results</a>';
+    return html;
+}
+
+document.addEventListener("DOMContentLoaded", function () {
+    const searchInput = document.getElementById("navbar-search");
+    const dropdown = document.getElementById("search-dropdown");
+    if (!searchInput || !dropdown) return;
+
+    let debounceTimer = null;
+
+    searchInput.addEventListener("input", function () {
+        const query = searchInput.value.trim();
+        clearTimeout(debounceTimer);
+
+        if (query.length < 2) {
+            dropdown.style.display = "none";
+            dropdown.innerHTML = "";
+            return;
+        }
+
+        debounceTimer = setTimeout(function () {
+            fetch("/api/search?q=" + encodeURIComponent(query))
+                .then(function (resp) { return resp.json(); })
+                .then(function (data) {
+                    if (!data.results || data.results.length === 0) {
+                        dropdown.innerHTML = '<div class="search-result-item" style="color:#999;">No results found</div>';
+                    } else {
+                        dropdown.innerHTML = buildResultHtml(data.results, query);
+                    }
+                    dropdown.style.display = "block";
+                });
+        }, 300);
+    });
+
+    document.addEventListener("click", function (e) {
+        if (!searchInput.contains(e.target) && !dropdown.contains(e.target)) {
+            dropdown.style.display = "none";
+        }
+    });
+
+    searchInput.addEventListener("keydown", function (e) {
+        if (e.key === "Enter") {
+            e.preventDefault();
+            const query = searchInput.value.trim();
+            if (query.length >= 2) {
+                globalThis.location.href = "/search?q=" + encodeURIComponent(query);
+            }
+        }
+    });
+});
diff --git a/templates/search_results.html b/templates/search_results.html
new file mode 100644
index 0000000..7ef8315
--- /dev/null
+++ b/templates/search_results.html
@@ -0,0 +1,49 @@
+{% extends "shared/_layout.html" %}
+{% block title %}Search - JAWA{% endblock %}
+{% block content %}
+<div class="hero-section">
+    <div class="container">
+        <h2>Search Results{% if query %} for "{{ query }}"{% endif %}</h2>
+        <p>Search webhooks, cron jobs, templates, and pages.</p>
+    </div>
+</div>
+<div class="container" style="max-width: 900px;">
+
+    <form action="/search" method="get" class="mb-4">
+        <div class="d-flex gap-2">
+            <input type="text" name="q" value="{{ query }}" class="form-control" placeholder="Search webhooks, cron, templates, pages..." autofocus>
+            <button type="submit" class="btn btn-jawa">Search</button>
+        </div>
+    </form>
+
+    {% if results %}
+        <p style="color: var(--color-text-muted); font-size: 0.88rem;">{{ results|length }} result{{ 's' if results|length != 1 }} found</p>
+        <div class="list-group">
+            {% for result in results %}
+            <a href="{{ result.url }}" class="list-group-item list-group-item-action" style="border-radius: var(--radius-md); margin-bottom: 0.5rem; border: 1px solid var(--color-border);">
+                <div class="d-flex align-items-center gap-2">
+                    <h6 class="mb-1" style="font-weight: 600;">{{ result.title }}</h6>
+                    {% if result.result_type == 'webhook' %}
+                        <span class="badge" style="background: var(--color-navbar); font-size: 0.65rem;">Webhook</span>
+                    {% elif result.result_type == 'cron' %}
+                        <span class="badge" style="background: var(--color-accent-light); font-size: 0.65rem;">Cron</span>
+                    {% elif result.result_type == 'template' %}
+                        <span class="badge" style="background: var(--color-primary); font-size: 0.65rem;">Template</span>
+                    {% elif result.result_type == 'page' %}
+                        <span class="badge" style="background: #6c757d; font-size: 0.65rem;">Page</span>
+                    {% endif %}
+                </div>
+                {% if result.description %}
+                    <p class="mb-0" style="font-size: 0.85rem; color: var(--color-text-secondary);">{{ result.description }}</p>
+                {% endif %}
+            </a>
+            {% endfor %}
+        </div>
+    {% elif query %}
+        <div class="form-section text-center" style="max-width: 500px; margin: 2rem auto;">
+            <p style="color: var(--color-text-muted);">No results found for "{{ query }}".</p>
+            <p style="color: var(--color-text-muted); font-size: 0.85rem;">Try different keywords or check your spelling.</p>
+        </div>
+    {% endif %}
+</div>
+{% endblock %}
diff --git a/templates/setup/credentials.html b/templates/setup/credentials.html
new file mode 100644
index 0000000..0ed1823
--- /dev/null
+++ b/templates/setup/credentials.html
@@ -0,0 +1,79 @@
+{% extends "shared/_layout.html" %}
+{% block title %}Credentials - JAWA{% endblock %}
+{% block content %}
+<div class="hero-section">
+    <div class="container">
+        <h2>API Credentials</h2>
+        <p>Manage credential sets for use with templates.</p>
+        <div class="hero-cta">
+            <a href="/setup" class="btn btn-hero-secondary">Setup</a>
+            <a href="/cleanup" class="btn btn-hero-secondary">Cleanup</a>
+            <a href="/branding" class="btn btn-hero-secondary">Branding</a>
+        </div>
+    </div>
+</div>
+<div class="container" style="max-width: 800px;">
+
+    {% if credentials %}
+    <div class="form-section mb-4">
+        <table class="hippocrates">
+            <thead>
+                <tr>
+                    <th>Name</th>
+                    <th>Server URL</th>
+                    <th>Client ID</th>
+                    <th>Secret</th>
+                    <th></th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for cred in credentials %}
+                <tr>
+                    <td>{{ cred.name }}</td>
+                    <td style="font-size: 0.82rem;">{{ cred.server_url }}</td>
+                    <td style="font-size: 0.82rem;">{{ cred.client_id }}</td>
+                    <td style="font-size: 0.82rem; color: var(--color-text-muted);">
+                        {{ '*' * 8 if cred.client_secret else '' }}
+                    </td>
+                    <td>
+                        <form method="post" action="/setup/credentials/delete/{{ loop.index0 }}" style="display:inline;">
+                            <button type="submit" class="btn btn-sm btn-danger" onclick="return confirm('Delete this credential set?');">Delete</button>
+                        </form>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </div>
+    {% else %}
+    <div class="form-section text-center mb-4" style="max-width: 500px; margin: 0 auto;">
+        <p style="color: var(--color-text-muted);">No credential sets configured yet.</p>
+    </div>
+    {% endif %}
+
+    <div class="form-section" style="max-width: 550px; margin: 0 auto;">
+        <h5 class="text-center mb-3" style="font-size: 1rem; font-weight: 600;">Add Credential Set</h5>
+        <form method="post" action="/setup/credentials/add">
+            <div class="mb-3">
+                <label for="cred-name" class="form-label" style="font-weight: 500; font-size: 0.88rem;">Name</label>
+                <input type="text" name="name" id="cred-name" class="form-control" placeholder="e.g. Production" required>
+            </div>
+            <div class="mb-3">
+                <label for="cred-url" class="form-label" style="font-weight: 500; font-size: 0.88rem;">Jamf Pro URL</label>
+                <input type="url" name="server_url" id="cred-url" class="form-control" placeholder="https://example.jamfcloud.com" pattern="https?://.+" title="Use https://">
+            </div>
+            <div class="mb-3">
+                <label for="cred-client-id" class="form-label" style="font-weight: 500; font-size: 0.88rem;">Client ID</label>
+                <input type="text" name="client_id" id="cred-client-id" class="form-control" placeholder="OAuth Client ID">
+            </div>
+            <div class="mb-3">
+                <label for="cred-secret" class="form-label" style="font-weight: 500; font-size: 0.88rem;">Client Secret</label>
+                <input type="password" name="client_secret" id="cred-secret" class="form-control" placeholder="OAuth Client Secret">
+            </div>
+            <div class="d-flex justify-content-center">
+                <button type="submit" class="btn btn-jawa">Add Credential Set</button>
+            </div>
+        </form>
+    </div>
+</div>
+{% endblock %}
diff --git a/views/credential_view.py b/views/credential_view.py
new file mode 100644
index 0000000..1710e8d
--- /dev/null
+++ b/views/credential_view.py
@@ -0,0 +1,165 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import json
+import os
+from typing import Any, Dict, List, Union
+
+from flask import (
+    Blueprint,
+    Response,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
+from markupsafe import escape
+
+from bin import logger
+
+blueprint = Blueprint(
+    "credential_view",
+    __name__,
+    template_folder="../templates",
+)
+
+logthis = logger.setup_child_logger("jawa", "credential_view")
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+CREDENTIALS_FILE = os.path.join(BASE_DIR, "data", "credentials.json")
+
+ERROR_TITLE = "Session Timed Out"
+ERROR_MSG_SIGN_IN = "Please sign in again"
+LOGOUT_ENDPOINT = "home_view.logout"
+
+
+def _load_credentials() -> List[Dict[str, Any]]:
+    """Load saved credential sets."""
+    if not os.path.isfile(CREDENTIALS_FILE):
+        return []
+    try:
+        with open(CREDENTIALS_FILE, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (json.JSONDecodeError, IOError):
+        return []
+
+
+def _save_credentials(credentials: List[Dict[str, Any]]) -> None:
+    """Save credential sets to file."""
+    with open(CREDENTIALS_FILE, "w", encoding="utf-8") as f:
+        json.dump(credentials, f, indent=2)
+
+
+@blueprint.route("/setup/credentials", methods=["GET"])
+def credentials_page() -> Union[Response, str]:
+    """Credential management page."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+
+    credentials = _load_credentials()
+    return render_template(
+        "setup/credentials.html",
+        username=session.get("username"),
+        credentials=credentials,
+    )
+
+
+@blueprint.route("/setup/credentials/add", methods=["POST"])
+def add_credential() -> Response:
+    """Add a new credential set."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+
+    name = str(escape(request.form.get("name", "").strip()))
+    server_url = str(escape(request.form.get("server_url", "").strip()))
+    client_id = str(escape(request.form.get("client_id", "").strip()))
+    client_secret = request.form.get("client_secret", "").strip()
+
+    if not name:
+        return redirect(
+            url_for(
+                "error",
+                error="Invalid Input",
+                error_message="Credential name is required.",
+            )
+        )
+
+    credentials = _load_credentials()
+    credentials.append(
+        {
+            "name": name,
+            "server_url": server_url,
+            "client_id": client_id,
+            "client_secret": client_secret,
+        }
+    )
+    _save_credentials(credentials)
+
+    logthis.info(
+        f"[{session.get('url')}] {session.get('username')} "
+        f"added credential set: {name}"
+    )
+
+    return redirect(url_for("credential_view.credentials_page"))
+
+
+@blueprint.route("/setup/credentials/delete/<int:index>", methods=["POST"])
+def delete_credential(index: int) -> Response:
+    """Delete a credential set by index."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+
+    credentials = _load_credentials()
+    if 0 <= index < len(credentials):
+        removed = credentials.pop(index)
+        _save_credentials(credentials)
+        logthis.info(
+            f"[{session.get('url')}] {session.get('username')} "
+            f"deleted credential set: {removed.get('name')}"
+        )
+
+    return redirect(url_for("credential_view.credentials_page"))
diff --git a/views/search_view.py b/views/search_view.py
new file mode 100644
index 0000000..53224d4
--- /dev/null
+++ b/views/search_view.py
@@ -0,0 +1,286 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+import json
+import os
+from typing import Any, Dict, List, Union
+
+from flask import (
+    Blueprint,
+    Response,
+    jsonify,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
+from markupsafe import escape
+
+from bin import logger
+
+blueprint = Blueprint(
+    "search_view",
+    __name__,
+    template_folder="../templates",
+)
+
+logthis = logger.setup_child_logger("jawa", "search_view")
+
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+WEBHOOKS_FILE = os.path.join(BASE_DIR, "data", "webhooks.json")
+CRON_FILE = os.path.join(BASE_DIR, "data", "cron.json")
+WORKFLOW_CONFIG = os.path.join(
+    BASE_DIR, "data", "workflows", "workflow_config.json"
+)
+
+NAVIGABLE_PAGES: List[Dict[str, str]] = [
+    {
+        "title": "Dashboard",
+        "url": "/dashboard",
+        "description": "Main dashboard",
+    },
+    {"title": "Webhooks", "url": "/webhooks", "description": "All webhooks"},
+    {
+        "title": "Jamf Pro Webhooks",
+        "url": "/webhooks/jamf",
+        "description": "Jamf Pro webhook management",
+    },
+    {
+        "title": "Okta Webhooks",
+        "url": "/webhooks/okta",
+        "description": "Okta webhook management",
+    },
+    {
+        "title": "Custom Webhooks",
+        "url": "/webhooks/custom",
+        "description": "Custom webhook management",
+    },
+    {
+        "title": "Templates",
+        "url": "/templates",
+        "description": "Pre-built automation templates",
+    },
+    {
+        "title": "Cron Jobs",
+        "url": "/cron",
+        "description": "Timed automations",
+    },
+    {
+        "title": "Log",
+        "url": "/log/home.html",
+        "description": "Application log viewer",
+    },
+    {
+        "title": "Files",
+        "url": "/resources/files",
+        "description": "Uploaded files",
+    },
+    {"title": "Setup", "url": "/setup", "description": "Server configuration"},
+    {
+        "title": "Branding",
+        "url": "/branding",
+        "description": "App name and icon customization",
+    },
+    {
+        "title": "Cleanup",
+        "url": "/cleanup",
+        "description": "Remove old script files",
+    },
+    {
+        "title": "Credentials",
+        "url": "/setup/credentials",
+        "description": "API credential management",
+    },
+]
+
+
+TAG_URL_MAP = {
+    "jamfpro": "/webhooks/jamf",
+    "okta": "/webhooks/okta",
+}
+
+
+def _load_json_file(filepath: str) -> list:
+    """Load a JSON list from a file, returning [] on error."""
+    if not os.path.isfile(filepath):
+        return []
+    try:
+        with open(filepath, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (json.JSONDecodeError, IOError):
+        return []
+
+
+def _index_pages() -> List[Dict[str, Any]]:
+    """Index navigable pages."""
+    return [
+        {
+            "title": page["title"],
+            "description": page.get("description", ""),
+            "url": page["url"],
+            "result_type": "page",
+            "searchable": (
+                f"{page['title']} {page.get('description', '')}".lower()
+            ),
+        }
+        for page in NAVIGABLE_PAGES
+    ]
+
+
+def _index_webhooks() -> List[Dict[str, Any]]:
+    """Index webhook entries."""
+    results: List[Dict[str, Any]] = []
+    for wh in _load_json_file(WEBHOOKS_FILE):
+        name = wh.get("name", "")
+        event = wh.get("event", wh.get("okta_event", ""))
+        desc = wh.get("description", "")
+        script = wh.get("script", "")
+        tag = wh.get("tag", "custom")
+        url = TAG_URL_MAP.get(tag, "/webhooks/custom")
+        results.append(
+            {
+                "title": name,
+                "description": f"{event} - {desc}" if desc else event,
+                "url": url,
+                "result_type": "webhook",
+                "searchable": f"{name} {event} {desc} {script}".lower(),
+            }
+        )
+    return results
+
+
+def _index_crons() -> List[Dict[str, Any]]:
+    """Index cron job entries."""
+    results: List[Dict[str, Any]] = []
+    for cron in _load_json_file(CRON_FILE):
+        name = cron.get("name", "")
+        freq = cron.get("frequency", "")
+        desc = cron.get("description", "")
+        script = cron.get("script", "")
+        results.append(
+            {
+                "title": name,
+                "description": f"{freq} - {desc}" if desc else freq,
+                "url": "/cron",
+                "result_type": "cron",
+                "searchable": f"{name} {freq} {desc} {script}".lower(),
+            }
+        )
+    return results
+
+
+def _index_templates() -> List[Dict[str, Any]]:
+    """Index template catalog entries."""
+    results: List[Dict[str, Any]] = []
+    for tmpl in _load_json_file(WORKFLOW_CONFIG):
+        title = tmpl.get("title", "")
+        desc = tmpl.get("description", "")
+        tags = " ".join(tmpl.get("tags", []))
+        event = tmpl.get("trigger_event", "")
+        slug = tmpl.get("slug", "")
+        results.append(
+            {
+                "title": title,
+                "description": desc,
+                "url": f"/templates/{slug}",
+                "result_type": "template",
+                "searchable": f"{title} {desc} {tags} {event}".lower(),
+            }
+        )
+    return results
+
+
+def _build_search_index() -> List[Dict[str, Any]]:
+    """Build a flat search index from all data sources."""
+    return (
+        _index_pages()
+        + _index_webhooks()
+        + _index_crons()
+        + _index_templates()
+    )
+
+
+def _search(query: str, limit: int = 20) -> List[Dict[str, str]]:
+    """Search the index for matching results."""
+    index = _build_search_index()
+    query_lower = query.lower()
+    terms = query_lower.split()
+
+    results: List[Dict[str, Any]] = []
+    for item in index:
+        searchable = item["searchable"]
+        if all(term in searchable for term in terms):
+            results.append(
+                {
+                    "title": item["title"],
+                    "description": item.get("description", ""),
+                    "url": item["url"],
+                    "result_type": item["result_type"],
+                }
+            )
+    return results[:limit]
+
+
+@blueprint.route("/api/search")
+def api_search() -> Union[Response, str]:
+    """JSON search endpoint for the navbar dropdown."""
+    if "username" not in session:
+        return jsonify({"results": []})
+
+    query = request.args.get("q", "").strip()
+    if len(query) < 2:
+        return jsonify({"results": []})
+
+    query = str(escape(query))
+    results = _search(query, limit=8)
+    return jsonify({"results": results})
+
+
+@blueprint.route("/search")
+def search_page() -> Union[Response, str]:
+    """Full search results page."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                "home_view.logout",
+                error_title="Session Timed Out",
+                error_message="Please sign in again",
+            )
+        )
+
+    query = request.args.get("q", "").strip()
+    query = str(escape(query))
+    results = _search(query, limit=50) if len(query) >= 2 else []
+
+    return render_template(
+        "search_results.html",
+        username=session.get("username"),
+        query=query,
+        results=results,
+    )

From 661cda3dc849694a150a2a14b82737a04a56b6a9 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Wed, 11 Feb 2026 12:14:59 -0600
Subject: [PATCH 12/84] feature: UI refresh (#59)

* feat: consolidate CSS, update base layout

* feat: update existing templates for new design system
---
 static/css/account.css          |   139 -
 static/css/bootstrap.css        | 10412 ------------------------------
 static/css/fonts.css            |   384 --
 static/css/main.css             |  1052 ++-
 static/css/nav.css              |   118 -
 static/css/site.css             |   182 -
 static/jQuery.js                |     2 -
 templates/dashboard.html        |   394 +-
 templates/error.html            |    15 +-
 templates/home.html             |    19 +-
 templates/log/home.html         |   240 +-
 templates/resources/delete.html |    17 +-
 templates/resources/files.html  |    64 +-
 templates/setup/branding.html   |    55 +-
 templates/setup/cleanup.html    |    41 +-
 templates/setup/setup.html      |    96 +-
 templates/success.html          |    13 +-
 views/home_view.py              |   317 +-
 views/log_view.py               |    62 +-
 19 files changed, 1501 insertions(+), 12121 deletions(-)
 delete mode 100644 static/css/account.css
 delete mode 100644 static/css/bootstrap.css
 delete mode 100644 static/css/fonts.css
 delete mode 100644 static/css/nav.css
 delete mode 100644 static/css/site.css
 delete mode 100644 static/jQuery.js

diff --git a/static/css/account.css b/static/css/account.css
deleted file mode 100644
index 1506bf3..0000000
--- a/static/css/account.css
+++ /dev/null
@@ -1,139 +0,0 @@
-
-.form-container {
-    max-width: 100vw;
-    padding-top: .5rem;
-    padding-bottom: 1rem;
-}
-
-
-.log-container {
-    padding: 10px;
-    max-width: 100vw;
-}
-
-.login-form-container {
-    padding-bottom: 7rem;
-    display: flex;
-}
-
-
-form.table-view > * {
-    margin-top: 5px;
-    margin-bottom: 5px;
-}
-
-form.table-view h1 {
-    text-align: center;
-}
-
-form.table-view button {
-    float: right;
-}
-
-form.table-view select {
-    padding: 0;
-}
-
-form.table-view {
-    min-width: 25vw;
-    max-width: 425px;
-    margin-bottom: 5rem;
-    margin-top: 1rem;
-    background-color: #d7a773f6;
-    color: #112a46;
-    border: 1px #aa845a;
-    border-radius: 2rem;
-    padding: 1rem;
-}
-
-form.files-form {
-    margin-top: auto;
-    margin-left: auto;
-    margin-right: auto;
-    max-height: 45vh;
-    max-width: fit-content;
-    background-color: #d7a773f6;
-    color: #112a46;
-    border: 1px #aa845a;
-    border-radius: 5px;
-    padding: 1rem;
-}
-
-.error-msg {
-    color: #b30000;
-    text-align: center;
-}
-
-.success-wrap {
-    overflow: hidden;
-    border-left: 1em solid transparent;
-    border-right: 1em solid transparent;
-    text-overflow: ellipsis;
-}
-
-.success-wrap:hover {
-    overflow: visible;
-}
-
-.success-form {
-    margin-top: auto;
-    margin-left: auto;
-    margin-right: auto;
-    text-align: center;
-    max-width: 1000px;
-    background-color: #d7a773f6;
-    color: #112a46;
-    border: 1px #aa845a;
-    border-radius: 5px;
-    padding: 10px;
-}
-
-.success-view {
-    margin-top: 1rem;
-    margin-bottom: 1rem;
-    padding-top: 1rem;
-}
-
-.button-align {
-    align-items: right;
-}
-
-.test-banner {
-    background-color: #ececec;
-}
-
-.body {
-    padding-top: 60px;
-}
-
-@media (max-width: 979px) {
-    body {
-        padding-top: 0px;
-    }
-}
-
-.table-view {
-    margin: auto;
-    max-width: 100vh;
-    background-color: #d7a773f6;
-    color: #112a46;
-    border: 1px #aa845a;
-    border-radius: 5px;
-    padding: 10px;
-}
-
-.table-view {
-    margin-top: 1rem;
-    max-width: 100vw;
-    background-color: #d7a773f6;
-    color: #112a46;
-    border: 1px #aa845a;
-    border-radius: 5px;
-    padding: 10px;
-}
-
-.table-view a {
-    color: #FFFFFF;
-    text-decoration: underline;
-}
-
diff --git a/static/css/bootstrap.css b/static/css/bootstrap.css
deleted file mode 100644
index b909727..0000000
--- a/static/css/bootstrap.css
+++ /dev/null
@@ -1,10412 +0,0 @@
-/*!
- * Bootstrap v4.5.2 (https://getbootstrap.com/)
- * Copyright 2011-2020 The Bootstrap Authors
- * Copyright 2011-2020 Twitter, Inc.
- * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
- */
-:root {
-    --blue: #007bff;
-    --indigo: #6610f2;
-    --purple: #6f42c1;
-    --pink: #e83e8c;
-    --red: #dc3545;
-    --orange: #fd7e14;
-    --yellow: #ffc107;
-    --green: #28a745;
-    --teal: #20c997;
-    --cyan: #17a2b8;
-    --white: #fff;
-    --gray: #6c757d;
-    --gray-dark: #343a40;
-    --primary: #007bff;
-    --secondary: #6c757d;
-    --success: #28a745;
-    --info: #17a2b8;
-    --warning: #ffc107;
-    --danger: #dc3545;
-    --light: #f8f9fa;
-    --dark: #343a40;
-    --breakpoint-xs: 0;
-    --breakpoint-sm: 576px;
-    --breakpoint-md: 768px;
-    --breakpoint-lg: 992px;
-    --breakpoint-xl: 1200px;
-    --font-family-sans-serif: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
-    --font-family-monospace: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace
-}
-
-*, ::after, ::before {
-    box-sizing: border-box
-}
-
-html {
-    font-family: sans-serif;
-    line-height: 1.15;
-    -webkit-text-size-adjust: 100%;
-    -webkit-tap-highlight-color: transparent
-}
-
-article, aside, figcaption, figure, footer, header, hgroup, main, nav, section {
-    display: block
-}
-
-body {
-    margin: 0;
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
-    font-size: 1rem;
-    font-weight: 400;
-    line-height: 1.5;
-    color: #212529;
-    text-align: left;
-    background-color: #fff
-}
-
-[tabindex="-1"]:focus:not(:focus-visible) {
-    outline: 0 !important
-}
-
-hr {
-    box-sizing: content-box;
-    height: 0;
-    overflow: visible
-}
-
-h1, h2, h3, h4, h5, h6 {
-    margin-top: 0;
-    margin-bottom: .5rem
-}
-
-p {
-    margin-top: 0;
-    margin-bottom: 1rem
-}
-
-abbr[data-original-title], abbr[title] {
-    text-decoration: underline;
-    -webkit-text-decoration: underline dotted;
-    text-decoration: underline dotted;
-    cursor: help;
-    border-bottom: 0;
-    -webkit-text-decoration-skip-ink: none;
-    text-decoration-skip-ink: none
-}
-
-address {
-    margin-bottom: 1rem;
-    font-style: normal;
-    line-height: inherit
-}
-
-dl, ol, ul {
-    margin-top: 0;
-    margin-bottom: 1rem
-}
-
-ol ol, ol ul, ul ol, ul ul {
-    margin-bottom: 0
-}
-
-dt {
-    font-weight: 700
-}
-
-dd {
-    margin-bottom: .5rem;
-    margin-left: 0
-}
-
-blockquote {
-    margin: 0 0 1rem
-}
-
-b, strong {
-    font-weight: bolder
-}
-
-small {
-    font-size: 80%
-}
-
-sub, sup {
-    position: relative;
-    font-size: 75%;
-    line-height: 0;
-    vertical-align: baseline
-}
-
-sub {
-    bottom: -.25em
-}
-
-sup {
-    top: -.5em
-}
-
-a {
-    color: #007bff;
-    text-decoration: none;
-    background-color: transparent
-}
-
-a:hover {
-    color: #0056b3;
-    text-decoration: underline
-}
-
-a:not([href]):not([class]) {
-    color: inherit;
-    text-decoration: none
-}
-
-a:not([href]):not([class]):hover {
-    color: inherit;
-    text-decoration: none
-}
-
-code, kbd, pre, samp {
-    font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
-    font-size: 1em
-}
-
-pre {
-    margin-top: 0;
-    margin-bottom: 1rem;
-    overflow: auto;
-    -ms-overflow-style: scrollbar
-}
-
-figure {
-    margin: 0 0 1rem
-}
-
-img {
-    vertical-align: middle;
-    border-style: none
-}
-
-svg {
-    overflow: hidden;
-    vertical-align: middle
-}
-
-table {
-    border-collapse: collapse
-}
-
-caption {
-    padding-top: .75rem;
-    padding-bottom: .75rem;
-    color: #6c757d;
-    text-align: left;
-    caption-side: bottom
-}
-
-th {
-    text-align: inherit
-}
-
-label {
-    display: inline-block;
-    margin-bottom: .5rem
-}
-
-button {
-    border-radius: 0
-}
-
-button:focus {
-    outline: 1px dotted;
-    outline: 5px auto -webkit-focus-ring-color
-}
-
-button, input, optgroup, select, textarea {
-    margin: 0;
-    font-family: inherit;
-    font-size: inherit;
-    line-height: inherit
-}
-
-button, input {
-    overflow: visible
-}
-
-button, select {
-    text-transform: none
-}
-
-[role=button] {
-    cursor: pointer
-}
-
-select {
-    word-wrap: normal
-}
-
-[type=button], [type=reset], [type=submit], button {
-    -webkit-appearance: button
-}
-
-[type=button]:not(:disabled), [type=reset]:not(:disabled), [type=submit]:not(:disabled), button:not(:disabled) {
-    cursor: pointer
-}
-
-[type=button]::-moz-focus-inner, [type=reset]::-moz-focus-inner, [type=submit]::-moz-focus-inner, button::-moz-focus-inner {
-    padding: 0;
-    border-style: none
-}
-
-input[type=checkbox], input[type=radio] {
-    box-sizing: border-box;
-    padding: 0
-}
-
-textarea {
-    overflow: auto;
-    resize: vertical
-}
-
-fieldset {
-    min-width: 0;
-    padding: 0;
-    margin: 0;
-    border: 0
-}
-
-legend {
-    display: block;
-    width: 100%;
-    max-width: 100%;
-    padding: 0;
-    margin-bottom: .5rem;
-    font-size: 1.5rem;
-    line-height: inherit;
-    color: inherit;
-    white-space: normal
-}
-
-progress {
-    vertical-align: baseline
-}
-
-[type=number]::-webkit-inner-spin-button, [type=number]::-webkit-outer-spin-button {
-    height: auto
-}
-
-[type=search] {
-    outline-offset: -2px;
-    -webkit-appearance: none
-}
-
-[type=search]::-webkit-search-decoration {
-    -webkit-appearance: none
-}
-
-::-webkit-file-upload-button {
-    font: inherit;
-    -webkit-appearance: button
-}
-
-output {
-    display: inline-block
-}
-
-summary {
-    display: list-item;
-    cursor: pointer
-}
-
-template {
-    display: none
-}
-
-[hidden] {
-    display: none !important
-}
-
-.h1, .h2, .h3, .h4, .h5, .h6, h1, h2, h3, h4, h5, h6 {
-    margin-bottom: .5rem;
-    font-weight: 500;
-    line-height: 1.2
-}
-
-.h1, h1 {
-    font-size: 2.5rem
-}
-
-.h2, h2 {
-    font-size: 2rem
-}
-
-.h3, h3 {
-    font-size: 1.75rem
-}
-
-.h4, h4 {
-    font-size: 1.5rem
-}
-
-.h5, h5 {
-    font-size: 1.25rem
-}
-
-.h6, h6 {
-    font-size: 1rem
-}
-
-.lead {
-    font-size: 1.25rem;
-    font-weight: 300
-}
-
-.display-1 {
-    font-size: 6rem;
-    font-weight: 300;
-    line-height: 1.2
-}
-
-.display-2 {
-    font-size: 5.5rem;
-    font-weight: 300;
-    line-height: 1.2
-}
-
-.display-3 {
-    font-size: 4.5rem;
-    font-weight: 300;
-    line-height: 1.2
-}
-
-.display-4 {
-    font-size: 3.5rem;
-    font-weight: 300;
-    line-height: 1.2
-}
-
-hr {
-    margin-top: 1rem;
-    margin-bottom: 1rem;
-    border: 0;
-    border-top: 1px solid rgba(0, 0, 0, .1)
-}
-
-.small, small {
-    font-size: 80%;
-    font-weight: 400
-}
-
-.mark, mark {
-    padding: .2em;
-    background-color: #fcf8e3
-}
-
-.list-unstyled {
-    padding-left: 0;
-    list-style: none
-}
-
-.list-inline {
-    padding-left: 0;
-    list-style: none
-}
-
-.list-inline-item {
-    display: inline-block
-}
-
-.list-inline-item:not(:last-child) {
-    margin-right: .5rem
-}
-
-.initialism {
-    font-size: 90%;
-    text-transform: uppercase
-}
-
-.blockquote {
-    margin-bottom: 1rem;
-    font-size: 1.25rem
-}
-
-.blockquote-footer {
-    display: block;
-    font-size: 80%;
-    color: #6c757d
-}
-
-.blockquote-footer::before {
-    content: "\2014\00A0"
-}
-
-.img-fluid {
-    max-width: 100%;
-    height: auto
-}
-
-.img-thumbnail {
-    padding: .25rem;
-    background-color: #fff;
-    border: 1px solid #dee2e6;
-    border-radius: .25rem;
-    max-width: 100%;
-    height: auto
-}
-
-.figure {
-    display: inline-block
-}
-
-.figure-img {
-    margin-bottom: .5rem;
-    line-height: 1
-}
-
-.figure-caption {
-    font-size: 90%;
-    color: #6c757d
-}
-
-code {
-    font-size: 87.5%;
-    color: #e83e8c;
-    word-wrap: break-word
-}
-
-a > code {
-    color: inherit
-}
-
-kbd {
-    padding: .2rem .4rem;
-    font-size: 87.5%;
-    color: #fff;
-    background-color: #212529;
-    border-radius: .2rem
-}
-
-kbd kbd {
-    padding: 0;
-    font-size: 100%;
-    font-weight: 700
-}
-
-pre {
-    display: block;
-    font-size: 87.5%;
-    color: #212529
-}
-
-pre code {
-    font-size: inherit;
-    color: inherit;
-    word-break: normal
-}
-
-.pre-scrollable {
-    max-height: 340px;
-    overflow-y: scroll
-}
-
-.container, .container-fluid, .container-lg, .container-md, .container-sm, .container-xl {
-    width: 100%;
-    padding-right: 15px;
-    padding-left: 15px;
-    margin-right: auto;
-    margin-left: auto;
-    display: flex;
-    justify-content: space-around;
-}
-
-@media (min-width: 576px) {
-    .container, .container-sm {
-        max-width: 540px
-    }
-}
-
-@media (min-width: 768px) {
-    .container, .container-md, .container-sm {
-        max-width: 720px
-    }
-}
-
-@media (min-width: 992px) {
-    .container, .container-lg, .container-md, .container-sm {
-        max-width: 960px
-    }
-}
-
-@media (min-width: 1200px) {
-    .container, .container-lg, .container-md, .container-sm, .container-xl {
-        max-width: 1140px
-    }
-}
-
-.row {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    margin-right: -15px;
-    margin-left: -15px
-}
-
-.no-gutters {
-    margin-right: 0;
-    margin-left: 0
-}
-
-.no-gutters > .col, .no-gutters > [class*=col-] {
-    padding-right: 0;
-    padding-left: 0
-}
-
-.col, .col-1, .col-10, .col-11, .col-12, .col-2, .col-3, .col-4, .col-5, .col-6, .col-7, .col-8, .col-9, .col-auto, .col-lg, .col-lg-1, .col-lg-10, .col-lg-11, .col-lg-12, .col-lg-2, .col-lg-3, .col-lg-4, .col-lg-5, .col-lg-6, .col-lg-7, .col-lg-8, .col-lg-9, .col-lg-auto, .col-md, .col-md-1, .col-md-10, .col-md-11, .col-md-12, .col-md-2, .col-md-3, .col-md-4, .col-md-5, .col-md-6, .col-md-7, .col-md-8, .col-md-9, .col-md-auto, .col-sm, .col-sm-1, .col-sm-10, .col-sm-11, .col-sm-12, .col-sm-2, .col-sm-3, .col-sm-4, .col-sm-5, .col-sm-6, .col-sm-7, .col-sm-8, .col-sm-9, .col-sm-auto, .col-xl, .col-xl-1, .col-xl-10, .col-xl-11, .col-xl-12, .col-xl-2, .col-xl-3, .col-xl-4, .col-xl-5, .col-xl-6, .col-xl-7, .col-xl-8, .col-xl-9, .col-xl-auto {
-    position: relative;
-    width: 100%;
-    padding-right: 15px;
-    padding-left: 15px
-}
-
-.col {
-    -ms-flex-preferred-size: 0;
-    flex-basis: 0;
-    -ms-flex-positive: 1;
-    flex-grow: 1;
-    max-width: 100%
-}
-
-.row-cols-1 > * {
-    -ms-flex: 0 0 100%;
-    flex: 0 0 100%;
-    max-width: 100%
-}
-
-.row-cols-2 > * {
-    -ms-flex: 0 0 50%;
-    flex: 0 0 50%;
-    max-width: 50%
-}
-
-.row-cols-3 > * {
-    -ms-flex: 0 0 33.333333%;
-    flex: 0 0 33.333333%;
-    max-width: 33.333333%
-}
-
-.row-cols-4 > * {
-    -ms-flex: 0 0 25%;
-    flex: 0 0 25%;
-    max-width: 25%
-}
-
-.row-cols-5 > * {
-    -ms-flex: 0 0 20%;
-    flex: 0 0 20%;
-    max-width: 20%
-}
-
-.row-cols-6 > * {
-    -ms-flex: 0 0 16.666667%;
-    flex: 0 0 16.666667%;
-    max-width: 16.666667%
-}
-
-.col-auto {
-    -ms-flex: 0 0 auto;
-    flex: 0 0 auto;
-    width: auto;
-    max-width: 100%
-}
-
-.col-1 {
-    -ms-flex: 0 0 8.333333%;
-    flex: 0 0 8.333333%;
-    max-width: 8.333333%
-}
-
-.col-2 {
-    -ms-flex: 0 0 16.666667%;
-    flex: 0 0 16.666667%;
-    max-width: 16.666667%
-}
-
-.col-3 {
-    -ms-flex: 0 0 25%;
-    flex: 0 0 25%;
-    max-width: 25%
-}
-
-.col-4 {
-    -ms-flex: 0 0 33.333333%;
-    flex: 0 0 33.333333%;
-    max-width: 33.333333%
-}
-
-.col-5 {
-    -ms-flex: 0 0 41.666667%;
-    flex: 0 0 41.666667%;
-    max-width: 41.666667%
-}
-
-.col-6 {
-    -ms-flex: 0 0 50%;
-    flex: 0 0 50%;
-    max-width: 50%
-}
-
-.col-7 {
-    -ms-flex: 0 0 58.333333%;
-    flex: 0 0 58.333333%;
-    max-width: 58.333333%
-}
-
-.col-8 {
-    -ms-flex: 0 0 66.666667%;
-    flex: 0 0 66.666667%;
-    max-width: 66.666667%
-}
-
-.col-9 {
-    -ms-flex: 0 0 75%;
-    flex: 0 0 75%;
-    max-width: 75%
-}
-
-.col-10 {
-    -ms-flex: 0 0 83.333333%;
-    flex: 0 0 83.333333%;
-    max-width: 83.333333%
-}
-
-.col-11 {
-    -ms-flex: 0 0 91.666667%;
-    flex: 0 0 91.666667%;
-    max-width: 91.666667%
-}
-
-.col-12 {
-    -ms-flex: 0 0 100%;
-    flex: 0 0 100%;
-    max-width: 100%
-}
-
-.order-first {
-    -ms-flex-order: -1;
-    order: -1
-}
-
-.order-last {
-    -ms-flex-order: 13;
-    order: 13
-}
-
-.order-0 {
-    -ms-flex-order: 0;
-    order: 0
-}
-
-.order-1 {
-    -ms-flex-order: 1;
-    order: 1
-}
-
-.order-2 {
-    -ms-flex-order: 2;
-    order: 2
-}
-
-.order-3 {
-    -ms-flex-order: 3;
-    order: 3
-}
-
-.order-4 {
-    -ms-flex-order: 4;
-    order: 4
-}
-
-.order-5 {
-    -ms-flex-order: 5;
-    order: 5
-}
-
-.order-6 {
-    -ms-flex-order: 6;
-    order: 6
-}
-
-.order-7 {
-    -ms-flex-order: 7;
-    order: 7
-}
-
-.order-8 {
-    -ms-flex-order: 8;
-    order: 8
-}
-
-.order-9 {
-    -ms-flex-order: 9;
-    order: 9
-}
-
-.order-10 {
-    -ms-flex-order: 10;
-    order: 10
-}
-
-.order-11 {
-    -ms-flex-order: 11;
-    order: 11
-}
-
-.order-12 {
-    -ms-flex-order: 12;
-    order: 12
-}
-
-.offset-1 {
-    margin-left: 8.333333%
-}
-
-.offset-2 {
-    margin-left: 16.666667%
-}
-
-.offset-3 {
-    margin-left: 25%
-}
-
-.offset-4 {
-    margin-left: 33.333333%
-}
-
-.offset-5 {
-    margin-left: 41.666667%
-}
-
-.offset-6 {
-    margin-left: 50%
-}
-
-.offset-7 {
-    margin-left: 58.333333%
-}
-
-.offset-8 {
-    margin-left: 66.666667%
-}
-
-.offset-9 {
-    margin-left: 75%
-}
-
-.offset-10 {
-    margin-left: 83.333333%
-}
-
-.offset-11 {
-    margin-left: 91.666667%
-}
-
-@media (min-width: 576px) {
-    .col-sm {
-        -ms-flex-preferred-size: 0;
-        flex-basis: 0;
-        -ms-flex-positive: 1;
-        flex-grow: 1;
-        max-width: 100%
-    }
-
-    .row-cols-sm-1 > * {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .row-cols-sm-2 > * {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .row-cols-sm-3 > * {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .row-cols-sm-4 > * {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .row-cols-sm-5 > * {
-        -ms-flex: 0 0 20%;
-        flex: 0 0 20%;
-        max-width: 20%
-    }
-
-    .row-cols-sm-6 > * {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-sm-auto {
-        -ms-flex: 0 0 auto;
-        flex: 0 0 auto;
-        width: auto;
-        max-width: 100%
-    }
-
-    .col-sm-1 {
-        -ms-flex: 0 0 8.333333%;
-        flex: 0 0 8.333333%;
-        max-width: 8.333333%
-    }
-
-    .col-sm-2 {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-sm-3 {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .col-sm-4 {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .col-sm-5 {
-        -ms-flex: 0 0 41.666667%;
-        flex: 0 0 41.666667%;
-        max-width: 41.666667%
-    }
-
-    .col-sm-6 {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .col-sm-7 {
-        -ms-flex: 0 0 58.333333%;
-        flex: 0 0 58.333333%;
-        max-width: 58.333333%
-    }
-
-    .col-sm-8 {
-        -ms-flex: 0 0 66.666667%;
-        flex: 0 0 66.666667%;
-        max-width: 66.666667%
-    }
-
-    .col-sm-9 {
-        -ms-flex: 0 0 75%;
-        flex: 0 0 75%;
-        max-width: 75%
-    }
-
-    .col-sm-10 {
-        -ms-flex: 0 0 83.333333%;
-        flex: 0 0 83.333333%;
-        max-width: 83.333333%
-    }
-
-    .col-sm-11 {
-        -ms-flex: 0 0 91.666667%;
-        flex: 0 0 91.666667%;
-        max-width: 91.666667%
-    }
-
-    .col-sm-12 {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .order-sm-first {
-        -ms-flex-order: -1;
-        order: -1
-    }
-
-    .order-sm-last {
-        -ms-flex-order: 13;
-        order: 13
-    }
-
-    .order-sm-0 {
-        -ms-flex-order: 0;
-        order: 0
-    }
-
-    .order-sm-1 {
-        -ms-flex-order: 1;
-        order: 1
-    }
-
-    .order-sm-2 {
-        -ms-flex-order: 2;
-        order: 2
-    }
-
-    .order-sm-3 {
-        -ms-flex-order: 3;
-        order: 3
-    }
-
-    .order-sm-4 {
-        -ms-flex-order: 4;
-        order: 4
-    }
-
-    .order-sm-5 {
-        -ms-flex-order: 5;
-        order: 5
-    }
-
-    .order-sm-6 {
-        -ms-flex-order: 6;
-        order: 6
-    }
-
-    .order-sm-7 {
-        -ms-flex-order: 7;
-        order: 7
-    }
-
-    .order-sm-8 {
-        -ms-flex-order: 8;
-        order: 8
-    }
-
-    .order-sm-9 {
-        -ms-flex-order: 9;
-        order: 9
-    }
-
-    .order-sm-10 {
-        -ms-flex-order: 10;
-        order: 10
-    }
-
-    .order-sm-11 {
-        -ms-flex-order: 11;
-        order: 11
-    }
-
-    .order-sm-12 {
-        -ms-flex-order: 12;
-        order: 12
-    }
-
-    .offset-sm-0 {
-        margin-left: 0
-    }
-
-    .offset-sm-1 {
-        margin-left: 8.333333%
-    }
-
-    .offset-sm-2 {
-        margin-left: 16.666667%
-    }
-
-    .offset-sm-3 {
-        margin-left: 25%
-    }
-
-    .offset-sm-4 {
-        margin-left: 33.333333%
-    }
-
-    .offset-sm-5 {
-        margin-left: 41.666667%
-    }
-
-    .offset-sm-6 {
-        margin-left: 50%
-    }
-
-    .offset-sm-7 {
-        margin-left: 58.333333%
-    }
-
-    .offset-sm-8 {
-        margin-left: 66.666667%
-    }
-
-    .offset-sm-9 {
-        margin-left: 75%
-    }
-
-    .offset-sm-10 {
-        margin-left: 83.333333%
-    }
-
-    .offset-sm-11 {
-        margin-left: 91.666667%
-    }
-}
-
-@media (min-width: 768px) {
-    .col-md {
-        -ms-flex-preferred-size: 0;
-        flex-basis: 0;
-        -ms-flex-positive: 1;
-        flex-grow: 1;
-        max-width: 100%
-    }
-
-    .row-cols-md-1 > * {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .row-cols-md-2 > * {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .row-cols-md-3 > * {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .row-cols-md-4 > * {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .row-cols-md-5 > * {
-        -ms-flex: 0 0 20%;
-        flex: 0 0 20%;
-        max-width: 20%
-    }
-
-    .row-cols-md-6 > * {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-md-auto {
-        -ms-flex: 0 0 auto;
-        flex: 0 0 auto;
-        width: auto;
-        max-width: 100%
-    }
-
-    .col-md-1 {
-        -ms-flex: 0 0 8.333333%;
-        flex: 0 0 8.333333%;
-        max-width: 8.333333%
-    }
-
-    .col-md-2 {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-md-3 {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .col-md-4 {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .col-md-5 {
-        -ms-flex: 0 0 41.666667%;
-        flex: 0 0 41.666667%;
-        max-width: 41.666667%
-    }
-
-    .col-md-6 {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .col-md-7 {
-        -ms-flex: 0 0 58.333333%;
-        flex: 0 0 58.333333%;
-        max-width: 58.333333%
-    }
-
-    .col-md-8 {
-        -ms-flex: 0 0 66.666667%;
-        flex: 0 0 66.666667%;
-        max-width: 66.666667%
-    }
-
-    .col-md-9 {
-        -ms-flex: 0 0 75%;
-        flex: 0 0 75%;
-        max-width: 75%
-    }
-
-    .col-md-10 {
-        -ms-flex: 0 0 83.333333%;
-        flex: 0 0 83.333333%;
-        max-width: 83.333333%
-    }
-
-    .col-md-11 {
-        -ms-flex: 0 0 91.666667%;
-        flex: 0 0 91.666667%;
-        max-width: 91.666667%
-    }
-
-    .col-md-12 {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .order-md-first {
-        -ms-flex-order: -1;
-        order: -1
-    }
-
-    .order-md-last {
-        -ms-flex-order: 13;
-        order: 13
-    }
-
-    .order-md-0 {
-        -ms-flex-order: 0;
-        order: 0
-    }
-
-    .order-md-1 {
-        -ms-flex-order: 1;
-        order: 1
-    }
-
-    .order-md-2 {
-        -ms-flex-order: 2;
-        order: 2
-    }
-
-    .order-md-3 {
-        -ms-flex-order: 3;
-        order: 3
-    }
-
-    .order-md-4 {
-        -ms-flex-order: 4;
-        order: 4
-    }
-
-    .order-md-5 {
-        -ms-flex-order: 5;
-        order: 5
-    }
-
-    .order-md-6 {
-        -ms-flex-order: 6;
-        order: 6
-    }
-
-    .order-md-7 {
-        -ms-flex-order: 7;
-        order: 7
-    }
-
-    .order-md-8 {
-        -ms-flex-order: 8;
-        order: 8
-    }
-
-    .order-md-9 {
-        -ms-flex-order: 9;
-        order: 9
-    }
-
-    .order-md-10 {
-        -ms-flex-order: 10;
-        order: 10
-    }
-
-    .order-md-11 {
-        -ms-flex-order: 11;
-        order: 11
-    }
-
-    .order-md-12 {
-        -ms-flex-order: 12;
-        order: 12
-    }
-
-    .offset-md-0 {
-        margin-left: 0
-    }
-
-    .offset-md-1 {
-        margin-left: 8.333333%
-    }
-
-    .offset-md-2 {
-        margin-left: 16.666667%
-    }
-
-    .offset-md-3 {
-        margin-left: 25%
-    }
-
-    .offset-md-4 {
-        margin-left: 33.333333%
-    }
-
-    .offset-md-5 {
-        margin-left: 41.666667%
-    }
-
-    .offset-md-6 {
-        margin-left: 50%
-    }
-
-    .offset-md-7 {
-        margin-left: 58.333333%
-    }
-
-    .offset-md-8 {
-        margin-left: 66.666667%
-    }
-
-    .offset-md-9 {
-        margin-left: 75%
-    }
-
-    .offset-md-10 {
-        margin-left: 83.333333%
-    }
-
-    .offset-md-11 {
-        margin-left: 91.666667%
-    }
-}
-
-@media (min-width: 992px) {
-    .col-lg {
-        -ms-flex-preferred-size: 0;
-        flex-basis: 0;
-        -ms-flex-positive: 1;
-        flex-grow: 1;
-        max-width: 100%
-    }
-
-    .row-cols-lg-1 > * {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .row-cols-lg-2 > * {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .row-cols-lg-3 > * {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .row-cols-lg-4 > * {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .row-cols-lg-5 > * {
-        -ms-flex: 0 0 20%;
-        flex: 0 0 20%;
-        max-width: 20%
-    }
-
-    .row-cols-lg-6 > * {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-lg-auto {
-        -ms-flex: 0 0 auto;
-        flex: 0 0 auto;
-        width: auto;
-        max-width: 100%
-    }
-
-    .col-lg-1 {
-        -ms-flex: 0 0 8.333333%;
-        flex: 0 0 8.333333%;
-        max-width: 8.333333%
-    }
-
-    .col-lg-2 {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-lg-3 {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .col-lg-4 {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .col-lg-5 {
-        -ms-flex: 0 0 41.666667%;
-        flex: 0 0 41.666667%;
-        max-width: 41.666667%
-    }
-
-    .col-lg-6 {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .col-lg-7 {
-        -ms-flex: 0 0 58.333333%;
-        flex: 0 0 58.333333%;
-        max-width: 58.333333%
-    }
-
-    .col-lg-8 {
-        -ms-flex: 0 0 66.666667%;
-        flex: 0 0 66.666667%;
-        max-width: 66.666667%
-    }
-
-    .col-lg-9 {
-        -ms-flex: 0 0 75%;
-        flex: 0 0 75%;
-        max-width: 75%
-    }
-
-    .col-lg-10 {
-        -ms-flex: 0 0 83.333333%;
-        flex: 0 0 83.333333%;
-        max-width: 83.333333%
-    }
-
-    .col-lg-11 {
-        -ms-flex: 0 0 91.666667%;
-        flex: 0 0 91.666667%;
-        max-width: 91.666667%
-    }
-
-    .col-lg-12 {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .order-lg-first {
-        -ms-flex-order: -1;
-        order: -1
-    }
-
-    .order-lg-last {
-        -ms-flex-order: 13;
-        order: 13
-    }
-
-    .order-lg-0 {
-        -ms-flex-order: 0;
-        order: 0
-    }
-
-    .order-lg-1 {
-        -ms-flex-order: 1;
-        order: 1
-    }
-
-    .order-lg-2 {
-        -ms-flex-order: 2;
-        order: 2
-    }
-
-    .order-lg-3 {
-        -ms-flex-order: 3;
-        order: 3
-    }
-
-    .order-lg-4 {
-        -ms-flex-order: 4;
-        order: 4
-    }
-
-    .order-lg-5 {
-        -ms-flex-order: 5;
-        order: 5
-    }
-
-    .order-lg-6 {
-        -ms-flex-order: 6;
-        order: 6
-    }
-
-    .order-lg-7 {
-        -ms-flex-order: 7;
-        order: 7
-    }
-
-    .order-lg-8 {
-        -ms-flex-order: 8;
-        order: 8
-    }
-
-    .order-lg-9 {
-        -ms-flex-order: 9;
-        order: 9
-    }
-
-    .order-lg-10 {
-        -ms-flex-order: 10;
-        order: 10
-    }
-
-    .order-lg-11 {
-        -ms-flex-order: 11;
-        order: 11
-    }
-
-    .order-lg-12 {
-        -ms-flex-order: 12;
-        order: 12
-    }
-
-    .offset-lg-0 {
-        margin-left: 0
-    }
-
-    .offset-lg-1 {
-        margin-left: 8.333333%
-    }
-
-    .offset-lg-2 {
-        margin-left: 16.666667%
-    }
-
-    .offset-lg-3 {
-        margin-left: 25%
-    }
-
-    .offset-lg-4 {
-        margin-left: 33.333333%
-    }
-
-    .offset-lg-5 {
-        margin-left: 41.666667%
-    }
-
-    .offset-lg-6 {
-        margin-left: 50%
-    }
-
-    .offset-lg-7 {
-        margin-left: 58.333333%
-    }
-
-    .offset-lg-8 {
-        margin-left: 66.666667%
-    }
-
-    .offset-lg-9 {
-        margin-left: 75%
-    }
-
-    .offset-lg-10 {
-        margin-left: 83.333333%
-    }
-
-    .offset-lg-11 {
-        margin-left: 91.666667%
-    }
-}
-
-@media (min-width: 1200px) {
-    .col-xl {
-        -ms-flex-preferred-size: 0;
-        flex-basis: 0;
-        -ms-flex-positive: 1;
-        flex-grow: 1;
-        max-width: 100%
-    }
-
-    .row-cols-xl-1 > * {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .row-cols-xl-2 > * {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .row-cols-xl-3 > * {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .row-cols-xl-4 > * {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .row-cols-xl-5 > * {
-        -ms-flex: 0 0 20%;
-        flex: 0 0 20%;
-        max-width: 20%
-    }
-
-    .row-cols-xl-6 > * {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-xl-auto {
-        -ms-flex: 0 0 auto;
-        flex: 0 0 auto;
-        width: auto;
-        max-width: 100%
-    }
-
-    .col-xl-1 {
-        -ms-flex: 0 0 8.333333%;
-        flex: 0 0 8.333333%;
-        max-width: 8.333333%
-    }
-
-    .col-xl-2 {
-        -ms-flex: 0 0 16.666667%;
-        flex: 0 0 16.666667%;
-        max-width: 16.666667%
-    }
-
-    .col-xl-3 {
-        -ms-flex: 0 0 25%;
-        flex: 0 0 25%;
-        max-width: 25%
-    }
-
-    .col-xl-4 {
-        -ms-flex: 0 0 33.333333%;
-        flex: 0 0 33.333333%;
-        max-width: 33.333333%
-    }
-
-    .col-xl-5 {
-        -ms-flex: 0 0 41.666667%;
-        flex: 0 0 41.666667%;
-        max-width: 41.666667%
-    }
-
-    .col-xl-6 {
-        -ms-flex: 0 0 50%;
-        flex: 0 0 50%;
-        max-width: 50%
-    }
-
-    .col-xl-7 {
-        -ms-flex: 0 0 58.333333%;
-        flex: 0 0 58.333333%;
-        max-width: 58.333333%
-    }
-
-    .col-xl-8 {
-        -ms-flex: 0 0 66.666667%;
-        flex: 0 0 66.666667%;
-        max-width: 66.666667%
-    }
-
-    .col-xl-9 {
-        -ms-flex: 0 0 75%;
-        flex: 0 0 75%;
-        max-width: 75%
-    }
-
-    .col-xl-10 {
-        -ms-flex: 0 0 83.333333%;
-        flex: 0 0 83.333333%;
-        max-width: 83.333333%
-    }
-
-    .col-xl-11 {
-        -ms-flex: 0 0 91.666667%;
-        flex: 0 0 91.666667%;
-        max-width: 91.666667%
-    }
-
-    .col-xl-12 {
-        -ms-flex: 0 0 100%;
-        flex: 0 0 100%;
-        max-width: 100%
-    }
-
-    .order-xl-first {
-        -ms-flex-order: -1;
-        order: -1
-    }
-
-    .order-xl-last {
-        -ms-flex-order: 13;
-        order: 13
-    }
-
-    .order-xl-0 {
-        -ms-flex-order: 0;
-        order: 0
-    }
-
-    .order-xl-1 {
-        -ms-flex-order: 1;
-        order: 1
-    }
-
-    .order-xl-2 {
-        -ms-flex-order: 2;
-        order: 2
-    }
-
-    .order-xl-3 {
-        -ms-flex-order: 3;
-        order: 3
-    }
-
-    .order-xl-4 {
-        -ms-flex-order: 4;
-        order: 4
-    }
-
-    .order-xl-5 {
-        -ms-flex-order: 5;
-        order: 5
-    }
-
-    .order-xl-6 {
-        -ms-flex-order: 6;
-        order: 6
-    }
-
-    .order-xl-7 {
-        -ms-flex-order: 7;
-        order: 7
-    }
-
-    .order-xl-8 {
-        -ms-flex-order: 8;
-        order: 8
-    }
-
-    .order-xl-9 {
-        -ms-flex-order: 9;
-        order: 9
-    }
-
-    .order-xl-10 {
-        -ms-flex-order: 10;
-        order: 10
-    }
-
-    .order-xl-11 {
-        -ms-flex-order: 11;
-        order: 11
-    }
-
-    .order-xl-12 {
-        -ms-flex-order: 12;
-        order: 12
-    }
-
-    .offset-xl-0 {
-        margin-left: 0
-    }
-
-    .offset-xl-1 {
-        margin-left: 8.333333%
-    }
-
-    .offset-xl-2 {
-        margin-left: 16.666667%
-    }
-
-    .offset-xl-3 {
-        margin-left: 25%
-    }
-
-    .offset-xl-4 {
-        margin-left: 33.333333%
-    }
-
-    .offset-xl-5 {
-        margin-left: 41.666667%
-    }
-
-    .offset-xl-6 {
-        margin-left: 50%
-    }
-
-    .offset-xl-7 {
-        margin-left: 58.333333%
-    }
-
-    .offset-xl-8 {
-        margin-left: 66.666667%
-    }
-
-    .offset-xl-9 {
-        margin-left: 75%
-    }
-
-    .offset-xl-10 {
-        margin-left: 83.333333%
-    }
-
-    .offset-xl-11 {
-        margin-left: 91.666667%
-    }
-}
-
-.table {
-    width: 100%;
-    margin-bottom: 1rem;
-    color: #212529
-}
-
-.table td, .table th {
-    padding: .75rem;
-    vertical-align: top;
-    border-top: 1px solid #dee2e6
-}
-
-.table thead th {
-    vertical-align: bottom;
-    border-bottom: 2px solid #dee2e6
-}
-
-.table tbody + tbody {
-    border-top: 2px solid #dee2e6
-}
-
-.table-sm td, .table-sm th {
-    padding: .3rem
-}
-
-.table-bordered {
-    border: 1px solid #dee2e6
-}
-
-.table-bordered td, .table-bordered th {
-    border: 1px solid #dee2e6
-}
-
-.table-bordered thead td, .table-bordered thead th {
-    border-bottom-width: 2px
-}
-
-.table-borderless tbody + tbody, .table-borderless td, .table-borderless th, .table-borderless thead th {
-    border: 0
-}
-
-.table-striped tbody tr:nth-of-type(odd) {
-    background-color: rgba(0, 0, 0, .05)
-}
-
-.table-hover tbody tr:hover {
-    color: #212529;
-    background-color: rgba(0, 0, 0, .075)
-}
-
-.table-primary, .table-primary > td, .table-primary > th {
-    background-color: #b8daff
-}
-
-.table-primary tbody + tbody, .table-primary td, .table-primary th, .table-primary thead th {
-    border-color: #7abaff
-}
-
-.table-hover .table-primary:hover {
-    background-color: #9fcdff
-}
-
-.table-hover .table-primary:hover > td, .table-hover .table-primary:hover > th {
-    background-color: #9fcdff
-}
-
-.table-secondary, .table-secondary > td, .table-secondary > th {
-    background-color: #d6d8db
-}
-
-.table-secondary tbody + tbody, .table-secondary td, .table-secondary th, .table-secondary thead th {
-    border-color: #b3b7bb
-}
-
-.table-hover .table-secondary:hover {
-    background-color: #c8cbcf
-}
-
-.table-hover .table-secondary:hover > td, .table-hover .table-secondary:hover > th {
-    background-color: #c8cbcf
-}
-
-.table-success, .table-success > td, .table-success > th {
-    background-color: #c3e6cb
-}
-
-.table-success tbody + tbody, .table-success td, .table-success th, .table-success thead th {
-    border-color: #8fd19e
-}
-
-.table-hover .table-success:hover {
-    background-color: #b1dfbb
-}
-
-.table-hover .table-success:hover > td, .table-hover .table-success:hover > th {
-    background-color: #b1dfbb
-}
-
-.table-info, .table-info > td, .table-info > th {
-    background-color: #bee5eb
-}
-
-.table-info tbody + tbody, .table-info td, .table-info th, .table-info thead th {
-    border-color: #86cfda
-}
-
-.table-hover .table-info:hover {
-    background-color: #abdde5
-}
-
-.table-hover .table-info:hover > td, .table-hover .table-info:hover > th {
-    background-color: #abdde5
-}
-
-.table-warning, .table-warning > td, .table-warning > th {
-    background-color: #ffeeba
-}
-
-.table-warning tbody + tbody, .table-warning td, .table-warning th, .table-warning thead th {
-    border-color: #ffdf7e
-}
-
-.table-hover .table-warning:hover {
-    background-color: #ffe8a1
-}
-
-.table-hover .table-warning:hover > td, .table-hover .table-warning:hover > th {
-    background-color: #ffe8a1
-}
-
-.table-danger, .table-danger > td, .table-danger > th {
-    background-color: #f5c6cb
-}
-
-.table-danger tbody + tbody, .table-danger td, .table-danger th, .table-danger thead th {
-    border-color: #ed969e
-}
-
-.table-hover .table-danger:hover {
-    background-color: #f1b0b7
-}
-
-.table-hover .table-danger:hover > td, .table-hover .table-danger:hover > th {
-    background-color: #f1b0b7
-}
-
-.table-light, .table-light > td, .table-light > th {
-    background-color: #fdfdfe
-}
-
-.table-light tbody + tbody, .table-light td, .table-light th, .table-light thead th {
-    border-color: #fbfcfc
-}
-
-.table-hover .table-light:hover {
-    background-color: #ececf6
-}
-
-.table-hover .table-light:hover > td, .table-hover .table-light:hover > th {
-    background-color: #ececf6
-}
-
-.table-dark, .table-dark > td, .table-dark > th {
-    background-color: #c6c8ca
-}
-
-.table-dark tbody + tbody, .table-dark td, .table-dark th, .table-dark thead th {
-    border-color: #95999c
-}
-
-.table-hover .table-dark:hover {
-    background-color: #b9bbbe
-}
-
-.table-hover .table-dark:hover > td, .table-hover .table-dark:hover > th {
-    background-color: #b9bbbe
-}
-
-.table-active, .table-active > td, .table-active > th {
-    background-color: rgba(0, 0, 0, .075)
-}
-
-.table-hover .table-active:hover {
-    background-color: rgba(0, 0, 0, .075)
-}
-
-.table-hover .table-active:hover > td, .table-hover .table-active:hover > th {
-    background-color: rgba(0, 0, 0, .075)
-}
-
-.table .thead-dark th {
-    color: #fff;
-    background-color: #343a40;
-    border-color: #454d55
-}
-
-.table .thead-light th {
-    color: #495057;
-    background-color: #e9ecef;
-    border-color: #dee2e6
-}
-
-.table-dark {
-    color: #fff;
-    background-color: #343a40
-}
-
-.table-dark td, .table-dark th, .table-dark thead th {
-    border-color: #454d55
-}
-
-.table-dark.table-bordered {
-    border: 0
-}
-
-.table-dark.table-striped tbody tr:nth-of-type(odd) {
-    background-color: rgba(255, 255, 255, .05)
-}
-
-.table-dark.table-hover tbody tr:hover {
-    color: #fff;
-    background-color: rgba(255, 255, 255, .075)
-}
-
-@media (max-width: 575.98px) {
-    .table-responsive-sm {
-        display: block;
-        width: 100%;
-        overflow-x: auto;
-        -webkit-overflow-scrolling: touch
-    }
-
-    .table-responsive-sm > .table-bordered {
-        border: 0
-    }
-}
-
-@media (max-width: 767.98px) {
-    .table-responsive-md {
-        display: block;
-        width: 100%;
-        overflow-x: auto;
-        -webkit-overflow-scrolling: touch
-    }
-
-    .table-responsive-md > .table-bordered {
-        border: 0
-    }
-}
-
-@media (max-width: 991.98px) {
-    .table-responsive-lg {
-        display: block;
-        width: 100%;
-        overflow-x: auto;
-        -webkit-overflow-scrolling: touch
-    }
-
-    .table-responsive-lg > .table-bordered {
-        border: 0
-    }
-}
-
-@media (max-width: 1199.98px) {
-    .table-responsive-xl {
-        display: block;
-        width: 100%;
-        overflow-x: auto;
-        -webkit-overflow-scrolling: touch
-    }
-
-    .table-responsive-xl > .table-bordered {
-        border: 0
-    }
-}
-
-.table-responsive {
-    display: block;
-    width: 100%;
-    overflow-x: auto;
-    -webkit-overflow-scrolling: touch
-}
-
-.table-responsive > .table-bordered {
-    border: 0
-}
-
-.form-control {
-    display: block;
-    width: 100%;
-    height: calc(1.5em + .75rem + 2px);
-    padding: .375rem .75rem;
-    font-size: 1rem;
-    font-weight: 400;
-    line-height: 1.5;
-    color: #495057;
-    background-color: #fff;
-    background-clip: padding-box;
-    border: 1px solid #ced4da;
-    border-radius: .25rem;
-    transition: border-color .15s ease-in-out, box-shadow .15s ease-in-out
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .form-control {
-        transition: none
-    }
-}
-
-.form-control::-ms-expand {
-    background-color: transparent;
-    border: 0
-}
-
-.form-control:-moz-focusring {
-    color: transparent;
-    text-shadow: 0 0 0 #495057
-}
-
-.form-control:focus {
-    color: #495057;
-    background-color: #fff;
-    border-color: #80bdff;
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.form-control::-webkit-input-placeholder {
-    color: #6c757d;
-    opacity: 1
-}
-
-.form-control::-moz-placeholder {
-    color: #6c757d;
-    opacity: 1
-}
-
-.form-control:-ms-input-placeholder {
-    color: #6c757d;
-    opacity: 1
-}
-
-.form-control::-ms-input-placeholder {
-    color: #6c757d;
-    opacity: 1
-}
-
-.form-control::placeholder {
-    color: #6c757d;
-    opacity: 1
-}
-
-.form-control:disabled, .form-control[readonly] {
-    background-color: #e9ecef;
-    opacity: 1
-}
-
-input[type=date].form-control, input[type=datetime-local].form-control, input[type=month].form-control, input[type=time].form-control {
-    -webkit-appearance: none;
-    -moz-appearance: none;
-    appearance: none
-}
-
-select.form-control:focus::-ms-value {
-    color: #495057;
-    background-color: #fff
-}
-
-.form-control-file, .form-control-range {
-    display: block;
-    width: 100%
-}
-
-.col-form-label {
-    padding-top: calc(.375rem + 1px);
-    padding-bottom: calc(.375rem + 1px);
-    margin-bottom: 0;
-    font-size: inherit;
-    line-height: 1.5
-}
-
-.col-form-label-lg {
-    padding-top: calc(.5rem + 1px);
-    padding-bottom: calc(.5rem + 1px);
-    font-size: 1.25rem;
-    line-height: 1.5
-}
-
-.col-form-label-sm {
-    padding-top: calc(.25rem + 1px);
-    padding-bottom: calc(.25rem + 1px);
-    font-size: .875rem;
-    line-height: 1.5
-}
-
-.form-control-plaintext {
-    display: block;
-    width: 100%;
-    padding: .375rem 0;
-    margin-bottom: 0;
-    font-size: 1rem;
-    line-height: 1.5;
-    color: #212529;
-    background-color: transparent;
-    border: solid transparent;
-    border-width: 1px 0
-}
-
-.form-control-plaintext.form-control-lg, .form-control-plaintext.form-control-sm {
-    padding-right: 0;
-    padding-left: 0
-}
-
-.form-control-sm {
-    height: calc(1.5em + .5rem + 2px);
-    padding: .25rem .5rem;
-    font-size: .875rem;
-    line-height: 1.5;
-    border-radius: .2rem
-}
-
-.form-control-lg {
-    height: calc(1.5em + 1rem + 2px);
-    padding: .5rem 1rem;
-    font-size: 1.25rem;
-    line-height: 1.5;
-    border-radius: .3rem
-}
-
-select.form-control[multiple], select.form-control[size] {
-    height: auto
-}
-
-textarea.form-control {
-    height: auto
-}
-
-.form-group {
-    margin-bottom: 1rem
-}
-
-.form-text {
-    display: block;
-    margin-top: .25rem
-}
-
-.form-row {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    margin-right: -5px;
-    margin-left: -5px
-}
-
-.form-row > .col, .form-row > [class*=col-] {
-    padding-right: 5px;
-    padding-left: 5px
-}
-
-.form-check {
-    position: relative;
-    display: block;
-    padding-left: 1.25rem
-}
-
-.form-check-input {
-    position: absolute;
-    margin-top: .3rem;
-    margin-left: -1.25rem
-}
-
-.form-check-input:disabled ~ .form-check-label, .form-check-input[disabled] ~ .form-check-label {
-    color: #6c757d
-}
-
-.form-check-label {
-    margin-bottom: 0
-}
-
-.form-check-inline {
-    display: -ms-inline-flexbox;
-    display: inline-flex;
-    -ms-flex-align: center;
-    align-items: center;
-    padding-left: 0;
-    margin-right: .75rem
-}
-
-.form-check-inline .form-check-input {
-    position: static;
-    margin-top: 0;
-    margin-right: .3125rem;
-    margin-left: 0
-}
-
-.valid-feedback {
-    display: none;
-    width: 100%;
-    margin-top: .25rem;
-    font-size: 80%;
-    color: #28a745
-}
-
-.valid-tooltip {
-    position: absolute;
-    top: 100%;
-    left: 0;
-    z-index: 5;
-    display: none;
-    max-width: 100%;
-    padding: .25rem .5rem;
-    margin-top: .1rem;
-    font-size: .875rem;
-    line-height: 1.5;
-    color: #fff;
-    background-color: rgba(40, 167, 69, .9);
-    border-radius: .25rem
-}
-
-.is-valid ~ .valid-feedback, .is-valid ~ .valid-tooltip, .was-validated :valid ~ .valid-feedback, .was-validated :valid ~ .valid-tooltip {
-    display: block
-}
-
-.form-control.is-valid, .was-validated .form-control:valid {
-    border-color: #28a745;
-    padding-right: calc(1.5em + .75rem);
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath fill='%2328a745' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3e%3c/svg%3e");
-    background-repeat: no-repeat;
-    background-position: right calc(.375em + .1875rem) center;
-    background-size: calc(.75em + .375rem) calc(.75em + .375rem)
-}
-
-.form-control.is-valid:focus, .was-validated .form-control:valid:focus {
-    border-color: #28a745;
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .25)
-}
-
-.was-validated textarea.form-control:valid, textarea.form-control.is-valid {
-    padding-right: calc(1.5em + .75rem);
-    background-position: top calc(.375em + .1875rem) right calc(.375em + .1875rem)
-}
-
-.custom-select.is-valid, .was-validated .custom-select:valid {
-    border-color: #28a745;
-    padding-right: calc(.75em + 2.3125rem);
-    background: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='5' viewBox='0 0 4 5'%3e%3cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3e%3c/svg%3e") no-repeat right .75rem center/8px 10px, url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath fill='%2328a745' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3e%3c/svg%3e") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)
-}
-
-.custom-select.is-valid:focus, .was-validated .custom-select:valid:focus {
-    border-color: #28a745;
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .25)
-}
-
-.form-check-input.is-valid ~ .form-check-label, .was-validated .form-check-input:valid ~ .form-check-label {
-    color: #28a745
-}
-
-.form-check-input.is-valid ~ .valid-feedback, .form-check-input.is-valid ~ .valid-tooltip, .was-validated .form-check-input:valid ~ .valid-feedback, .was-validated .form-check-input:valid ~ .valid-tooltip {
-    display: block
-}
-
-.custom-control-input.is-valid ~ .custom-control-label, .was-validated .custom-control-input:valid ~ .custom-control-label {
-    color: #28a745
-}
-
-.custom-control-input.is-valid ~ .custom-control-label::before, .was-validated .custom-control-input:valid ~ .custom-control-label::before {
-    border-color: #28a745
-}
-
-.custom-control-input.is-valid:checked ~ .custom-control-label::before, .was-validated .custom-control-input:valid:checked ~ .custom-control-label::before {
-    border-color: #34ce57;
-    background-color: #34ce57
-}
-
-.custom-control-input.is-valid:focus ~ .custom-control-label::before, .was-validated .custom-control-input:valid:focus ~ .custom-control-label::before {
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .25)
-}
-
-.custom-control-input.is-valid:focus:not(:checked) ~ .custom-control-label::before, .was-validated .custom-control-input:valid:focus:not(:checked) ~ .custom-control-label::before {
-    border-color: #28a745
-}
-
-.custom-file-input.is-valid ~ .custom-file-label, .was-validated .custom-file-input:valid ~ .custom-file-label {
-    border-color: #28a745
-}
-
-.custom-file-input.is-valid:focus ~ .custom-file-label, .was-validated .custom-file-input:valid:focus ~ .custom-file-label {
-    border-color: #28a745;
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .25)
-}
-
-.invalid-feedback {
-    display: none;
-    width: 100%;
-    margin-top: .25rem;
-    font-size: 80%;
-    color: #dc3545
-}
-
-.invalid-tooltip {
-    position: absolute;
-    top: 100%;
-    left: 0;
-    z-index: 5;
-    display: none;
-    max-width: 100%;
-    padding: .25rem .5rem;
-    margin-top: .1rem;
-    font-size: .875rem;
-    line-height: 1.5;
-    color: #fff;
-    background-color: rgba(220, 53, 69, .9);
-    border-radius: .25rem
-}
-
-.is-invalid ~ .invalid-feedback, .is-invalid ~ .invalid-tooltip, .was-validated :invalid ~ .invalid-feedback, .was-validated :invalid ~ .invalid-tooltip {
-    display: block
-}
-
-.form-control.is-invalid, .was-validated .form-control:invalid {
-    border-color: #dc3545;
-    padding-right: calc(1.5em + .75rem);
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' fill='none' stroke='%23dc3545' viewBox='0 0 12 12'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23dc3545' stroke='none'/%3e%3c/svg%3e");
-    background-repeat: no-repeat;
-    background-position: right calc(.375em + .1875rem) center;
-    background-size: calc(.75em + .375rem) calc(.75em + .375rem)
-}
-
-.form-control.is-invalid:focus, .was-validated .form-control:invalid:focus {
-    border-color: #dc3545;
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .25)
-}
-
-.was-validated textarea.form-control:invalid, textarea.form-control.is-invalid {
-    padding-right: calc(1.5em + .75rem);
-    background-position: top calc(.375em + .1875rem) right calc(.375em + .1875rem)
-}
-
-.custom-select.is-invalid, .was-validated .custom-select:invalid {
-    border-color: #dc3545;
-    padding-right: calc(.75em + 2.3125rem);
-    background: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='5' viewBox='0 0 4 5'%3e%3cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3e%3c/svg%3e") no-repeat right .75rem center/8px 10px, url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' fill='none' stroke='%23dc3545' viewBox='0 0 12 12'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23dc3545' stroke='none'/%3e%3c/svg%3e") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)
-}
-
-.custom-select.is-invalid:focus, .was-validated .custom-select:invalid:focus {
-    border-color: #dc3545;
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .25)
-}
-
-.form-check-input.is-invalid ~ .form-check-label, .was-validated .form-check-input:invalid ~ .form-check-label {
-    color: #dc3545
-}
-
-.form-check-input.is-invalid ~ .invalid-feedback, .form-check-input.is-invalid ~ .invalid-tooltip, .was-validated .form-check-input:invalid ~ .invalid-feedback, .was-validated .form-check-input:invalid ~ .invalid-tooltip {
-    display: block
-}
-
-.custom-control-input.is-invalid ~ .custom-control-label, .was-validated .custom-control-input:invalid ~ .custom-control-label {
-    color: #dc3545
-}
-
-.custom-control-input.is-invalid ~ .custom-control-label::before, .was-validated .custom-control-input:invalid ~ .custom-control-label::before {
-    border-color: #dc3545
-}
-
-.custom-control-input.is-invalid:checked ~ .custom-control-label::before, .was-validated .custom-control-input:invalid:checked ~ .custom-control-label::before {
-    border-color: #e4606d;
-    background-color: #e4606d
-}
-
-.custom-control-input.is-invalid:focus ~ .custom-control-label::before, .was-validated .custom-control-input:invalid:focus ~ .custom-control-label::before {
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .25)
-}
-
-.custom-control-input.is-invalid:focus:not(:checked) ~ .custom-control-label::before, .was-validated .custom-control-input:invalid:focus:not(:checked) ~ .custom-control-label::before {
-    border-color: #dc3545
-}
-
-.custom-file-input.is-invalid ~ .custom-file-label, .was-validated .custom-file-input:invalid ~ .custom-file-label {
-    border-color: #dc3545
-}
-
-.custom-file-input.is-invalid:focus ~ .custom-file-label, .was-validated .custom-file-input:invalid:focus ~ .custom-file-label {
-    border-color: #dc3545;
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .25)
-}
-
-.form-inline {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-flow: row wrap;
-    flex-flow: row wrap;
-    -ms-flex-align: center;
-    align-items: center
-}
-
-.form-inline .form-check {
-    width: 100%
-}
-
-@media (min-width: 576px) {
-    .form-inline label {
-        display: -ms-flexbox;
-        display: flex;
-        -ms-flex-align: center;
-        align-items: center;
-        -ms-flex-pack: center;
-        justify-content: center;
-        margin-bottom: 0
-    }
-
-    .form-inline .form-group {
-        display: -ms-flexbox;
-        display: flex;
-        -ms-flex: 0 0 auto;
-        flex: 0 0 auto;
-        -ms-flex-flow: row wrap;
-        flex-flow: row wrap;
-        -ms-flex-align: center;
-        align-items: center;
-        margin-bottom: 0
-    }
-
-    .form-inline .form-control {
-        display: inline-block;
-        width: auto;
-        vertical-align: middle
-    }
-
-    .form-inline .form-control-plaintext {
-        display: inline-block
-    }
-
-    .form-inline .custom-select, .form-inline .input-group {
-        width: auto
-    }
-
-    .form-inline .form-check {
-        display: -ms-flexbox;
-        display: flex;
-        -ms-flex-align: center;
-        align-items: center;
-        -ms-flex-pack: center;
-        justify-content: center;
-        width: auto;
-        padding-left: 0
-    }
-
-    .form-inline .form-check-input {
-        position: relative;
-        -ms-flex-negative: 0;
-        flex-shrink: 0;
-        margin-top: 0;
-        margin-right: .25rem;
-        margin-left: 0
-    }
-
-    .form-inline .custom-control {
-        -ms-flex-align: center;
-        align-items: center;
-        -ms-flex-pack: center;
-        justify-content: center
-    }
-
-    .form-inline .custom-control-label {
-        margin-bottom: 0
-    }
-}
-
-.btn {
-    display: inline-block;
-    font-weight: 400;
-    color: #212529;
-    text-align: center;
-    vertical-align: middle;
-    -webkit-user-select: none;
-    -moz-user-select: none;
-    -ms-user-select: none;
-    user-select: none;
-    background-color: transparent;
-    border: 1px solid transparent;
-    padding: .375rem .75rem;
-    font-size: 1rem;
-    line-height: 1.5;
-    border-radius: .25rem;
-    transition: color .15s ease-in-out, background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .btn {
-        transition: none
-    }
-}
-
-.btn:hover {
-    color: #212529;
-    text-decoration: none
-}
-
-.btn.focus, .btn:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.btn.disabled, .btn:disabled {
-    opacity: .65
-}
-
-.btn:not(:disabled):not(.disabled) {
-    cursor: pointer
-}
-
-a.btn.disabled, fieldset:disabled a.btn {
-    pointer-events: none
-}
-
-.btn-primary {
-    color: #fff;
-    background-color: #007bff;
-    border-color: #007bff
-}
-
-.btn-primary:hover {
-    color: #fff;
-    background-color: #0069d9;
-    border-color: #0062cc
-}
-
-.btn-primary.focus, .btn-primary:focus {
-    color: #fff;
-    background-color: #0069d9;
-    border-color: #0062cc;
-    box-shadow: 0 0 0 .2rem rgba(38, 143, 255, .5)
-}
-
-.btn-primary.disabled, .btn-primary:disabled {
-    color: #fff;
-    background-color: #007bff;
-    border-color: #007bff
-}
-
-.btn-primary:not(:disabled):not(.disabled).active, .btn-primary:not(:disabled):not(.disabled):active, .show > .btn-primary.dropdown-toggle {
-    color: #fff;
-    background-color: #0062cc;
-    border-color: #005cbf
-}
-
-.btn-primary:not(:disabled):not(.disabled).active:focus, .btn-primary:not(:disabled):not(.disabled):active:focus, .show > .btn-primary.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(38, 143, 255, .5)
-}
-
-.btn-secondary {
-    color: #fff;
-    background-color: #6c757d;
-    border-color: #6c757d
-}
-
-.btn-secondary:hover {
-    color: #fff;
-    background-color: #5a6268;
-    border-color: #545b62
-}
-
-.btn-secondary.focus, .btn-secondary:focus {
-    color: #fff;
-    background-color: #5a6268;
-    border-color: #545b62;
-    box-shadow: 0 0 0 .2rem rgba(130, 138, 145, .5)
-}
-
-.btn-secondary.disabled, .btn-secondary:disabled {
-    color: #fff;
-    background-color: #6c757d;
-    border-color: #6c757d
-}
-
-.btn-secondary:not(:disabled):not(.disabled).active, .btn-secondary:not(:disabled):not(.disabled):active, .show > .btn-secondary.dropdown-toggle {
-    color: #fff;
-    background-color: #545b62;
-    border-color: #4e555b
-}
-
-.btn-secondary:not(:disabled):not(.disabled).active:focus, .btn-secondary:not(:disabled):not(.disabled):active:focus, .show > .btn-secondary.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(130, 138, 145, .5)
-}
-
-.btn-success {
-    color: #fff;
-    background-color: #28a745;
-    border-color: #28a745
-}
-
-.btn-success:hover {
-    color: #fff;
-    background-color: #218838;
-    border-color: #1e7e34
-}
-
-.btn-success.focus, .btn-success:focus {
-    color: #fff;
-    background-color: #218838;
-    border-color: #1e7e34;
-    box-shadow: 0 0 0 .2rem rgba(72, 180, 97, .5)
-}
-
-.btn-success.disabled, .btn-success:disabled {
-    color: #fff;
-    background-color: #28a745;
-    border-color: #28a745
-}
-
-.btn-success:not(:disabled):not(.disabled).active, .btn-success:not(:disabled):not(.disabled):active, .show > .btn-success.dropdown-toggle {
-    color: #fff;
-    background-color: #1e7e34;
-    border-color: #1c7430
-}
-
-.btn-success:not(:disabled):not(.disabled).active:focus, .btn-success:not(:disabled):not(.disabled):active:focus, .show > .btn-success.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(72, 180, 97, .5)
-}
-
-.btn-info {
-    color: #fff;
-    background-color: #17a2b8;
-    border-color: #17a2b8
-}
-
-.btn-info:hover {
-    color: #fff;
-    background-color: #138496;
-    border-color: #117a8b
-}
-
-.btn-info.focus, .btn-info:focus {
-    color: #fff;
-    background-color: #138496;
-    border-color: #117a8b;
-    box-shadow: 0 0 0 .2rem rgba(58, 176, 195, .5)
-}
-
-.btn-info.disabled, .btn-info:disabled {
-    color: #fff;
-    background-color: #17a2b8;
-    border-color: #17a2b8
-}
-
-.btn-info:not(:disabled):not(.disabled).active, .btn-info:not(:disabled):not(.disabled):active, .show > .btn-info.dropdown-toggle {
-    color: #fff;
-    background-color: #117a8b;
-    border-color: #10707f
-}
-
-.btn-info:not(:disabled):not(.disabled).active:focus, .btn-info:not(:disabled):not(.disabled):active:focus, .show > .btn-info.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(58, 176, 195, .5)
-}
-
-.btn-warning {
-    color: #212529;
-    background-color: #ffc107;
-    border-color: #ffc107
-}
-
-.btn-warning:hover {
-    color: #212529;
-    background-color: #e0a800;
-    border-color: #d39e00
-}
-
-.btn-warning.focus, .btn-warning:focus {
-    color: #212529;
-    background-color: #e0a800;
-    border-color: #d39e00;
-    box-shadow: 0 0 0 .2rem rgba(222, 170, 12, .5)
-}
-
-.btn-warning.disabled, .btn-warning:disabled {
-    color: #212529;
-    background-color: #ffc107;
-    border-color: #ffc107
-}
-
-.btn-warning:not(:disabled):not(.disabled).active, .btn-warning:not(:disabled):not(.disabled):active, .show > .btn-warning.dropdown-toggle {
-    color: #212529;
-    background-color: #d39e00;
-    border-color: #c69500
-}
-
-.btn-warning:not(:disabled):not(.disabled).active:focus, .btn-warning:not(:disabled):not(.disabled):active:focus, .show > .btn-warning.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(222, 170, 12, .5)
-}
-
-.btn-danger {
-    color: #fff;
-    background-color: #dc3545;
-    border-color: #dc3545
-}
-
-.btn-danger:hover {
-    color: #fff;
-    background-color: #c82333;
-    border-color: #bd2130
-}
-
-.btn-danger.focus, .btn-danger:focus {
-    color: #fff;
-    background-color: #c82333;
-    border-color: #bd2130;
-    box-shadow: 0 0 0 .2rem rgba(225, 83, 97, .5)
-}
-
-.btn-danger.disabled, .btn-danger:disabled {
-    color: #fff;
-    background-color: #dc3545;
-    border-color: #dc3545
-}
-
-.btn-danger:not(:disabled):not(.disabled).active, .btn-danger:not(:disabled):not(.disabled):active, .show > .btn-danger.dropdown-toggle {
-    color: #fff;
-    background-color: #bd2130;
-    border-color: #b21f2d
-}
-
-.btn-danger:not(:disabled):not(.disabled).active:focus, .btn-danger:not(:disabled):not(.disabled):active:focus, .show > .btn-danger.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(225, 83, 97, .5)
-}
-
-.btn-light {
-    color: #212529;
-    background-color: #f8f9fa;
-    border-color: #f8f9fa
-}
-
-.btn-light:hover {
-    color: #212529;
-    background-color: #e2e6ea;
-    border-color: #dae0e5
-}
-
-.btn-light.focus, .btn-light:focus {
-    color: #212529;
-    background-color: #e2e6ea;
-    border-color: #dae0e5;
-    box-shadow: 0 0 0 .2rem rgba(216, 217, 219, .5)
-}
-
-.btn-light.disabled, .btn-light:disabled {
-    color: #212529;
-    background-color: #f8f9fa;
-    border-color: #f8f9fa
-}
-
-.btn-light:not(:disabled):not(.disabled).active, .btn-light:not(:disabled):not(.disabled):active, .show > .btn-light.dropdown-toggle {
-    color: #212529;
-    background-color: #dae0e5;
-    border-color: #d3d9df
-}
-
-.btn-light:not(:disabled):not(.disabled).active:focus, .btn-light:not(:disabled):not(.disabled):active:focus, .show > .btn-light.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(216, 217, 219, .5)
-}
-
-.btn-dark {
-    color: #fff;
-    background-color: #343a40;
-    border-color: #343a40
-}
-
-.btn-dark:hover {
-    color: #fff;
-    background-color: #23272b;
-    border-color: #1d2124
-}
-
-.btn-dark.focus, .btn-dark:focus {
-    color: #fff;
-    background-color: #23272b;
-    border-color: #1d2124;
-    box-shadow: 0 0 0 .2rem rgba(82, 88, 93, .5)
-}
-
-.btn-dark.disabled, .btn-dark:disabled {
-    color: #fff;
-    background-color: #343a40;
-    border-color: #343a40
-}
-
-.btn-dark:not(:disabled):not(.disabled).active, .btn-dark:not(:disabled):not(.disabled):active, .show > .btn-dark.dropdown-toggle {
-    color: #fff;
-    background-color: #1d2124;
-    border-color: #171a1d
-}
-
-.btn-dark:not(:disabled):not(.disabled).active:focus, .btn-dark:not(:disabled):not(.disabled):active:focus, .show > .btn-dark.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(82, 88, 93, .5)
-}
-
-.btn-outline-primary {
-    color: #007bff;
-    border-color: #007bff
-}
-
-.btn-outline-primary:hover {
-    color: #fff;
-    background-color: #007bff;
-    border-color: #007bff
-}
-
-.btn-outline-primary.focus, .btn-outline-primary:focus {
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .5)
-}
-
-.btn-outline-primary.disabled, .btn-outline-primary:disabled {
-    color: #007bff;
-    background-color: transparent
-}
-
-.btn-outline-primary:not(:disabled):not(.disabled).active, .btn-outline-primary:not(:disabled):not(.disabled):active, .show > .btn-outline-primary.dropdown-toggle {
-    color: #fff;
-    background-color: #007bff;
-    border-color: #007bff
-}
-
-.btn-outline-primary:not(:disabled):not(.disabled).active:focus, .btn-outline-primary:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-primary.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .5)
-}
-
-.btn-outline-secondary {
-    color: #6c757d;
-    border-color: #6c757d
-}
-
-.btn-outline-secondary:hover {
-    color: #fff;
-    background-color: #6c757d;
-    border-color: #6c757d
-}
-
-.btn-outline-secondary.focus, .btn-outline-secondary:focus {
-    box-shadow: 0 0 0 .2rem rgba(108, 117, 125, .5)
-}
-
-.btn-outline-secondary.disabled, .btn-outline-secondary:disabled {
-    color: #6c757d;
-    background-color: transparent
-}
-
-.btn-outline-secondary:not(:disabled):not(.disabled).active, .btn-outline-secondary:not(:disabled):not(.disabled):active, .show > .btn-outline-secondary.dropdown-toggle {
-    color: #fff;
-    background-color: #6c757d;
-    border-color: #6c757d
-}
-
-.btn-outline-secondary:not(:disabled):not(.disabled).active:focus, .btn-outline-secondary:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-secondary.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(108, 117, 125, .5)
-}
-
-.btn-outline-success {
-    color: #28a745;
-    border-color: #28a745
-}
-
-.btn-outline-success:hover {
-    color: #fff;
-    background-color: #28a745;
-    border-color: #28a745
-}
-
-.btn-outline-success.focus, .btn-outline-success:focus {
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .5)
-}
-
-.btn-outline-success.disabled, .btn-outline-success:disabled {
-    color: #28a745;
-    background-color: transparent
-}
-
-.btn-outline-success:not(:disabled):not(.disabled).active, .btn-outline-success:not(:disabled):not(.disabled):active, .show > .btn-outline-success.dropdown-toggle {
-    color: #fff;
-    background-color: #28a745;
-    border-color: #28a745
-}
-
-.btn-outline-success:not(:disabled):not(.disabled).active:focus, .btn-outline-success:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-success.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .5)
-}
-
-.btn-outline-info {
-    color: #17a2b8;
-    border-color: #17a2b8
-}
-
-.btn-outline-info:hover {
-    color: #fff;
-    background-color: #17a2b8;
-    border-color: #17a2b8
-}
-
-.btn-outline-info.focus, .btn-outline-info:focus {
-    box-shadow: 0 0 0 .2rem rgba(23, 162, 184, .5)
-}
-
-.btn-outline-info.disabled, .btn-outline-info:disabled {
-    color: #17a2b8;
-    background-color: transparent
-}
-
-.btn-outline-info:not(:disabled):not(.disabled).active, .btn-outline-info:not(:disabled):not(.disabled):active, .show > .btn-outline-info.dropdown-toggle {
-    color: #fff;
-    background-color: #17a2b8;
-    border-color: #17a2b8
-}
-
-.btn-outline-info:not(:disabled):not(.disabled).active:focus, .btn-outline-info:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-info.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(23, 162, 184, .5)
-}
-
-.btn-outline-warning {
-    color: #ffc107;
-    border-color: #ffc107
-}
-
-.btn-outline-warning:hover {
-    color: #212529;
-    background-color: #ffc107;
-    border-color: #ffc107
-}
-
-.btn-outline-warning.focus, .btn-outline-warning:focus {
-    box-shadow: 0 0 0 .2rem rgba(255, 193, 7, .5)
-}
-
-.btn-outline-warning.disabled, .btn-outline-warning:disabled {
-    color: #ffc107;
-    background-color: transparent
-}
-
-.btn-outline-warning:not(:disabled):not(.disabled).active, .btn-outline-warning:not(:disabled):not(.disabled):active, .show > .btn-outline-warning.dropdown-toggle {
-    color: #212529;
-    background-color: #ffc107;
-    border-color: #ffc107
-}
-
-.btn-outline-warning:not(:disabled):not(.disabled).active:focus, .btn-outline-warning:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-warning.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(255, 193, 7, .5)
-}
-
-.btn-outline-danger {
-    color: #dc3545;
-    border-color: #dc3545
-}
-
-.btn-outline-danger:hover {
-    color: #fff;
-    background-color: #dc3545;
-    border-color: #dc3545
-}
-
-.btn-outline-danger.focus, .btn-outline-danger:focus {
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .5)
-}
-
-.btn-outline-danger.disabled, .btn-outline-danger:disabled {
-    color: #dc3545;
-    background-color: transparent
-}
-
-.btn-outline-danger:not(:disabled):not(.disabled).active, .btn-outline-danger:not(:disabled):not(.disabled):active, .show > .btn-outline-danger.dropdown-toggle {
-    color: #fff;
-    background-color: #dc3545;
-    border-color: #dc3545
-}
-
-.btn-outline-danger:not(:disabled):not(.disabled).active:focus, .btn-outline-danger:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-danger.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .5)
-}
-
-.btn-outline-light {
-    color: #f8f9fa;
-    border-color: #f8f9fa
-}
-
-.btn-outline-light:hover {
-    color: #212529;
-    background-color: #f8f9fa;
-    border-color: #f8f9fa
-}
-
-.btn-outline-light.focus, .btn-outline-light:focus {
-    box-shadow: 0 0 0 .2rem rgba(248, 249, 250, .5)
-}
-
-.btn-outline-light.disabled, .btn-outline-light:disabled {
-    color: #f8f9fa;
-    background-color: transparent
-}
-
-.btn-outline-light:not(:disabled):not(.disabled).active, .btn-outline-light:not(:disabled):not(.disabled):active, .show > .btn-outline-light.dropdown-toggle {
-    color: #212529;
-    background-color: #f8f9fa;
-    border-color: #f8f9fa
-}
-
-.btn-outline-light:not(:disabled):not(.disabled).active:focus, .btn-outline-light:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-light.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(248, 249, 250, .5)
-}
-
-.btn-outline-dark {
-    color: #343a40;
-    border-color: #343a40
-}
-
-.btn-outline-dark:hover {
-    color: #fff;
-    background-color: #343a40;
-    border-color: #343a40
-}
-
-.btn-outline-dark.focus, .btn-outline-dark:focus {
-    box-shadow: 0 0 0 .2rem rgba(52, 58, 64, .5)
-}
-
-.btn-outline-dark.disabled, .btn-outline-dark:disabled {
-    color: #343a40;
-    background-color: transparent
-}
-
-.btn-outline-dark:not(:disabled):not(.disabled).active, .btn-outline-dark:not(:disabled):not(.disabled):active, .show > .btn-outline-dark.dropdown-toggle {
-    color: #fff;
-    background-color: #343a40;
-    border-color: #343a40
-}
-
-.btn-outline-dark:not(:disabled):not(.disabled).active:focus, .btn-outline-dark:not(:disabled):not(.disabled):active:focus, .show > .btn-outline-dark.dropdown-toggle:focus {
-    box-shadow: 0 0 0 .2rem rgba(52, 58, 64, .5)
-}
-
-.btn-link {
-    font-weight: 400;
-    color: #007bff;
-    text-decoration: none
-}
-
-.btn-link:hover {
-    color: #0056b3;
-    text-decoration: underline
-}
-
-.btn-link.focus, .btn-link:focus {
-    text-decoration: underline
-}
-
-.btn-link.disabled, .btn-link:disabled {
-    color: #6c757d;
-    pointer-events: none
-}
-
-.btn-group-lg > .btn, .btn-lg {
-    padding: .5rem 1rem;
-    font-size: 1.25rem;
-    line-height: 1.5;
-    border-radius: .3rem
-}
-
-.btn-group-sm > .btn, .btn-sm {
-    padding: .25rem .5rem;
-    font-size: .875rem;
-    line-height: 1.5;
-    border-radius: .2rem
-}
-
-.btn-block {
-    display: block;
-    width: 100%
-}
-
-.btn-block + .btn-block {
-    margin-top: .5rem
-}
-
-input[type=button].btn-block, input[type=reset].btn-block, input[type=submit].btn-block {
-    width: 100%
-}
-
-.fade {
-    transition: opacity .15s linear
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .fade {
-        transition: none
-    }
-}
-
-.fade:not(.show) {
-    opacity: 0
-}
-
-.collapse:not(.show) {
-    display: none
-}
-
-.collapsing {
-    position: relative;
-    height: 0;
-    overflow: hidden;
-    transition: height .35s ease
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .collapsing {
-        transition: none
-    }
-}
-
-.dropdown, .dropleft, .dropright, .dropup {
-    position: relative
-}
-
-.dropdown-toggle {
-    white-space: nowrap
-}
-
-.dropdown-toggle::after {
-    display: inline-block;
-    margin-left: .255em;
-    vertical-align: .255em;
-    content: "";
-    border-top: .3em solid;
-    border-right: .3em solid transparent;
-    border-bottom: 0;
-    border-left: .3em solid transparent
-}
-
-.dropdown-toggle:empty::after {
-    margin-left: 0
-}
-
-.dropdown-menu {
-    position: absolute;
-    top: 100%;
-    left: 0;
-    z-index: 1000;
-    display: none;
-    float: left;
-    min-width: 10rem;
-    padding: .5rem 0;
-    margin: .125rem 0 0;
-    font-size: 1rem;
-    color: #212529;
-    text-align: left;
-    list-style: none;
-    background-color: #fff;
-    background-clip: padding-box;
-    border: 1px solid rgba(0, 0, 0, .15);
-    border-radius: .25rem
-}
-
-.dropdown-menu-left {
-    right: auto;
-    left: 0
-}
-
-.dropdown-menu-right {
-    right: 0;
-    left: auto
-}
-
-@media (min-width: 576px) {
-    .dropdown-menu-sm-left {
-        right: auto;
-        left: 0
-    }
-
-    .dropdown-menu-sm-right {
-        right: 0;
-        left: auto
-    }
-}
-
-@media (min-width: 768px) {
-    .dropdown-menu-md-left {
-        right: auto;
-        left: 0
-    }
-
-    .dropdown-menu-md-right {
-        right: 0;
-        left: auto
-    }
-}
-
-@media (min-width: 992px) {
-    .dropdown-menu-lg-left {
-        right: auto;
-        left: 0
-    }
-
-    .dropdown-menu-lg-right {
-        right: 0;
-        left: auto
-    }
-}
-
-@media (min-width: 1200px) {
-    .dropdown-menu-xl-left {
-        right: auto;
-        left: 0
-    }
-
-    .dropdown-menu-xl-right {
-        right: 0;
-        left: auto
-    }
-}
-
-.dropup .dropdown-menu {
-    top: auto;
-    bottom: 100%;
-    margin-top: 0;
-    margin-bottom: .125rem
-}
-
-.dropup .dropdown-toggle::after {
-    display: inline-block;
-    margin-left: .255em;
-    vertical-align: .255em;
-    content: "";
-    border-top: 0;
-    border-right: .3em solid transparent;
-    border-bottom: .3em solid;
-    border-left: .3em solid transparent
-}
-
-.dropup .dropdown-toggle:empty::after {
-    margin-left: 0
-}
-
-.dropright .dropdown-menu {
-    top: 0;
-    right: auto;
-    left: 100%;
-    margin-top: 0;
-    margin-left: .125rem
-}
-
-.dropright .dropdown-toggle::after {
-    display: inline-block;
-    margin-left: .255em;
-    vertical-align: .255em;
-    content: "";
-    border-top: .3em solid transparent;
-    border-right: 0;
-    border-bottom: .3em solid transparent;
-    border-left: .3em solid
-}
-
-.dropright .dropdown-toggle:empty::after {
-    margin-left: 0
-}
-
-.dropright .dropdown-toggle::after {
-    vertical-align: 0
-}
-
-.dropleft .dropdown-menu {
-    top: 0;
-    right: 100%;
-    left: auto;
-    margin-top: 0;
-    margin-right: .125rem
-}
-
-.dropleft .dropdown-toggle::after {
-    display: inline-block;
-    margin-left: .255em;
-    vertical-align: .255em;
-    content: ""
-}
-
-.dropleft .dropdown-toggle::after {
-    display: none
-}
-
-.dropleft .dropdown-toggle::before {
-    display: inline-block;
-    margin-right: .255em;
-    vertical-align: .255em;
-    content: "";
-    border-top: .3em solid transparent;
-    border-right: .3em solid;
-    border-bottom: .3em solid transparent
-}
-
-.dropleft .dropdown-toggle:empty::after {
-    margin-left: 0
-}
-
-.dropleft .dropdown-toggle::before {
-    vertical-align: 0
-}
-
-.dropdown-menu[x-placement^=bottom], .dropdown-menu[x-placement^=left], .dropdown-menu[x-placement^=right], .dropdown-menu[x-placement^=top] {
-    right: auto;
-    bottom: auto
-}
-
-.dropdown-divider {
-    height: 0;
-    margin: .5rem 0;
-    overflow: hidden;
-    border-top: 1px solid #e9ecef
-}
-
-.dropdown-item {
-    display: block;
-    width: 100%;
-    padding: .25rem 1.5rem;
-    clear: both;
-    font-weight: 400;
-    color: #212529;
-    text-align: inherit;
-    white-space: nowrap;
-    background-color: transparent;
-    border: 0
-}
-
-.dropdown-item:focus, .dropdown-item:hover {
-    color: #16181b;
-    text-decoration: none;
-    background-color: #f8f9fa
-}
-
-.dropdown-item.active, .dropdown-item:active {
-    color: #fff;
-    text-decoration: none;
-    background-color: #007bff
-}
-
-.dropdown-item.disabled, .dropdown-item:disabled {
-    color: #6c757d;
-    pointer-events: none;
-    background-color: transparent
-}
-
-.dropdown-menu.show {
-    display: block
-}
-
-.dropdown-header {
-    display: block;
-    padding: .5rem 1.5rem;
-    margin-bottom: 0;
-    font-size: .875rem;
-    color: #6c757d;
-    white-space: nowrap
-}
-
-.dropdown-item-text {
-    display: block;
-    padding: .25rem 1.5rem;
-    color: #212529
-}
-
-.btn-group, .btn-group-vertical {
-    position: relative;
-    display: -ms-inline-flexbox;
-    display: inline-flex;
-    vertical-align: middle
-}
-
-.btn-group-vertical > .btn, .btn-group > .btn {
-    position: relative;
-    -ms-flex: 1 1 auto;
-    flex: 1 1 auto
-}
-
-.btn-group-vertical > .btn:hover, .btn-group > .btn:hover {
-    z-index: 1
-}
-
-.btn-group-vertical > .btn.active, .btn-group-vertical > .btn:active, .btn-group-vertical > .btn:focus, .btn-group > .btn.active, .btn-group > .btn:active, .btn-group > .btn:focus {
-    z-index: 1
-}
-
-.btn-toolbar {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    -ms-flex-pack: start;
-    justify-content: flex-start
-}
-
-.btn-toolbar .input-group {
-    width: auto
-}
-
-.btn-group > .btn-group:not(:first-child), .btn-group > .btn:not(:first-child) {
-    margin-left: -1px
-}
-
-.btn-group > .btn-group:not(:last-child) > .btn, .btn-group > .btn:not(:last-child):not(.dropdown-toggle) {
-    border-top-right-radius: 0;
-    border-bottom-right-radius: 0
-}
-
-.btn-group > .btn-group:not(:first-child) > .btn, .btn-group > .btn:not(:first-child) {
-    border-top-left-radius: 0;
-    border-bottom-left-radius: 0
-}
-
-.dropdown-toggle-split {
-    padding-right: .5625rem;
-    padding-left: .5625rem
-}
-
-.dropdown-toggle-split::after, .dropright .dropdown-toggle-split::after, .dropup .dropdown-toggle-split::after {
-    margin-left: 0
-}
-
-.dropleft .dropdown-toggle-split::before {
-    margin-right: 0
-}
-
-.btn-group-sm > .btn + .dropdown-toggle-split, .btn-sm + .dropdown-toggle-split {
-    padding-right: .375rem;
-    padding-left: .375rem
-}
-
-.btn-group-lg > .btn + .dropdown-toggle-split, .btn-lg + .dropdown-toggle-split {
-    padding-right: .75rem;
-    padding-left: .75rem
-}
-
-.btn-group-vertical {
-    -ms-flex-direction: column;
-    flex-direction: column;
-    -ms-flex-align: start;
-    align-items: flex-start;
-    -ms-flex-pack: center;
-    justify-content: center
-}
-
-.btn-group-vertical > .btn, .btn-group-vertical > .btn-group {
-    width: 100%
-}
-
-.btn-group-vertical > .btn-group:not(:first-child), .btn-group-vertical > .btn:not(:first-child) {
-    margin-top: -1px
-}
-
-.btn-group-vertical > .btn-group:not(:last-child) > .btn, .btn-group-vertical > .btn:not(:last-child):not(.dropdown-toggle) {
-    border-bottom-right-radius: 0;
-    border-bottom-left-radius: 0
-}
-
-.btn-group-vertical > .btn-group:not(:first-child) > .btn, .btn-group-vertical > .btn:not(:first-child) {
-    border-top-left-radius: 0;
-    border-top-right-radius: 0
-}
-
-.btn-group-toggle > .btn, .btn-group-toggle > .btn-group > .btn {
-    margin-bottom: 0
-}
-
-.btn-group-toggle > .btn input[type=checkbox], .btn-group-toggle > .btn input[type=radio], .btn-group-toggle > .btn-group > .btn input[type=checkbox], .btn-group-toggle > .btn-group > .btn input[type=radio] {
-    position: absolute;
-    clip: rect(0, 0, 0, 0);
-    pointer-events: none
-}
-
-.input-group {
-    position: relative;
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    -ms-flex-align: stretch;
-    align-items: stretch;
-    width: 100%
-}
-
-.input-group > .custom-file, .input-group > .custom-select, .input-group > .form-control, .input-group > .form-control-plaintext {
-    position: relative;
-    -ms-flex: 1 1 auto;
-    flex: 1 1 auto;
-    width: 1%;
-    min-width: 0;
-    margin-bottom: 0
-}
-
-.input-group > .custom-file + .custom-file, .input-group > .custom-file + .custom-select, .input-group > .custom-file + .form-control, .input-group > .custom-select + .custom-file, .input-group > .custom-select + .custom-select, .input-group > .custom-select + .form-control, .input-group > .form-control + .custom-file, .input-group > .form-control + .custom-select, .input-group > .form-control + .form-control, .input-group > .form-control-plaintext + .custom-file, .input-group > .form-control-plaintext + .custom-select, .input-group > .form-control-plaintext + .form-control {
-    margin-left: -1px
-}
-
-.input-group > .custom-file .custom-file-input:focus ~ .custom-file-label, .input-group > .custom-select:focus, .input-group > .form-control:focus {
-    z-index: 3
-}
-
-.input-group > .custom-file .custom-file-input:focus {
-    z-index: 4
-}
-
-.input-group > .custom-select:not(:last-child), .input-group > .form-control:not(:last-child) {
-    border-top-right-radius: 0;
-    border-bottom-right-radius: 0
-}
-
-.input-group > .custom-select:not(:first-child), .input-group > .form-control:not(:first-child) {
-    border-top-left-radius: 0;
-    border-bottom-left-radius: 0
-}
-
-.input-group > .custom-file {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: center;
-    align-items: center
-}
-
-.input-group > .custom-file:not(:last-child) .custom-file-label, .input-group > .custom-file:not(:last-child) .custom-file-label::after {
-    border-top-right-radius: 0;
-    border-bottom-right-radius: 0
-}
-
-.input-group > .custom-file:not(:first-child) .custom-file-label {
-    border-top-left-radius: 0;
-    border-bottom-left-radius: 0
-}
-
-.input-group-append, .input-group-prepend {
-    display: -ms-flexbox;
-    display: flex
-}
-
-.input-group-append .btn, .input-group-prepend .btn {
-    position: relative;
-    z-index: 2
-}
-
-.input-group-append .btn:focus, .input-group-prepend .btn:focus {
-    z-index: 3
-}
-
-.input-group-append .btn + .btn, .input-group-append .btn + .input-group-text, .input-group-append .input-group-text + .btn, .input-group-append .input-group-text + .input-group-text, .input-group-prepend .btn + .btn, .input-group-prepend .btn + .input-group-text, .input-group-prepend .input-group-text + .btn, .input-group-prepend .input-group-text + .input-group-text {
-    margin-left: -1px
-}
-
-.input-group-prepend {
-    margin-right: -1px
-}
-
-.input-group-append {
-    margin-left: -1px
-}
-
-.input-group-text {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: center;
-    align-items: center;
-    padding: .375rem .75rem;
-    margin-bottom: 0;
-    font-size: 1rem;
-    font-weight: 400;
-    line-height: 1.5;
-    color: #495057;
-    text-align: center;
-    white-space: nowrap;
-    background-color: #e9ecef;
-    border: 1px solid #ced4da;
-    border-radius: .25rem
-}
-
-.input-group-text input[type=checkbox], .input-group-text input[type=radio] {
-    margin-top: 0
-}
-
-.input-group-lg > .custom-select, .input-group-lg > .form-control:not(textarea) {
-    height: calc(1.5em + 1rem + 2px)
-}
-
-.input-group-lg > .custom-select, .input-group-lg > .form-control, .input-group-lg > .input-group-append > .btn, .input-group-lg > .input-group-append > .input-group-text, .input-group-lg > .input-group-prepend > .btn, .input-group-lg > .input-group-prepend > .input-group-text {
-    padding: .5rem 1rem;
-    font-size: 1.25rem;
-    line-height: 1.5;
-    border-radius: .3rem
-}
-
-.input-group-sm > .custom-select, .input-group-sm > .form-control:not(textarea) {
-    height: calc(1.5em + .5rem + 2px)
-}
-
-.input-group-sm > .custom-select, .input-group-sm > .form-control, .input-group-sm > .input-group-append > .btn, .input-group-sm > .input-group-append > .input-group-text, .input-group-sm > .input-group-prepend > .btn, .input-group-sm > .input-group-prepend > .input-group-text {
-    padding: .25rem .5rem;
-    font-size: .875rem;
-    line-height: 1.5;
-    border-radius: .2rem
-}
-
-.input-group-lg > .custom-select, .input-group-sm > .custom-select {
-    padding-right: 1.75rem
-}
-
-.input-group > .input-group-append:last-child > .btn:not(:last-child):not(.dropdown-toggle), .input-group > .input-group-append:last-child > .input-group-text:not(:last-child), .input-group > .input-group-append:not(:last-child) > .btn, .input-group > .input-group-append:not(:last-child) > .input-group-text, .input-group > .input-group-prepend > .btn, .input-group > .input-group-prepend > .input-group-text {
-    border-top-right-radius: 0;
-    border-bottom-right-radius: 0
-}
-
-.input-group > .input-group-append > .btn, .input-group > .input-group-append > .input-group-text, .input-group > .input-group-prepend:first-child > .btn:not(:first-child), .input-group > .input-group-prepend:first-child > .input-group-text:not(:first-child), .input-group > .input-group-prepend:not(:first-child) > .btn, .input-group > .input-group-prepend:not(:first-child) > .input-group-text {
-    border-top-left-radius: 0;
-    border-bottom-left-radius: 0
-}
-
-.custom-control {
-    position: relative;
-    z-index: 1;
-    display: block;
-    min-height: 1.5rem;
-    padding-left: 1.5rem
-}
-
-.custom-control-inline {
-    display: -ms-inline-flexbox;
-    display: inline-flex;
-    margin-right: 1rem
-}
-
-.custom-control-input {
-    position: absolute;
-    left: 0;
-    z-index: -1;
-    width: 1rem;
-    height: 1.25rem;
-    opacity: 0
-}
-
-.custom-control-input:checked ~ .custom-control-label::before {
-    color: #fff;
-    border-color: #007bff;
-    background-color: #007bff
-}
-
-.custom-control-input:focus ~ .custom-control-label::before {
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.custom-control-input:focus:not(:checked) ~ .custom-control-label::before {
-    border-color: #80bdff
-}
-
-.custom-control-input:not(:disabled):active ~ .custom-control-label::before {
-    color: #fff;
-    background-color: #b3d7ff;
-    border-color: #b3d7ff
-}
-
-.custom-control-input:disabled ~ .custom-control-label, .custom-control-input[disabled] ~ .custom-control-label {
-    color: #6c757d
-}
-
-.custom-control-input:disabled ~ .custom-control-label::before, .custom-control-input[disabled] ~ .custom-control-label::before {
-    background-color: #e9ecef
-}
-
-.custom-control-label {
-    position: relative;
-    margin-bottom: 0;
-    vertical-align: top
-}
-
-.custom-control-label::before {
-    position: absolute;
-    top: .25rem;
-    left: -1.5rem;
-    display: block;
-    width: 1rem;
-    height: 1rem;
-    pointer-events: none;
-    content: "";
-    background-color: #fff;
-    border: #adb5bd solid 1px
-}
-
-.custom-control-label::after {
-    position: absolute;
-    top: .25rem;
-    left: -1.5rem;
-    display: block;
-    width: 1rem;
-    height: 1rem;
-    content: "";
-    background: no-repeat 50%/50% 50%
-}
-
-.custom-checkbox .custom-control-label::before {
-    border-radius: .25rem
-}
-
-.custom-checkbox .custom-control-input:checked ~ .custom-control-label::after {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath fill='%23fff' d='M6.564.75l-3.59 3.612-1.538-1.55L0 4.26l2.974 2.99L8 2.193z'/%3e%3c/svg%3e")
-}
-
-.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::before {
-    border-color: #007bff;
-    background-color: #007bff
-}
-
-.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::after {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='4' viewBox='0 0 4 4'%3e%3cpath stroke='%23fff' d='M0 2h4'/%3e%3c/svg%3e")
-}
-
-.custom-checkbox .custom-control-input:disabled:checked ~ .custom-control-label::before {
-    background-color: rgba(0, 123, 255, .5)
-}
-
-.custom-checkbox .custom-control-input:disabled:indeterminate ~ .custom-control-label::before {
-    background-color: rgba(0, 123, 255, .5)
-}
-
-.custom-radio .custom-control-label::before {
-    border-radius: 50%
-}
-
-.custom-radio .custom-control-input:checked ~ .custom-control-label::after {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='%23fff'/%3e%3c/svg%3e")
-}
-
-.custom-radio .custom-control-input:disabled:checked ~ .custom-control-label::before {
-    background-color: rgba(0, 123, 255, .5)
-}
-
-.custom-switch {
-    padding-left: 2.25rem
-}
-
-.custom-switch .custom-control-label::before {
-    left: -2.25rem;
-    width: 1.75rem;
-    pointer-events: all;
-    border-radius: .5rem
-}
-
-.custom-switch .custom-control-label::after {
-    top: calc(.25rem + 2px);
-    left: calc(-2.25rem + 2px);
-    width: calc(1rem - 4px);
-    height: calc(1rem - 4px);
-    background-color: #adb5bd;
-    border-radius: .5rem;
-    transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out, -webkit-transform .15s ease-in-out;
-    transition: transform .15s ease-in-out, background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    transition: transform .15s ease-in-out, background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out, -webkit-transform .15s ease-in-out
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .custom-switch .custom-control-label::after {
-        transition: none
-    }
-}
-
-.custom-switch .custom-control-input:checked ~ .custom-control-label::after {
-    background-color: #fff;
-    -webkit-transform: translateX(.75rem);
-    transform: translateX(.75rem)
-}
-
-.custom-switch .custom-control-input:disabled:checked ~ .custom-control-label::before {
-    background-color: rgba(0, 123, 255, .5)
-}
-
-.custom-select {
-    display: inline-block;
-    width: 100%;
-    height: calc(1.5em + .75rem + 2px);
-    padding: .375rem 1.75rem .375rem .75rem;
-    font-size: 1rem;
-    font-weight: 400;
-    line-height: 1.5;
-    color: #495057;
-    vertical-align: middle;
-    background: #fff url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='5' viewBox='0 0 4 5'%3e%3cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3e%3c/svg%3e") no-repeat right .75rem center/8px 10px;
-    border: 1px solid #ced4da;
-    border-radius: .25rem;
-    -webkit-appearance: none;
-    -moz-appearance: none;
-    appearance: none
-}
-
-.custom-select:focus {
-    border-color: #80bdff;
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.custom-select:focus::-ms-value {
-    color: #495057;
-    background-color: #fff
-}
-
-.custom-select[multiple], .custom-select[size]:not([size="1"]) {
-    height: auto;
-    padding-right: .75rem;
-    background-image: none
-}
-
-.custom-select:disabled {
-    color: #6c757d;
-    background-color: #e9ecef
-}
-
-.custom-select::-ms-expand {
-    display: none
-}
-
-.custom-select:-moz-focusring {
-    color: transparent;
-    text-shadow: 0 0 0 #495057
-}
-
-.custom-select-sm {
-    height: calc(1.5em + .5rem + 2px);
-    padding-top: .25rem;
-    padding-bottom: .25rem;
-    padding-left: .5rem;
-    font-size: .875rem
-}
-
-.custom-select-lg {
-    height: calc(1.5em + 1rem + 2px);
-    padding-top: .5rem;
-    padding-bottom: .5rem;
-    padding-left: 1rem;
-    font-size: 1.25rem
-}
-
-.custom-file {
-    position: relative;
-    display: inline-block;
-    width: 100%;
-    height: calc(1.5em + .75rem + 2px);
-    margin-bottom: 0
-}
-
-.custom-file-input {
-    position: relative;
-    z-index: 2;
-    width: 100%;
-    height: calc(1.5em + .75rem + 2px);
-    margin: 0;
-    opacity: 0
-}
-
-.custom-file-input:focus ~ .custom-file-label {
-    border-color: #80bdff;
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.custom-file-input:disabled ~ .custom-file-label, .custom-file-input[disabled] ~ .custom-file-label {
-    background-color: #e9ecef
-}
-
-.custom-file-input:lang(en) ~ .custom-file-label::after {
-    content: "Browse"
-}
-
-.custom-file-input ~ .custom-file-label[data-browse]::after {
-    content: attr(data-browse)
-}
-
-.custom-file-label {
-    position: absolute;
-    top: 0;
-    right: 0;
-    left: 0;
-    z-index: 1;
-    height: calc(1.5em + .75rem + 2px);
-    padding: .375rem .75rem;
-    font-weight: 400;
-    line-height: 1.5;
-    color: #495057;
-    background-color: #fff;
-    border: 1px solid #ced4da;
-    border-radius: .25rem
-}
-
-.custom-file-label::after {
-    position: absolute;
-    top: 0;
-    right: 0;
-    bottom: 0;
-    z-index: 3;
-    display: block;
-    height: calc(1.5em + .75rem);
-    padding: .375rem .75rem;
-    line-height: 1.5;
-    color: #495057;
-    content: "Browse";
-    background-color: #e9ecef;
-    border-left: inherit;
-    border-radius: 0 .25rem .25rem 0
-}
-
-.custom-range {
-    width: 100%;
-    height: 1.4rem;
-    padding: 0;
-    background-color: transparent;
-    -webkit-appearance: none;
-    -moz-appearance: none;
-    appearance: none
-}
-
-.custom-range:focus {
-    outline: 0
-}
-
-.custom-range:focus::-webkit-slider-thumb {
-    box-shadow: 0 0 0 1px #fff, 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.custom-range:focus::-moz-range-thumb {
-    box-shadow: 0 0 0 1px #fff, 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.custom-range:focus::-ms-thumb {
-    box-shadow: 0 0 0 1px #fff, 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.custom-range::-moz-focus-outer {
-    border: 0
-}
-
-.custom-range::-webkit-slider-thumb {
-    width: 1rem;
-    height: 1rem;
-    margin-top: -.25rem;
-    background-color: #007bff;
-    border: 0;
-    border-radius: 1rem;
-    -webkit-transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    -webkit-appearance: none;
-    appearance: none
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .custom-range::-webkit-slider-thumb {
-        -webkit-transition: none;
-        transition: none
-    }
-}
-
-.custom-range::-webkit-slider-thumb:active {
-    background-color: #b3d7ff
-}
-
-.custom-range::-webkit-slider-runnable-track {
-    width: 100%;
-    height: .5rem;
-    color: transparent;
-    cursor: pointer;
-    background-color: #dee2e6;
-    border-color: transparent;
-    border-radius: 1rem
-}
-
-.custom-range::-moz-range-thumb {
-    width: 1rem;
-    height: 1rem;
-    background-color: #007bff;
-    border: 0;
-    border-radius: 1rem;
-    -moz-transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    -moz-appearance: none;
-    appearance: none
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .custom-range::-moz-range-thumb {
-        -moz-transition: none;
-        transition: none
-    }
-}
-
-.custom-range::-moz-range-thumb:active {
-    background-color: #b3d7ff
-}
-
-.custom-range::-moz-range-track {
-    width: 100%;
-    height: .5rem;
-    color: transparent;
-    cursor: pointer;
-    background-color: #dee2e6;
-    border-color: transparent;
-    border-radius: 1rem
-}
-
-.custom-range::-ms-thumb {
-    width: 1rem;
-    height: 1rem;
-    margin-top: 0;
-    margin-right: .2rem;
-    margin-left: .2rem;
-    background-color: #007bff;
-    border: 0;
-    border-radius: 1rem;
-    -ms-transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out;
-    appearance: none
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .custom-range::-ms-thumb {
-        -ms-transition: none;
-        transition: none
-    }
-}
-
-.custom-range::-ms-thumb:active {
-    background-color: #b3d7ff
-}
-
-.custom-range::-ms-track {
-    width: 100%;
-    height: .5rem;
-    color: transparent;
-    cursor: pointer;
-    background-color: transparent;
-    border-color: transparent;
-    border-width: .5rem
-}
-
-.custom-range::-ms-fill-lower {
-    background-color: #dee2e6;
-    border-radius: 1rem
-}
-
-.custom-range::-ms-fill-upper {
-    margin-right: 15px;
-    background-color: #dee2e6;
-    border-radius: 1rem
-}
-
-.custom-range:disabled::-webkit-slider-thumb {
-    background-color: #adb5bd
-}
-
-.custom-range:disabled::-webkit-slider-runnable-track {
-    cursor: default
-}
-
-.custom-range:disabled::-moz-range-thumb {
-    background-color: #adb5bd
-}
-
-.custom-range:disabled::-moz-range-track {
-    cursor: default
-}
-
-.custom-range:disabled::-ms-thumb {
-    background-color: #adb5bd
-}
-
-.custom-control-label::before, .custom-file-label, .custom-select {
-    transition: background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .custom-control-label::before, .custom-file-label, .custom-select {
-        transition: none
-    }
-}
-
-.nav {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    padding-left: 0;
-    margin-bottom: 0;
-    list-style: none
-}
-
-.nav-link {
-    display: block;
-    padding: .5rem 1rem
-}
-
-.nav-link:focus, .nav-link:hover {
-    text-decoration: none
-}
-
-.nav-link.disabled {
-    color: #6c757d;
-    pointer-events: none;
-    cursor: default
-}
-
-.nav-tabs {
-    border-bottom: 1px solid #dee2e6
-}
-
-.nav-tabs .nav-item {
-    margin-bottom: -1px
-}
-
-.nav-tabs .nav-link {
-    border: 1px solid transparent;
-    border-top-left-radius: .25rem;
-    border-top-right-radius: .25rem
-}
-
-.nav-tabs .nav-link:focus, .nav-tabs .nav-link:hover {
-    border-color: #e9ecef #e9ecef #dee2e6
-}
-
-.nav-tabs .nav-link.disabled {
-    color: #6c757d;
-    background-color: transparent;
-    border-color: transparent
-}
-
-.nav-tabs .nav-item.show .nav-link, .nav-tabs .nav-link.active {
-    color: #495057;
-    background-color: #fff;
-    border-color: #dee2e6 #dee2e6 #fff
-}
-
-.nav-tabs .dropdown-menu {
-    margin-top: -1px;
-    border-top-left-radius: 0;
-    border-top-right-radius: 0
-}
-
-.nav-pills .nav-link {
-    border-radius: .25rem
-}
-
-.nav-pills .nav-link.active, .nav-pills .show > .nav-link {
-    color: #fff;
-    background-color: #007bff
-}
-
-.nav-fill .nav-item, .nav-fill > .nav-link {
-    -ms-flex: 1 1 auto;
-    flex: 1 1 auto;
-    text-align: center
-}
-
-.nav-justified .nav-item, .nav-justified > .nav-link {
-    -ms-flex-preferred-size: 0;
-    flex-basis: 0;
-    -ms-flex-positive: 1;
-    flex-grow: 1;
-    text-align: center
-}
-
-.tab-content > .tab-pane {
-    display: none
-}
-
-.tab-content > .active {
-    display: block
-}
-
-.navbar {
-    position: relative;
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    -ms-flex-align: center;
-    align-items: center;
-    -ms-flex-pack: justify;
-    justify-content: space-between;
-    padding: .5rem 1rem
-}
-
-.navbar .container, .navbar .container-fluid, .navbar .container-lg, .navbar .container-md, .navbar .container-sm, .navbar .container-xl {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    -ms-flex-align: center;
-    align-items: center;
-    -ms-flex-pack: justify;
-    justify-content: space-between
-}
-
-.navbar-brand {
-    display: inline-block;
-    padding-top: .3125rem;
-    padding-bottom: .3125rem;
-    margin-right: 1rem;
-    font-size: 1.25rem;
-    line-height: inherit;
-    white-space: nowrap
-}
-
-.navbar-brand:focus, .navbar-brand:hover {
-    text-decoration: none
-}
-
-.navbar-nav {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-direction: column;
-    flex-direction: column;
-    padding-left: 0;
-    margin-bottom: 0;
-    list-style: none
-}
-
-.navbar-nav .nav-link {
-    padding-right: 0;
-    padding-left: 0
-}
-
-.navbar-nav .dropdown-menu {
-    position: static;
-    float: none
-}
-
-.navbar-text {
-    display: inline-block;
-    padding-top: .5rem;
-    padding-bottom: .5rem
-}
-
-.navbar-collapse {
-    -ms-flex-preferred-size: 100%;
-    flex-basis: 100%;
-    -ms-flex-positive: 1;
-    flex-grow: 1;
-    -ms-flex-align: center;
-    align-items: center
-}
-
-.navbar-toggler {
-    padding: .25rem .75rem;
-    font-size: 1.25rem;
-    line-height: 1;
-    background-color: transparent;
-    border: 1px solid transparent;
-    border-radius: .25rem
-}
-
-.navbar-toggler:focus, .navbar-toggler:hover {
-    text-decoration: none
-}
-
-.navbar-toggler-icon {
-    display: inline-block;
-    width: 1.5em;
-    height: 1.5em;
-    vertical-align: middle;
-    content: "";
-    background: no-repeat center center;
-    background-size: 100% 100%
-}
-
-@media (max-width: 575.98px) {
-    .navbar-expand-sm > .container, .navbar-expand-sm > .container-fluid, .navbar-expand-sm > .container-lg, .navbar-expand-sm > .container-md, .navbar-expand-sm > .container-sm, .navbar-expand-sm > .container-xl {
-        padding-right: 0;
-        padding-left: 0
-    }
-}
-
-@media (min-width: 576px) {
-    .navbar-expand-sm {
-        -ms-flex-flow: row nowrap;
-        flex-flow: row nowrap;
-        -ms-flex-pack: start;
-        justify-content: flex-start
-    }
-
-    .navbar-expand-sm .navbar-nav {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .navbar-expand-sm .navbar-nav .dropdown-menu {
-        position: absolute
-    }
-
-    .navbar-expand-sm .navbar-nav .nav-link {
-        padding-right: .5rem;
-        padding-left: .5rem
-    }
-
-    .navbar-expand-sm > .container, .navbar-expand-sm > .container-fluid, .navbar-expand-sm > .container-lg, .navbar-expand-sm > .container-md, .navbar-expand-sm > .container-sm, .navbar-expand-sm > .container-xl {
-        -ms-flex-wrap: nowrap;
-        flex-wrap: nowrap
-    }
-
-    .navbar-expand-sm .navbar-collapse {
-        display: -ms-flexbox !important;
-        display: flex !important;
-        -ms-flex-preferred-size: auto;
-        flex-basis: auto
-    }
-
-    .navbar-expand-sm .navbar-toggler {
-        display: none
-    }
-}
-
-@media (max-width: 767.98px) {
-    .navbar-expand-md > .container, .navbar-expand-md > .container-fluid, .navbar-expand-md > .container-lg, .navbar-expand-md > .container-md, .navbar-expand-md > .container-sm, .navbar-expand-md > .container-xl {
-        padding-right: 0;
-        padding-left: 0
-    }
-}
-
-@media (min-width: 768px) {
-    .navbar-expand-md {
-        -ms-flex-flow: row nowrap;
-        flex-flow: row nowrap;
-        -ms-flex-pack: start;
-        justify-content: flex-start
-    }
-
-    .navbar-expand-md .navbar-nav {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .navbar-expand-md .navbar-nav .dropdown-menu {
-        position: absolute
-    }
-
-    .navbar-expand-md .navbar-nav .nav-link {
-        padding-right: .5rem;
-        padding-left: .5rem
-    }
-
-    .navbar-expand-md > .container, .navbar-expand-md > .container-fluid, .navbar-expand-md > .container-lg, .navbar-expand-md > .container-md, .navbar-expand-md > .container-sm, .navbar-expand-md > .container-xl {
-        -ms-flex-wrap: nowrap;
-        flex-wrap: nowrap
-    }
-
-    .navbar-expand-md .navbar-collapse {
-        display: -ms-flexbox !important;
-        display: flex !important;
-        -ms-flex-preferred-size: auto;
-        flex-basis: auto
-    }
-
-    .navbar-expand-md .navbar-toggler {
-        display: none
-    }
-}
-
-@media (max-width: 991.98px) {
-    .navbar-expand-lg > .container, .navbar-expand-lg > .container-fluid, .navbar-expand-lg > .container-lg, .navbar-expand-lg > .container-md, .navbar-expand-lg > .container-sm, .navbar-expand-lg > .container-xl {
-        padding-right: 0;
-        padding-left: 0
-    }
-}
-
-@media (min-width: 992px) {
-    .navbar-expand-lg {
-        -ms-flex-flow: row nowrap;
-        flex-flow: row nowrap;
-        -ms-flex-pack: start;
-        justify-content: flex-start
-    }
-
-    .navbar-expand-lg .navbar-nav {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .navbar-expand-lg .navbar-nav .dropdown-menu {
-        position: absolute
-    }
-
-    .navbar-expand-lg .navbar-nav .nav-link {
-        padding-right: .5rem;
-        padding-left: .5rem
-    }
-
-    .navbar-expand-lg > .container, .navbar-expand-lg > .container-fluid, .navbar-expand-lg > .container-lg, .navbar-expand-lg > .container-md, .navbar-expand-lg > .container-sm, .navbar-expand-lg > .container-xl {
-        -ms-flex-wrap: nowrap;
-        flex-wrap: nowrap
-    }
-
-    .navbar-expand-lg .navbar-collapse {
-        display: -ms-flexbox !important;
-        display: flex !important;
-        -ms-flex-preferred-size: auto;
-        flex-basis: auto
-    }
-
-    .navbar-expand-lg .navbar-toggler {
-        display: none
-    }
-}
-
-@media (max-width: 1199.98px) {
-    .navbar-expand-xl > .container, .navbar-expand-xl > .container-fluid, .navbar-expand-xl > .container-lg, .navbar-expand-xl > .container-md, .navbar-expand-xl > .container-sm, .navbar-expand-xl > .container-xl {
-        padding-right: 0;
-        padding-left: 0
-    }
-}
-
-@media (min-width: 1200px) {
-    .navbar-expand-xl {
-        -ms-flex-flow: row nowrap;
-        flex-flow: row nowrap;
-        -ms-flex-pack: start;
-        justify-content: flex-start
-    }
-
-    .navbar-expand-xl .navbar-nav {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .navbar-expand-xl .navbar-nav .dropdown-menu {
-        position: absolute
-    }
-
-    .navbar-expand-xl .navbar-nav .nav-link {
-        padding-right: .5rem;
-        padding-left: .5rem
-    }
-
-    .navbar-expand-xl > .container, .navbar-expand-xl > .container-fluid, .navbar-expand-xl > .container-lg, .navbar-expand-xl > .container-md, .navbar-expand-xl > .container-sm, .navbar-expand-xl > .container-xl {
-        -ms-flex-wrap: nowrap;
-        flex-wrap: nowrap
-    }
-
-    .navbar-expand-xl .navbar-collapse {
-        display: -ms-flexbox !important;
-        display: flex !important;
-        -ms-flex-preferred-size: auto;
-        flex-basis: auto
-    }
-
-    .navbar-expand-xl .navbar-toggler {
-        display: none
-    }
-}
-
-.navbar-expand {
-    -ms-flex-flow: row nowrap;
-    flex-flow: row nowrap;
-    -ms-flex-pack: start;
-    justify-content: flex-start
-}
-
-.navbar-expand > .container, .navbar-expand > .container-fluid, .navbar-expand > .container-lg, .navbar-expand > .container-md, .navbar-expand > .container-sm, .navbar-expand > .container-xl {
-    padding-right: 0;
-    padding-left: 0
-}
-
-.navbar-expand .navbar-nav {
-    -ms-flex-direction: row;
-    flex-direction: row
-}
-
-.navbar-expand .navbar-nav .dropdown-menu {
-    position: absolute
-}
-
-.navbar-expand .navbar-nav .nav-link {
-    padding-right: .5rem;
-    padding-left: .5rem
-}
-
-.navbar-expand > .container, .navbar-expand > .container-fluid, .navbar-expand > .container-lg, .navbar-expand > .container-md, .navbar-expand > .container-sm, .navbar-expand > .container-xl {
-    -ms-flex-wrap: nowrap;
-    flex-wrap: nowrap
-}
-
-.navbar-expand .navbar-collapse {
-    display: -ms-flexbox !important;
-    display: flex !important;
-    -ms-flex-preferred-size: auto;
-    flex-basis: auto
-}
-
-.navbar-expand .navbar-toggler {
-    display: none
-}
-
-.navbar-light .navbar-brand {
-    color: rgba(0, 0, 0, .9)
-}
-
-.navbar-light .navbar-brand:focus, .navbar-light .navbar-brand:hover {
-    color: rgba(0, 0, 0, .9)
-}
-
-.navbar-light .navbar-nav .nav-link {
-    color: rgba(0, 0, 0, .5)
-}
-
-.navbar-light .navbar-nav .nav-link:focus, .navbar-light .navbar-nav .nav-link:hover {
-    color: rgba(0, 0, 0, .7)
-}
-
-.navbar-light .navbar-nav .nav-link.disabled {
-    color: rgba(0, 0, 0, .3)
-}
-
-.navbar-light .navbar-nav .active > .nav-link, .navbar-light .navbar-nav .nav-link.active, .navbar-light .navbar-nav .nav-link.show, .navbar-light .navbar-nav .show > .nav-link {
-    color: rgba(0, 0, 0, .9)
-}
-
-.navbar-light .navbar-toggler {
-    color: rgba(0, 0, 0, .5);
-    border-color: rgba(0, 0, 0, .1)
-}
-
-.navbar-light .navbar-toggler-icon {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='30' height='30' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%280, 0, 0, 0.5%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e")
-}
-
-.navbar-light .navbar-text {
-    color: rgba(0, 0, 0, .5)
-}
-
-.navbar-light .navbar-text a {
-    color: rgba(0, 0, 0, .9)
-}
-
-.navbar-light .navbar-text a:focus, .navbar-light .navbar-text a:hover {
-    color: rgba(0, 0, 0, .9)
-}
-
-.navbar-dark .navbar-brand {
-    color: #fff
-}
-
-.navbar-dark .navbar-brand:focus, .navbar-dark .navbar-brand:hover {
-    color: #fff
-}
-
-.navbar-dark .navbar-nav .nav-link {
-    color: rgba(255, 255, 255, .5)
-}
-
-.navbar-dark .navbar-nav .nav-link:focus, .navbar-dark .navbar-nav .nav-link:hover {
-    color: rgba(255, 255, 255, .75)
-}
-
-.navbar-dark .navbar-nav .nav-link.disabled {
-    color: rgba(255, 255, 255, .25)
-}
-
-.navbar-dark .navbar-nav .active > .nav-link, .navbar-dark .navbar-nav .nav-link.active, .navbar-dark .navbar-nav .nav-link.show, .navbar-dark .navbar-nav .show > .nav-link {
-    color: #fff
-}
-
-.navbar-dark .navbar-toggler {
-    color: rgba(255, 255, 255, .5);
-    border-color: rgba(255, 255, 255, .1)
-}
-
-.navbar-dark .navbar-toggler-icon {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='30' height='30' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.5%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e")
-}
-
-.navbar-dark .navbar-text {
-    color: rgba(255, 255, 255, .5)
-}
-
-.navbar-dark .navbar-text a {
-    color: #fff
-}
-
-.navbar-dark .navbar-text a:focus, .navbar-dark .navbar-text a:hover {
-    color: #fff
-}
-
-.card {
-    position: relative;
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-direction: column;
-    flex-direction: column;
-    min-width: 0;
-    word-wrap: break-word;
-    background-color: #fff;
-    background-clip: border-box;
-    border: 1px solid rgba(0, 0, 0, .125);
-    border-radius: .25rem
-}
-
-.card > hr {
-    margin-right: 0;
-    margin-left: 0
-}
-
-.card > .list-group {
-    border-top: inherit;
-    border-bottom: inherit
-}
-
-.card > .list-group:first-child {
-    border-top-width: 0;
-    border-top-left-radius: calc(.25rem - 1px);
-    border-top-right-radius: calc(.25rem - 1px)
-}
-
-.card > .list-group:last-child {
-    border-bottom-width: 0;
-    border-bottom-right-radius: calc(.25rem - 1px);
-    border-bottom-left-radius: calc(.25rem - 1px)
-}
-
-.card > .card-header + .list-group, .card > .list-group + .card-footer {
-    border-top: 0
-}
-
-.card-body {
-    -ms-flex: 1 1 auto;
-    flex: 1 1 auto;
-    min-height: 1px;
-    padding: 1.25rem
-}
-
-.card-title {
-    margin-bottom: .75rem
-}
-
-.card-subtitle {
-    margin-top: -.375rem;
-    margin-bottom: 0
-}
-
-.card-text:last-child {
-    margin-bottom: 0
-}
-
-.card-link:hover {
-    text-decoration: none
-}
-
-.card-link + .card-link {
-    margin-left: 1.25rem
-}
-
-.card-header {
-    padding: .75rem 1.25rem;
-    margin-bottom: 0;
-    background-color: rgba(0, 0, 0, .03);
-    border-bottom: 1px solid rgba(0, 0, 0, .125)
-}
-
-.card-header:first-child {
-    border-radius: calc(.25rem - 1px) calc(.25rem - 1px) 0 0
-}
-
-.card-footer {
-    padding: .75rem 1.25rem;
-    background-color: rgba(0, 0, 0, .03);
-    border-top: 1px solid rgba(0, 0, 0, .125)
-}
-
-.card-footer:last-child {
-    border-radius: 0 0 calc(.25rem - 1px) calc(.25rem - 1px)
-}
-
-.card-header-tabs {
-    margin-right: -.625rem;
-    margin-bottom: -.75rem;
-    margin-left: -.625rem;
-    border-bottom: 0
-}
-
-.card-header-pills {
-    margin-right: -.625rem;
-    margin-left: -.625rem
-}
-
-.card-img-overlay {
-    position: absolute;
-    top: 0;
-    right: 0;
-    bottom: 0;
-    left: 0;
-    padding: 1.25rem;
-    border-radius: calc(.25rem - 1px)
-}
-
-.card-img, .card-img-bottom, .card-img-top {
-    -ms-flex-negative: 0;
-    flex-shrink: 0;
-    width: 100%
-}
-
-.card-img, .card-img-top {
-    border-top-left-radius: calc(.25rem - 1px);
-    border-top-right-radius: calc(.25rem - 1px)
-}
-
-.card-img, .card-img-bottom {
-    border-bottom-right-radius: calc(.25rem - 1px);
-    border-bottom-left-radius: calc(.25rem - 1px)
-}
-
-.card-deck .card {
-    margin-bottom: 15px
-}
-
-@media (min-width: 576px) {
-    .card-deck {
-        display: -ms-flexbox;
-        display: flex;
-        -ms-flex-flow: row wrap;
-        flex-flow: row wrap;
-        margin-right: -15px;
-        margin-left: -15px
-    }
-
-    .card-deck .card {
-        -ms-flex: 1 0 0%;
-        flex: 1 0 0%;
-        margin-right: 15px;
-        margin-bottom: 0;
-        margin-left: 15px
-    }
-}
-
-.card-group > .card {
-    margin-bottom: 15px
-}
-
-@media (min-width: 576px) {
-    .card-group {
-        display: -ms-flexbox;
-        display: flex;
-        -ms-flex-flow: row wrap;
-        flex-flow: row wrap
-    }
-
-    .card-group > .card {
-        -ms-flex: 1 0 0%;
-        flex: 1 0 0%;
-        margin-bottom: 0
-    }
-
-    .card-group > .card + .card {
-        margin-left: 0;
-        border-left: 0
-    }
-
-    .card-group > .card:not(:last-child) {
-        border-top-right-radius: 0;
-        border-bottom-right-radius: 0
-    }
-
-    .card-group > .card:not(:last-child) .card-header, .card-group > .card:not(:last-child) .card-img-top {
-        border-top-right-radius: 0
-    }
-
-    .card-group > .card:not(:last-child) .card-footer, .card-group > .card:not(:last-child) .card-img-bottom {
-        border-bottom-right-radius: 0
-    }
-
-    .card-group > .card:not(:first-child) {
-        border-top-left-radius: 0;
-        border-bottom-left-radius: 0
-    }
-
-    .card-group > .card:not(:first-child) .card-header, .card-group > .card:not(:first-child) .card-img-top {
-        border-top-left-radius: 0
-    }
-
-    .card-group > .card:not(:first-child) .card-footer, .card-group > .card:not(:first-child) .card-img-bottom {
-        border-bottom-left-radius: 0
-    }
-}
-
-.card-columns .card {
-    margin-bottom: .75rem
-}
-
-@media (min-width: 576px) {
-    .card-columns {
-        -webkit-column-count: 3;
-        -moz-column-count: 3;
-        column-count: 3;
-        -webkit-column-gap: 1.25rem;
-        -moz-column-gap: 1.25rem;
-        column-gap: 1.25rem;
-        orphans: 1;
-        widows: 1
-    }
-
-    .card-columns .card {
-        display: inline-block;
-        width: 100%
-    }
-}
-
-.accordion {
-    overflow-anchor: none
-}
-
-.accordion > .card {
-    overflow: hidden
-}
-
-.accordion > .card:not(:last-of-type) {
-    border-bottom: 0;
-    border-bottom-right-radius: 0;
-    border-bottom-left-radius: 0
-}
-
-.accordion > .card:not(:first-of-type) {
-    border-top-left-radius: 0;
-    border-top-right-radius: 0
-}
-
-.accordion > .card > .card-header {
-    border-radius: 0;
-    margin-bottom: -1px
-}
-
-.breadcrumb {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    padding: .75rem 1rem;
-    margin-bottom: 1rem;
-    list-style: none;
-    background-color: #e9ecef;
-    border-radius: .25rem
-}
-
-.breadcrumb-item {
-    display: -ms-flexbox;
-    display: flex
-}
-
-.breadcrumb-item + .breadcrumb-item {
-    padding-left: .5rem
-}
-
-.breadcrumb-item + .breadcrumb-item::before {
-    display: inline-block;
-    padding-right: .5rem;
-    color: #6c757d;
-    content: "/"
-}
-
-.breadcrumb-item + .breadcrumb-item:hover::before {
-    text-decoration: underline
-}
-
-.breadcrumb-item + .breadcrumb-item:hover::before {
-    text-decoration: none
-}
-
-.breadcrumb-item.active {
-    color: #6c757d
-}
-
-.pagination {
-    display: -ms-flexbox;
-    display: flex;
-    padding-left: 0;
-    list-style: none;
-    border-radius: .25rem
-}
-
-.page-link {
-    position: relative;
-    display: block;
-    padding: .5rem .75rem;
-    margin-left: -1px;
-    line-height: 1.25;
-    color: #007bff;
-    background-color: #fff;
-    border: 1px solid #dee2e6
-}
-
-.page-link:hover {
-    z-index: 2;
-    color: #0056b3;
-    text-decoration: none;
-    background-color: #e9ecef;
-    border-color: #dee2e6
-}
-
-.page-link:focus {
-    z-index: 3;
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .25)
-}
-
-.page-item:first-child .page-link {
-    margin-left: 0;
-    border-top-left-radius: .25rem;
-    border-bottom-left-radius: .25rem
-}
-
-.page-item:last-child .page-link {
-    border-top-right-radius: .25rem;
-    border-bottom-right-radius: .25rem
-}
-
-.page-item.active .page-link {
-    z-index: 3;
-    color: #fff;
-    background-color: #007bff;
-    border-color: #007bff
-}
-
-.page-item.disabled .page-link {
-    color: #6c757d;
-    pointer-events: none;
-    cursor: auto;
-    background-color: #fff;
-    border-color: #dee2e6
-}
-
-.pagination-lg .page-link {
-    padding: .75rem 1.5rem;
-    font-size: 1.25rem;
-    line-height: 1.5
-}
-
-.pagination-lg .page-item:first-child .page-link {
-    border-top-left-radius: .3rem;
-    border-bottom-left-radius: .3rem
-}
-
-.pagination-lg .page-item:last-child .page-link {
-    border-top-right-radius: .3rem;
-    border-bottom-right-radius: .3rem
-}
-
-.pagination-sm .page-link {
-    padding: .25rem .5rem;
-    font-size: .875rem;
-    line-height: 1.5
-}
-
-.pagination-sm .page-item:first-child .page-link {
-    border-top-left-radius: .2rem;
-    border-bottom-left-radius: .2rem
-}
-
-.pagination-sm .page-item:last-child .page-link {
-    border-top-right-radius: .2rem;
-    border-bottom-right-radius: .2rem
-}
-
-.badge {
-    display: inline-block;
-    padding: .25em .4em;
-    font-size: 75%;
-    font-weight: 700;
-    line-height: 1;
-    text-align: center;
-    white-space: nowrap;
-    vertical-align: baseline;
-    border-radius: .25rem;
-    transition: color .15s ease-in-out, background-color .15s ease-in-out, border-color .15s ease-in-out, box-shadow .15s ease-in-out
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .badge {
-        transition: none
-    }
-}
-
-a.badge:focus, a.badge:hover {
-    text-decoration: none
-}
-
-.badge:empty {
-    display: none
-}
-
-.btn .badge {
-    position: relative;
-    top: -1px
-}
-
-.badge-pill {
-    padding-right: .6em;
-    padding-left: .6em;
-    border-radius: 10rem
-}
-
-.badge-primary {
-    color: #fff;
-    background-color: #007bff
-}
-
-a.badge-primary:focus, a.badge-primary:hover {
-    color: #fff;
-    background-color: #0062cc
-}
-
-a.badge-primary.focus, a.badge-primary:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(0, 123, 255, .5)
-}
-
-.badge-secondary {
-    color: #fff;
-    background-color: #6c757d
-}
-
-a.badge-secondary:focus, a.badge-secondary:hover {
-    color: #fff;
-    background-color: #545b62
-}
-
-a.badge-secondary.focus, a.badge-secondary:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(108, 117, 125, .5)
-}
-
-.badge-success {
-    color: #fff;
-    background-color: #28a745
-}
-
-a.badge-success:focus, a.badge-success:hover {
-    color: #fff;
-    background-color: #1e7e34
-}
-
-a.badge-success.focus, a.badge-success:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(40, 167, 69, .5)
-}
-
-.badge-info {
-    color: #fff;
-    background-color: #17a2b8
-}
-
-a.badge-info:focus, a.badge-info:hover {
-    color: #fff;
-    background-color: #117a8b
-}
-
-a.badge-info.focus, a.badge-info:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(23, 162, 184, .5)
-}
-
-.badge-warning {
-    color: #212529;
-    background-color: #ffc107
-}
-
-a.badge-warning:focus, a.badge-warning:hover {
-    color: #212529;
-    background-color: #d39e00
-}
-
-a.badge-warning.focus, a.badge-warning:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(255, 193, 7, .5)
-}
-
-.badge-danger {
-    color: #fff;
-    background-color: #dc3545
-}
-
-a.badge-danger:focus, a.badge-danger:hover {
-    color: #fff;
-    background-color: #bd2130
-}
-
-a.badge-danger.focus, a.badge-danger:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(220, 53, 69, .5)
-}
-
-.badge-light {
-    color: #212529;
-    background-color: #f8f9fa
-}
-
-a.badge-light:focus, a.badge-light:hover {
-    color: #212529;
-    background-color: #dae0e5
-}
-
-a.badge-light.focus, a.badge-light:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(248, 249, 250, .5)
-}
-
-.badge-dark {
-    color: #fff;
-    background-color: #343a40
-}
-
-a.badge-dark:focus, a.badge-dark:hover {
-    color: #fff;
-    background-color: #1d2124
-}
-
-a.badge-dark.focus, a.badge-dark:focus {
-    outline: 0;
-    box-shadow: 0 0 0 .2rem rgba(52, 58, 64, .5)
-}
-
-.jumbotron {
-    padding: 2rem 1rem;
-    margin-bottom: 2rem;
-    background-color: #e9ecef;
-    border-radius: .3rem
-}
-
-@media (min-width: 576px) {
-    .jumbotron {
-        padding: 4rem 2rem
-    }
-}
-
-.jumbotron-fluid {
-    padding-right: 0;
-    padding-left: 0;
-    border-radius: 0
-}
-
-.alert {
-    position: relative;
-    padding: .75rem 1.25rem;
-    margin-bottom: 1rem;
-    border: 1px solid transparent;
-    border-radius: .25rem
-}
-
-.alert-heading {
-    color: inherit
-}
-
-.alert-link {
-    font-weight: 700
-}
-
-.alert-dismissible {
-    padding-right: 4rem
-}
-
-.alert-dismissible .close {
-    position: absolute;
-    top: 0;
-    right: 0;
-    padding: .75rem 1.25rem;
-    color: inherit
-}
-
-.alert-primary {
-    color: #004085;
-    background-color: #cce5ff;
-    border-color: #b8daff
-}
-
-.alert-primary hr {
-    border-top-color: #9fcdff
-}
-
-.alert-primary .alert-link {
-    color: #002752
-}
-
-.alert-secondary {
-    color: #383d41;
-    background-color: #e2e3e5;
-    border-color: #d6d8db
-}
-
-.alert-secondary hr {
-    border-top-color: #c8cbcf
-}
-
-.alert-secondary .alert-link {
-    color: #202326
-}
-
-.alert-success {
-    color: #155724;
-    background-color: #d4edda;
-    border-color: #c3e6cb
-}
-
-.alert-success hr {
-    border-top-color: #b1dfbb
-}
-
-.alert-success .alert-link {
-    color: #0b2e13
-}
-
-.alert-info {
-    color: #0c5460;
-    background-color: #d1ecf1;
-    border-color: #bee5eb
-}
-
-.alert-info hr {
-    border-top-color: #abdde5
-}
-
-.alert-info .alert-link {
-    color: #062c33
-}
-
-.alert-warning {
-    color: #856404;
-    background-color: #fff3cd;
-    border-color: #ffeeba
-}
-
-.alert-warning hr {
-    border-top-color: #ffe8a1
-}
-
-.alert-warning .alert-link {
-    color: #533f03
-}
-
-.alert-danger {
-    color: #721c24;
-    background-color: #f8d7da;
-    border-color: #f5c6cb
-}
-
-.alert-danger hr {
-    border-top-color: #f1b0b7
-}
-
-.alert-danger .alert-link {
-    color: #491217
-}
-
-.alert-light {
-    color: #818182;
-    background-color: #fefefe;
-    border-color: #fdfdfe
-}
-
-.alert-light hr {
-    border-top-color: #ececf6
-}
-
-.alert-light .alert-link {
-    color: #686868
-}
-
-.alert-dark {
-    color: #1b1e21;
-    background-color: #d6d8d9;
-    border-color: #c6c8ca
-}
-
-.alert-dark hr {
-    border-top-color: #b9bbbe
-}
-
-.alert-dark .alert-link {
-    color: #040505
-}
-
-@-webkit-keyframes progress-bar-stripes {
-    from {
-        background-position: 1rem 0
-    }
-    to {
-        background-position: 0 0
-    }
-}
-
-@keyframes progress-bar-stripes {
-    from {
-        background-position: 1rem 0
-    }
-    to {
-        background-position: 0 0
-    }
-}
-
-.progress {
-    display: -ms-flexbox;
-    display: flex;
-    height: 1rem;
-    overflow: hidden;
-    line-height: 0;
-    font-size: .75rem;
-    background-color: #e9ecef;
-    border-radius: .25rem
-}
-
-.progress-bar {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-direction: column;
-    flex-direction: column;
-    -ms-flex-pack: center;
-    justify-content: center;
-    overflow: hidden;
-    color: #fff;
-    text-align: center;
-    white-space: nowrap;
-    background-color: #007bff;
-    transition: width .6s ease
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .progress-bar {
-        transition: none
-    }
-}
-
-.progress-bar-striped {
-    background-image: linear-gradient(45deg, rgba(255, 255, 255, .15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%, transparent 75%, transparent);
-    background-size: 1rem 1rem
-}
-
-.progress-bar-animated {
-    -webkit-animation: progress-bar-stripes 1s linear infinite;
-    animation: progress-bar-stripes 1s linear infinite
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .progress-bar-animated {
-        -webkit-animation: none;
-        animation: none
-    }
-}
-
-.media {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: start;
-    align-items: flex-start
-}
-
-.media-body {
-    -ms-flex: 1;
-    flex: 1
-}
-
-.list-group {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-direction: column;
-    flex-direction: column;
-    padding-left: 0;
-    margin-bottom: 0;
-    border-radius: .25rem
-}
-
-.list-group-item-action {
-    width: 100%;
-    color: #495057;
-    text-align: inherit
-}
-
-.list-group-item-action:focus, .list-group-item-action:hover {
-    z-index: 1;
-    color: #495057;
-    text-decoration: none;
-    background-color: #f8f9fa
-}
-
-.list-group-item-action:active {
-    color: #212529;
-    background-color: #e9ecef
-}
-
-.list-group-item {
-    position: relative;
-    display: block;
-    padding: .75rem 1.25rem;
-    background-color: #fff;
-    border: 1px solid rgba(0, 0, 0, .125)
-}
-
-.list-group-item:first-child {
-    border-top-left-radius: inherit;
-    border-top-right-radius: inherit
-}
-
-.list-group-item:last-child {
-    border-bottom-right-radius: inherit;
-    border-bottom-left-radius: inherit
-}
-
-.list-group-item.disabled, .list-group-item:disabled {
-    color: #6c757d;
-    pointer-events: none;
-    background-color: #fff
-}
-
-.list-group-item.active {
-    z-index: 2;
-    color: #fff;
-    background-color: #007bff;
-    border-color: #007bff
-}
-
-.list-group-item + .list-group-item {
-    border-top-width: 0
-}
-
-.list-group-item + .list-group-item.active {
-    margin-top: -1px;
-    border-top-width: 1px
-}
-
-.list-group-horizontal {
-    -ms-flex-direction: row;
-    flex-direction: row
-}
-
-.list-group-horizontal > .list-group-item:first-child {
-    border-bottom-left-radius: .25rem;
-    border-top-right-radius: 0
-}
-
-.list-group-horizontal > .list-group-item:last-child {
-    border-top-right-radius: .25rem;
-    border-bottom-left-radius: 0
-}
-
-.list-group-horizontal > .list-group-item.active {
-    margin-top: 0
-}
-
-.list-group-horizontal > .list-group-item + .list-group-item {
-    border-top-width: 1px;
-    border-left-width: 0
-}
-
-.list-group-horizontal > .list-group-item + .list-group-item.active {
-    margin-left: -1px;
-    border-left-width: 1px
-}
-
-@media (min-width: 576px) {
-    .list-group-horizontal-sm {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .list-group-horizontal-sm > .list-group-item:first-child {
-        border-bottom-left-radius: .25rem;
-        border-top-right-radius: 0
-    }
-
-    .list-group-horizontal-sm > .list-group-item:last-child {
-        border-top-right-radius: .25rem;
-        border-bottom-left-radius: 0
-    }
-
-    .list-group-horizontal-sm > .list-group-item.active {
-        margin-top: 0
-    }
-
-    .list-group-horizontal-sm > .list-group-item + .list-group-item {
-        border-top-width: 1px;
-        border-left-width: 0
-    }
-
-    .list-group-horizontal-sm > .list-group-item + .list-group-item.active {
-        margin-left: -1px;
-        border-left-width: 1px
-    }
-}
-
-@media (min-width: 768px) {
-    .list-group-horizontal-md {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .list-group-horizontal-md > .list-group-item:first-child {
-        border-bottom-left-radius: .25rem;
-        border-top-right-radius: 0
-    }
-
-    .list-group-horizontal-md > .list-group-item:last-child {
-        border-top-right-radius: .25rem;
-        border-bottom-left-radius: 0
-    }
-
-    .list-group-horizontal-md > .list-group-item.active {
-        margin-top: 0
-    }
-
-    .list-group-horizontal-md > .list-group-item + .list-group-item {
-        border-top-width: 1px;
-        border-left-width: 0
-    }
-
-    .list-group-horizontal-md > .list-group-item + .list-group-item.active {
-        margin-left: -1px;
-        border-left-width: 1px
-    }
-}
-
-@media (min-width: 992px) {
-    .list-group-horizontal-lg {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .list-group-horizontal-lg > .list-group-item:first-child {
-        border-bottom-left-radius: .25rem;
-        border-top-right-radius: 0
-    }
-
-    .list-group-horizontal-lg > .list-group-item:last-child {
-        border-top-right-radius: .25rem;
-        border-bottom-left-radius: 0
-    }
-
-    .list-group-horizontal-lg > .list-group-item.active {
-        margin-top: 0
-    }
-
-    .list-group-horizontal-lg > .list-group-item + .list-group-item {
-        border-top-width: 1px;
-        border-left-width: 0
-    }
-
-    .list-group-horizontal-lg > .list-group-item + .list-group-item.active {
-        margin-left: -1px;
-        border-left-width: 1px
-    }
-}
-
-@media (min-width: 1200px) {
-    .list-group-horizontal-xl {
-        -ms-flex-direction: row;
-        flex-direction: row
-    }
-
-    .list-group-horizontal-xl > .list-group-item:first-child {
-        border-bottom-left-radius: .25rem;
-        border-top-right-radius: 0
-    }
-
-    .list-group-horizontal-xl > .list-group-item:last-child {
-        border-top-right-radius: .25rem;
-        border-bottom-left-radius: 0
-    }
-
-    .list-group-horizontal-xl > .list-group-item.active {
-        margin-top: 0
-    }
-
-    .list-group-horizontal-xl > .list-group-item + .list-group-item {
-        border-top-width: 1px;
-        border-left-width: 0
-    }
-
-    .list-group-horizontal-xl > .list-group-item + .list-group-item.active {
-        margin-left: -1px;
-        border-left-width: 1px
-    }
-}
-
-.list-group-flush {
-    border-radius: 0
-}
-
-.list-group-flush > .list-group-item {
-    border-width: 0 0 1px
-}
-
-.list-group-flush > .list-group-item:last-child {
-    border-bottom-width: 0
-}
-
-.list-group-item-primary {
-    color: #004085;
-    background-color: #b8daff
-}
-
-.list-group-item-primary.list-group-item-action:focus, .list-group-item-primary.list-group-item-action:hover {
-    color: #004085;
-    background-color: #9fcdff
-}
-
-.list-group-item-primary.list-group-item-action.active {
-    color: #fff;
-    background-color: #004085;
-    border-color: #004085
-}
-
-.list-group-item-secondary {
-    color: #383d41;
-    background-color: #d6d8db
-}
-
-.list-group-item-secondary.list-group-item-action:focus, .list-group-item-secondary.list-group-item-action:hover {
-    color: #383d41;
-    background-color: #c8cbcf
-}
-
-.list-group-item-secondary.list-group-item-action.active {
-    color: #fff;
-    background-color: #383d41;
-    border-color: #383d41
-}
-
-.list-group-item-success {
-    color: #155724;
-    background-color: #c3e6cb
-}
-
-.list-group-item-success.list-group-item-action:focus, .list-group-item-success.list-group-item-action:hover {
-    color: #155724;
-    background-color: #b1dfbb
-}
-
-.list-group-item-success.list-group-item-action.active {
-    color: #fff;
-    background-color: #155724;
-    border-color: #155724
-}
-
-.list-group-item-info {
-    color: #0c5460;
-    background-color: #bee5eb
-}
-
-.list-group-item-info.list-group-item-action:focus, .list-group-item-info.list-group-item-action:hover {
-    color: #0c5460;
-    background-color: #abdde5
-}
-
-.list-group-item-info.list-group-item-action.active {
-    color: #fff;
-    background-color: #0c5460;
-    border-color: #0c5460
-}
-
-.list-group-item-warning {
-    color: #856404;
-    background-color: #ffeeba
-}
-
-.list-group-item-warning.list-group-item-action:focus, .list-group-item-warning.list-group-item-action:hover {
-    color: #856404;
-    background-color: #ffe8a1
-}
-
-.list-group-item-warning.list-group-item-action.active {
-    color: #fff;
-    background-color: #856404;
-    border-color: #856404
-}
-
-.list-group-item-danger {
-    color: #721c24;
-    background-color: #f5c6cb
-}
-
-.list-group-item-danger.list-group-item-action:focus, .list-group-item-danger.list-group-item-action:hover {
-    color: #721c24;
-    background-color: #f1b0b7
-}
-
-.list-group-item-danger.list-group-item-action.active {
-    color: #fff;
-    background-color: #721c24;
-    border-color: #721c24
-}
-
-.list-group-item-light {
-    color: #818182;
-    background-color: #fdfdfe
-}
-
-.list-group-item-light.list-group-item-action:focus, .list-group-item-light.list-group-item-action:hover {
-    color: #818182;
-    background-color: #ececf6
-}
-
-.list-group-item-light.list-group-item-action.active {
-    color: #fff;
-    background-color: #818182;
-    border-color: #818182
-}
-
-.list-group-item-dark {
-    color: #1b1e21;
-    background-color: #c6c8ca
-}
-
-.list-group-item-dark.list-group-item-action:focus, .list-group-item-dark.list-group-item-action:hover {
-    color: #1b1e21;
-    background-color: #b9bbbe
-}
-
-.list-group-item-dark.list-group-item-action.active {
-    color: #fff;
-    background-color: #1b1e21;
-    border-color: #1b1e21
-}
-
-.close {
-    float: right;
-    font-size: 1.5rem;
-    font-weight: 700;
-    line-height: 1;
-    color: #000;
-    text-shadow: 0 1px 0 #fff;
-    opacity: .5
-}
-
-.close:hover {
-    color: #000;
-    text-decoration: none
-}
-
-.close:not(:disabled):not(.disabled):focus, .close:not(:disabled):not(.disabled):hover {
-    opacity: .75
-}
-
-button.close {
-    padding: 0;
-    background-color: transparent;
-    border: 0
-}
-
-a.close.disabled {
-    pointer-events: none
-}
-
-.toast {
-    -ms-flex-preferred-size: 350px;
-    flex-basis: 350px;
-    max-width: 350px;
-    font-size: .875rem;
-    background-color: rgba(255, 255, 255, .85);
-    background-clip: padding-box;
-    border: 1px solid rgba(0, 0, 0, .1);
-    box-shadow: 0 .25rem .75rem rgba(0, 0, 0, .1);
-    opacity: 0;
-    border-radius: .25rem
-}
-
-.toast:not(:last-child) {
-    margin-bottom: .75rem
-}
-
-.toast.showing {
-    opacity: 1
-}
-
-.toast.show {
-    display: block;
-    opacity: 1
-}
-
-.toast.hide {
-    display: none
-}
-
-.toast-header {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: center;
-    align-items: center;
-    padding: .25rem .75rem;
-    color: #6c757d;
-    background-color: rgba(255, 255, 255, .85);
-    background-clip: padding-box;
-    border-bottom: 1px solid rgba(0, 0, 0, .05);
-    border-top-left-radius: calc(.25rem - 1px);
-    border-top-right-radius: calc(.25rem - 1px)
-}
-
-.toast-body {
-    padding: .75rem
-}
-
-.modal-open {
-    overflow: hidden
-}
-
-.modal-open .modal {
-    overflow-x: hidden;
-    overflow-y: auto
-}
-
-.modal {
-    position: fixed;
-    top: 0;
-    left: 0;
-    z-index: 1050;
-    display: none;
-    width: 100%;
-    height: 100%;
-    overflow: hidden;
-    outline: 0
-}
-
-.modal-dialog {
-    position: relative;
-    width: auto;
-    margin: .5rem;
-    pointer-events: none
-}
-
-.modal.fade .modal-dialog {
-    transition: -webkit-transform .3s ease-out;
-    transition: transform .3s ease-out;
-    transition: transform .3s ease-out, -webkit-transform .3s ease-out;
-    -webkit-transform: translate(0, -50px);
-    transform: translate(0, -50px)
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .modal.fade .modal-dialog {
-        transition: none
-    }
-}
-
-.modal.show .modal-dialog {
-    -webkit-transform: none;
-    transform: none
-}
-
-.modal.modal-static .modal-dialog {
-    -webkit-transform: scale(1.02);
-    transform: scale(1.02)
-}
-
-.modal-dialog-scrollable {
-    display: -ms-flexbox;
-    display: flex;
-    max-height: calc(100% - 1rem)
-}
-
-.modal-dialog-scrollable .modal-content {
-    max-height: calc(100vh - 1rem);
-    overflow: hidden
-}
-
-.modal-dialog-scrollable .modal-footer, .modal-dialog-scrollable .modal-header {
-    -ms-flex-negative: 0;
-    flex-shrink: 0
-}
-
-.modal-dialog-scrollable .modal-body {
-    overflow-y: auto
-}
-
-.modal-dialog-centered {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: center;
-    align-items: center;
-    min-height: calc(100% - 1rem)
-}
-
-.modal-dialog-centered::before {
-    display: block;
-    height: calc(100vh - 1rem);
-    height: -webkit-min-content;
-    height: -moz-min-content;
-    height: min-content;
-    content: ""
-}
-
-.modal-dialog-centered.modal-dialog-scrollable {
-    -ms-flex-direction: column;
-    flex-direction: column;
-    -ms-flex-pack: center;
-    justify-content: center;
-    height: 100%
-}
-
-.modal-dialog-centered.modal-dialog-scrollable .modal-content {
-    max-height: none
-}
-
-.modal-dialog-centered.modal-dialog-scrollable::before {
-    content: none
-}
-
-.modal-content {
-    position: relative;
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-direction: column;
-    flex-direction: column;
-    width: 100%;
-    pointer-events: auto;
-    background-color: #fff;
-    background-clip: padding-box;
-    border: 1px solid rgba(0, 0, 0, .2);
-    border-radius: .3rem;
-    outline: 0
-}
-
-.modal-backdrop {
-    position: fixed;
-    top: 0;
-    left: 0;
-    z-index: 1040;
-    width: 100vw;
-    height: 100vh;
-    background-color: #000
-}
-
-.modal-backdrop.fade {
-    opacity: 0
-}
-
-.modal-backdrop.show {
-    opacity: .5
-}
-
-.modal-header {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: start;
-    align-items: flex-start;
-    -ms-flex-pack: justify;
-    justify-content: space-between;
-    padding: 1rem 1rem;
-    border-bottom: 1px solid #dee2e6;
-    border-top-left-radius: calc(.3rem - 1px);
-    border-top-right-radius: calc(.3rem - 1px)
-}
-
-.modal-header .close {
-    padding: 1rem 1rem;
-    margin: -1rem -1rem -1rem auto
-}
-
-.modal-title {
-    margin-bottom: 0;
-    line-height: 1.5
-}
-
-.modal-body {
-    position: relative;
-    -ms-flex: 1 1 auto;
-    flex: 1 1 auto;
-    padding: 1rem
-}
-
-.modal-footer {
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-wrap: wrap;
-    flex-wrap: wrap;
-    -ms-flex-align: center;
-    align-items: center;
-    -ms-flex-pack: end;
-    justify-content: flex-end;
-    padding: .75rem;
-    border-top: 1px solid #dee2e6;
-    border-bottom-right-radius: calc(.3rem - 1px);
-    border-bottom-left-radius: calc(.3rem - 1px)
-}
-
-.modal-footer > * {
-    margin: .25rem
-}
-
-.modal-scrollbar-measure {
-    position: absolute;
-    top: -9999px;
-    width: 50px;
-    height: 50px;
-    overflow: scroll
-}
-
-@media (min-width: 576px) {
-    .modal-dialog {
-        max-width: 500px;
-        margin: 1.75rem auto
-    }
-
-    .modal-dialog-scrollable {
-        max-height: calc(100% - 3.5rem)
-    }
-
-    .modal-dialog-scrollable .modal-content {
-        max-height: calc(100vh - 3.5rem)
-    }
-
-    .modal-dialog-centered {
-        min-height: calc(100% - 3.5rem)
-    }
-
-    .modal-dialog-centered::before {
-        height: calc(100vh - 3.5rem);
-        height: -webkit-min-content;
-        height: -moz-min-content;
-        height: min-content
-    }
-
-    .modal-sm {
-        max-width: 300px
-    }
-}
-
-@media (min-width: 992px) {
-    .modal-lg, .modal-xl {
-        max-width: 800px
-    }
-}
-
-@media (min-width: 1200px) {
-    .modal-xl {
-        max-width: 1140px
-    }
-}
-
-.tooltip {
-    position: absolute;
-    z-index: 1070;
-    display: block;
-    margin: 0;
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
-    font-style: normal;
-    font-weight: 400;
-    line-height: 1.5;
-    text-align: left;
-    text-align: start;
-    text-decoration: none;
-    text-shadow: none;
-    text-transform: none;
-    letter-spacing: normal;
-    word-break: normal;
-    word-spacing: normal;
-    white-space: normal;
-    line-break: auto;
-    font-size: .875rem;
-    word-wrap: break-word;
-    opacity: 0
-}
-
-.tooltip.show {
-    opacity: .9
-}
-
-.tooltip .arrow {
-    position: absolute;
-    display: block;
-    width: .8rem;
-    height: .4rem
-}
-
-.tooltip .arrow::before {
-    position: absolute;
-    content: "";
-    border-color: transparent;
-    border-style: solid
-}
-
-.bs-tooltip-auto[x-placement^=top], .bs-tooltip-top {
-    padding: .4rem 0
-}
-
-.bs-tooltip-auto[x-placement^=top] .arrow, .bs-tooltip-top .arrow {
-    bottom: 0
-}
-
-.bs-tooltip-auto[x-placement^=top] .arrow::before, .bs-tooltip-top .arrow::before {
-    top: 0;
-    border-width: .4rem .4rem 0;
-    border-top-color: #000
-}
-
-.bs-tooltip-auto[x-placement^=right], .bs-tooltip-right {
-    padding: 0 .4rem
-}
-
-.bs-tooltip-auto[x-placement^=right] .arrow, .bs-tooltip-right .arrow {
-    left: 0;
-    width: .4rem;
-    height: .8rem
-}
-
-.bs-tooltip-auto[x-placement^=right] .arrow::before, .bs-tooltip-right .arrow::before {
-    right: 0;
-    border-width: .4rem .4rem .4rem 0;
-    border-right-color: #000
-}
-
-.bs-tooltip-auto[x-placement^=bottom], .bs-tooltip-bottom {
-    padding: .4rem 0
-}
-
-.bs-tooltip-auto[x-placement^=bottom] .arrow, .bs-tooltip-bottom .arrow {
-    top: 0
-}
-
-.bs-tooltip-auto[x-placement^=bottom] .arrow::before, .bs-tooltip-bottom .arrow::before {
-    bottom: 0;
-    border-width: 0 .4rem .4rem;
-    border-bottom-color: #000
-}
-
-.bs-tooltip-auto[x-placement^=left], .bs-tooltip-left {
-    padding: 0 .4rem
-}
-
-.bs-tooltip-auto[x-placement^=left] .arrow, .bs-tooltip-left .arrow {
-    right: 0;
-    width: .4rem;
-    height: .8rem
-}
-
-.bs-tooltip-auto[x-placement^=left] .arrow::before, .bs-tooltip-left .arrow::before {
-    left: 0;
-    border-width: .4rem 0 .4rem .4rem;
-    border-left-color: #000
-}
-
-.tooltip-inner {
-    max-width: 200px;
-    padding: .25rem .5rem;
-    color: #fff;
-    text-align: center;
-    background-color: #000;
-    border-radius: .25rem
-}
-
-.popover {
-    position: absolute;
-    top: 0;
-    left: 0;
-    z-index: 1060;
-    display: block;
-    max-width: 276px;
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
-    font-style: normal;
-    font-weight: 400;
-    line-height: 1.5;
-    text-align: left;
-    text-align: start;
-    text-decoration: none;
-    text-shadow: none;
-    text-transform: none;
-    letter-spacing: normal;
-    word-break: normal;
-    word-spacing: normal;
-    white-space: normal;
-    line-break: auto;
-    font-size: .875rem;
-    word-wrap: break-word;
-    background-color: #fff;
-    background-clip: padding-box;
-    border: 1px solid rgba(0, 0, 0, .2);
-    border-radius: .3rem
-}
-
-.popover .arrow {
-    position: absolute;
-    display: block;
-    width: 1rem;
-    height: .5rem;
-    margin: 0 .3rem
-}
-
-.popover .arrow::after, .popover .arrow::before {
-    position: absolute;
-    display: block;
-    content: "";
-    border-color: transparent;
-    border-style: solid
-}
-
-.bs-popover-auto[x-placement^=top], .bs-popover-top {
-    margin-bottom: .5rem
-}
-
-.bs-popover-auto[x-placement^=top] > .arrow, .bs-popover-top > .arrow {
-    bottom: calc(-.5rem - 1px)
-}
-
-.bs-popover-auto[x-placement^=top] > .arrow::before, .bs-popover-top > .arrow::before {
-    bottom: 0;
-    border-width: .5rem .5rem 0;
-    border-top-color: rgba(0, 0, 0, .25)
-}
-
-.bs-popover-auto[x-placement^=top] > .arrow::after, .bs-popover-top > .arrow::after {
-    bottom: 1px;
-    border-width: .5rem .5rem 0;
-    border-top-color: #fff
-}
-
-.bs-popover-auto[x-placement^=right], .bs-popover-right {
-    margin-left: .5rem
-}
-
-.bs-popover-auto[x-placement^=right] > .arrow, .bs-popover-right > .arrow {
-    left: calc(-.5rem - 1px);
-    width: .5rem;
-    height: 1rem;
-    margin: .3rem 0
-}
-
-.bs-popover-auto[x-placement^=right] > .arrow::before, .bs-popover-right > .arrow::before {
-    left: 0;
-    border-width: .5rem .5rem .5rem 0;
-    border-right-color: rgba(0, 0, 0, .25)
-}
-
-.bs-popover-auto[x-placement^=right] > .arrow::after, .bs-popover-right > .arrow::after {
-    left: 1px;
-    border-width: .5rem .5rem .5rem 0;
-    border-right-color: #fff
-}
-
-.bs-popover-auto[x-placement^=bottom], .bs-popover-bottom {
-    margin-top: .5rem
-}
-
-.bs-popover-auto[x-placement^=bottom] > .arrow, .bs-popover-bottom > .arrow {
-    top: calc(-.5rem - 1px)
-}
-
-.bs-popover-auto[x-placement^=bottom] > .arrow::before, .bs-popover-bottom > .arrow::before {
-    top: 0;
-    border-width: 0 .5rem .5rem .5rem;
-    border-bottom-color: rgba(0, 0, 0, .25)
-}
-
-.bs-popover-auto[x-placement^=bottom] > .arrow::after, .bs-popover-bottom > .arrow::after {
-    top: 1px;
-    border-width: 0 .5rem .5rem .5rem;
-    border-bottom-color: #fff
-}
-
-.bs-popover-auto[x-placement^=bottom] .popover-header::before, .bs-popover-bottom .popover-header::before {
-    position: absolute;
-    top: 0;
-    left: 50%;
-    display: block;
-    width: 1rem;
-    margin-left: -.5rem;
-    content: "";
-    border-bottom: 1px solid #f7f7f7
-}
-
-.bs-popover-auto[x-placement^=left], .bs-popover-left {
-    margin-right: .5rem
-}
-
-.bs-popover-auto[x-placement^=left] > .arrow, .bs-popover-left > .arrow {
-    right: calc(-.5rem - 1px);
-    width: .5rem;
-    height: 1rem;
-    margin: .3rem 0
-}
-
-.bs-popover-auto[x-placement^=left] > .arrow::before, .bs-popover-left > .arrow::before {
-    right: 0;
-    border-width: .5rem 0 .5rem .5rem;
-    border-left-color: rgba(0, 0, 0, .25)
-}
-
-.bs-popover-auto[x-placement^=left] > .arrow::after, .bs-popover-left > .arrow::after {
-    right: 1px;
-    border-width: .5rem 0 .5rem .5rem;
-    border-left-color: #fff
-}
-
-.popover-header {
-    padding: .5rem .75rem;
-    margin-bottom: 0;
-    font-size: 1rem;
-    background-color: #f7f7f7;
-    border-bottom: 1px solid #ebebeb;
-    border-top-left-radius: calc(.3rem - 1px);
-    border-top-right-radius: calc(.3rem - 1px)
-}
-
-.popover-header:empty {
-    display: none
-}
-
-.popover-body {
-    padding: .5rem .75rem;
-    color: #212529
-}
-
-.carousel {
-    position: relative
-}
-
-.carousel.pointer-event {
-    -ms-touch-action: pan-y;
-    touch-action: pan-y
-}
-
-.carousel-inner {
-    position: relative;
-    width: 100%;
-    overflow: hidden
-}
-
-.carousel-inner::after {
-    display: block;
-    clear: both;
-    content: ""
-}
-
-.carousel-item {
-    position: relative;
-    display: none;
-    float: left;
-    width: 100%;
-    margin-right: -100%;
-    -webkit-backface-visibility: hidden;
-    backface-visibility: hidden;
-    transition: -webkit-transform .6s ease-in-out;
-    transition: transform .6s ease-in-out;
-    transition: transform .6s ease-in-out, -webkit-transform .6s ease-in-out
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .carousel-item {
-        transition: none
-    }
-}
-
-.carousel-item-next, .carousel-item-prev, .carousel-item.active {
-    display: block
-}
-
-.active.carousel-item-right, .carousel-item-next:not(.carousel-item-left) {
-    -webkit-transform: translateX(100%);
-    transform: translateX(100%)
-}
-
-.active.carousel-item-left, .carousel-item-prev:not(.carousel-item-right) {
-    -webkit-transform: translateX(-100%);
-    transform: translateX(-100%)
-}
-
-.carousel-fade .carousel-item {
-    opacity: 0;
-    transition-property: opacity;
-    -webkit-transform: none;
-    transform: none
-}
-
-.carousel-fade .carousel-item-next.carousel-item-left, .carousel-fade .carousel-item-prev.carousel-item-right, .carousel-fade .carousel-item.active {
-    z-index: 1;
-    opacity: 1
-}
-
-.carousel-fade .active.carousel-item-left, .carousel-fade .active.carousel-item-right {
-    z-index: 0;
-    opacity: 0;
-    transition: opacity 0s .6s
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .carousel-fade .active.carousel-item-left, .carousel-fade .active.carousel-item-right {
-        transition: none
-    }
-}
-
-.carousel-control-next, .carousel-control-prev {
-    position: absolute;
-    top: 0;
-    bottom: 0;
-    z-index: 1;
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-align: center;
-    align-items: center;
-    -ms-flex-pack: center;
-    justify-content: center;
-    width: 15%;
-    color: #fff;
-    text-align: center;
-    opacity: .5;
-    transition: opacity .15s ease
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .carousel-control-next, .carousel-control-prev {
-        transition: none
-    }
-}
-
-.carousel-control-next:focus, .carousel-control-next:hover, .carousel-control-prev:focus, .carousel-control-prev:hover {
-    color: #fff;
-    text-decoration: none;
-    outline: 0;
-    opacity: .9
-}
-
-.carousel-control-prev {
-    left: 0
-}
-
-.carousel-control-next {
-    right: 0
-}
-
-.carousel-control-next-icon, .carousel-control-prev-icon {
-    display: inline-block;
-    width: 20px;
-    height: 20px;
-    background: no-repeat 50%/100% 100%
-}
-
-.carousel-control-prev-icon {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath d='M5.25 0l-4 4 4 4 1.5-1.5L4.25 4l2.5-2.5L5.25 0z'/%3e%3c/svg%3e")
-}
-
-.carousel-control-next-icon {
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath d='M2.75 0l-1.5 1.5L3.75 4l-2.5 2.5L2.75 8l4-4-4-4z'/%3e%3c/svg%3e")
-}
-
-.carousel-indicators {
-    position: absolute;
-    right: 0;
-    bottom: 0;
-    left: 0;
-    z-index: 15;
-    display: -ms-flexbox;
-    display: flex;
-    -ms-flex-pack: center;
-    justify-content: center;
-    padding-left: 0;
-    margin-right: 15%;
-    margin-left: 15%;
-    list-style: none
-}
-
-.carousel-indicators li {
-    box-sizing: content-box;
-    -ms-flex: 0 1 auto;
-    flex: 0 1 auto;
-    width: 30px;
-    height: 3px;
-    margin-right: 3px;
-    margin-left: 3px;
-    text-indent: -999px;
-    cursor: pointer;
-    background-color: #fff;
-    background-clip: padding-box;
-    border-top: 10px solid transparent;
-    border-bottom: 10px solid transparent;
-    opacity: .5;
-    transition: opacity .6s ease
-}
-
-@media (prefers-reduced-motion: reduce) {
-    .carousel-indicators li {
-        transition: none
-    }
-}
-
-.carousel-indicators .active {
-    opacity: 1
-}
-
-.carousel-caption {
-    position: absolute;
-    right: 15%;
-    bottom: 20px;
-    left: 15%;
-    z-index: 10;
-    padding-top: 20px;
-    padding-bottom: 20px;
-    color: #fff;
-    text-align: center
-}
-
-@-webkit-keyframes spinner-border {
-    to {
-        -webkit-transform: rotate(360deg);
-        transform: rotate(360deg)
-    }
-}
-
-@keyframes spinner-border {
-    to {
-        -webkit-transform: rotate(360deg);
-        transform: rotate(360deg)
-    }
-}
-
-.spinner-border {
-    display: inline-block;
-    width: 2rem;
-    height: 2rem;
-    vertical-align: text-bottom;
-    border: .25em solid currentColor;
-    border-right-color: transparent;
-    border-radius: 50%;
-    -webkit-animation: spinner-border .75s linear infinite;
-    animation: spinner-border .75s linear infinite
-}
-
-.spinner-border-sm {
-    width: 1rem;
-    height: 1rem;
-    border-width: .2em
-}
-
-@-webkit-keyframes spinner-grow {
-    0% {
-        -webkit-transform: scale(0);
-        transform: scale(0)
-    }
-    50% {
-        opacity: 1;
-        -webkit-transform: none;
-        transform: none
-    }
-}
-
-@keyframes spinner-grow {
-    0% {
-        -webkit-transform: scale(0);
-        transform: scale(0)
-    }
-    50% {
-        opacity: 1;
-        -webkit-transform: none;
-        transform: none
-    }
-}
-
-.spinner-grow {
-    display: inline-block;
-    width: 2rem;
-    height: 2rem;
-    vertical-align: text-bottom;
-    background-color: currentColor;
-    border-radius: 50%;
-    opacity: 0;
-    -webkit-animation: spinner-grow .75s linear infinite;
-    animation: spinner-grow .75s linear infinite
-}
-
-.spinner-grow-sm {
-    width: 1rem;
-    height: 1rem
-}
-
-.align-baseline {
-    vertical-align: baseline !important
-}
-
-.align-top {
-    vertical-align: top !important
-}
-
-.align-middle {
-    vertical-align: middle !important
-}
-
-.align-bottom {
-    vertical-align: bottom !important
-}
-
-.align-text-bottom {
-    vertical-align: text-bottom !important
-}
-
-.align-text-top {
-    vertical-align: text-top !important
-}
-
-.bg-primary {
-    background-color: #007bff !important
-}
-
-a.bg-primary:focus, a.bg-primary:hover, button.bg-primary:focus, button.bg-primary:hover {
-    background-color: #0062cc !important
-}
-
-.bg-secondary {
-    background-color: #6c757d !important
-}
-
-a.bg-secondary:focus, a.bg-secondary:hover, button.bg-secondary:focus, button.bg-secondary:hover {
-    background-color: #545b62 !important
-}
-
-.bg-success {
-    background-color: #28a745 !important
-}
-
-a.bg-success:focus, a.bg-success:hover, button.bg-success:focus, button.bg-success:hover {
-    background-color: #1e7e34 !important
-}
-
-.bg-info {
-    background-color: #17a2b8 !important
-}
-
-a.bg-info:focus, a.bg-info:hover, button.bg-info:focus, button.bg-info:hover {
-    background-color: #117a8b !important
-}
-
-.bg-warning {
-    background-color: #ffc107 !important
-}
-
-a.bg-warning:focus, a.bg-warning:hover, button.bg-warning:focus, button.bg-warning:hover {
-    background-color: #d39e00 !important
-}
-
-.bg-danger {
-    background-color: #dc3545 !important
-}
-
-a.bg-danger:focus, a.bg-danger:hover, button.bg-danger:focus, button.bg-danger:hover {
-    background-color: #bd2130 !important
-}
-
-.bg-light {
-    background-color: #f8f9fa !important
-}
-
-a.bg-light:focus, a.bg-light:hover, button.bg-light:focus, button.bg-light:hover {
-    background-color: #dae0e5 !important
-}
-
-.bg-dark {
-    background-color: #343a40 !important
-}
-
-a.bg-dark:focus, a.bg-dark:hover, button.bg-dark:focus, button.bg-dark:hover {
-    background-color: #1d2124 !important
-}
-
-.bg-white {
-    background-color: #fff !important
-}
-
-.bg-transparent {
-    background-color: transparent !important
-}
-
-.border {
-    border: 1px solid #dee2e6 !important
-}
-
-.border-top {
-    border-top: 1px solid #dee2e6 !important
-}
-
-.border-right {
-    border-right: 1px solid #dee2e6 !important
-}
-
-.border-bottom {
-    border-bottom: 1px solid #dee2e6 !important
-}
-
-.border-left {
-    border-left: 1px solid #dee2e6 !important
-}
-
-.border-0 {
-    border: 0 !important
-}
-
-.border-top-0 {
-    border-top: 0 !important
-}
-
-.border-right-0 {
-    border-right: 0 !important
-}
-
-.border-bottom-0 {
-    border-bottom: 0 !important
-}
-
-.border-left-0 {
-    border-left: 0 !important
-}
-
-.border-primary {
-    border-color: #007bff !important
-}
-
-.border-secondary {
-    border-color: #6c757d !important
-}
-
-.border-success {
-    border-color: #28a745 !important
-}
-
-.border-info {
-    border-color: #17a2b8 !important
-}
-
-.border-warning {
-    border-color: #ffc107 !important
-}
-
-.border-danger {
-    border-color: #dc3545 !important
-}
-
-.border-light {
-    border-color: #f8f9fa !important
-}
-
-.border-dark {
-    border-color: #343a40 !important
-}
-
-.border-white {
-    border-color: #fff !important
-}
-
-.rounded-sm {
-    border-radius: .2rem !important
-}
-
-.rounded {
-    border-radius: .25rem !important
-}
-
-.rounded-top {
-    border-top-left-radius: .25rem !important;
-    border-top-right-radius: .25rem !important
-}
-
-.rounded-right {
-    border-top-right-radius: .25rem !important;
-    border-bottom-right-radius: .25rem !important
-}
-
-.rounded-bottom {
-    border-bottom-right-radius: .25rem !important;
-    border-bottom-left-radius: .25rem !important
-}
-
-.rounded-left {
-    border-top-left-radius: .25rem !important;
-    border-bottom-left-radius: .25rem !important
-}
-
-.rounded-lg {
-    border-radius: .3rem !important
-}
-
-.rounded-circle {
-    border-radius: 50% !important
-}
-
-.rounded-pill {
-    border-radius: 50rem !important
-}
-
-.rounded-0 {
-    border-radius: 0 !important
-}
-
-.clearfix::after {
-    display: block;
-    clear: both;
-    content: ""
-}
-
-.d-none {
-    display: none !important
-}
-
-.d-inline {
-    display: inline !important
-}
-
-.d-inline-block {
-    display: inline-block !important
-}
-
-.d-block {
-    display: block !important
-}
-
-.d-table {
-    display: table !important
-}
-
-.d-table-row {
-    display: table-row !important
-}
-
-.d-table-cell {
-    display: table-cell !important
-}
-
-.d-flex {
-    display: -ms-flexbox !important;
-    display: flex !important
-}
-
-.d-inline-flex {
-    display: -ms-inline-flexbox !important;
-    display: inline-flex !important
-}
-
-@media (min-width: 576px) {
-    .d-sm-none {
-        display: none !important
-    }
-
-    .d-sm-inline {
-        display: inline !important
-    }
-
-    .d-sm-inline-block {
-        display: inline-block !important
-    }
-
-    .d-sm-block {
-        display: block !important
-    }
-
-    .d-sm-table {
-        display: table !important
-    }
-
-    .d-sm-table-row {
-        display: table-row !important
-    }
-
-    .d-sm-table-cell {
-        display: table-cell !important
-    }
-
-    .d-sm-flex {
-        display: -ms-flexbox !important;
-        display: flex !important
-    }
-
-    .d-sm-inline-flex {
-        display: -ms-inline-flexbox !important;
-        display: inline-flex !important
-    }
-}
-
-@media (min-width: 768px) {
-    .d-md-none {
-        display: none !important
-    }
-
-    .d-md-inline {
-        display: inline !important
-    }
-
-    .d-md-inline-block {
-        display: inline-block !important
-    }
-
-    .d-md-block {
-        display: block !important
-    }
-
-    .d-md-table {
-        display: table !important
-    }
-
-    .d-md-table-row {
-        display: table-row !important
-    }
-
-    .d-md-table-cell {
-        display: table-cell !important
-    }
-
-    .d-md-flex {
-        display: -ms-flexbox !important;
-        display: flex !important
-    }
-
-    .d-md-inline-flex {
-        display: -ms-inline-flexbox !important;
-        display: inline-flex !important
-    }
-}
-
-@media (min-width: 992px) {
-    .d-lg-none {
-        display: none !important
-    }
-
-    .d-lg-inline {
-        display: inline !important
-    }
-
-    .d-lg-inline-block {
-        display: inline-block !important
-    }
-
-    .d-lg-block {
-        display: block !important
-    }
-
-    .d-lg-table {
-        display: table !important
-    }
-
-    .d-lg-table-row {
-        display: table-row !important
-    }
-
-    .d-lg-table-cell {
-        display: table-cell !important
-    }
-
-    .d-lg-flex {
-        display: -ms-flexbox !important;
-        display: flex !important
-    }
-
-    .d-lg-inline-flex {
-        display: -ms-inline-flexbox !important;
-        display: inline-flex !important
-    }
-}
-
-@media (min-width: 1200px) {
-    .d-xl-none {
-        display: none !important
-    }
-
-    .d-xl-inline {
-        display: inline !important
-    }
-
-    .d-xl-inline-block {
-        display: inline-block !important
-    }
-
-    .d-xl-block {
-        display: block !important
-    }
-
-    .d-xl-table {
-        display: table !important
-    }
-
-    .d-xl-table-row {
-        display: table-row !important
-    }
-
-    .d-xl-table-cell {
-        display: table-cell !important
-    }
-
-    .d-xl-flex {
-        display: -ms-flexbox !important;
-        display: flex !important
-    }
-
-    .d-xl-inline-flex {
-        display: -ms-inline-flexbox !important;
-        display: inline-flex !important
-    }
-}
-
-@media print {
-    .d-print-none {
-        display: none !important
-    }
-
-    .d-print-inline {
-        display: inline !important
-    }
-
-    .d-print-inline-block {
-        display: inline-block !important
-    }
-
-    .d-print-block {
-        display: block !important
-    }
-
-    .d-print-table {
-        display: table !important
-    }
-
-    .d-print-table-row {
-        display: table-row !important
-    }
-
-    .d-print-table-cell {
-        display: table-cell !important
-    }
-
-    .d-print-flex {
-        display: -ms-flexbox !important;
-        display: flex !important
-    }
-
-    .d-print-inline-flex {
-        display: -ms-inline-flexbox !important;
-        display: inline-flex !important
-    }
-}
-
-.embed-responsive {
-    position: relative;
-    display: block;
-    width: 100%;
-    padding: 0;
-    overflow: hidden
-}
-
-.embed-responsive::before {
-    display: block;
-    content: ""
-}
-
-.embed-responsive .embed-responsive-item, .embed-responsive embed, .embed-responsive iframe, .embed-responsive object, .embed-responsive video {
-    position: absolute;
-    top: 0;
-    bottom: 0;
-    left: 0;
-    width: 100%;
-    height: 100%;
-    border: 0
-}
-
-.embed-responsive-21by9::before {
-    padding-top: 42.857143%
-}
-
-.embed-responsive-16by9::before {
-    padding-top: 56.25%
-}
-
-.embed-responsive-4by3::before {
-    padding-top: 75%
-}
-
-.embed-responsive-1by1::before {
-    padding-top: 100%
-}
-
-.flex-row {
-    -ms-flex-direction: row !important;
-    flex-direction: row !important
-}
-
-.flex-column {
-    -ms-flex-direction: column !important;
-    flex-direction: column !important
-}
-
-.flex-row-reverse {
-    -ms-flex-direction: row-reverse !important;
-    flex-direction: row-reverse !important
-}
-
-.flex-column-reverse {
-    -ms-flex-direction: column-reverse !important;
-    flex-direction: column-reverse !important
-}
-
-.flex-wrap {
-    -ms-flex-wrap: wrap !important;
-    flex-wrap: wrap !important
-}
-
-.flex-nowrap {
-    -ms-flex-wrap: nowrap !important;
-    flex-wrap: nowrap !important
-}
-
-.flex-wrap-reverse {
-    -ms-flex-wrap: wrap-reverse !important;
-    flex-wrap: wrap-reverse !important
-}
-
-.flex-fill {
-    -ms-flex: 1 1 auto !important;
-    flex: 1 1 auto !important
-}
-
-.flex-grow-0 {
-    -ms-flex-positive: 0 !important;
-    flex-grow: 0 !important
-}
-
-.flex-grow-1 {
-    -ms-flex-positive: 1 !important;
-    flex-grow: 1 !important
-}
-
-.flex-shrink-0 {
-    -ms-flex-negative: 0 !important;
-    flex-shrink: 0 !important
-}
-
-.flex-shrink-1 {
-    -ms-flex-negative: 1 !important;
-    flex-shrink: 1 !important
-}
-
-.justify-content-start {
-    -ms-flex-pack: start !important;
-    justify-content: flex-start !important
-}
-
-.justify-content-end {
-    -ms-flex-pack: end !important;
-    justify-content: flex-end !important
-}
-
-.justify-content-center {
-    -ms-flex-pack: center !important;
-    justify-content: center !important
-}
-
-.justify-content-between {
-    -ms-flex-pack: justify !important;
-    justify-content: space-between !important
-}
-
-.justify-content-around {
-    -ms-flex-pack: distribute !important;
-    justify-content: space-around !important
-}
-
-.align-items-start {
-    -ms-flex-align: start !important;
-    align-items: flex-start !important
-}
-
-.align-items-end {
-    -ms-flex-align: end !important;
-    align-items: flex-end !important
-}
-
-.align-items-center {
-    -ms-flex-align: center !important;
-    align-items: center !important
-}
-
-.align-items-baseline {
-    -ms-flex-align: baseline !important;
-    align-items: baseline !important
-}
-
-.align-items-stretch {
-    -ms-flex-align: stretch !important;
-    align-items: stretch !important
-}
-
-.align-content-start {
-    -ms-flex-line-pack: start !important;
-    align-content: flex-start !important
-}
-
-.align-content-end {
-    -ms-flex-line-pack: end !important;
-    align-content: flex-end !important
-}
-
-.align-content-center {
-    -ms-flex-line-pack: center !important;
-    align-content: center !important
-}
-
-.align-content-between {
-    -ms-flex-line-pack: justify !important;
-    align-content: space-between !important
-}
-
-.align-content-around {
-    -ms-flex-line-pack: distribute !important;
-    align-content: space-around !important
-}
-
-.align-content-stretch {
-    -ms-flex-line-pack: stretch !important;
-    align-content: stretch !important
-}
-
-.align-self-auto {
-    -ms-flex-item-align: auto !important;
-    align-self: auto !important
-}
-
-.align-self-start {
-    -ms-flex-item-align: start !important;
-    align-self: flex-start !important
-}
-
-.align-self-end {
-    -ms-flex-item-align: end !important;
-    align-self: flex-end !important
-}
-
-.align-self-center {
-    -ms-flex-item-align: center !important;
-    align-self: center !important
-}
-
-.align-self-baseline {
-    -ms-flex-item-align: baseline !important;
-    align-self: baseline !important
-}
-
-.align-self-stretch {
-    -ms-flex-item-align: stretch !important;
-    align-self: stretch !important
-}
-
-@media (min-width: 576px) {
-    .flex-sm-row {
-        -ms-flex-direction: row !important;
-        flex-direction: row !important
-    }
-
-    .flex-sm-column {
-        -ms-flex-direction: column !important;
-        flex-direction: column !important
-    }
-
-    .flex-sm-row-reverse {
-        -ms-flex-direction: row-reverse !important;
-        flex-direction: row-reverse !important
-    }
-
-    .flex-sm-column-reverse {
-        -ms-flex-direction: column-reverse !important;
-        flex-direction: column-reverse !important
-    }
-
-    .flex-sm-wrap {
-        -ms-flex-wrap: wrap !important;
-        flex-wrap: wrap !important
-    }
-
-    .flex-sm-nowrap {
-        -ms-flex-wrap: nowrap !important;
-        flex-wrap: nowrap !important
-    }
-
-    .flex-sm-wrap-reverse {
-        -ms-flex-wrap: wrap-reverse !important;
-        flex-wrap: wrap-reverse !important
-    }
-
-    .flex-sm-fill {
-        -ms-flex: 1 1 auto !important;
-        flex: 1 1 auto !important
-    }
-
-    .flex-sm-grow-0 {
-        -ms-flex-positive: 0 !important;
-        flex-grow: 0 !important
-    }
-
-    .flex-sm-grow-1 {
-        -ms-flex-positive: 1 !important;
-        flex-grow: 1 !important
-    }
-
-    .flex-sm-shrink-0 {
-        -ms-flex-negative: 0 !important;
-        flex-shrink: 0 !important
-    }
-
-    .flex-sm-shrink-1 {
-        -ms-flex-negative: 1 !important;
-        flex-shrink: 1 !important
-    }
-
-    .justify-content-sm-start {
-        -ms-flex-pack: start !important;
-        justify-content: flex-start !important
-    }
-
-    .justify-content-sm-end {
-        -ms-flex-pack: end !important;
-        justify-content: flex-end !important
-    }
-
-    .justify-content-sm-center {
-        -ms-flex-pack: center !important;
-        justify-content: center !important
-    }
-
-    .justify-content-sm-between {
-        -ms-flex-pack: justify !important;
-        justify-content: space-between !important
-    }
-
-    .justify-content-sm-around {
-        -ms-flex-pack: distribute !important;
-        justify-content: space-around !important
-    }
-
-    .align-items-sm-start {
-        -ms-flex-align: start !important;
-        align-items: flex-start !important
-    }
-
-    .align-items-sm-end {
-        -ms-flex-align: end !important;
-        align-items: flex-end !important
-    }
-
-    .align-items-sm-center {
-        -ms-flex-align: center !important;
-        align-items: center !important
-    }
-
-    .align-items-sm-baseline {
-        -ms-flex-align: baseline !important;
-        align-items: baseline !important
-    }
-
-    .align-items-sm-stretch {
-        -ms-flex-align: stretch !important;
-        align-items: stretch !important
-    }
-
-    .align-content-sm-start {
-        -ms-flex-line-pack: start !important;
-        align-content: flex-start !important
-    }
-
-    .align-content-sm-end {
-        -ms-flex-line-pack: end !important;
-        align-content: flex-end !important
-    }
-
-    .align-content-sm-center {
-        -ms-flex-line-pack: center !important;
-        align-content: center !important
-    }
-
-    .align-content-sm-between {
-        -ms-flex-line-pack: justify !important;
-        align-content: space-between !important
-    }
-
-    .align-content-sm-around {
-        -ms-flex-line-pack: distribute !important;
-        align-content: space-around !important
-    }
-
-    .align-content-sm-stretch {
-        -ms-flex-line-pack: stretch !important;
-        align-content: stretch !important
-    }
-
-    .align-self-sm-auto {
-        -ms-flex-item-align: auto !important;
-        align-self: auto !important
-    }
-
-    .align-self-sm-start {
-        -ms-flex-item-align: start !important;
-        align-self: flex-start !important
-    }
-
-    .align-self-sm-end {
-        -ms-flex-item-align: end !important;
-        align-self: flex-end !important
-    }
-
-    .align-self-sm-center {
-        -ms-flex-item-align: center !important;
-        align-self: center !important
-    }
-
-    .align-self-sm-baseline {
-        -ms-flex-item-align: baseline !important;
-        align-self: baseline !important
-    }
-
-    .align-self-sm-stretch {
-        -ms-flex-item-align: stretch !important;
-        align-self: stretch !important
-    }
-}
-
-@media (min-width: 768px) {
-    .flex-md-row {
-        -ms-flex-direction: row !important;
-        flex-direction: row !important
-    }
-
-    .flex-md-column {
-        -ms-flex-direction: column !important;
-        flex-direction: column !important
-    }
-
-    .flex-md-row-reverse {
-        -ms-flex-direction: row-reverse !important;
-        flex-direction: row-reverse !important
-    }
-
-    .flex-md-column-reverse {
-        -ms-flex-direction: column-reverse !important;
-        flex-direction: column-reverse !important
-    }
-
-    .flex-md-wrap {
-        -ms-flex-wrap: wrap !important;
-        flex-wrap: wrap !important
-    }
-
-    .flex-md-nowrap {
-        -ms-flex-wrap: nowrap !important;
-        flex-wrap: nowrap !important
-    }
-
-    .flex-md-wrap-reverse {
-        -ms-flex-wrap: wrap-reverse !important;
-        flex-wrap: wrap-reverse !important
-    }
-
-    .flex-md-fill {
-        -ms-flex: 1 1 auto !important;
-        flex: 1 1 auto !important
-    }
-
-    .flex-md-grow-0 {
-        -ms-flex-positive: 0 !important;
-        flex-grow: 0 !important
-    }
-
-    .flex-md-grow-1 {
-        -ms-flex-positive: 1 !important;
-        flex-grow: 1 !important
-    }
-
-    .flex-md-shrink-0 {
-        -ms-flex-negative: 0 !important;
-        flex-shrink: 0 !important
-    }
-
-    .flex-md-shrink-1 {
-        -ms-flex-negative: 1 !important;
-        flex-shrink: 1 !important
-    }
-
-    .justify-content-md-start {
-        -ms-flex-pack: start !important;
-        justify-content: flex-start !important
-    }
-
-    .justify-content-md-end {
-        -ms-flex-pack: end !important;
-        justify-content: flex-end !important
-    }
-
-    .justify-content-md-center {
-        -ms-flex-pack: center !important;
-        justify-content: center !important
-    }
-
-    .justify-content-md-between {
-        -ms-flex-pack: justify !important;
-        justify-content: space-between !important
-    }
-
-    .justify-content-md-around {
-        -ms-flex-pack: distribute !important;
-        justify-content: space-around !important
-    }
-
-    .align-items-md-start {
-        -ms-flex-align: start !important;
-        align-items: flex-start !important
-    }
-
-    .align-items-md-end {
-        -ms-flex-align: end !important;
-        align-items: flex-end !important
-    }
-
-    .align-items-md-center {
-        -ms-flex-align: center !important;
-        align-items: center !important
-    }
-
-    .align-items-md-baseline {
-        -ms-flex-align: baseline !important;
-        align-items: baseline !important
-    }
-
-    .align-items-md-stretch {
-        -ms-flex-align: stretch !important;
-        align-items: stretch !important
-    }
-
-    .align-content-md-start {
-        -ms-flex-line-pack: start !important;
-        align-content: flex-start !important
-    }
-
-    .align-content-md-end {
-        -ms-flex-line-pack: end !important;
-        align-content: flex-end !important
-    }
-
-    .align-content-md-center {
-        -ms-flex-line-pack: center !important;
-        align-content: center !important
-    }
-
-    .align-content-md-between {
-        -ms-flex-line-pack: justify !important;
-        align-content: space-between !important
-    }
-
-    .align-content-md-around {
-        -ms-flex-line-pack: distribute !important;
-        align-content: space-around !important
-    }
-
-    .align-content-md-stretch {
-        -ms-flex-line-pack: stretch !important;
-        align-content: stretch !important
-    }
-
-    .align-self-md-auto {
-        -ms-flex-item-align: auto !important;
-        align-self: auto !important
-    }
-
-    .align-self-md-start {
-        -ms-flex-item-align: start !important;
-        align-self: flex-start !important
-    }
-
-    .align-self-md-end {
-        -ms-flex-item-align: end !important;
-        align-self: flex-end !important
-    }
-
-    .align-self-md-center {
-        -ms-flex-item-align: center !important;
-        align-self: center !important
-    }
-
-    .align-self-md-baseline {
-        -ms-flex-item-align: baseline !important;
-        align-self: baseline !important
-    }
-
-    .align-self-md-stretch {
-        -ms-flex-item-align: stretch !important;
-        align-self: stretch !important
-    }
-}
-
-@media (min-width: 992px) {
-    .flex-lg-row {
-        -ms-flex-direction: row !important;
-        flex-direction: row !important
-    }
-
-    .flex-lg-column {
-        -ms-flex-direction: column !important;
-        flex-direction: column !important
-    }
-
-    .flex-lg-row-reverse {
-        -ms-flex-direction: row-reverse !important;
-        flex-direction: row-reverse !important
-    }
-
-    .flex-lg-column-reverse {
-        -ms-flex-direction: column-reverse !important;
-        flex-direction: column-reverse !important
-    }
-
-    .flex-lg-wrap {
-        -ms-flex-wrap: wrap !important;
-        flex-wrap: wrap !important
-    }
-
-    .flex-lg-nowrap {
-        -ms-flex-wrap: nowrap !important;
-        flex-wrap: nowrap !important
-    }
-
-    .flex-lg-wrap-reverse {
-        -ms-flex-wrap: wrap-reverse !important;
-        flex-wrap: wrap-reverse !important
-    }
-
-    .flex-lg-fill {
-        -ms-flex: 1 1 auto !important;
-        flex: 1 1 auto !important
-    }
-
-    .flex-lg-grow-0 {
-        -ms-flex-positive: 0 !important;
-        flex-grow: 0 !important
-    }
-
-    .flex-lg-grow-1 {
-        -ms-flex-positive: 1 !important;
-        flex-grow: 1 !important
-    }
-
-    .flex-lg-shrink-0 {
-        -ms-flex-negative: 0 !important;
-        flex-shrink: 0 !important
-    }
-
-    .flex-lg-shrink-1 {
-        -ms-flex-negative: 1 !important;
-        flex-shrink: 1 !important
-    }
-
-    .justify-content-lg-start {
-        -ms-flex-pack: start !important;
-        justify-content: flex-start !important
-    }
-
-    .justify-content-lg-end {
-        -ms-flex-pack: end !important;
-        justify-content: flex-end !important
-    }
-
-    .justify-content-lg-center {
-        -ms-flex-pack: center !important;
-        justify-content: center !important
-    }
-
-    .justify-content-lg-between {
-        -ms-flex-pack: justify !important;
-        justify-content: space-between !important
-    }
-
-    .justify-content-lg-around {
-        -ms-flex-pack: distribute !important;
-        justify-content: space-around !important
-    }
-
-    .align-items-lg-start {
-        -ms-flex-align: start !important;
-        align-items: flex-start !important
-    }
-
-    .align-items-lg-end {
-        -ms-flex-align: end !important;
-        align-items: flex-end !important
-    }
-
-    .align-items-lg-center {
-        -ms-flex-align: center !important;
-        align-items: center !important
-    }
-
-    .align-items-lg-baseline {
-        -ms-flex-align: baseline !important;
-        align-items: baseline !important
-    }
-
-    .align-items-lg-stretch {
-        -ms-flex-align: stretch !important;
-        align-items: stretch !important
-    }
-
-    .align-content-lg-start {
-        -ms-flex-line-pack: start !important;
-        align-content: flex-start !important
-    }
-
-    .align-content-lg-end {
-        -ms-flex-line-pack: end !important;
-        align-content: flex-end !important
-    }
-
-    .align-content-lg-center {
-        -ms-flex-line-pack: center !important;
-        align-content: center !important
-    }
-
-    .align-content-lg-between {
-        -ms-flex-line-pack: justify !important;
-        align-content: space-between !important
-    }
-
-    .align-content-lg-around {
-        -ms-flex-line-pack: distribute !important;
-        align-content: space-around !important
-    }
-
-    .align-content-lg-stretch {
-        -ms-flex-line-pack: stretch !important;
-        align-content: stretch !important
-    }
-
-    .align-self-lg-auto {
-        -ms-flex-item-align: auto !important;
-        align-self: auto !important
-    }
-
-    .align-self-lg-start {
-        -ms-flex-item-align: start !important;
-        align-self: flex-start !important
-    }
-
-    .align-self-lg-end {
-        -ms-flex-item-align: end !important;
-        align-self: flex-end !important
-    }
-
-    .align-self-lg-center {
-        -ms-flex-item-align: center !important;
-        align-self: center !important
-    }
-
-    .align-self-lg-baseline {
-        -ms-flex-item-align: baseline !important;
-        align-self: baseline !important
-    }
-
-    .align-self-lg-stretch {
-        -ms-flex-item-align: stretch !important;
-        align-self: stretch !important
-    }
-}
-
-@media (min-width: 1200px) {
-    .flex-xl-row {
-        -ms-flex-direction: row !important;
-        flex-direction: row !important
-    }
-
-    .flex-xl-column {
-        -ms-flex-direction: column !important;
-        flex-direction: column !important
-    }
-
-    .flex-xl-row-reverse {
-        -ms-flex-direction: row-reverse !important;
-        flex-direction: row-reverse !important
-    }
-
-    .flex-xl-column-reverse {
-        -ms-flex-direction: column-reverse !important;
-        flex-direction: column-reverse !important
-    }
-
-    .flex-xl-wrap {
-        -ms-flex-wrap: wrap !important;
-        flex-wrap: wrap !important
-    }
-
-    .flex-xl-nowrap {
-        -ms-flex-wrap: nowrap !important;
-        flex-wrap: nowrap !important
-    }
-
-    .flex-xl-wrap-reverse {
-        -ms-flex-wrap: wrap-reverse !important;
-        flex-wrap: wrap-reverse !important
-    }
-
-    .flex-xl-fill {
-        -ms-flex: 1 1 auto !important;
-        flex: 1 1 auto !important
-    }
-
-    .flex-xl-grow-0 {
-        -ms-flex-positive: 0 !important;
-        flex-grow: 0 !important
-    }
-
-    .flex-xl-grow-1 {
-        -ms-flex-positive: 1 !important;
-        flex-grow: 1 !important
-    }
-
-    .flex-xl-shrink-0 {
-        -ms-flex-negative: 0 !important;
-        flex-shrink: 0 !important
-    }
-
-    .flex-xl-shrink-1 {
-        -ms-flex-negative: 1 !important;
-        flex-shrink: 1 !important
-    }
-
-    .justify-content-xl-start {
-        -ms-flex-pack: start !important;
-        justify-content: flex-start !important
-    }
-
-    .justify-content-xl-end {
-        -ms-flex-pack: end !important;
-        justify-content: flex-end !important
-    }
-
-    .justify-content-xl-center {
-        -ms-flex-pack: center !important;
-        justify-content: center !important
-    }
-
-    .justify-content-xl-between {
-        -ms-flex-pack: justify !important;
-        justify-content: space-between !important
-    }
-
-    .justify-content-xl-around {
-        -ms-flex-pack: distribute !important;
-        justify-content: space-around !important
-    }
-
-    .align-items-xl-start {
-        -ms-flex-align: start !important;
-        align-items: flex-start !important
-    }
-
-    .align-items-xl-end {
-        -ms-flex-align: end !important;
-        align-items: flex-end !important
-    }
-
-    .align-items-xl-center {
-        -ms-flex-align: center !important;
-        align-items: center !important
-    }
-
-    .align-items-xl-baseline {
-        -ms-flex-align: baseline !important;
-        align-items: baseline !important
-    }
-
-    .align-items-xl-stretch {
-        -ms-flex-align: stretch !important;
-        align-items: stretch !important
-    }
-
-    .align-content-xl-start {
-        -ms-flex-line-pack: start !important;
-        align-content: flex-start !important
-    }
-
-    .align-content-xl-end {
-        -ms-flex-line-pack: end !important;
-        align-content: flex-end !important
-    }
-
-    .align-content-xl-center {
-        -ms-flex-line-pack: center !important;
-        align-content: center !important
-    }
-
-    .align-content-xl-between {
-        -ms-flex-line-pack: justify !important;
-        align-content: space-between !important
-    }
-
-    .align-content-xl-around {
-        -ms-flex-line-pack: distribute !important;
-        align-content: space-around !important
-    }
-
-    .align-content-xl-stretch {
-        -ms-flex-line-pack: stretch !important;
-        align-content: stretch !important
-    }
-
-    .align-self-xl-auto {
-        -ms-flex-item-align: auto !important;
-        align-self: auto !important
-    }
-
-    .align-self-xl-start {
-        -ms-flex-item-align: start !important;
-        align-self: flex-start !important
-    }
-
-    .align-self-xl-end {
-        -ms-flex-item-align: end !important;
-        align-self: flex-end !important
-    }
-
-    .align-self-xl-center {
-        -ms-flex-item-align: center !important;
-        align-self: center !important
-    }
-
-    .align-self-xl-baseline {
-        -ms-flex-item-align: baseline !important;
-        align-self: baseline !important
-    }
-
-    .align-self-xl-stretch {
-        -ms-flex-item-align: stretch !important;
-        align-self: stretch !important
-    }
-}
-
-.float-left {
-    float: left !important
-}
-
-.float-right {
-    float: right !important
-}
-
-.float-none {
-    float: none !important
-}
-
-@media (min-width: 576px) {
-    .float-sm-left {
-        float: left !important
-    }
-
-    .float-sm-right {
-        float: right !important
-    }
-
-    .float-sm-none {
-        float: none !important
-    }
-}
-
-@media (min-width: 768px) {
-    .float-md-left {
-        float: left !important
-    }
-
-    .float-md-right {
-        float: right !important
-    }
-
-    .float-md-none {
-        float: none !important
-    }
-}
-
-@media (min-width: 992px) {
-    .float-lg-left {
-        float: left !important
-    }
-
-    .float-lg-right {
-        float: right !important
-    }
-
-    .float-lg-none {
-        float: none !important
-    }
-}
-
-@media (min-width: 1200px) {
-    .float-xl-left {
-        float: left !important
-    }
-
-    .float-xl-right {
-        float: right !important
-    }
-
-    .float-xl-none {
-        float: none !important
-    }
-}
-
-.user-select-all {
-    -webkit-user-select: all !important;
-    -moz-user-select: all !important;
-    -ms-user-select: all !important;
-    user-select: all !important
-}
-
-.user-select-auto {
-    -webkit-user-select: auto !important;
-    -moz-user-select: auto !important;
-    -ms-user-select: auto !important;
-    user-select: auto !important
-}
-
-.user-select-none {
-    -webkit-user-select: none !important;
-    -moz-user-select: none !important;
-    -ms-user-select: none !important;
-    user-select: none !important
-}
-
-.overflow-auto {
-    overflow: auto !important
-}
-
-.overflow-hidden {
-    overflow: hidden !important
-}
-
-.position-static {
-    position: static !important
-}
-
-.position-relative {
-    position: relative !important
-}
-
-.position-absolute {
-    position: absolute !important
-}
-
-.position-fixed {
-    position: fixed !important
-}
-
-.position-sticky {
-    position: -webkit-sticky !important;
-    position: sticky !important
-}
-
-.fixed-top {
-    position: fixed;
-    top: 0;
-    right: 0;
-    left: 0;
-    z-index: 1030
-}
-
-.fixed-bottom {
-    position: fixed;
-    right: 0;
-    bottom: 0;
-    left: 0;
-    z-index: 1030
-}
-
-@supports ((position:-webkit-sticky) or (position:sticky)) {
-    .sticky-top {
-        position: -webkit-sticky;
-        position: sticky;
-        top: 0;
-        z-index: 1020
-    }
-}
-
-.sr-only {
-    position: absolute;
-    width: 1px;
-    height: 1px;
-    padding: 0;
-    margin: -1px;
-    overflow: hidden;
-    clip: rect(0, 0, 0, 0);
-    white-space: nowrap;
-    border: 0
-}
-
-.sr-only-focusable:active, .sr-only-focusable:focus {
-    position: static;
-    width: auto;
-    height: auto;
-    overflow: visible;
-    clip: auto;
-    white-space: normal
-}
-
-.shadow-sm {
-    box-shadow: 0 .125rem .25rem rgba(0, 0, 0, .075) !important
-}
-
-.shadow {
-    box-shadow: 0 .5rem 1rem rgba(0, 0, 0, .15) !important
-}
-
-.shadow-lg {
-    box-shadow: 0 1rem 3rem rgba(0, 0, 0, .175) !important
-}
-
-.shadow-none {
-    box-shadow: none !important
-}
-
-.w-25 {
-    width: 25% !important
-}
-
-.w-50 {
-    width: 50% !important
-}
-
-.w-75 {
-    width: 75% !important
-}
-
-.w-100 {
-    width: 100% !important
-}
-
-.w-auto {
-    width: auto !important
-}
-
-.h-25 {
-    height: 25% !important
-}
-
-.h-50 {
-    height: 50% !important
-}
-
-.h-75 {
-    height: 75% !important
-}
-
-.h-100 {
-    height: 100% !important
-}
-
-.h-auto {
-    height: auto !important
-}
-
-.mw-100 {
-    max-width: 100% !important
-}
-
-.mh-100 {
-    max-height: 100% !important
-}
-
-.min-vw-100 {
-    min-width: 100vw !important
-}
-
-.min-vh-100 {
-    min-height: 100vh !important
-}
-
-.vw-100 {
-    width: 100vw !important
-}
-
-.vh-100 {
-    height: 100vh !important
-}
-
-.m-0 {
-    margin: 0 !important
-}
-
-.mt-0, .my-0 {
-    margin-top: 0 !important
-}
-
-.mr-0, .mx-0 {
-    margin-right: 0 !important
-}
-
-.mb-0, .my-0 {
-    margin-bottom: 0 !important
-}
-
-.ml-0, .mx-0 {
-    margin-left: 0 !important
-}
-
-.m-1 {
-    margin: .25rem !important
-}
-
-.mt-1, .my-1 {
-    margin-top: .25rem !important
-}
-
-.mr-1, .mx-1 {
-    margin-right: .25rem !important
-}
-
-.mb-1, .my-1 {
-    margin-bottom: .25rem !important
-}
-
-.ml-1, .mx-1 {
-    margin-left: .25rem !important
-}
-
-.m-2 {
-    margin: .5rem !important
-}
-
-.mt-2, .my-2 {
-    margin-top: .5rem !important
-}
-
-.mr-2, .mx-2 {
-    margin-right: .5rem !important
-}
-
-.mb-2, .my-2 {
-    margin-bottom: .5rem !important
-}
-
-.ml-2, .mx-2 {
-    margin-left: .5rem !important
-}
-
-.m-3 {
-    margin: 1rem !important
-}
-
-.mt-3, .my-3 {
-    margin-top: 1rem !important
-}
-
-.mr-3, .mx-3 {
-    margin-right: 1rem !important
-}
-
-.mb-3, .my-3 {
-    margin-bottom: 1rem !important
-}
-
-.ml-3, .mx-3 {
-    margin-left: 1rem !important
-}
-
-.m-4 {
-    margin: 1.5rem !important
-}
-
-.mt-4, .my-4 {
-    margin-top: 1.5rem !important
-}
-
-.mr-4, .mx-4 {
-    margin-right: 1.5rem !important
-}
-
-.mb-4, .my-4 {
-    margin-bottom: 1.5rem !important
-}
-
-.ml-4, .mx-4 {
-    margin-left: 1.5rem !important
-}
-
-.m-5 {
-    margin: 3rem !important
-}
-
-.mt-5, .my-5 {
-    margin-top: 3rem !important
-}
-
-.mr-5, .mx-5 {
-    margin-right: 3rem !important
-}
-
-.mb-5, .my-5 {
-    margin-bottom: 3rem !important
-}
-
-.ml-5, .mx-5 {
-    margin-left: 3rem !important
-}
-
-.p-0 {
-    padding: 0 !important
-}
-
-.pt-0, .py-0 {
-    padding-top: 0 !important
-}
-
-.pr-0, .px-0 {
-    padding-right: 0 !important
-}
-
-.pb-0, .py-0 {
-    padding-bottom: 0 !important
-}
-
-.pl-0, .px-0 {
-    padding-left: 0 !important
-}
-
-.p-1 {
-    padding: .25rem !important
-}
-
-.pt-1, .py-1 {
-    padding-top: .25rem !important
-}
-
-.pr-1, .px-1 {
-    padding-right: .25rem !important
-}
-
-.pb-1, .py-1 {
-    padding-bottom: .25rem !important
-}
-
-.pl-1, .px-1 {
-    padding-left: .25rem !important
-}
-
-.p-2 {
-    padding: .5rem !important
-}
-
-.pt-2, .py-2 {
-    padding-top: .5rem !important
-}
-
-.pr-2, .px-2 {
-    padding-right: .5rem !important
-}
-
-.pb-2, .py-2 {
-    padding-bottom: .5rem !important
-}
-
-.pl-2, .px-2 {
-    padding-left: .5rem !important
-}
-
-.p-3 {
-    padding: 1rem !important
-}
-
-.pt-3, .py-3 {
-    padding-top: 1rem !important
-}
-
-.pr-3, .px-3 {
-    padding-right: 1rem !important
-}
-
-.pb-3, .py-3 {
-    padding-bottom: 1rem !important
-}
-
-.pl-3, .px-3 {
-    padding-left: 1rem !important
-}
-
-.p-4 {
-    padding: 1.5rem !important
-}
-
-.pt-4, .py-4 {
-    padding-top: 1.5rem !important
-}
-
-.pr-4, .px-4 {
-    padding-right: 1.5rem !important
-}
-
-.pb-4, .py-4 {
-    padding-bottom: 1.5rem !important
-}
-
-.pl-4, .px-4 {
-    padding-left: 1.5rem !important
-}
-
-.p-5 {
-    padding: 3rem !important
-}
-
-.pt-5, .py-5 {
-    padding-top: 3rem !important
-}
-
-.pr-5, .px-5 {
-    padding-right: 3rem !important
-}
-
-.pb-5, .py-5 {
-    padding-bottom: 3rem !important
-}
-
-.pl-5, .px-5 {
-    padding-left: 3rem !important
-}
-
-.m-n1 {
-    margin: -.25rem !important
-}
-
-.mt-n1, .my-n1 {
-    margin-top: -.25rem !important
-}
-
-.mr-n1, .mx-n1 {
-    margin-right: -.25rem !important
-}
-
-.mb-n1, .my-n1 {
-    margin-bottom: -.25rem !important
-}
-
-.ml-n1, .mx-n1 {
-    margin-left: -.25rem !important
-}
-
-.m-n2 {
-    margin: -.5rem !important
-}
-
-.mt-n2, .my-n2 {
-    margin-top: -.5rem !important
-}
-
-.mr-n2, .mx-n2 {
-    margin-right: -.5rem !important
-}
-
-.mb-n2, .my-n2 {
-    margin-bottom: -.5rem !important
-}
-
-.ml-n2, .mx-n2 {
-    margin-left: -.5rem !important
-}
-
-.m-n3 {
-    margin: -1rem !important
-}
-
-.mt-n3, .my-n3 {
-    margin-top: -1rem !important
-}
-
-.mr-n3, .mx-n3 {
-    margin-right: -1rem !important
-}
-
-.mb-n3, .my-n3 {
-    margin-bottom: -1rem !important
-}
-
-.ml-n3, .mx-n3 {
-    margin-left: -1rem !important
-}
-
-.m-n4 {
-    margin: -1.5rem !important
-}
-
-.mt-n4, .my-n4 {
-    margin-top: -1.5rem !important
-}
-
-.mr-n4, .mx-n4 {
-    margin-right: -1.5rem !important
-}
-
-.mb-n4, .my-n4 {
-    margin-bottom: -1.5rem !important
-}
-
-.ml-n4, .mx-n4 {
-    margin-left: -1.5rem !important
-}
-
-.m-n5 {
-    margin: -3rem !important
-}
-
-.mt-n5, .my-n5 {
-    margin-top: -3rem !important
-}
-
-.mr-n5, .mx-n5 {
-    margin-right: -3rem !important
-}
-
-.mb-n5, .my-n5 {
-    margin-bottom: -3rem !important
-}
-
-.ml-n5, .mx-n5 {
-    margin-left: -3rem !important
-}
-
-.m-auto {
-    margin: auto !important
-}
-
-.mt-auto, .my-auto {
-    margin-top: auto !important
-}
-
-.mr-auto, .mx-auto {
-    margin-right: auto !important
-}
-
-.mb-auto, .my-auto {
-    margin-bottom: auto !important
-}
-
-.ml-auto, .mx-auto {
-    margin-left: auto !important
-}
-
-@media (min-width: 576px) {
-    .m-sm-0 {
-        margin: 0 !important
-    }
-
-    .mt-sm-0, .my-sm-0 {
-        margin-top: 0 !important
-    }
-
-    .mr-sm-0, .mx-sm-0 {
-        margin-right: 0 !important
-    }
-
-    .mb-sm-0, .my-sm-0 {
-        margin-bottom: 0 !important
-    }
-
-    .ml-sm-0, .mx-sm-0 {
-        margin-left: 0 !important
-    }
-
-    .m-sm-1 {
-        margin: .25rem !important
-    }
-
-    .mt-sm-1, .my-sm-1 {
-        margin-top: .25rem !important
-    }
-
-    .mr-sm-1, .mx-sm-1 {
-        margin-right: .25rem !important
-    }
-
-    .mb-sm-1, .my-sm-1 {
-        margin-bottom: .25rem !important
-    }
-
-    .ml-sm-1, .mx-sm-1 {
-        margin-left: .25rem !important
-    }
-
-    .m-sm-2 {
-        margin: .5rem !important
-    }
-
-    .mt-sm-2, .my-sm-2 {
-        margin-top: .5rem !important
-    }
-
-    .mr-sm-2, .mx-sm-2 {
-        margin-right: .5rem !important
-    }
-
-    .mb-sm-2, .my-sm-2 {
-        margin-bottom: .5rem !important
-    }
-
-    .ml-sm-2, .mx-sm-2 {
-        margin-left: .5rem !important
-    }
-
-    .m-sm-3 {
-        margin: 1rem !important
-    }
-
-    .mt-sm-3, .my-sm-3 {
-        margin-top: 1rem !important
-    }
-
-    .mr-sm-3, .mx-sm-3 {
-        margin-right: 1rem !important
-    }
-
-    .mb-sm-3, .my-sm-3 {
-        margin-bottom: 1rem !important
-    }
-
-    .ml-sm-3, .mx-sm-3 {
-        margin-left: 1rem !important
-    }
-
-    .m-sm-4 {
-        margin: 1.5rem !important
-    }
-
-    .mt-sm-4, .my-sm-4 {
-        margin-top: 1.5rem !important
-    }
-
-    .mr-sm-4, .mx-sm-4 {
-        margin-right: 1.5rem !important
-    }
-
-    .mb-sm-4, .my-sm-4 {
-        margin-bottom: 1.5rem !important
-    }
-
-    .ml-sm-4, .mx-sm-4 {
-        margin-left: 1.5rem !important
-    }
-
-    .m-sm-5 {
-        margin: 3rem !important
-    }
-
-    .mt-sm-5, .my-sm-5 {
-        margin-top: 3rem !important
-    }
-
-    .mr-sm-5, .mx-sm-5 {
-        margin-right: 3rem !important
-    }
-
-    .mb-sm-5, .my-sm-5 {
-        margin-bottom: 3rem !important
-    }
-
-    .ml-sm-5, .mx-sm-5 {
-        margin-left: 3rem !important
-    }
-
-    .p-sm-0 {
-        padding: 0 !important
-    }
-
-    .pt-sm-0, .py-sm-0 {
-        padding-top: 0 !important
-    }
-
-    .pr-sm-0, .px-sm-0 {
-        padding-right: 0 !important
-    }
-
-    .pb-sm-0, .py-sm-0 {
-        padding-bottom: 0 !important
-    }
-
-    .pl-sm-0, .px-sm-0 {
-        padding-left: 0 !important
-    }
-
-    .p-sm-1 {
-        padding: .25rem !important
-    }
-
-    .pt-sm-1, .py-sm-1 {
-        padding-top: .25rem !important
-    }
-
-    .pr-sm-1, .px-sm-1 {
-        padding-right: .25rem !important
-    }
-
-    .pb-sm-1, .py-sm-1 {
-        padding-bottom: .25rem !important
-    }
-
-    .pl-sm-1, .px-sm-1 {
-        padding-left: .25rem !important
-    }
-
-    .p-sm-2 {
-        padding: .5rem !important
-    }
-
-    .pt-sm-2, .py-sm-2 {
-        padding-top: .5rem !important
-    }
-
-    .pr-sm-2, .px-sm-2 {
-        padding-right: .5rem !important
-    }
-
-    .pb-sm-2, .py-sm-2 {
-        padding-bottom: .5rem !important
-    }
-
-    .pl-sm-2, .px-sm-2 {
-        padding-left: .5rem !important
-    }
-
-    .p-sm-3 {
-        padding: 1rem !important
-    }
-
-    .pt-sm-3, .py-sm-3 {
-        padding-top: 1rem !important
-    }
-
-    .pr-sm-3, .px-sm-3 {
-        padding-right: 1rem !important
-    }
-
-    .pb-sm-3, .py-sm-3 {
-        padding-bottom: 1rem !important
-    }
-
-    .pl-sm-3, .px-sm-3 {
-        padding-left: 1rem !important
-    }
-
-    .p-sm-4 {
-        padding: 1.5rem !important
-    }
-
-    .pt-sm-4, .py-sm-4 {
-        padding-top: 1.5rem !important
-    }
-
-    .pr-sm-4, .px-sm-4 {
-        padding-right: 1.5rem !important
-    }
-
-    .pb-sm-4, .py-sm-4 {
-        padding-bottom: 1.5rem !important
-    }
-
-    .pl-sm-4, .px-sm-4 {
-        padding-left: 1.5rem !important
-    }
-
-    .p-sm-5 {
-        padding: 3rem !important
-    }
-
-    .pt-sm-5, .py-sm-5 {
-        padding-top: 3rem !important
-    }
-
-    .pr-sm-5, .px-sm-5 {
-        padding-right: 3rem !important
-    }
-
-    .pb-sm-5, .py-sm-5 {
-        padding-bottom: 3rem !important
-    }
-
-    .pl-sm-5, .px-sm-5 {
-        padding-left: 3rem !important
-    }
-
-    .m-sm-n1 {
-        margin: -.25rem !important
-    }
-
-    .mt-sm-n1, .my-sm-n1 {
-        margin-top: -.25rem !important
-    }
-
-    .mr-sm-n1, .mx-sm-n1 {
-        margin-right: -.25rem !important
-    }
-
-    .mb-sm-n1, .my-sm-n1 {
-        margin-bottom: -.25rem !important
-    }
-
-    .ml-sm-n1, .mx-sm-n1 {
-        margin-left: -.25rem !important
-    }
-
-    .m-sm-n2 {
-        margin: -.5rem !important
-    }
-
-    .mt-sm-n2, .my-sm-n2 {
-        margin-top: -.5rem !important
-    }
-
-    .mr-sm-n2, .mx-sm-n2 {
-        margin-right: -.5rem !important
-    }
-
-    .mb-sm-n2, .my-sm-n2 {
-        margin-bottom: -.5rem !important
-    }
-
-    .ml-sm-n2, .mx-sm-n2 {
-        margin-left: -.5rem !important
-    }
-
-    .m-sm-n3 {
-        margin: -1rem !important
-    }
-
-    .mt-sm-n3, .my-sm-n3 {
-        margin-top: -1rem !important
-    }
-
-    .mr-sm-n3, .mx-sm-n3 {
-        margin-right: -1rem !important
-    }
-
-    .mb-sm-n3, .my-sm-n3 {
-        margin-bottom: -1rem !important
-    }
-
-    .ml-sm-n3, .mx-sm-n3 {
-        margin-left: -1rem !important
-    }
-
-    .m-sm-n4 {
-        margin: -1.5rem !important
-    }
-
-    .mt-sm-n4, .my-sm-n4 {
-        margin-top: -1.5rem !important
-    }
-
-    .mr-sm-n4, .mx-sm-n4 {
-        margin-right: -1.5rem !important
-    }
-
-    .mb-sm-n4, .my-sm-n4 {
-        margin-bottom: -1.5rem !important
-    }
-
-    .ml-sm-n4, .mx-sm-n4 {
-        margin-left: -1.5rem !important
-    }
-
-    .m-sm-n5 {
-        margin: -3rem !important
-    }
-
-    .mt-sm-n5, .my-sm-n5 {
-        margin-top: -3rem !important
-    }
-
-    .mr-sm-n5, .mx-sm-n5 {
-        margin-right: -3rem !important
-    }
-
-    .mb-sm-n5, .my-sm-n5 {
-        margin-bottom: -3rem !important
-    }
-
-    .ml-sm-n5, .mx-sm-n5 {
-        margin-left: -3rem !important
-    }
-
-    .m-sm-auto {
-        margin: auto !important
-    }
-
-    .mt-sm-auto, .my-sm-auto {
-        margin-top: auto !important
-    }
-
-    .mr-sm-auto, .mx-sm-auto {
-        margin-right: auto !important
-    }
-
-    .mb-sm-auto, .my-sm-auto {
-        margin-bottom: auto !important
-    }
-
-    .ml-sm-auto, .mx-sm-auto {
-        margin-left: auto !important
-    }
-}
-
-@media (min-width: 768px) {
-    .m-md-0 {
-        margin: 0 !important
-    }
-
-    .mt-md-0, .my-md-0 {
-        margin-top: 0 !important
-    }
-
-    .mr-md-0, .mx-md-0 {
-        margin-right: 0 !important
-    }
-
-    .mb-md-0, .my-md-0 {
-        margin-bottom: 0 !important
-    }
-
-    .ml-md-0, .mx-md-0 {
-        margin-left: 0 !important
-    }
-
-    .m-md-1 {
-        margin: .25rem !important
-    }
-
-    .mt-md-1, .my-md-1 {
-        margin-top: .25rem !important
-    }
-
-    .mr-md-1, .mx-md-1 {
-        margin-right: .25rem !important
-    }
-
-    .mb-md-1, .my-md-1 {
-        margin-bottom: .25rem !important
-    }
-
-    .ml-md-1, .mx-md-1 {
-        margin-left: .25rem !important
-    }
-
-    .m-md-2 {
-        margin: .5rem !important
-    }
-
-    .mt-md-2, .my-md-2 {
-        margin-top: .5rem !important
-    }
-
-    .mr-md-2, .mx-md-2 {
-        margin-right: .5rem !important
-    }
-
-    .mb-md-2, .my-md-2 {
-        margin-bottom: .5rem !important
-    }
-
-    .ml-md-2, .mx-md-2 {
-        margin-left: .5rem !important
-    }
-
-    .m-md-3 {
-        margin: 1rem !important
-    }
-
-    .mt-md-3, .my-md-3 {
-        margin-top: 1rem !important
-    }
-
-    .mr-md-3, .mx-md-3 {
-        margin-right: 1rem !important
-    }
-
-    .mb-md-3, .my-md-3 {
-        margin-bottom: 1rem !important
-    }
-
-    .ml-md-3, .mx-md-3 {
-        margin-left: 1rem !important
-    }
-
-    .m-md-4 {
-        margin: 1.5rem !important
-    }
-
-    .mt-md-4, .my-md-4 {
-        margin-top: 1.5rem !important
-    }
-
-    .mr-md-4, .mx-md-4 {
-        margin-right: 1.5rem !important
-    }
-
-    .mb-md-4, .my-md-4 {
-        margin-bottom: 1.5rem !important
-    }
-
-    .ml-md-4, .mx-md-4 {
-        margin-left: 1.5rem !important
-    }
-
-    .m-md-5 {
-        margin: 3rem !important
-    }
-
-    .mt-md-5, .my-md-5 {
-        margin-top: 3rem !important
-    }
-
-    .mr-md-5, .mx-md-5 {
-        margin-right: 3rem !important
-    }
-
-    .mb-md-5, .my-md-5 {
-        margin-bottom: 3rem !important
-    }
-
-    .ml-md-5, .mx-md-5 {
-        margin-left: 3rem !important
-    }
-
-    .p-md-0 {
-        padding: 0 !important
-    }
-
-    .pt-md-0, .py-md-0 {
-        padding-top: 0 !important
-    }
-
-    .pr-md-0, .px-md-0 {
-        padding-right: 0 !important
-    }
-
-    .pb-md-0, .py-md-0 {
-        padding-bottom: 0 !important
-    }
-
-    .pl-md-0, .px-md-0 {
-        padding-left: 0 !important
-    }
-
-    .p-md-1 {
-        padding: .25rem !important
-    }
-
-    .pt-md-1, .py-md-1 {
-        padding-top: .25rem !important
-    }
-
-    .pr-md-1, .px-md-1 {
-        padding-right: .25rem !important
-    }
-
-    .pb-md-1, .py-md-1 {
-        padding-bottom: .25rem !important
-    }
-
-    .pl-md-1, .px-md-1 {
-        padding-left: .25rem !important
-    }
-
-    .p-md-2 {
-        padding: .5rem !important
-    }
-
-    .pt-md-2, .py-md-2 {
-        padding-top: .5rem !important
-    }
-
-    .pr-md-2, .px-md-2 {
-        padding-right: .5rem !important
-    }
-
-    .pb-md-2, .py-md-2 {
-        padding-bottom: .5rem !important
-    }
-
-    .pl-md-2, .px-md-2 {
-        padding-left: .5rem !important
-    }
-
-    .p-md-3 {
-        padding: 1rem !important
-    }
-
-    .pt-md-3, .py-md-3 {
-        padding-top: 1rem !important
-    }
-
-    .pr-md-3, .px-md-3 {
-        padding-right: 1rem !important
-    }
-
-    .pb-md-3, .py-md-3 {
-        padding-bottom: 1rem !important
-    }
-
-    .pl-md-3, .px-md-3 {
-        padding-left: 1rem !important
-    }
-
-    .p-md-4 {
-        padding: 1.5rem !important
-    }
-
-    .pt-md-4, .py-md-4 {
-        padding-top: 1.5rem !important
-    }
-
-    .pr-md-4, .px-md-4 {
-        padding-right: 1.5rem !important
-    }
-
-    .pb-md-4, .py-md-4 {
-        padding-bottom: 1.5rem !important
-    }
-
-    .pl-md-4, .px-md-4 {
-        padding-left: 1.5rem !important
-    }
-
-    .p-md-5 {
-        padding: 3rem !important
-    }
-
-    .pt-md-5, .py-md-5 {
-        padding-top: 3rem !important
-    }
-
-    .pr-md-5, .px-md-5 {
-        padding-right: 3rem !important
-    }
-
-    .pb-md-5, .py-md-5 {
-        padding-bottom: 3rem !important
-    }
-
-    .pl-md-5, .px-md-5 {
-        padding-left: 3rem !important
-    }
-
-    .m-md-n1 {
-        margin: -.25rem !important
-    }
-
-    .mt-md-n1, .my-md-n1 {
-        margin-top: -.25rem !important
-    }
-
-    .mr-md-n1, .mx-md-n1 {
-        margin-right: -.25rem !important
-    }
-
-    .mb-md-n1, .my-md-n1 {
-        margin-bottom: -.25rem !important
-    }
-
-    .ml-md-n1, .mx-md-n1 {
-        margin-left: -.25rem !important
-    }
-
-    .m-md-n2 {
-        margin: -.5rem !important
-    }
-
-    .mt-md-n2, .my-md-n2 {
-        margin-top: -.5rem !important
-    }
-
-    .mr-md-n2, .mx-md-n2 {
-        margin-right: -.5rem !important
-    }
-
-    .mb-md-n2, .my-md-n2 {
-        margin-bottom: -.5rem !important
-    }
-
-    .ml-md-n2, .mx-md-n2 {
-        margin-left: -.5rem !important
-    }
-
-    .m-md-n3 {
-        margin: -1rem !important
-    }
-
-    .mt-md-n3, .my-md-n3 {
-        margin-top: -1rem !important
-    }
-
-    .mr-md-n3, .mx-md-n3 {
-        margin-right: -1rem !important
-    }
-
-    .mb-md-n3, .my-md-n3 {
-        margin-bottom: -1rem !important
-    }
-
-    .ml-md-n3, .mx-md-n3 {
-        margin-left: -1rem !important
-    }
-
-    .m-md-n4 {
-        margin: -1.5rem !important
-    }
-
-    .mt-md-n4, .my-md-n4 {
-        margin-top: -1.5rem !important
-    }
-
-    .mr-md-n4, .mx-md-n4 {
-        margin-right: -1.5rem !important
-    }
-
-    .mb-md-n4, .my-md-n4 {
-        margin-bottom: -1.5rem !important
-    }
-
-    .ml-md-n4, .mx-md-n4 {
-        margin-left: -1.5rem !important
-    }
-
-    .m-md-n5 {
-        margin: -3rem !important
-    }
-
-    .mt-md-n5, .my-md-n5 {
-        margin-top: -3rem !important
-    }
-
-    .mr-md-n5, .mx-md-n5 {
-        margin-right: -3rem !important
-    }
-
-    .mb-md-n5, .my-md-n5 {
-        margin-bottom: -3rem !important
-    }
-
-    .ml-md-n5, .mx-md-n5 {
-        margin-left: -3rem !important
-    }
-
-    .m-md-auto {
-        margin: auto !important
-    }
-
-    .mt-md-auto, .my-md-auto {
-        margin-top: auto !important
-    }
-
-    .mr-md-auto, .mx-md-auto {
-        margin-right: auto !important
-    }
-
-    .mb-md-auto, .my-md-auto {
-        margin-bottom: auto !important
-    }
-
-    .ml-md-auto, .mx-md-auto {
-        margin-left: auto !important
-    }
-}
-
-@media (min-width: 992px) {
-    .m-lg-0 {
-        margin: 0 !important
-    }
-
-    .mt-lg-0, .my-lg-0 {
-        margin-top: 0 !important
-    }
-
-    .mr-lg-0, .mx-lg-0 {
-        margin-right: 0 !important
-    }
-
-    .mb-lg-0, .my-lg-0 {
-        margin-bottom: 0 !important
-    }
-
-    .ml-lg-0, .mx-lg-0 {
-        margin-left: 0 !important
-    }
-
-    .m-lg-1 {
-        margin: .25rem !important
-    }
-
-    .mt-lg-1, .my-lg-1 {
-        margin-top: .25rem !important
-    }
-
-    .mr-lg-1, .mx-lg-1 {
-        margin-right: .25rem !important
-    }
-
-    .mb-lg-1, .my-lg-1 {
-        margin-bottom: .25rem !important
-    }
-
-    .ml-lg-1, .mx-lg-1 {
-        margin-left: .25rem !important
-    }
-
-    .m-lg-2 {
-        margin: .5rem !important
-    }
-
-    .mt-lg-2, .my-lg-2 {
-        margin-top: .5rem !important
-    }
-
-    .mr-lg-2, .mx-lg-2 {
-        margin-right: .5rem !important
-    }
-
-    .mb-lg-2, .my-lg-2 {
-        margin-bottom: .5rem !important
-    }
-
-    .ml-lg-2, .mx-lg-2 {
-        margin-left: .5rem !important
-    }
-
-    .m-lg-3 {
-        margin: 1rem !important
-    }
-
-    .mt-lg-3, .my-lg-3 {
-        margin-top: 1rem !important
-    }
-
-    .mr-lg-3, .mx-lg-3 {
-        margin-right: 1rem !important
-    }
-
-    .mb-lg-3, .my-lg-3 {
-        margin-bottom: 1rem !important
-    }
-
-    .ml-lg-3, .mx-lg-3 {
-        margin-left: 1rem !important
-    }
-
-    .m-lg-4 {
-        margin: 1.5rem !important
-    }
-
-    .mt-lg-4, .my-lg-4 {
-        margin-top: 1.5rem !important
-    }
-
-    .mr-lg-4, .mx-lg-4 {
-        margin-right: 1.5rem !important
-    }
-
-    .mb-lg-4, .my-lg-4 {
-        margin-bottom: 1.5rem !important
-    }
-
-    .ml-lg-4, .mx-lg-4 {
-        margin-left: 1.5rem !important
-    }
-
-    .m-lg-5 {
-        margin: 3rem !important
-    }
-
-    .mt-lg-5, .my-lg-5 {
-        margin-top: 3rem !important
-    }
-
-    .mr-lg-5, .mx-lg-5 {
-        margin-right: 3rem !important
-    }
-
-    .mb-lg-5, .my-lg-5 {
-        margin-bottom: 3rem !important
-    }
-
-    .ml-lg-5, .mx-lg-5 {
-        margin-left: 3rem !important
-    }
-
-    .p-lg-0 {
-        padding: 0 !important
-    }
-
-    .pt-lg-0, .py-lg-0 {
-        padding-top: 0 !important
-    }
-
-    .pr-lg-0, .px-lg-0 {
-        padding-right: 0 !important
-    }
-
-    .pb-lg-0, .py-lg-0 {
-        padding-bottom: 0 !important
-    }
-
-    .pl-lg-0, .px-lg-0 {
-        padding-left: 0 !important
-    }
-
-    .p-lg-1 {
-        padding: .25rem !important
-    }
-
-    .pt-lg-1, .py-lg-1 {
-        padding-top: .25rem !important
-    }
-
-    .pr-lg-1, .px-lg-1 {
-        padding-right: .25rem !important
-    }
-
-    .pb-lg-1, .py-lg-1 {
-        padding-bottom: .25rem !important
-    }
-
-    .pl-lg-1, .px-lg-1 {
-        padding-left: .25rem !important
-    }
-
-    .p-lg-2 {
-        padding: .5rem !important
-    }
-
-    .pt-lg-2, .py-lg-2 {
-        padding-top: .5rem !important
-    }
-
-    .pr-lg-2, .px-lg-2 {
-        padding-right: .5rem !important
-    }
-
-    .pb-lg-2, .py-lg-2 {
-        padding-bottom: .5rem !important
-    }
-
-    .pl-lg-2, .px-lg-2 {
-        padding-left: .5rem !important
-    }
-
-    .p-lg-3 {
-        padding: 1rem !important
-    }
-
-    .pt-lg-3, .py-lg-3 {
-        padding-top: 1rem !important
-    }
-
-    .pr-lg-3, .px-lg-3 {
-        padding-right: 1rem !important
-    }
-
-    .pb-lg-3, .py-lg-3 {
-        padding-bottom: 1rem !important
-    }
-
-    .pl-lg-3, .px-lg-3 {
-        padding-left: 1rem !important
-    }
-
-    .p-lg-4 {
-        padding: 1.5rem !important
-    }
-
-    .pt-lg-4, .py-lg-4 {
-        padding-top: 1.5rem !important
-    }
-
-    .pr-lg-4, .px-lg-4 {
-        padding-right: 1.5rem !important
-    }
-
-    .pb-lg-4, .py-lg-4 {
-        padding-bottom: 1.5rem !important
-    }
-
-    .pl-lg-4, .px-lg-4 {
-        padding-left: 1.5rem !important
-    }
-
-    .p-lg-5 {
-        padding: 3rem !important
-    }
-
-    .pt-lg-5, .py-lg-5 {
-        padding-top: 3rem !important
-    }
-
-    .pr-lg-5, .px-lg-5 {
-        padding-right: 3rem !important
-    }
-
-    .pb-lg-5, .py-lg-5 {
-        padding-bottom: 3rem !important
-    }
-
-    .pl-lg-5, .px-lg-5 {
-        padding-left: 3rem !important
-    }
-
-    .m-lg-n1 {
-        margin: -.25rem !important
-    }
-
-    .mt-lg-n1, .my-lg-n1 {
-        margin-top: -.25rem !important
-    }
-
-    .mr-lg-n1, .mx-lg-n1 {
-        margin-right: -.25rem !important
-    }
-
-    .mb-lg-n1, .my-lg-n1 {
-        margin-bottom: -.25rem !important
-    }
-
-    .ml-lg-n1, .mx-lg-n1 {
-        margin-left: -.25rem !important
-    }
-
-    .m-lg-n2 {
-        margin: -.5rem !important
-    }
-
-    .mt-lg-n2, .my-lg-n2 {
-        margin-top: -.5rem !important
-    }
-
-    .mr-lg-n2, .mx-lg-n2 {
-        margin-right: -.5rem !important
-    }
-
-    .mb-lg-n2, .my-lg-n2 {
-        margin-bottom: -.5rem !important
-    }
-
-    .ml-lg-n2, .mx-lg-n2 {
-        margin-left: -.5rem !important
-    }
-
-    .m-lg-n3 {
-        margin: -1rem !important
-    }
-
-    .mt-lg-n3, .my-lg-n3 {
-        margin-top: -1rem !important
-    }
-
-    .mr-lg-n3, .mx-lg-n3 {
-        margin-right: -1rem !important
-    }
-
-    .mb-lg-n3, .my-lg-n3 {
-        margin-bottom: -1rem !important
-    }
-
-    .ml-lg-n3, .mx-lg-n3 {
-        margin-left: -1rem !important
-    }
-
-    .m-lg-n4 {
-        margin: -1.5rem !important
-    }
-
-    .mt-lg-n4, .my-lg-n4 {
-        margin-top: -1.5rem !important
-    }
-
-    .mr-lg-n4, .mx-lg-n4 {
-        margin-right: -1.5rem !important
-    }
-
-    .mb-lg-n4, .my-lg-n4 {
-        margin-bottom: -1.5rem !important
-    }
-
-    .ml-lg-n4, .mx-lg-n4 {
-        margin-left: -1.5rem !important
-    }
-
-    .m-lg-n5 {
-        margin: -3rem !important
-    }
-
-    .mt-lg-n5, .my-lg-n5 {
-        margin-top: -3rem !important
-    }
-
-    .mr-lg-n5, .mx-lg-n5 {
-        margin-right: -3rem !important
-    }
-
-    .mb-lg-n5, .my-lg-n5 {
-        margin-bottom: -3rem !important
-    }
-
-    .ml-lg-n5, .mx-lg-n5 {
-        margin-left: -3rem !important
-    }
-
-    .m-lg-auto {
-        margin: auto !important
-    }
-
-    .mt-lg-auto, .my-lg-auto {
-        margin-top: auto !important
-    }
-
-    .mr-lg-auto, .mx-lg-auto {
-        margin-right: auto !important
-    }
-
-    .mb-lg-auto, .my-lg-auto {
-        margin-bottom: auto !important
-    }
-
-    .ml-lg-auto, .mx-lg-auto {
-        margin-left: auto !important
-    }
-}
-
-@media (min-width: 1200px) {
-    .m-xl-0 {
-        margin: 0 !important
-    }
-
-    .mt-xl-0, .my-xl-0 {
-        margin-top: 0 !important
-    }
-
-    .mr-xl-0, .mx-xl-0 {
-        margin-right: 0 !important
-    }
-
-    .mb-xl-0, .my-xl-0 {
-        margin-bottom: 0 !important
-    }
-
-    .ml-xl-0, .mx-xl-0 {
-        margin-left: 0 !important
-    }
-
-    .m-xl-1 {
-        margin: .25rem !important
-    }
-
-    .mt-xl-1, .my-xl-1 {
-        margin-top: .25rem !important
-    }
-
-    .mr-xl-1, .mx-xl-1 {
-        margin-right: .25rem !important
-    }
-
-    .mb-xl-1, .my-xl-1 {
-        margin-bottom: .25rem !important
-    }
-
-    .ml-xl-1, .mx-xl-1 {
-        margin-left: .25rem !important
-    }
-
-    .m-xl-2 {
-        margin: .5rem !important
-    }
-
-    .mt-xl-2, .my-xl-2 {
-        margin-top: .5rem !important
-    }
-
-    .mr-xl-2, .mx-xl-2 {
-        margin-right: .5rem !important
-    }
-
-    .mb-xl-2, .my-xl-2 {
-        margin-bottom: .5rem !important
-    }
-
-    .ml-xl-2, .mx-xl-2 {
-        margin-left: .5rem !important
-    }
-
-    .m-xl-3 {
-        margin: 1rem !important
-    }
-
-    .mt-xl-3, .my-xl-3 {
-        margin-top: 1rem !important
-    }
-
-    .mr-xl-3, .mx-xl-3 {
-        margin-right: 1rem !important
-    }
-
-    .mb-xl-3, .my-xl-3 {
-        margin-bottom: 1rem !important
-    }
-
-    .ml-xl-3, .mx-xl-3 {
-        margin-left: 1rem !important
-    }
-
-    .m-xl-4 {
-        margin: 1.5rem !important
-    }
-
-    .mt-xl-4, .my-xl-4 {
-        margin-top: 1.5rem !important
-    }
-
-    .mr-xl-4, .mx-xl-4 {
-        margin-right: 1.5rem !important
-    }
-
-    .mb-xl-4, .my-xl-4 {
-        margin-bottom: 1.5rem !important
-    }
-
-    .ml-xl-4, .mx-xl-4 {
-        margin-left: 1.5rem !important
-    }
-
-    .m-xl-5 {
-        margin: 3rem !important
-    }
-
-    .mt-xl-5, .my-xl-5 {
-        margin-top: 3rem !important
-    }
-
-    .mr-xl-5, .mx-xl-5 {
-        margin-right: 3rem !important
-    }
-
-    .mb-xl-5, .my-xl-5 {
-        margin-bottom: 3rem !important
-    }
-
-    .ml-xl-5, .mx-xl-5 {
-        margin-left: 3rem !important
-    }
-
-    .p-xl-0 {
-        padding: 0 !important
-    }
-
-    .pt-xl-0, .py-xl-0 {
-        padding-top: 0 !important
-    }
-
-    .pr-xl-0, .px-xl-0 {
-        padding-right: 0 !important
-    }
-
-    .pb-xl-0, .py-xl-0 {
-        padding-bottom: 0 !important
-    }
-
-    .pl-xl-0, .px-xl-0 {
-        padding-left: 0 !important
-    }
-
-    .p-xl-1 {
-        padding: .25rem !important
-    }
-
-    .pt-xl-1, .py-xl-1 {
-        padding-top: .25rem !important
-    }
-
-    .pr-xl-1, .px-xl-1 {
-        padding-right: .25rem !important
-    }
-
-    .pb-xl-1, .py-xl-1 {
-        padding-bottom: .25rem !important
-    }
-
-    .pl-xl-1, .px-xl-1 {
-        padding-left: .25rem !important
-    }
-
-    .p-xl-2 {
-        padding: .5rem !important
-    }
-
-    .pt-xl-2, .py-xl-2 {
-        padding-top: .5rem !important
-    }
-
-    .pr-xl-2, .px-xl-2 {
-        padding-right: .5rem !important
-    }
-
-    .pb-xl-2, .py-xl-2 {
-        padding-bottom: .5rem !important
-    }
-
-    .pl-xl-2, .px-xl-2 {
-        padding-left: .5rem !important
-    }
-
-    .p-xl-3 {
-        padding: 1rem !important
-    }
-
-    .pt-xl-3, .py-xl-3 {
-        padding-top: 1rem !important
-    }
-
-    .pr-xl-3, .px-xl-3 {
-        padding-right: 1rem !important
-    }
-
-    .pb-xl-3, .py-xl-3 {
-        padding-bottom: 1rem !important
-    }
-
-    .pl-xl-3, .px-xl-3 {
-        padding-left: 1rem !important
-    }
-
-    .p-xl-4 {
-        padding: 1.5rem !important
-    }
-
-    .pt-xl-4, .py-xl-4 {
-        padding-top: 1.5rem !important
-    }
-
-    .pr-xl-4, .px-xl-4 {
-        padding-right: 1.5rem !important
-    }
-
-    .pb-xl-4, .py-xl-4 {
-        padding-bottom: 1.5rem !important
-    }
-
-    .pl-xl-4, .px-xl-4 {
-        padding-left: 1.5rem !important
-    }
-
-    .p-xl-5 {
-        padding: 3rem !important
-    }
-
-    .pt-xl-5, .py-xl-5 {
-        padding-top: 3rem !important
-    }
-
-    .pr-xl-5, .px-xl-5 {
-        padding-right: 3rem !important
-    }
-
-    .pb-xl-5, .py-xl-5 {
-        padding-bottom: 3rem !important
-    }
-
-    .pl-xl-5, .px-xl-5 {
-        padding-left: 3rem !important
-    }
-
-    .m-xl-n1 {
-        margin: -.25rem !important
-    }
-
-    .mt-xl-n1, .my-xl-n1 {
-        margin-top: -.25rem !important
-    }
-
-    .mr-xl-n1, .mx-xl-n1 {
-        margin-right: -.25rem !important
-    }
-
-    .mb-xl-n1, .my-xl-n1 {
-        margin-bottom: -.25rem !important
-    }
-
-    .ml-xl-n1, .mx-xl-n1 {
-        margin-left: -.25rem !important
-    }
-
-    .m-xl-n2 {
-        margin: -.5rem !important
-    }
-
-    .mt-xl-n2, .my-xl-n2 {
-        margin-top: -.5rem !important
-    }
-
-    .mr-xl-n2, .mx-xl-n2 {
-        margin-right: -.5rem !important
-    }
-
-    .mb-xl-n2, .my-xl-n2 {
-        margin-bottom: -.5rem !important
-    }
-
-    .ml-xl-n2, .mx-xl-n2 {
-        margin-left: -.5rem !important
-    }
-
-    .m-xl-n3 {
-        margin: -1rem !important
-    }
-
-    .mt-xl-n3, .my-xl-n3 {
-        margin-top: -1rem !important
-    }
-
-    .mr-xl-n3, .mx-xl-n3 {
-        margin-right: -1rem !important
-    }
-
-    .mb-xl-n3, .my-xl-n3 {
-        margin-bottom: -1rem !important
-    }
-
-    .ml-xl-n3, .mx-xl-n3 {
-        margin-left: -1rem !important
-    }
-
-    .m-xl-n4 {
-        margin: -1.5rem !important
-    }
-
-    .mt-xl-n4, .my-xl-n4 {
-        margin-top: -1.5rem !important
-    }
-
-    .mr-xl-n4, .mx-xl-n4 {
-        margin-right: -1.5rem !important
-    }
-
-    .mb-xl-n4, .my-xl-n4 {
-        margin-bottom: -1.5rem !important
-    }
-
-    .ml-xl-n4, .mx-xl-n4 {
-        margin-left: -1.5rem !important
-    }
-
-    .m-xl-n5 {
-        margin: -3rem !important
-    }
-
-    .mt-xl-n5, .my-xl-n5 {
-        margin-top: -3rem !important
-    }
-
-    .mr-xl-n5, .mx-xl-n5 {
-        margin-right: -3rem !important
-    }
-
-    .mb-xl-n5, .my-xl-n5 {
-        margin-bottom: -3rem !important
-    }
-
-    .ml-xl-n5, .mx-xl-n5 {
-        margin-left: -3rem !important
-    }
-
-    .m-xl-auto {
-        margin: auto !important
-    }
-
-    .mt-xl-auto, .my-xl-auto {
-        margin-top: auto !important
-    }
-
-    .mr-xl-auto, .mx-xl-auto {
-        margin-right: auto !important
-    }
-
-    .mb-xl-auto, .my-xl-auto {
-        margin-bottom: auto !important
-    }
-
-    .ml-xl-auto, .mx-xl-auto {
-        margin-left: auto !important
-    }
-}
-
-.stretched-link::after {
-    position: absolute;
-    top: 0;
-    right: 0;
-    bottom: 0;
-    left: 0;
-    z-index: 1;
-    pointer-events: auto;
-    content: "";
-    background-color: rgba(0, 0, 0, 0)
-}
-
-.text-monospace {
-    font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace !important
-}
-
-.text-justify {
-    text-align: justify !important
-}
-
-.text-wrap {
-    white-space: normal !important
-}
-
-.text-nowrap {
-    white-space: nowrap !important
-}
-
-.text-truncate {
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap
-}
-
-.text-left {
-    text-align: left !important
-}
-
-.text-right {
-    text-align: right !important
-}
-
-.text-center {
-    text-align: center !important
-}
-
-@media (min-width: 576px) {
-    .text-sm-left {
-        text-align: left !important
-    }
-
-    .text-sm-right {
-        text-align: right !important
-    }
-
-    .text-sm-center {
-        text-align: center !important
-    }
-}
-
-@media (min-width: 768px) {
-    .text-md-left {
-        text-align: left !important
-    }
-
-    .text-md-right {
-        text-align: right !important
-    }
-
-    .text-md-center {
-        text-align: center !important
-    }
-}
-
-@media (min-width: 992px) {
-    .text-lg-left {
-        text-align: left !important
-    }
-
-    .text-lg-right {
-        text-align: right !important
-    }
-
-    .text-lg-center {
-        text-align: center !important
-    }
-}
-
-@media (min-width: 1200px) {
-    .text-xl-left {
-        text-align: left !important
-    }
-
-    .text-xl-right {
-        text-align: right !important
-    }
-
-    .text-xl-center {
-        text-align: center !important
-    }
-}
-
-.text-lowercase {
-    text-transform: lowercase !important
-}
-
-.text-uppercase {
-    text-transform: uppercase !important
-}
-
-.text-capitalize {
-    text-transform: capitalize !important
-}
-
-.font-weight-light {
-    font-weight: 300 !important
-}
-
-.font-weight-lighter {
-    font-weight: lighter !important
-}
-
-.font-weight-normal {
-    font-weight: 400 !important
-}
-
-.font-weight-bold {
-    font-weight: 700 !important
-}
-
-.font-weight-bolder {
-    font-weight: bolder !important
-}
-
-.font-italic {
-    font-style: italic !important
-}
-
-.text-white {
-    color: #fff !important
-}
-
-.text-primary {
-    color: #007bff !important
-}
-
-a.text-primary:focus, a.text-primary:hover {
-    color: #0056b3 !important
-}
-
-.text-secondary {
-    color: #6c757d !important
-}
-
-a.text-secondary:focus, a.text-secondary:hover {
-    color: #494f54 !important
-}
-
-.text-success {
-    color: #28a745 !important
-}
-
-a.text-success:focus, a.text-success:hover {
-    color: #19692c !important
-}
-
-.text-info {
-    color: #17a2b8 !important
-}
-
-a.text-info:focus, a.text-info:hover {
-    color: #0f6674 !important
-}
-
-.text-warning {
-    color: #ffc107 !important
-}
-
-a.text-warning:focus, a.text-warning:hover {
-    color: #ba8b00 !important
-}
-
-.text-danger {
-    color: #dc3545 !important
-}
-
-a.text-danger:focus, a.text-danger:hover {
-    color: #a71d2a !important
-}
-
-.text-light {
-    color: #f8f9fa !important
-}
-
-a.text-light:focus, a.text-light:hover {
-    color: #cbd3da !important
-}
-
-.text-dark {
-    color: #343a40 !important
-}
-
-a.text-dark:focus, a.text-dark:hover {
-    color: #121416 !important
-}
-
-.text-body {
-    color: #212529 !important
-}
-
-.text-muted {
-    color: #6c757d !important
-}
-
-.text-black-50 {
-    color: rgba(0, 0, 0, .5) !important
-}
-
-.text-white-50 {
-    color: rgba(255, 255, 255, .5) !important
-}
-
-.text-hide {
-    font: 0/0 a;
-    color: transparent;
-    text-shadow: none;
-    background-color: transparent;
-    border: 0
-}
-
-.text-decoration-none {
-    text-decoration: none !important
-}
-
-.text-break {
-    word-break: break-word !important;
-    overflow-wrap: break-word !important
-}
-
-.text-reset {
-    color: inherit !important
-}
-
-.visible {
-    visibility: visible !important
-}
-
-.invisible {
-    visibility: hidden !important
-}
-
-@media print {
-    *, ::after, ::before {
-        text-shadow: none !important;
-        box-shadow: none !important
-    }
-
-    a:not(.btn) {
-        text-decoration: underline
-    }
-
-    abbr[title]::after {
-        content: " (" attr(title) ")"
-    }
-
-    pre {
-        white-space: pre-wrap !important
-    }
-
-    blockquote, pre {
-        border: 1px solid #adb5bd;
-        page-break-inside: avoid
-    }
-
-    thead {
-        display: table-header-group
-    }
-
-    img, tr {
-        page-break-inside: avoid
-    }
-
-    h2, h3, p {
-        orphans: 3;
-        widows: 3
-    }
-
-    h2, h3 {
-        page-break-after: avoid
-    }
-
-    @page {
-        size: a3
-    }
-
-    body {
-        min-width: 992px !important
-    }
-
-    .container {
-        min-width: 992px !important
-    }
-
-    .navbar {
-        display: none
-    }
-
-    .badge {
-        border: 1px solid #000
-    }
-
-    .table {
-        border-collapse: collapse !important
-    }
-
-    .table td, .table th {
-        background-color: #fff !important
-    }
-
-    .table-bordered td, .table-bordered th {
-        border: 1px solid #dee2e6 !important
-    }
-
-    .table-dark {
-        color: inherit
-    }
-
-    .table-dark tbody + tbody, .table-dark td, .table-dark th, .table-dark thead th {
-        border-color: #dee2e6
-    }
-
-    .table .thead-dark th {
-        color: inherit;
-        border-color: #dee2e6
-    }
-}
-
-/*# sourceMappingURL=bootstrap.min.css.map */
-
diff --git a/static/css/fonts.css b/static/css/fonts.css
deleted file mode 100644
index 6598fa3..0000000
--- a/static/css/fonts.css
+++ /dev/null
@@ -1,384 +0,0 @@
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Code Pro';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Source Code Pro Medium'), local('SourceCodePro-Medium'), url(https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDvucq7Gq0DDzS.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Code Pro';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Source Code Pro Medium'), local('SourceCodePro-Medium'), url(https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDt-cq7Gq0DDzS.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Code Pro';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Source Code Pro Medium'), local('SourceCodePro-Medium'), url(https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDsOcq7Gq0DDzS.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Code Pro';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Source Code Pro Medium'), local('SourceCodePro-Medium'), url(https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDvOcq7Gq0DDzS.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Code Pro';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Source Code Pro Medium'), local('SourceCodePro-Medium'), url(https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDvecq7Gq0DDzS.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Code Pro';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Source Code Pro Medium'), local('SourceCodePro-Medium'), url(https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7qsDJB9cme_xc.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7jsDJB9cme_xc.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7rsDJB9cme_xc.woff2) format('woff2');
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7ksDJB9cme_xc.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7osDJB9cme_xc.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7psDJB9cme_xc.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 400;
-  src: local('Source Sans Pro Italic'), local('SourceSansPro-Italic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDJB9cme.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCdh18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCdo18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCdg18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCdv18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCdj18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCdi18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold Italic'), local('SourceSansPro-SemiBoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18S0xR41.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdh18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdo18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdv18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdj18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdi18S0xR41YDw.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: italic;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold Italic'), local('SourceSansPro-BoldItalic'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18S0xR41.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lujVj9_mf.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lujVj9_mf.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lujVj9_mf.woff2) format('woff2');
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lujVj9_mf.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lujVj9_mf.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lujVj9_mf.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmhdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwkxdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmxdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlBdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmBdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmRdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 600;
-  src: local('Source Sans Pro SemiBold'), local('SourceSansPro-SemiBold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+1F00-1FFF;
-}
-/* greek */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0370-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRdu3cOWxy40.woff2) format('woff2');
-  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: 'Source Sans Pro';
-  font-style: normal;
-  font-weight: 700;
-  src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2) format('woff2');
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
\ No newline at end of file
diff --git a/static/css/main.css b/static/css/main.css
index 05d18c4..d6af3b9 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -1,23 +1,85 @@
+/* ===== Design Tokens ===== */
+:root {
+    /* Primary palette */
+    --color-primary: #3c6aa7;
+    --color-primary-hover: #26446b;
+    --color-primary-light: #edf2f8;
+
+    /* Brand — JAWA's signature burgundy */
+    --color-navbar: #6A2F30;
+    --color-navbar-dark: #4e2223;
+
+    /* Accent — sandstone/caramel */
+    --color-accent: #d7a773;
+    --color-accent-light: #aa845a;
+
+    /* Text hierarchy */
+    --color-text: #112a46;
+    --color-text-secondary: #5a6978;
+    --color-text-muted: #8a95a3;
+
+    /* Surfaces */
+    --color-surface: #faf8f5;
+    --color-surface-raised: #f3efe9;
+    --color-surface-hover: #e8e2d9;
+    --color-border: #ddd6cc;
+
+    /* Code blocks */
+    --color-code-bg: #112a46;
+    --color-code-text: #e2e8f0;
+
+    /* Typography */
+    --font-sans: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+    --font-mono: 'JetBrains Mono', 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
+
+    /* Spacing and shape */
+    --radius-sm: 6px;
+    --radius-md: 8px;
+    --radius-lg: 12px;
+    --radius-pill: 9999px;
+
+    /* Elevation */
+    --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.05);
+    --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.08);
+    --shadow-lg: 0 8px 24px rgba(0, 0, 0, 0.12);
+}
+
+/* ===== Base Styles ===== */
 body {
     margin: 0;
-    padding: 0;
-    font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
-    color: #444;
+    padding-top: 56px;
+    font-family: var(--font-sans);
+    color: var(--color-text);
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+}
+
+a {
+    color: var(--color-primary);
 }
 
 a:visited {
-    color: antiquewhite;
+    color: var(--color-primary-hover);
 }
 
 a:hover {
-    color: #fff3cd;
+    color: var(--color-primary-hover);
     text-decoration: underline;
-    font-weight: none
+}
+
+/* Keep white links inside navbar and footer */
+nav a, nav a:visited,
+footer a, footer a:visited {
+    color: rgba(255, 255, 255, 0.8);
+}
+
+nav a:hover, footer a:hover {
+    color: #fff;
 }
 
 
 header {
-    background-color: #050053;
+    background-color: var(--color-code-bg);
     height: 35px;
     width: 100%;
     opacity: .9;
@@ -40,31 +102,15 @@ header h1.logo:hover {
  * Centering the body content
  */
 .container {
-    width: 900px;
-    margin: 0;
-}
-
-div.home {
-    padding: 10px 0 30px 0;
-    background-color: #fff;
-    -webkit-border-radius: 6px;
-    -moz-border-radius: 6px;
-    border-radius: 6px;
-}
-
-div.webhooks {
-    padding: 10px 0 30px 0;
-    background-color: #fff;
-    -webkit-border-radius: 6px;
-    -moz-border-radius: 6px;
-    border-radius: 6px;
+    max-width: 1100px;
+    margin: 0 auto;
+    padding-left: 1rem;
+    padding-right: 1rem;
 }
 
-div.success {
+div.home, div.webhooks, div.success {
     padding: 10px 0 30px 0;
     background-color: #fff;
-    -webkit-border-radius: 6px;
-    -moz-border-radius: 6px;
     border-radius: 6px;
 }
 
@@ -84,25 +130,10 @@ h3 {
     color: #999;
 }
 
-h1-center {
+.h1-center {
     text-align: center;
 }
 
-.div1 {
-    width: 300px;
-    height: 100px;
-    border: 1px solid blue;
-    box-sizing: border-box;
-}
-
-.div2 {
-    width: 300px;
-    height: 100px;
-    padding: 50px;
-    border: 1px solid red;
-    box-sizing: border-box;
-}
-
 * {
     box-sizing: border-box;
 }
@@ -125,20 +156,6 @@ h1-center {
     text-decoration: none;
 }
 
-.nav {
-    background: #eee;
-}
-
-.nav ul {
-    list-style-type: none;
-    padding: 0;
-}
-
-.nav ul a {
-    color: #000;
-    text-decoration: none;
-}
-
 .button-holder {
     padding-top: 20px;
 }
@@ -156,8 +173,6 @@ h1-center {
 }
 
 .submit {
-    -webkit-appearance: none;
-    -moz-appearance: none;
     appearance: none;
     width: 100px;
     height: 40px;
@@ -186,13 +201,9 @@ h1-center {
     border-left: 3px solid rgba(255, 255, 255, 0.0);
     background-color: transparent !important;
     animation-name: rotateAnimation;
-    -webkit-animation-name: wk-rotateAnimation;
-    animation-duration: 3s;
-    -webkit-animation-duration: 1s;
+    animation-duration: 1s;
     animation-delay: 0.2s;
-    -webkit-animation-delay: 0.2s;
     animation-iteration-count: infinite;
-    -webkit-animation-iteration-count: infinite;
 }
 
 @keyframes rotateAnimation {
@@ -204,37 +215,23 @@ h1-center {
     }
 }
 
-@-webkit-keyframes wk-rotateAnimation {
-    0% {
-        -webkit-transform: rotate(0deg);
-    }
-    100% {
-        -webkit-transform: rotate(360deg);
-    }
-}
-
 .fa {
-    color: #3c6aa7;
+    color: var(--color-primary);
     font-size: 18px !important;
     position: absolute;
     left: 50%;
     top: 50%;
     margin-left: -9px;
     margin-top: -9px;
-    -webkit-transform: scaleX(0) !important;
     transform: scaleX(0) !important;
 }
 
 .finish {
-    -webkit-transform: scaleX(1) !important;
     transform: scaleX(1) !important;
 }
 
 .hide-loading {
     opacity: 0;
-    -webkit-transform: rotate(0deg) !important;
-    transform: rotate(0deg) !important;
-    -webkit-transform: scale(0) !important;
     transform: scale(0) !important;
 }
 
@@ -242,15 +239,6 @@ h1-center {
     margin: 2rem;
 }
 
-@-webkit-keyframes sk-circleFadeDelay {
-    0%, 39%, 100% {
-        opacity: 0;
-    }
-    40% {
-        opacity: 1;
-    }
-}
-
 @keyframes sk-circleFadeDelay {
     0%, 39%, 100% {
         opacity: 0;
@@ -275,14 +263,15 @@ h1-center {
     display: inline-block;
 }
 
+/* ===== Tables ===== */
 .hippocrates {
-    font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+    font-family: var(--font-sans);
     border-collapse: collapse;
     width: 100%;
 }
 
 .hippocrates td, .hippocrates th {
-    border: 1px solid #ddd;
+    border: 1px solid var(--color-border);
     padding: 8px;
 }
 
@@ -291,36 +280,30 @@ h1-center {
 }
 
 .hippocrates tr:hover {
-    background-color: #ddd;
+    background-color: var(--color-surface);
 }
 
 .hippocrates th {
     padding-top: 12px;
     padding-bottom: 12px;
     text-align: left;
-    background-color: #26446b;
+    background-color: var(--color-primary-hover);
     color: white;
+    font-weight: 500;
+    font-size: 0.85rem;
+    border: none;
 }
 
 
 .rules-test {
-    padding-left: 50;
-    padding-right: 50;
-    margin-right: 50px;
-    margin-left: 50px;
-    color: #444444;
-}
-
-
-n {
-    color: #0066aa;
+    padding: 0 50px;
+    margin: 0 50px;
+    color: var(--color-text);
 }
 
 .alert-soft {
-    padding-left: 25px;
-    padding-right: 25px;
-    margin-right: 25px;
-    margin-left: 25px;
+    padding: 0 25px;
+    margin: 0 25px;
 }
 
 .btn-padded {
@@ -330,14 +313,11 @@ n {
 .webhooks-list span {
     display: block;
     font-size: 12px;
-    overflow-block: hidden;
-    /*margin-top: 10px;*/
 }
 
 .webhooks-list h6 {
     display: block;
     font-size: 12px;
-    overflow-block: hidden;
     word-wrap: normal;
 }
 
@@ -350,25 +330,35 @@ n {
 .jawa-bg {
     background-image: linear-gradient(to bottom, #edc9af, #eac2a4, #e6bc99, #e2b58d, #ddaf82, #ddaf82, #ddaf82, #ddaf82, #e2b58d, #e6bc99, #eac2a4, #edc9af);
     background-size: 100% 100%;
-    height: 100vh;
+    min-height: 100vh;
+    width: 100%;
 }
 
 .vertical-center {
     margin: 0;
     position: absolute;
     top: 50%;
-    -ms-transform: translateY(-50%);
     transform: translateY(-50%);
 }
 
 .container-bg {
-    background-color: #d7a773f6;
+    background-color: var(--color-surface);
 }
 
+/* ===== Cards ===== */
 .card {
-    width: 10rem;
-    padding: 3px;
+    padding: 0.5rem;
     margin: 10px;
+    max-width: 260px;
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    transition: transform 0.2s ease, box-shadow 0.2s ease, border-color 0.2s ease;
+}
+
+.card:hover {
+    transform: translateY(-2px);
+    box-shadow: var(--shadow-md);
+    border-color: var(--color-primary);
 }
 
 .dash-list .btn-jawa {
@@ -379,25 +369,43 @@ n {
     font-size: unset;
 }
 
+/* ===== Buttons ===== */
+.btn-jawa {
+    color: #fff;
+    background-color: var(--color-navbar);
+    border-color: var(--color-navbar);
+    border-radius: var(--radius-sm);
+    font-weight: 500;
+    transition: background-color 0.15s ease;
+}
+
 .btn-jawa:hover {
-    color: lightgrey;
+    background-color: var(--color-navbar-dark);
+    border-color: var(--color-navbar-dark);
+    color: #fff;
+}
+
+.btn-jawa:disabled {
+    background: unset;
+    border: unset;
+    color: transparent;
+}
+
+a.btn-jawa,
+a.btn-jawa:visited {
+    color: #fff;
+    text-decoration: none;
 }
 
 .alert-jawa {
     color: #FFFFFF;
-    background-color: #6A2F30;
+    background-color: var(--color-navbar);
     border-color: #c3e6cb;
     border-radius: 1rem;
     padding-top: 0.2rem;
     padding-bottom: 0.2rem;
 }
 
-.btn-jawa:disabled {
-    background: unset;
-    border: unset;
-    color: transparent;;
-}
-
 .btn-danger {
     margin: 5px;
     padding: 5px;
@@ -409,19 +417,25 @@ n {
     border-radius: 1rem;
 }
 
-.btn-jawa {
-    color: #fff;
-    background-color: #6A2F30;
-    border-color: #112a26;
-    border-radius: 1rem;
+.card-img {
+    width: 72px;
+    height: 72px;
+    margin-top: 0.5rem;
+    margin-bottom: 0.25rem;
+    opacity: 0.85;
 }
 
-.card-img {
-    width: 72%
+.card .btn-jawa {
+    text-align: center;
+    width: 100%;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    font-size: 0.8rem;
 }
 
 .border-info {
-    border-color: #aa845a !important;
+    border-color: var(--color-accent-light) !important;
 }
 
 .alert-warning {
@@ -435,3 +449,779 @@ n {
 .btn-group-sm .btn {
     border-radius: 0.5rem;
 }
+
+/* ===== Navbar (from nav.css) ===== */
+.navbar {
+    z-index: 9999;
+    border-radius: 0;
+    max-width: 100vw;
+    background-color: var(--color-navbar) !important;
+    box-shadow: var(--shadow-sm);
+    padding: 0.5rem 1rem;
+    border: none;
+    margin-bottom: 0;
+}
+
+.nav-item .nav-link {
+    color: rgba(255, 255, 255, 0.8) !important;
+    font-weight: 500;
+    font-size: 0.92rem;
+    padding: 0.4rem 0.75rem !important;
+    border-radius: var(--radius-sm);
+    transition: background-color 0.15s ease, color 0.15s ease;
+}
+
+.nav-item .nav-link:hover {
+    color: #fff !important;
+    background-color: rgba(255, 255, 255, 0.08);
+}
+
+.navbar-brand,
+.navbar-nav > li > a {
+    color: #fff;
+    text-align: center;
+}
+
+.navbar-brand:hover {
+    text-decoration: underline;
+}
+
+.navbar-brand img {
+    width: 32px;
+}
+
+.navbar-toggler {
+    border-color: #eee;
+    margin-top: 5px;
+}
+
+#last_nav_link {
+    margin-right: 0;
+}
+
+nav {
+    padding: 10px;
+    font-size: 17px;
+    color: white;
+    background-color: var(--color-navbar);
+}
+
+nav > a {
+    color: white;
+    margin-right: 10px;
+}
+
+.nav-expand-line {
+    height: 2px;
+    margin: 6px;
+    background-color: white;
+}
+
+#navbarSupportedContent {
+    background-color: var(--color-navbar);
+    padding: 10px;
+}
+
+/* ===== Footer ===== */
+footer {
+    padding: 1.25rem;
+    text-align: center;
+    color: rgba(255, 255, 255, 0.75);
+    background-color: var(--color-navbar);
+    font-size: 0.8rem;
+}
+
+footer a {
+    color: var(--color-accent);
+}
+
+/* ===== Site Layout (from site.css) ===== */
+.title {
+    font-weight: bold;
+}
+
+.main_content {
+    margin: 0;
+    background-color: #fff;
+    padding: 0 0 50px;
+}
+
+.test-links {
+    text-align: center;
+    border-bottom: 1px solid #d3d3d3;
+    border-top: 1px solid #d3d3d3;
+    margin-bottom: 0;
+}
+
+.test-links .stat {
+    display: inline-block;
+    min-width: 30vw;
+    padding: 2px;
+    font-size: 16px;
+    color: #003d61;
+}
+
+.test-links .stat a {
+    color: var(--color-text-secondary);
+}
+
+.test-links .stat a:visited {
+    color: var(--color-text-secondary);
+}
+
+.project-list .subtitle {
+    font-style: italic;
+}
+
+.project-list h2 {
+    font-size: 24px;
+    font-weight: bold;
+}
+
+.project-list .project {
+    border: 1px solid #d3d3d3;
+    padding: 10px;
+    background-color: #2c2c2c;
+    min-height: 45px;
+    margin-top: 15px;
+    color: black;
+    margin-bottom: 15px;
+}
+
+.project-list .project .title {
+    font-size: 20px;
+}
+
+.project-list .project a {
+    color: var(--color-primary);
+}
+
+.project-list .project .desc {
+    font-weight: normal;
+    font-size: 16px;
+    font-style: italic;
+}
+
+.test-links-bottom {
+    background-color: var(--color-surface);
+    padding: 10px 0;
+    text-align: center;
+    border-bottom: 1px solid var(--color-border);
+    border-top: 1px solid var(--color-border);
+    margin-top: 30px;
+}
+
+.confirm-delete-box {
+    margin: auto;
+    max-width: 2000px;
+    text-align: center;
+    background-color: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    padding: 1rem;
+}
+
+.log-view {
+    max-width: 100%;
+    margin: 0 auto;
+    text-align: left;
+    background-color: var(--color-code-bg);
+    color: var(--color-code-text);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    padding: 1rem;
+    font-family: var(--font-mono);
+    font-size: 0.82rem;
+    line-height: 1.6;
+}
+
+.log-frame {
+    max-height: 65vh;
+}
+
+.log-form {
+    margin: 0 auto;
+    background-color: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    padding: 10px;
+}
+
+.log-background {
+    background-color: var(--color-surface);
+    border: 1px solid var(--color-border);
+}
+
+.download-button {
+    margin: auto;
+    text-align: center;
+    padding: 15px 0;
+}
+
+.sub_links {
+    padding-top: 66px;
+    background-color: var(--color-surface);
+}
+
+@media (max-width: 979px) {
+    body {
+        padding-top: 0;
+    }
+}
+
+.sub_links.affix {
+    position: fixed;
+    top: 0;
+    width: 100%;
+    z-index: 10;
+}
+
+#upload-trigger {
+    display: none
+}
+
+#upload_link {
+    text-decoration: none;
+}
+
+.article {
+    padding-top: 40px;
+}
+
+.nav a {
+    color: #422f32;
+    text-decoration: underline;
+}
+
+.nav a:visited {
+    color: #FFFFFF;
+    text-decoration: underline;
+}
+
+/* ===== Account / Forms (from account.css) ===== */
+.form-container {
+    max-width: 100vw;
+    padding-top: .5rem;
+    padding-bottom: 1rem;
+}
+
+.log-container {
+    padding: 10px;
+    max-width: 100vw;
+    margin-bottom: -30px;
+}
+
+.login-form-container {
+    padding-bottom: 2rem;
+    background: transparent !important;
+    border: none !important;
+    box-shadow: none !important;
+}
+
+form.table-view > * {
+    margin-top: 5px;
+    margin-bottom: 5px;
+}
+
+form.table-view h1 {
+    text-align: center;
+}
+
+form.table-view button {
+    float: right;
+}
+
+form.table-view select {
+    padding: 0;
+}
+
+form.table-view {
+    min-width: 25vw;
+    max-width: 425px;
+    margin-bottom: 5rem;
+    margin-top: 1rem;
+    background-color: var(--color-surface);
+    color: var(--color-text);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    padding: 1.5rem;
+}
+
+form.files-form {
+    margin: auto;
+    max-height: 45vh;
+    max-width: fit-content;
+    background-color: var(--color-surface);
+    color: var(--color-text);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    padding: 1rem;
+}
+
+.error-msg {
+    color: #b30000;
+    text-align: center;
+}
+
+.success-wrap {
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.success-wrap:hover {
+    overflow: visible;
+}
+
+.success-form {
+    margin: auto;
+    text-align: center;
+    max-width: 1000px;
+    background-color: var(--color-surface);
+    color: var(--color-text);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    padding: 10px;
+}
+
+.success-view {
+    margin-top: 1rem;
+    margin-bottom: 1rem;
+    padding-top: 1rem;
+}
+
+.button-align {
+    text-align: right;
+}
+
+.test-banner {
+    background-color: #ececec;
+}
+
+.body {
+    padding-top: 60px;
+}
+
+.table-view {
+    margin: auto;
+    margin-top: 1rem;
+    max-width: 100vw;
+    background-color: var(--color-surface);
+    color: var(--color-text);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    padding: 1.25rem;
+}
+
+.table-view a {
+    color: var(--color-primary);
+    text-decoration: underline;
+}
+
+/* ===== Forms (modernized) ===== */
+.form-control {
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-sm);
+    color: var(--color-text);
+    font-size: 0.9rem;
+    padding: 0.5rem 0.75rem;
+}
+
+.form-control:focus {
+    border-color: var(--color-primary);
+    box-shadow: 0 0 0 3px rgba(60, 106, 167, 0.15);
+    outline: none;
+}
+
+.form-section {
+    background: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    padding: 2rem;
+}
+
+/* ===== Code / Script Previews ===== */
+.script-preview pre {
+    background: var(--color-code-bg);
+    color: var(--color-code-text);
+    border-radius: var(--radius-md);
+    padding: 1rem;
+    font-family: var(--font-mono);
+    font-size: 0.82rem;
+    line-height: 1.6;
+    overflow-x: auto;
+}
+
+code {
+    font-family: var(--font-mono);
+}
+
+/* ===== Page Sub-Navigation (pill-style) ===== */
+.page-sub-nav {
+    display: flex;
+    justify-content: center;
+    gap: 0.5rem;
+    flex-wrap: wrap;
+    padding: 0.75rem 0;
+    margin-bottom: 1rem;
+}
+
+.page-sub-nav a {
+    padding: 0.4rem 1rem;
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-pill);
+    font-size: 0.85rem;
+    font-weight: 500;
+    color: var(--color-text-secondary);
+    text-decoration: none;
+    transition: all 0.15s ease;
+}
+
+.page-sub-nav a:hover,
+.page-sub-nav a.active {
+    background: var(--color-primary);
+    color: #fff;
+    border-color: var(--color-primary);
+}
+
+.page-sub-nav a:visited {
+    color: var(--color-text-secondary);
+}
+
+.page-sub-nav a:visited:hover,
+.page-sub-nav a:visited.active {
+    color: #fff;
+}
+
+/* ===== Hero Section ===== */
+.hero-section {
+    background: linear-gradient(135deg, #3a1517 0%, var(--color-navbar) 50%, #8b4547 100%);
+    color: #fff;
+    padding: 3rem 0;
+    margin-bottom: 2rem;
+    position: relative;
+    overflow: hidden;
+    text-align: left;
+}
+
+.hero-section::before {
+    content: "";
+    position: absolute;
+    top: -50%;
+    right: -20%;
+    width: 60%;
+    height: 200%;
+    background: radial-gradient(ellipse, rgba(215, 167, 115, 0.12), transparent 70%);
+    pointer-events: none;
+}
+
+.hero-section h2 {
+    font-size: 2rem;
+    font-weight: 700;
+    letter-spacing: -1px;
+    margin: 0 0 0.5rem;
+    color: #fff;
+    text-align: left;
+    position: relative;
+}
+
+.hero-section p {
+    color: rgba(255, 255, 255, 0.85);
+    font-size: 1.05rem;
+    margin: 0;
+    text-align: left;
+    position: relative;
+}
+
+.hero-cta {
+    display: flex;
+    gap: 0.75rem;
+    margin-top: 1.25rem;
+    position: relative;
+}
+
+.hero-cta .btn {
+    font-weight: 600;
+    padding: 0.5rem 1.5rem;
+    border-radius: var(--radius-md);
+}
+
+.btn-hero-primary {
+    background: var(--color-accent);
+    color: #112a46;
+    border: none;
+    text-decoration: none;
+}
+
+.btn-hero-primary:hover {
+    background: #e8c49a;
+    color: #112a46;
+    text-decoration: none;
+}
+
+.btn-hero-secondary {
+    background: rgba(255, 255, 255, 0.1);
+    color: #fff;
+    border: 1px solid rgba(255, 255, 255, 0.6);
+    text-decoration: none;
+}
+
+.btn-hero-secondary:hover {
+    background: rgba(255, 255, 255, 0.2);
+    color: #fff;
+    border-color: rgba(255, 255, 255, 0.9);
+    text-decoration: none;
+}
+
+a.btn-hero-primary,
+a.btn-hero-primary:visited,
+a.btn-hero-primary:hover,
+a.btn-hero-secondary,
+a.btn-hero-secondary:visited,
+a.btn-hero-secondary:hover {
+    color: inherit;
+    text-decoration: none;
+}
+
+a.btn-hero-primary,
+a.btn-hero-primary:visited {
+    color: #112a46;
+}
+
+a.btn-hero-secondary,
+a.btn-hero-secondary:visited {
+    color: #fff;
+}
+
+/* ===== Section Header ===== */
+.section-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: baseline;
+    border-bottom: 2px solid var(--color-primary);
+    padding-bottom: 0.5rem;
+    margin-bottom: 1.25rem;
+}
+
+.section-header h3 {
+    font-size: 1.3rem;
+    font-weight: 600;
+    color: var(--color-text);
+    margin: 0;
+}
+
+/* ===== Main Content Wrapper ===== */
+.main-content {
+    min-height: calc(100vh - 136px);
+}
+
+.main-content-no-nav {
+    margin-top: -56px;
+    padding-top: 0;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+}
+
+.login-form-container,
+.login-form-container form,
+.login-form-container div:not(.alert):not(.alert *) {
+    background: transparent !important;
+    border: none;
+    box-shadow: none;
+}
+
+.login-form-container .form-control {
+    background: rgba(255, 255, 255, 0.75);
+    border: 1px solid rgba(0, 0, 0, 0.15);
+}
+
+.login-form-container .alert-warning {
+    background: #fff3cd !important;
+    border: 1px solid #ffc107 !important;
+    border-radius: var(--radius-md);
+    color: #664d03;
+    padding: 1rem 1.25rem;
+    font-size: 0.9rem;
+}
+
+.login-form-container .alert-warning .text-wrap {
+    background: transparent !important;
+    color: #664d03;
+    font-size: 0.85rem;
+    margin-top: 0.25rem;
+}
+
+/* ===== Workflow Catalog ===== */
+.workflow-card {
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    padding: 1.25rem;
+    background: #fff;
+    transition: transform 0.2s ease, box-shadow 0.2s ease, border-color 0.2s ease;
+    width: auto;
+    height: 100%;
+}
+
+.workflow-card:hover {
+    transform: translateY(-2px);
+    box-shadow: var(--shadow-md);
+    border-color: var(--color-primary);
+}
+
+.workflow-card .card-title {
+    font-weight: 600;
+    font-size: 1.05rem;
+    color: var(--color-text);
+}
+
+.workflow-card .card-text {
+    font-size: 0.88rem;
+    color: var(--color-text-secondary);
+}
+
+.workflow-card .badge {
+    font-size: 0.7rem;
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+}
+
+.badge-provisioning {
+    background-color: var(--color-primary);
+    color: #fff;
+}
+
+.badge-observability {
+    background-color: var(--color-accent-light);
+    color: #fff;
+}
+
+.badge-extensions {
+    background-color: var(--color-navbar);
+    color: #fff;
+}
+
+.workflow-detail-sidebar {
+    background: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-lg);
+    padding: 1.5rem;
+}
+
+.workflow-detail-sidebar dt {
+    font-size: 0.7rem;
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--color-text-muted);
+    margin-top: 1rem;
+}
+
+.workflow-detail-sidebar dd {
+    font-size: 0.88rem;
+    color: var(--color-text);
+}
+
+.filter-btn {
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-pill);
+    padding: 0.3rem 0.9rem;
+    font-size: 0.82rem;
+    font-weight: 500;
+    background: #fff;
+    color: var(--color-text-secondary);
+    cursor: pointer;
+    transition: all 0.15s ease;
+}
+
+.filter-btn:hover,
+.filter-btn.active {
+    background: var(--color-primary);
+    color: #fff;
+    border-color: var(--color-primary);
+}
+
+/* ===== Navbar Search ===== */
+.search-input {
+    background: rgba(255, 255, 255, 0.12);
+    border: 1px solid rgba(255, 255, 255, 0.2);
+    border-radius: var(--radius-pill);
+    color: #fff;
+    font-size: 0.85rem;
+    padding: 0.3rem 0.75rem;
+    width: 220px;
+    transition: width 0.3s ease, border-color 0.2s ease, background 0.2s ease;
+}
+
+.search-input::placeholder {
+    color: rgba(255, 255, 255, 0.5);
+}
+
+.search-input:focus {
+    width: 300px;
+    outline: none;
+    border-color: var(--color-accent);
+    background: rgba(255, 255, 255, 0.18);
+    box-shadow: 0 0 0 2px rgba(215, 167, 115, 0.3);
+}
+
+.search-dropdown {
+    position: fixed;
+    top: 56px;
+    right: 1rem;
+    width: 380px;
+    max-height: 400px;
+    overflow-y: auto;
+    background: #fff;
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    box-shadow: var(--shadow-lg);
+    z-index: 10000;
+    display: none;
+}
+
+.search-result-item {
+    display: block;
+    padding: 0.5rem 0.75rem;
+    font-size: 0.85rem;
+    color: var(--color-text);
+    text-decoration: none;
+    border-bottom: 1px solid var(--color-surface-raised);
+    transition: background 0.1s ease;
+}
+
+.search-result-item:hover {
+    background: var(--color-surface);
+}
+
+.search-result-title {
+    padding: 0.4rem 0.75rem;
+    font-weight: 600;
+    font-size: 0.88rem;
+    border-bottom: 1px solid var(--color-border);
+}
+
+/* ===== Navbar Extras Dropdown ===== */
+.navbar .dropdown-menu {
+    background: var(--color-surface);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    box-shadow: var(--shadow-md);
+    padding: 0.25rem 0;
+    min-width: 180px;
+}
+
+.navbar .dropdown-menu .dropdown-item {
+    color: var(--color-text);
+    font-size: 0.88rem;
+    padding: 0.4rem 1rem;
+}
+
+.navbar .dropdown-menu .dropdown-item:hover {
+    background: var(--color-surface-hover);
+    color: var(--color-text);
+}
+
+.navbar .dropdown-menu .dropdown-divider {
+    border-color: var(--color-border);
+}
diff --git a/static/css/nav.css b/static/css/nav.css
deleted file mode 100644
index 65a09e8..0000000
--- a/static/css/nav.css
+++ /dev/null
@@ -1,118 +0,0 @@
-
-.navbar {
-    z-index: 9999;
-    border-radius: 0px;
-    padding-bottom: 10px;
-    max-width: 100vw;
-}
-
-.navbar-inverse .navbar-collapse, .navbar-inverse .navbar-form {
-    border-color: #02377c;
-
-    color: white;
-}
-
-.navbar-inverse {
-    background-color: #6A2F30;
-    border-color: #0067a3;
-}
-
-.navbar-inverse .navbar-nav > .active > a, .navbar-inverse .navbar-nav > .active > a:hover, .navbar-inverse .navbar-nav > .active > a:focus {
-    color: #fff;
-    background-color: #024bbf;
-}
-
-.navbar-inverse .navbar-brand,
-.navbar-inverse .navbar-nav > li > a {
-    color: #fff;
-    text-align: center;
-}
-
-.navbar-inverse .navbar-brand:hover {
-    text-decoration: underline;
-}
-
-.navbar-inverse .navbar-toggle {
-    border-color: #eee;
-}
-
-.navbar {
-    margin-bottom: 0px;
-}
-
-
-.navbar-brand img {
-    width: 65px;
-    /*margin-left: 60px;*/
-}
-
-.navbar-inverse .navbar-toggle {
-    margin-top: 5px;
-}
-
-.navbar-nav li {
-    /*margin-top: 20px;*/
-}
-
-#last_nav_link {
-    margin-right: 0px;
-}
-
-nav {
-    padding: 10px;
-    font-size: 17px;
-    color: white;
-    /*height: 85px;*/
-    background-color: #6A2F30;
-}
-
-nav > a {
-    color: white;
-    margin-right: 10px;
-}
-
-.nav-expand-line {
-    height: 2px;
-    margin: 6px;
-    background-color: white;
-}
-
-#navbarSupportedContent {
-    background-color: #6A2F30;
-    padding: 10px;
-}
-
-.footer {
-    padding: 10px;
-    font-size: 17px;
-    text-align: center;
-    color: white;
-    /*height: 85px;*/
-    background-color: #6A2F30;
-}
-
-.footer p {
-    margin-top: 30px;
-}
-
-.article {
-    padding-top: 40px;
-}
-
-.stat {
-    display: inline-block;
-    min-width: 30vw;
-    padding: 2px;
-    font-size: 16px;
-    color: #FFFFFF;
-}
-
-.nav a {
-    color: #422f32;
-    text-decoration: underline;
-}
-
-.nav a:visited {
-    color: #FFFFFF;
-    text-decoration: underline;
-}
diff --git a/static/css/site.css b/static/css/site.css
deleted file mode 100644
index 0131386..0000000
--- a/static/css/site.css
+++ /dev/null
@@ -1,182 +0,0 @@
-.title {
-    font-weight: bold;
-}
-
-.main_content {
-    margin: 0px;
-    background-color: #fff;
-    padding: 0px 0px 50px;
-}
-
-nav {
-    background-color: #0073b7;
-    padding: 10px;
-    font-size: 20px;
-    color: white;
-    height: 65px;
-}
-
-nav > a {
-    color: white;
-    margin-right: 10px;
-}
-
-.test-links {
-    text-align: center;
-    border-bottom: 1px solid #d3d3d3;
-    border-top: 1px solid #d3d3d3;
-    margin-bottom: 0px;
-}
-
-.test-links .stat {
-    display: inline-block;
-    min-width: 30vw;
-    padding: 2px;
-    font-size: 16px;
-    color: #003d61;
-
-}
-
-.test-links .stat a {
-    color: #FFFFFF;
-}
-
-.test-links .stat a:visited {
-    color: #ffffff;
-}
-
-.project-list .subtitle {
-    font-style: italic;
-
-}
-
-.project-list h2 {
-    font-size: 24px;
-    font-weight: bold;
-}
-
-.project-list .project {
-    border: 1px solid #d3d3d3;
-    padding: 10px;
-    background-color: #2c2c2c;
-    min-height: 45px;
-    margin-top: 15px;
-    color: black;
-    margin-bottom: 15px;
-}
-
-.project-list .project .title {
-    font-size: 20px;
-}
-
-.project-list .project a {
-    color: #006dad;
-}
-
-.project-list .project .desc {
-    font-weight: normal;
-    font-size: 16;
-    font-style: italic;
-}
-
-footer {
-    padding: 10px;
-    font-size: 17px;
-    color: white;
-    /*height: 85px;*/
-    background-color: #6A2F30;
-    /*box-shadow: 0 50vh 0 50vh #6b7078;*/
-}
-
-footer a {
-    color: #2495f2;
-}
-
-.test-links-bottom {
-    background-color: #d7a773f6;
-    padding: 10px 0px;
-    text-align: center;
-    border-bottom: 1px solid #d3d3d3;
-    border-top: 1px solid #d3d3d3;
-    margin-top: 30px;
-}
-
-
-.confirm-delete-box {
-    margin-top: auto;
-    margin-left: auto;
-    margin-right: auto;
-    max-width: 2000px;
-    text-align: center;
-    background-color: #d7a773f6;
-    border: 1px #aa845a;
-    border-radius: 55px;
-    padding: 10px;
-}
-
-.log-view {
-    max-width: 100vw;
-    margin-top: 0;
-    margin-left: 1vh;
-    margin-right: 1vh;
-    text-after-overflow: left;
-    text-align-all: left;
-    background-color: #d7a773f6;
-    border: 1px #aa845a;
-    border-radius: 8px;
-    padding: 10px;
-}
-
-.log-frame {
-    max-height: 65vh;
-}
-
-.log-form {
-    margin-top: 0;
-    margin-left: auto;
-    margin-right: auto;
-    background-color: #d7a773f6;
-    border: 1px #aa845a;
-    border-radius: 5px;
-    padding: 10px;
-}
-
-.log-background {
-    background-color: #d7a773f6;
-    border: 1px #aa845a;
-}
-
-.download-button {
-    margin-top: auto;
-    margin-left: auto;
-    margin-right: auto;
-    text-align: center;
-    background-color: #d7a773f6;
-    padding-top: 15px;
-    padding-bottom: 15px;
-}
-
-.sub_links {
-    padding-top: 66px;
-    background-color: #d7a773f6;
-
-@media (max-width: 979px) {
-    body {
-        padding-top: 0px;
-    }
-}
-
-.sub_links.affix {
-    position: fixed;
-    top: 0;
-    width: 100%;
-    z-index: 10;
-}
-
-#upload {
-    display: none
-}
-
-#upload_link {
-    text-decoration: none;
-}
\ No newline at end of file
diff --git a/static/jQuery.js b/static/jQuery.js
deleted file mode 100644
index 07c00cd..0000000
--- a/static/jQuery.js
+++ /dev/null
@@ -1,2 +0,0 @@
-/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */
-!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var f="3.4.1",k=function(e,t){return new k.fn.init(e,t)},p=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g;function d(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n||0===t||"number"==typeof t&&0<t&&t-1 in e)}k.fn=k.prototype={jquery:f,constructor:k,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=k.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return k.each(this,e)},map:function(n){return this.pushStack(k.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject||this.constructor()},push:u,sort:t.sort,splice:t.splice},k.extend=k.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]||{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]||{},s++),"object"==typeof a||m(a)||(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(k.isPlainObject(r)||(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i||k.isPlainObject(n)?n:{},i=!1,a[t]=k.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},k.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e||"[object Object]"!==o.call(e))&&(!(t=r(e))||"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t){b(e,{nonce:t&&t.nonce})},each:function(e,t){var n,r=0;if(d(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},trim:function(e){return null==e?"":(e+"").replace(p,"")},makeArray:function(e,t){var n=t||[];return null!=e&&(d(Object(e))?k.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(d(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g.apply([],a)},guid:1,support:y}),"function"==typeof Symbol&&(k.fn[Symbol.iterator]=t[Symbol.iterator]),k.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var h=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,k="sizzle"+1*new Date,m=n.document,S=0,r=0,p=ue(),x=ue(),N=ue(),A=ue(),D=function(e,t){return e===t&&(l=!0),0},j={}.hasOwnProperty,t=[],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",M="[\\x20\\t\\r\\n\\f]",I="(?:\\\\.|[\\w-]|[^\0-\\xa0])+",W="\\["+M+"*("+I+")(?:"+M+"*([*^$|!~]?=)"+M+"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|("+I+"))|)"+M+"*\\]",$=":("+I+")(?:\\((('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|((?:\\\\.|[^\\\\()[\\]]|"+W+")*)|.*)\\)|)",F=new RegExp(M+"+","g"),B=new RegExp("^"+M+"+|((?:^|[^\\\\])(?:\\\\.)*)"+M+"+$","g"),_=new RegExp("^"+M+"*,"+M+"*"),z=new RegExp("^"+M+"*([>+~]|"+M+")"+M+"*"),U=new RegExp(M+"|>"),X=new RegExp($),V=new RegExp("^"+I+"$"),G={ID:new RegExp("^#("+I+")"),CLASS:new RegExp("^\\.("+I+")"),TAG:new RegExp("^("+I+"|[*])"),ATTR:new RegExp("^"+W),PSEUDO:new RegExp("^"+$),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+M+"*(even|odd|(([+-]|)(\\d*)n|)"+M+"*(?:([+-]|)"+M+"*(\\d+)|))"+M+"*\\)|)","i"),bool:new RegExp("^(?:"+R+")$","i"),needsContext:new RegExp("^"+M+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+M+"*((?:-\\d)?\\d*)"+M+"*\\)|)(?=[^-]|$)","i")},Y=/HTML$/i,Q=/^(?:input|select|textarea|button)$/i,J=/^h\d$/i,K=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ee=/[+~]/,te=new RegExp("\\\\([\\da-f]{1,6}"+M+"?|("+M+")|.)","ig"),ne=function(e,t,n){var r="0x"+t-65536;return r!=r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},re=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ie=function(e,t){return t?"\0"===e?"\ufffd":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},oe=function(){T()},ae=be(function(e){return!0===e.disabled&&"fieldset"===e.nodeName.toLowerCase()},{dir:"parentNode",next:"legend"});try{H.apply(t=O.call(m.childNodes),m.childNodes),t[m.childNodes.length].nodeType}catch(e){H={apply:t.length?function(e,t){L.apply(e,O.call(t))}:function(e,t){var n=e.length,r=0;while(e[n++]=t[r++]);e.length=n-1}}}function se(t,e,n,r){var i,o,a,s,u,l,c,f=e&&e.ownerDocument,p=e?e.nodeType:9;if(n=n||[],"string"!=typeof t||!t||1!==p&&9!==p&&11!==p)return n;if(!r&&((e?e.ownerDocument||e:m)!==C&&T(e),e=e||C,E)){if(11!==p&&(u=Z.exec(t)))if(i=u[1]){if(9===p){if(!(a=e.getElementById(i)))return n;if(a.id===i)return n.push(a),n}else if(f&&(a=f.getElementById(i))&&y(e,a)&&a.id===i)return n.push(a),n}else{if(u[2])return H.apply(n,e.getElementsByTagName(t)),n;if((i=u[3])&&d.getElementsByClassName&&e.getElementsByClassName)return H.apply(n,e.getElementsByClassName(i)),n}if(d.qsa&&!A[t+" "]&&(!v||!v.test(t))&&(1!==p||"object"!==e.nodeName.toLowerCase())){if(c=t,f=e,1===p&&U.test(t)){(s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=k),o=(l=h(t)).length;while(o--)l[o]="#"+s+" "+xe(l[o]);c=l.join(","),f=ee.test(t)&&ye(e.parentNode)||e}try{return H.apply(n,f.querySelectorAll(c)),n}catch(e){A(t,!0)}finally{s===k&&e.removeAttribute("id")}}}return g(t.replace(B,"$1"),e,n,r)}function ue(){var r=[];return function e(t,n){return r.push(t+" ")>b.cacheLength&&delete e[r.shift()],e[t+" "]=n}}function le(e){return e[k]=!0,e}function ce(e){var t=C.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function fe(e,t){var n=e.split("|"),r=n.length;while(r--)b.attrHandle[n[r]]=t}function pe(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function de(t){return function(e){return"input"===e.nodeName.toLowerCase()&&e.type===t}}function he(n){return function(e){var t=e.nodeName.toLowerCase();return("input"===t||"button"===t)&&e.type===n}}function ge(t){return function(e){return"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disabled===t:e.isDisabled===t||e.isDisabled!==!t&&ae(e)===t:e.disabled===t:"label"in e&&e.disabled===t}}function ve(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e.namespaceURI,n=(e.ownerDocument||e).documentElement;return!Y.test(t||n&&n.nodeName||"HTML")},T=se.setDocument=function(e){var t,n,r=e?e.ownerDocument||e:m;return r!==C&&9===r.nodeType&&r.documentElement&&(a=(C=r).documentElement,E=!i(C),m!==C&&(n=C.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",oe,!1):n.attachEvent&&n.attachEvent("onunload",oe)),d.attributes=ce(function(e){return e.className="i",!e.getAttribute("className")}),d.getElementsByTagName=ce(function(e){return e.appendChild(C.createComment("")),!e.getElementsByTagName("*").length}),d.getElementsByClassName=K.test(C.getElementsByClassName),d.getById=ce(function(e){return a.appendChild(e).id=k,!C.getElementsByName||!C.getElementsByName(k).length}),d.getById?(b.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return e.getAttribute("id")===t}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n=t.getElementById(e);return n?[n]:[]}}):(b.filter.ID=function(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((n=o.getAttributeNode("id"))&&n.value===e)return[o];i=t.getElementsByName(e),r=0;while(o=i[r++])if((n=o.getAttributeNode("id"))&&n.value===e)return[o]}return[]}}),b.find.TAG=d.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):d.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){while(n=o[i++])1===n.nodeType&&r.push(n);return r}return o},b.find.CLASS=d.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&E)return t.getElementsByClassName(e)},s=[],v=[],(d.qsa=K.test(C.querySelectorAll))&&(ce(function(e){a.appendChild(e).innerHTML="<a id='"+k+"'></a><select id='"+k+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&v.push("[*^$]="+M+"*(?:''|\"\")"),e.querySelectorAll("[selected]").length||v.push("\\["+M+"*(?:value|"+R+")"),e.querySelectorAll("[id~="+k+"-]").length||v.push("~="),e.querySelectorAll(":checked").length||v.push(":checked"),e.querySelectorAll("a#"+k+"+*").length||v.push(".#.+[+~]")}),ce(function(e){e.innerHTML="<a href='' disabled='disabled'></a><select disabled='disabled'><option/></select>";var t=C.createElement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&v.push("name"+M+"*[*^$|!~]?="),2!==e.querySelectorAll(":enabled").length&&v.push(":enabled",":disabled"),a.appendChild(e).disabled=!0,2!==e.querySelectorAll(":disabled").length&&v.push(":enabled",":disabled"),e.querySelectorAll("*,:x"),v.push(",.*:")})),(d.matchesSelector=K.test(c=a.matches||a.webkitMatchesSelector||a.mozMatchesSelector||a.oMatchesSelector||a.msMatchesSelector))&&ce(function(e){d.disconnectedMatch=c.call(e,"*"),c.call(e,"[s!='']:x"),s.push("!=",$)}),v=v.length&&new RegExp(v.join("|")),s=s.length&&new RegExp(s.join("|")),t=K.test(a.compareDocumentPosition),y=t||K.test(a.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return l=!0,0;var n=!e.compareDocumentPosition-!t.compareDocumentPosition;return n||(1&(n=(e.ownerDocument||e)===(t.ownerDocument||t)?e.compareDocumentPosition(t):1)||!d.sortDetached&&t.compareDocumentPosition(e)===n?e===C||e.ownerDocument===m&&y(m,e)?-1:t===C||t.ownerDocument===m&&y(m,t)?1:u?P(u,e)-P(u,t):0:4&n?-1:1)}:function(e,t){if(e===t)return l=!0,0;var n,r=0,i=e.parentNode,o=t.parentNode,a=[e],s=[t];if(!i||!o)return e===C?-1:t===C?1:i?-1:o?1:u?P(u,e)-P(u,t):0;if(i===o)return pe(e,t);n=e;while(n=n.parentNode)a.unshift(n);n=t;while(n=n.parentNode)s.unshift(n);while(a[r]===s[r])r++;return r?pe(a[r],s[r]):a[r]===m?-1:s[r]===m?1:0}),C},se.matches=function(e,t){return se(e,null,null,t)},se.matchesSelector=function(e,t){if((e.ownerDocument||e)!==C&&T(e),d.matchesSelector&&E&&!A[t+" "]&&(!s||!s.test(t))&&(!v||!v.test(t)))try{var n=c.call(e,t);if(n||d.disconnectedMatch||e.document&&11!==e.document.nodeType)return n}catch(e){A(t,!0)}return 0<se(t,C,null,[e]).length},se.contains=function(e,t){return(e.ownerDocument||e)!==C&&T(e),y(e,t)},se.attr=function(e,t){(e.ownerDocument||e)!==C&&T(e);var n=b.attrHandle[t.toLowerCase()],r=n&&j.call(b.attrHandle,t.toLowerCase())?n(e,t,!E):void 0;return void 0!==r?r:d.attributes||!E?e.getAttribute(t):(r=e.getAttributeNode(t))&&r.specified?r.value:null},se.escape=function(e){return(e+"").replace(re,ie)},se.error=function(e){throw new Error("Syntax error, unrecognized expression: "+e)},se.uniqueSort=function(e){var t,n=[],r=0,i=0;if(l=!d.detectDuplicates,u=!d.sortStable&&e.slice(0),e.sort(D),l){while(t=e[i++])t===e[i]&&(r=n.push(i));while(r--)e.splice(n[r],1)}return u=null,e},o=se.getText=function(e){var t,n="",r=0,i=e.nodeType;if(i){if(1===i||9===i||11===i){if("string"==typeof e.textContent)return e.textContent;for(e=e.firstChild;e;e=e.nextSibling)n+=o(e)}else if(3===i||4===i)return e.nodeValue}else while(t=e[r++])n+=o(t);return n},(b=se.selectors={cacheLength:50,createPseudo:le,match:G,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(e){return e[1]=e[1].replace(te,ne),e[3]=(e[3]||e[4]||e[5]||"").replace(te,ne),"~="===e[2]&&(e[3]=" "+e[3]+" "),e.slice(0,4)},CHILD:function(e){return e[1]=e[1].toLowerCase(),"nth"===e[1].slice(0,3)?(e[3]||se.error(e[0]),e[4]=+(e[4]?e[5]+(e[6]||1):2*("even"===e[3]||"odd"===e[3])),e[5]=+(e[7]+e[8]||"odd"===e[3])):e[3]&&se.error(e[0]),e},PSEUDO:function(e){var t,n=!e[6]&&e[2];return G.CHILD.test(e[0])?null:(e[3]?e[2]=e[4]||e[5]||"":n&&X.test(n)&&(t=h(n,!0))&&(t=n.indexOf(")",n.length-t)-n.length)&&(e[0]=e[0].slice(0,t),e[2]=n.slice(0,t)),e.slice(0,3))}},filter:{TAG:function(e){var t=e.replace(te,ne).toLowerCase();return"*"===e?function(){return!0}:function(e){return e.nodeName&&e.nodeName.toLowerCase()===t}},CLASS:function(e){var t=p[e+" "];return t||(t=new RegExp("(^|"+M+")"+e+"("+M+"|$)"))&&p(e,function(e){return t.test("string"==typeof e.className&&e.className||"undefined"!=typeof e.getAttribute&&e.getAttribute("class")||"")})},ATTR:function(n,r,i){return function(e){var t=se.attr(e,n);return null==t?"!="===r:!r||(t+="","="===r?t===i:"!="===r?t!==i:"^="===r?i&&0===t.indexOf(i):"*="===r?i&&-1<t.indexOf(i):"$="===r?i&&t.slice(-i.length)===i:"~="===r?-1<(" "+t.replace(F," ")+" ").indexOf(i):"|="===r&&(t===i||t.slice(0,i.length+1)===i+"-"))}},CHILD:function(h,e,t,g,v){var y="nth"!==h.slice(0,3),m="last"!==h.slice(-4),x="of-type"===e;return 1===g&&0===v?function(e){return!!e.parentNode}:function(e,t,n){var r,i,o,a,s,u,l=y!==m?"nextSibling":"previousSibling",c=e.parentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[k]||(a[k]={}))[a.uniqueID]||(o[a.uniqueID]={}))[h]||[])[0]===S&&r[1])&&r[2],a=s&&c.childNodes[s];while(a=++s&&a&&a[l]||(d=s=0)||u.pop())if(1===a.nodeType&&++d&&a===e){i[h]=[S,s,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[k]||(a[k]={}))[a.uniqueID]||(o[a.uniqueID]={}))[h]||[])[0]===S&&r[1]),!1===d)while(a=++s&&a&&a[l]||(d=s=0)||u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[k]||(a[k]={}))[a.uniqueID]||(o[a.uniqueID]={}))[h]=[S,d]),a===e))break;return(d-=v)===g||d%g==0&&0<=d/g}}},PSEUDO:function(e,o){var t,a=b.pseudos[e]||b.setFilters[e.toLowerCase()]||se.error("unsupported pseudo: "+e);return a[k]?a(o):1<a.length?(t=[e,e,"",o],b.setFilters.hasOwnProperty(e.toLowerCase())?le(function(e,t){var n,r=a(e,o),i=r.length;while(i--)e[n=P(e,r[i])]=!(t[n]=r[i])}):function(e){return a(e,0,t)}):a}},pseudos:{not:le(function(e){var r=[],i=[],s=f(e.replace(B,"$1"));return s[k]?le(function(e,t,n,r){var i,o=s(e,null,r,[]),a=e.length;while(a--)(i=o[a])&&(e[a]=!(t[a]=i))}):function(e,t,n){return r[0]=e,s(r,null,n,i),r[0]=null,!i.pop()}}),has:le(function(t){return function(e){return 0<se(t,e).length}}),contains:le(function(t){return t=t.replace(te,ne),function(e){return-1<(e.textContent||o(e)).indexOf(t)}}),lang:le(function(n){return V.test(n||"")||se.error("unsupported lang: "+n),n=n.replace(te,ne).toLowerCase(),function(e){var t;do{if(t=E?e.lang:e.getAttribute("xml:lang")||e.getAttribute("lang"))return(t=t.toLowerCase())===n||0===t.indexOf(n+"-")}while((e=e.parentNode)&&1===e.nodeType);return!1}}),target:function(e){var t=n.location&&n.location.hash;return t&&t.slice(1)===e.id},root:function(e){return e===a},focus:function(e){return e===C.activeElement&&(!C.hasFocus||C.hasFocus())&&!!(e.type||e.href||~e.tabIndex)},enabled:ge(!1),disabled:ge(!0),checked:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&!!e.checked||"option"===t&&!!e.selected},selected:function(e){return e.parentNode&&e.parentNode.selectedIndex,!0===e.selected},empty:function(e){for(e=e.firstChild;e;e=e.nextSibling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!b.pseudos.empty(e)},header:function(e){return J.test(e.nodeName)},input:function(e){return Q.test(e.nodeName)},button:function(e){var t=e.nodeName.toLowerCase();return"input"===t&&"button"===e.type||"button"===t},text:function(e){var t;return"input"===e.nodeName.toLowerCase()&&"text"===e.type&&(null==(t=e.getAttribute("type"))||"text"===t.toLowerCase())},first:ve(function(){return[0]}),last:ve(function(e,t){return[t-1]}),eq:ve(function(e,t,n){return[n<0?n+t:n]}),even:ve(function(e,t){for(var n=0;n<t;n+=2)e.push(n);return e}),odd:ve(function(e,t){for(var n=1;n<t;n+=2)e.push(n);return e}),lt:ve(function(e,t,n){for(var r=n<0?n+t:t<n?t:n;0<=--r;)e.push(r);return e}),gt:ve(function(e,t,n){for(var r=n<0?n+t:n;++r<t;)e.push(r);return e})}}).pseudos.nth=b.pseudos.eq,{radio:!0,checkbox:!0,file:!0,password:!0,image:!0})b.pseudos[e]=de(e);for(e in{submit:!0,reset:!0})b.pseudos[e]=he(e);function me(){}function xe(e){for(var t=0,n=e.length,r="";t<n;t++)r+=e[t].value;return r}function be(s,e,t){var u=e.dir,l=e.next,c=l||u,f=t&&"parentNode"===c,p=r++;return e.first?function(e,t,n){while(e=e[u])if(1===e.nodeType||f)return s(e,t,n);return!1}:function(e,t,n){var r,i,o,a=[S,p];if(n){while(e=e[u])if((1===e.nodeType||f)&&s(e,t,n))return!0}else while(e=e[u])if(1===e.nodeType||f)if(i=(o=e[k]||(e[k]={}))[e.uniqueID]||(o[e.uniqueID]={}),l&&l===e.nodeName.toLowerCase())e=e[u]||e;else{if((r=i[c])&&r[0]===S&&r[1]===p)return a[2]=r[2];if((i[c]=a)[2]=s(e,t,n))return!0}return!1}}function we(i){return 1<i.length?function(e,t,n){var r=i.length;while(r--)if(!i[r](e,t,n))return!1;return!0}:i[0]}function Te(e,t,n,r,i){for(var o,a=[],s=0,u=e.length,l=null!=t;s<u;s++)(o=e[s])&&(n&&!n(o,r,i)||(a.push(o),l&&t.push(s)));return a}function Ce(d,h,g,v,y,e){return v&&!v[k]&&(v=Ce(v)),y&&!y[k]&&(y=Ce(y,e)),le(function(e,t,n,r){var i,o,a,s=[],u=[],l=t.length,c=e||function(e,t,n){for(var r=0,i=t.length;r<i;r++)se(e,t[r],n);return n}(h||"*",n.nodeType?[n]:n,[]),f=!d||!e&&h?c:Te(c,s,d,n,r),p=g?y||(e?d:l||v)?[]:t:f;if(g&&g(f,p,n,r),v){i=Te(p,u),v(i,[],n,r),o=i.length;while(o--)(a=i[o])&&(p[u[o]]=!(f[u[o]]=a))}if(e){if(y||d){if(y){i=[],o=p.length;while(o--)(a=p[o])&&i.push(f[o]=a);y(null,p=[],i,r)}o=p.length;while(o--)(a=p[o])&&-1<(i=y?P(e,a):s[o])&&(e[i]=!(t[i]=a))}}else p=Te(p===t?p.splice(l,p.length):p),y?y(null,t,p,r):H.apply(t,p)})}function Ee(e){for(var i,t,n,r=e.length,o=b.relative[e[0].type],a=o||b.relative[" "],s=o?1:0,u=be(function(e){return e===i},a,!0),l=be(function(e){return-1<P(i,e)},a,!0),c=[function(e,t,n){var r=!o&&(n||t!==w)||((i=t).nodeType?u(e,t,n):l(e,t,n));return i=null,r}];s<r;s++)if(t=b.relative[e[s].type])c=[be(we(c),t)];else{if((t=b.filter[e[s].type].apply(null,e[s].matches))[k]){for(n=++s;n<r;n++)if(b.relative[e[n].type])break;return Ce(1<s&&we(c),1<s&&xe(e.slice(0,s-1).concat({value:" "===e[s-2].type?"*":""})).replace(B,"$1"),t,s<n&&Ee(e.slice(s,n)),n<r&&Ee(e=e.slice(n)),n<r&&xe(e))}c.push(t)}return we(c)}return me.prototype=b.filters=b.pseudos,b.setFilters=new me,h=se.tokenize=function(e,t){var n,r,i,o,a,s,u,l=x[e+" "];if(l)return t?0:l.slice(0);a=e,s=[],u=b.preFilter;while(a){for(o in n&&!(r=_.exec(a))||(r&&(a=a.slice(r[0].length)||a),s.push(i=[])),n=!1,(r=z.exec(a))&&(n=r.shift(),i.push({value:n,type:r[0].replace(B," ")}),a=a.slice(n.length)),b.filter)!(r=G[o].exec(a))||u[o]&&!(r=u[o](r))||(n=r.shift(),i.push({value:n,type:o,matches:r}),a=a.slice(n.length));if(!n)break}return t?a.length:a?se.error(e):x(e,s).slice(0)},f=se.compile=function(e,t){var n,v,y,m,x,r,i=[],o=[],a=N[e+" "];if(!a){t||(t=h(e)),n=t.length;while(n--)(a=Ee(t[n]))[k]?i.push(a):o.push(a);(a=N(e,(v=o,m=0<(y=i).length,x=0<v.length,r=function(e,t,n,r,i){var o,a,s,u=0,l="0",c=e&&[],f=[],p=w,d=e||x&&b.find.TAG("*",i),h=S+=null==p?1:Math.random()||.1,g=d.length;for(i&&(w=t===C||t||i);l!==g&&null!=(o=d[l]);l++){if(x&&o){a=0,t||o.ownerDocument===C||(T(o),n=!E);while(s=v[a++])if(s(o,t||C,n)){r.push(o);break}i&&(S=h)}m&&((o=!s&&o)&&u--,e&&c.push(o))}if(u+=l,m&&l!==u){a=0;while(s=y[a++])s(c,f,t,n);if(e){if(0<u)while(l--)c[l]||f[l]||(f[l]=q.call(r));f=Te(f)}H.apply(r,f),i&&!e&&0<f.length&&1<u+y.length&&se.uniqueSort(r)}return i&&(S=h,w=p),c},m?le(r):r))).selector=e}return a},g=se.select=function(e,t,n,r){var i,o,a,s,u,l="function"==typeof e&&e,c=!r&&h(e=l.selector||e);if(n=n||[],1===c.length){if(2<(o=c[0]=c[0].slice(0)).length&&"ID"===(a=o[0]).type&&9===t.nodeType&&E&&b.relative[o[1].type]){if(!(t=(b.find.ID(a.matches[0].replace(te,ne),t)||[])[0]))return n;l&&(t=t.parentNode),e=e.slice(o.shift().value.length)}i=G.needsContext.test(e)?0:o.length;while(i--){if(a=o[i],b.relative[s=a.type])break;if((u=b.find[s])&&(r=u(a.matches[0].replace(te,ne),ee.test(o[0].type)&&ye(t.parentNode)||t))){if(o.splice(i,1),!(e=r.length&&xe(o)))return H.apply(n,r),n;break}}}return(l||f(e,c))(r,t,!E,n,!t||ee.test(e)&&ye(t.parentNode)||t),n},d.sortStable=k.split("").sort(D).join("")===k,d.detectDuplicates=!!l,T(),d.sortDetached=ce(function(e){return 1&e.compareDocumentPosition(C.createElement("fieldset"))}),ce(function(e){return e.innerHTML="<a href='#'></a>","#"===e.firstChild.getAttribute("href")})||fe("type|href|height|width",function(e,t,n){if(!n)return e.getAttribute(t,"type"===t.toLowerCase()?1:2)}),d.attributes&&ce(function(e){return e.innerHTML="<input/>",e.firstChild.setAttribute("value",""),""===e.firstChild.getAttribute("value")})||fe("value",function(e,t,n){if(!n&&"input"===e.nodeName.toLowerCase())return e.defaultValue}),ce(function(e){return null==e.getAttribute("disabled")})||fe(R,function(e,t,n){var r;if(!n)return!0===e[t]?t.toLowerCase():(r=e.getAttributeNode(t))&&r.specified?r.value:null}),se}(C);k.find=h,k.expr=h.selectors,k.expr[":"]=k.expr.pseudos,k.uniqueSort=k.unique=h.uniqueSort,k.text=h.getText,k.isXMLDoc=h.isXML,k.contains=h.contains,k.escapeSelector=h.escape;var T=function(e,t,n){var r=[],i=void 0!==n;while((e=e[t])&&9!==e.nodeType)if(1===e.nodeType){if(i&&k(e).is(n))break;r.push(e)}return r},S=function(e,t){for(var n=[];e;e=e.nextSibling)1===e.nodeType&&e!==t&&n.push(e);return n},N=k.expr.match.needsContext;function A(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}var D=/^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i;function j(e,n,r){return m(n)?k.grep(e,function(e,t){return!!n.call(e,t,e)!==r}):n.nodeType?k.grep(e,function(e){return e===n!==r}):"string"!=typeof n?k.grep(e,function(e){return-1<i.call(n,e)!==r}):k.filter(n,e,r)}k.filter=function(e,t,n){var r=t[0];return n&&(e=":not("+e+")"),1===t.length&&1===r.nodeType?k.find.matchesSelector(r,e)?[r]:[]:k.find.matches(e,k.grep(t,function(e){return 1===e.nodeType}))},k.fn.extend({find:function(e){var t,n,r=this.length,i=this;if("string"!=typeof e)return this.pushStack(k(e).filter(function(){for(t=0;t<r;t++)if(k.contains(i[t],this))return!0}));for(n=this.pushStack([]),t=0;t<r;t++)k.find(e,i[t],n);return 1<r?k.uniqueSort(n):n},filter:function(e){return this.pushStack(j(this,e||[],!1))},not:function(e){return this.pushStack(j(this,e||[],!0))},is:function(e){return!!j(this,"string"==typeof e&&N.test(e)?k(e):e||[],!1).length}});var q,L=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/;(k.fn.init=function(e,t,n){var r,i;if(!e)return this;if(n=n||q,"string"==typeof e){if(!(r="<"===e[0]&&">"===e[e.length-1]&&3<=e.length?[null,e,null]:L.exec(e))||!r[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(r[1]){if(t=t instanceof k?t[0]:t,k.merge(this,k.parseHTML(r[1],t&&t.nodeType?t.ownerDocument||t:E,!0)),D.test(r[1])&&k.isPlainObject(t))for(r in t)m(this[r])?this[r](t[r]):this.attr(r,t[r]);return this}return(i=E.getElementById(r[2]))&&(this[0]=i,this.length=1),this}return e.nodeType?(this[0]=e,this.length=1,this):m(e)?void 0!==n.ready?n.ready(e):e(k):k.makeArray(e,this)}).prototype=k.fn,q=k(E);var H=/^(?:parents|prev(?:Until|All))/,O={children:!0,contents:!0,next:!0,prev:!0};function P(e,t){while((e=e[t])&&1!==e.nodeType);return e}k.fn.extend({has:function(e){var t=k(e,this),n=t.length;return this.filter(function(){for(var e=0;e<n;e++)if(k.contains(this,t[e]))return!0})},closest:function(e,t){var n,r=0,i=this.length,o=[],a="string"!=typeof e&&k(e);if(!N.test(e))for(;r<i;r++)for(n=this[r];n&&n!==t;n=n.parentNode)if(n.nodeType<11&&(a?-1<a.index(n):1===n.nodeType&&k.find.matchesSelector(n,e))){o.push(n);break}return this.pushStack(1<o.length?k.uniqueSort(o):o)},index:function(e){return e?"string"==typeof e?i.call(k(e),this[0]):i.call(this,e.jquery?e[0]:e):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(e,t){return this.pushStack(k.uniqueSort(k.merge(this.get(),k(e,t))))},addBack:function(e){return this.add(null==e?this.prevObject:this.prevObject.filter(e))}}),k.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return T(e,"parentNode")},parentsUntil:function(e,t,n){return T(e,"parentNode",n)},next:function(e){return P(e,"nextSibling")},prev:function(e){return P(e,"previousSibling")},nextAll:function(e){return T(e,"nextSibling")},prevAll:function(e){return T(e,"previousSibling")},nextUntil:function(e,t,n){return T(e,"nextSibling",n)},prevUntil:function(e,t,n){return T(e,"previousSibling",n)},siblings:function(e){return S((e.parentNode||{}).firstChild,e)},children:function(e){return S(e.firstChild)},contents:function(e){return"undefined"!=typeof e.contentDocument?e.contentDocument:(A(e,"template")&&(e=e.content||e),k.merge([],e.childNodes))}},function(r,i){k.fn[r]=function(e,t){var n=k.map(this,i,e);return"Until"!==r.slice(-5)&&(t=e),t&&"string"==typeof t&&(n=k.filter(t,n)),1<this.length&&(O[r]||k.uniqueSort(n),H.test(r)&&n.reverse()),this.pushStack(n)}});var R=/[^\x20\t\r\n\f]+/g;function M(e){return e}function I(e){throw e}function W(e,t,n,r){var i;try{e&&m(i=e.promise)?i.call(e).done(t).fail(n):e&&m(i=e.then)?i.call(e,t,n):t.apply(void 0,[e].slice(r))}catch(e){n.apply(void 0,[e])}}k.Callbacks=function(r){var e,n;r="string"==typeof r?(e=r,n={},k.each(e.match(R)||[],function(e,t){n[t]=!0}),n):k.extend({},r);var i,t,o,a,s=[],u=[],l=-1,c=function(){for(a=a||r.once,o=i=!0;u.length;l=-1){t=u.shift();while(++l<s.length)!1===s[l].apply(t[0],t[1])&&r.stopOnFalse&&(l=s.length,t=!1)}r.memory||(t=!1),i=!1,a&&(s=t?[]:"")},f={add:function(){return s&&(t&&!i&&(l=s.length-1,u.push(t)),function n(e){k.each(e,function(e,t){m(t)?r.unique&&f.has(t)||s.push(t):t&&t.length&&"string"!==w(t)&&n(t)})}(arguments),t&&!i&&c()),this},remove:function(){return k.each(arguments,function(e,t){var n;while(-1<(n=k.inArray(t,s,n)))s.splice(n,1),n<=l&&l--}),this},has:function(e){return e?-1<k.inArray(e,s):0<s.length},empty:function(){return s&&(s=[]),this},disable:function(){return a=u=[],s=t="",this},disabled:function(){return!s},lock:function(){return a=u=[],t||i||(s=t=""),this},locked:function(){return!!a},fireWith:function(e,t){return a||(t=[e,(t=t||[]).slice?t.slice():t],u.push(t),i||c()),this},fire:function(){return f.fireWith(this,arguments),this},fired:function(){return!!o}};return f},k.extend({Deferred:function(e){var o=[["notify","progress",k.Callbacks("memory"),k.Callbacks("memory"),2],["resolve","done",k.Callbacks("once memory"),k.Callbacks("once memory"),0,"resolved"],["reject","fail",k.Callbacks("once memory"),k.Callbacks("once memory"),1,"rejected"]],i="pending",a={state:function(){return i},always:function(){return s.done(arguments).fail(arguments),this},"catch":function(e){return a.then(null,e)},pipe:function(){var i=arguments;return k.Deferred(function(r){k.each(o,function(e,t){var n=m(i[t[4]])&&i[t[4]];s[t[1]](function(){var e=n&&n.apply(this,arguments);e&&m(e.promise)?e.promise().progress(r.notify).done(r.resolve).fail(r.reject):r[t[0]+"With"](this,n?[e]:arguments)})}),i=null}).promise()},then:function(t,n,r){var u=0;function l(i,o,a,s){return function(){var n=this,r=arguments,e=function(){var e,t;if(!(i<u)){if((e=a.apply(n,r))===o.promise())throw new TypeError("Thenable self-resolution");t=e&&("object"==typeof e||"function"==typeof e)&&e.then,m(t)?s?t.call(e,l(u,o,M,s),l(u,o,I,s)):(u++,t.call(e,l(u,o,M,s),l(u,o,I,s),l(u,o,M,o.notifyWith))):(a!==M&&(n=void 0,r=[e]),(s||o.resolveWith)(n,r))}},t=s?e:function(){try{e()}catch(e){k.Deferred.exceptionHook&&k.Deferred.exceptionHook(e,t.stackTrace),u<=i+1&&(a!==I&&(n=void 0,r=[e]),o.rejectWith(n,r))}};i?t():(k.Deferred.getStackHook&&(t.stackTrace=k.Deferred.getStackHook()),C.setTimeout(t))}}return k.Deferred(function(e){o[0][3].add(l(0,e,m(r)?r:M,e.notifyWith)),o[1][3].add(l(0,e,m(t)?t:M)),o[2][3].add(l(0,e,m(n)?n:I))}).promise()},promise:function(e){return null!=e?k.extend(e,a):a}},s={};return k.each(o,function(e,t){var n=t[2],r=t[5];a[t[1]]=n.add,r&&n.add(function(){i=r},o[3-e][2].disable,o[3-e][3].disable,o[0][2].lock,o[0][3].lock),n.add(t[3].fire),s[t[0]]=function(){return s[t[0]+"With"](this===s?void 0:this,arguments),this},s[t[0]+"With"]=n.fireWith}),a.promise(s),e&&e.call(s,s),s},when:function(e){var n=arguments.length,t=n,r=Array(t),i=s.call(arguments),o=k.Deferred(),a=function(t){return function(e){r[t]=this,i[t]=1<arguments.length?s.call(arguments):e,--n||o.resolveWith(r,i)}};if(n<=1&&(W(e,o.done(a(t)).resolve,o.reject,!n),"pending"===o.state()||m(i[t]&&i[t].then)))return o.then();while(t--)W(i[t],a(t),o.reject);return o.promise()}});var $=/^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;k.Deferred.exceptionHook=function(e,t){C.console&&C.console.warn&&e&&$.test(e.name)&&C.console.warn("jQuery.Deferred exception: "+e.message,e.stack,t)},k.readyException=function(e){C.setTimeout(function(){throw e})};var F=k.Deferred();function B(){E.removeEventListener("DOMContentLoaded",B),C.removeEventListener("load",B),k.ready()}k.fn.ready=function(e){return F.then(e)["catch"](function(e){k.readyException(e)}),this},k.extend({isReady:!1,readyWait:1,ready:function(e){(!0===e?--k.readyWait:k.isReady)||(k.isReady=!0)!==e&&0<--k.readyWait||F.resolveWith(E,[k])}}),k.ready.then=F.then,"complete"===E.readyState||"loading"!==E.readyState&&!E.documentElement.doScroll?C.setTimeout(k.ready):(E.addEventListener("DOMContentLoaded",B),C.addEventListener("load",B));var _=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)_(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(i=!0,m(r)||(a=!0),l&&(a?(t.call(e,r),t=null):(l=t,t=function(e,t,n){return l.call(k(e),n)})),t))for(;s<u;s++)t(e[s],n,a?r:r.call(e[s],s,t(e[s],n)));return i?e:l?t.call(e):u?t(e[0],n):o},z=/^-ms-/,U=/-([a-z])/g;function X(e,t){return t.toUpperCase()}function V(e){return e.replace(z,"ms-").replace(U,X)}var G=function(e){return 1===e.nodeType||9===e.nodeType||!+e.nodeType};function Y(){this.expando=k.expando+Y.uid++}Y.uid=1,Y.prototype={cache:function(e){var t=e[this.expando];return t||(t={},G(e)&&(e.nodeType?e[this.expando]=t:Object.defineProperty(e,this.expando,{value:t,configurable:!0}))),t},set:function(e,t,n){var r,i=this.cache(e);if("string"==typeof t)i[V(t)]=n;else for(r in t)i[V(r)]=t[r];return i},get:function(e,t){return void 0===t?this.cache(e):e[this.expando]&&e[this.expando][V(t)]},access:function(e,t,n){return void 0===t||t&&"string"==typeof t&&void 0===n?this.get(e,t):(this.set(e,t,n),void 0!==n?n:t)},remove:function(e,t){var n,r=e[this.expando];if(void 0!==r){if(void 0!==t){n=(t=Array.isArray(t)?t.map(V):(t=V(t))in r?[t]:t.match(R)||[]).length;while(n--)delete r[t[n]]}(void 0===t||k.isEmptyObject(r))&&(e.nodeType?e[this.expando]=void 0:delete e[this.expando])}},hasData:function(e){var t=e[this.expando];return void 0!==t&&!k.isEmptyObject(t)}};var Q=new Y,J=new Y,K=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,Z=/[A-Z]/g;function ee(e,t,n){var r,i;if(void 0===n&&1===e.nodeType)if(r="data-"+t.replace(Z,"-$&").toLowerCase(),"string"==typeof(n=e.getAttribute(r))){try{n="true"===(i=n)||"false"!==i&&("null"===i?null:i===+i+""?+i:K.test(i)?JSON.parse(i):i)}catch(e){}J.set(e,t,n)}else n=void 0;return n}k.extend({hasData:function(e){return J.hasData(e)||Q.hasData(e)},data:function(e,t,n){return J.access(e,t,n)},removeData:function(e,t){J.remove(e,t)},_data:function(e,t,n){return Q.access(e,t,n)},_removeData:function(e,t){Q.remove(e,t)}}),k.fn.extend({data:function(n,e){var t,r,i,o=this[0],a=o&&o.attributes;if(void 0===n){if(this.length&&(i=J.get(o),1===o.nodeType&&!Q.get(o,"hasDataAttrs"))){t=a.length;while(t--)a[t]&&0===(r=a[t].name).indexOf("data-")&&(r=V(r.slice(5)),ee(o,r,i[r]));Q.set(o,"hasDataAttrs",!0)}return i}return"object"==typeof n?this.each(function(){J.set(this,n)}):_(this,function(e){var t;if(o&&void 0===e)return void 0!==(t=J.get(o,n))?t:void 0!==(t=ee(o,n))?t:void 0;this.each(function(){J.set(this,n,e)})},null,e,1<arguments.length,null,!0)},removeData:function(e){return this.each(function(){J.remove(this,e)})}}),k.extend({queue:function(e,t,n){var r;if(e)return t=(t||"fx")+"queue",r=Q.get(e,t),n&&(!r||Array.isArray(n)?r=Q.access(e,t,k.makeArray(n)):r.push(n)),r||[]},dequeue:function(e,t){t=t||"fx";var n=k.queue(e,t),r=n.length,i=n.shift(),o=k._queueHooks(e,t);"inprogress"===i&&(i=n.shift(),r--),i&&("fx"===t&&n.unshift("inprogress"),delete o.stop,i.call(e,function(){k.dequeue(e,t)},o)),!r&&o&&o.empty.fire()},_queueHooks:function(e,t){var n=t+"queueHooks";return Q.get(e,n)||Q.access(e,n,{empty:k.Callbacks("once memory").add(function(){Q.remove(e,[t+"queue",n])})})}}),k.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?k.queue(this[0],t):void 0===n?this:this.each(function(){var e=k.queue(this,t,n);k._queueHooks(this,t),"fx"===t&&"inprogress"!==e[0]&&k.dequeue(this,t)})},dequeue:function(e){return this.each(function(){k.dequeue(this,e)})},clearQueue:function(e){return this.queue(e||"fx",[])},promise:function(e,t){var n,r=1,i=k.Deferred(),o=this,a=this.length,s=function(){--r||i.resolveWith(o,[o])};"string"!=typeof e&&(t=e,e=void 0),e=e||"fx";while(a--)(n=Q.get(o[a],e+"queueHooks"))&&n.empty&&(r++,n.empty.add(s));return s(),i.promise(t)}});var te=/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/.source,ne=new RegExp("^(?:([+-])=|)("+te+")([a-z%]*)$","i"),re=["Top","Right","Bottom","Left"],ie=E.documentElement,oe=function(e){return k.contains(e.ownerDocument,e)},ae={composed:!0};ie.getRootNode&&(oe=function(e){return k.contains(e.ownerDocument,e)||e.getRootNode(ae)===e.ownerDocument});var se=function(e,t){return"none"===(e=t||e).style.display||""===e.style.display&&oe(e)&&"none"===k.css(e,"display")},ue=function(e,t,n,r){var i,o,a={};for(o in t)a[o]=e.style[o],e.style[o]=t[o];for(o in i=n.apply(e,r||[]),t)e.style[o]=a[o];return i};function le(e,t,n,r){var i,o,a=20,s=r?function(){return r.cur()}:function(){return k.css(e,t,"")},u=s(),l=n&&n[3]||(k.cssNumber[t]?"":"px"),c=e.nodeType&&(k.cssNumber[t]||"px"!==l&&+u)&&ne.exec(k.css(e,t));if(c&&c[3]!==l){u/=2,l=l||c[3],c=+u||1;while(a--)k.style(e,t,c+l),(1-o)*(1-(o=s()/u||.5))<=0&&(a=0),c/=o;c*=2,k.style(e,t,c+l),n=n||[]}return n&&(c=+c||+u||0,i=n[1]?c+(n[1]+1)*n[2]:+n[2],r&&(r.unit=l,r.start=c,r.end=i)),i}var ce={};function fe(e,t){for(var n,r,i,o,a,s,u,l=[],c=0,f=e.length;c<f;c++)(r=e[c]).style&&(n=r.style.display,t?("none"===n&&(l[c]=Q.get(r,"display")||null,l[c]||(r.style.display="")),""===r.style.display&&se(r)&&(l[c]=(u=a=o=void 0,a=(i=r).ownerDocument,s=i.nodeName,(u=ce[s])||(o=a.body.appendChild(a.createElement(s)),u=k.css(o,"display"),o.parentNode.removeChild(o),"none"===u&&(u="block"),ce[s]=u)))):"none"!==n&&(l[c]="none",Q.set(r,"display",n)));for(c=0;c<f;c++)null!=l[c]&&(e[c].style.display=l[c]);return e}k.fn.extend({show:function(){return fe(this,!0)},hide:function(){return fe(this)},toggle:function(e){return"boolean"==typeof e?e?this.show():this.hide():this.each(function(){se(this)?k(this).show():k(this).hide()})}});var pe=/^(?:checkbox|radio)$/i,de=/<([a-z][^\/\0>\x20\t\r\n\f]*)/i,he=/^$|^module$|\/(?:java|ecma)script/i,ge={option:[1,"<select multiple='multiple'>","</select>"],thead:[1,"<table>","</table>"],col:[2,"<table><colgroup>","</colgroup></table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],_default:[0,"",""]};function ve(e,t){var n;return n="undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t||"*"):"undefined"!=typeof e.querySelectorAll?e.querySelectorAll(t||"*"):[],void 0===t||t&&A(e,t)?k.merge([e],n):n}function ye(e,t){for(var n=0,r=e.length;n<r;n++)Q.set(e[n],"globalEval",!t||Q.get(t[n],"globalEval"))}ge.optgroup=ge.option,ge.tbody=ge.tfoot=ge.colgroup=ge.caption=ge.thead,ge.th=ge.td;var me,xe,be=/<|&#?\w+;/;function we(e,t,n,r,i){for(var o,a,s,u,l,c,f=t.createDocumentFragment(),p=[],d=0,h=e.length;d<h;d++)if((o=e[d])||0===o)if("object"===w(o))k.merge(p,o.nodeType?[o]:o);else if(be.test(o)){a=a||f.appendChild(t.createElement("div")),s=(de.exec(o)||["",""])[1].toLowerCase(),u=ge[s]||ge._default,a.innerHTML=u[1]+k.htmlPrefilter(o)+u[2],c=u[0];while(c--)a=a.lastChild;k.merge(p,a.childNodes),(a=f.firstChild).textContent=""}else p.push(t.createTextNode(o));f.textContent="",d=0;while(o=p[d++])if(r&&-1<k.inArray(o,r))i&&i.push(o);else if(l=oe(o),a=ve(f.appendChild(o),"script"),l&&ye(a),n){c=0;while(o=a[c++])he.test(o.type||"")&&n.push(o)}return f}me=E.createDocumentFragment().appendChild(E.createElement("div")),(xe=E.createElement("input")).setAttribute("type","radio"),xe.setAttribute("checked","checked"),xe.setAttribute("name","t"),me.appendChild(xe),y.checkClone=me.cloneNode(!0).cloneNode(!0).lastChild.checked,me.innerHTML="<textarea>x</textarea>",y.noCloneChecked=!!me.cloneNode(!0).lastChild.defaultValue;var Te=/^key/,Ce=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,Ee=/^([^.]*)(?:\.(.+)|)/;function ke(){return!0}function Se(){return!1}function Ne(e,t){return e===function(){try{return E.activeElement}catch(e){}}()==("focus"===t)}function Ae(e,t,n,r,i,o){var a,s;if("object"==typeof t){for(s in"string"!=typeof n&&(r=r||n,n=void 0),t)Ae(e,s,n,r,t[s],o);return e}if(null==r&&null==i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),!1===i)i=Se;else if(!i)return e;return 1===o&&(a=i,(i=function(e){return k().off(e),a.apply(this,arguments)}).guid=a.guid||(a.guid=k.guid++)),e.each(function(){k.event.add(this,t,i,r,n)})}function De(e,i,o){o?(Q.set(e,i,!1),k.event.add(e,i,{namespace:!1,handler:function(e){var t,n,r=Q.get(this,i);if(1&e.isTrigger&&this[i]){if(r.length)(k.event.special[i]||{}).delegateType&&e.stopPropagation();else if(r=s.call(arguments),Q.set(this,i,r),t=o(this,i),this[i](),r!==(n=Q.get(this,i))||t?Q.set(this,i,!1):n={},r!==n)return e.stopImmediatePropagation(),e.preventDefault(),n.value}else r.length&&(Q.set(this,i,{value:k.event.trigger(k.extend(r[0],k.Event.prototype),r.slice(1),this)}),e.stopImmediatePropagation())}})):void 0===Q.get(e,i)&&k.event.add(e,i,ke)}k.event={global:{},add:function(t,e,n,r,i){var o,a,s,u,l,c,f,p,d,h,g,v=Q.get(t);if(v){n.handler&&(n=(o=n).handler,i=o.selector),i&&k.find.matchesSelector(ie,i),n.guid||(n.guid=k.guid++),(u=v.events)||(u=v.events={}),(a=v.handle)||(a=v.handle=function(e){return"undefined"!=typeof k&&k.event.triggered!==e.type?k.event.dispatch.apply(t,arguments):void 0}),l=(e=(e||"").match(R)||[""]).length;while(l--)d=g=(s=Ee.exec(e[l])||[])[1],h=(s[2]||"").split(".").sort(),d&&(f=k.event.special[d]||{},d=(i?f.delegateType:f.bindType)||d,f=k.event.special[d]||{},c=k.extend({type:d,origType:g,data:r,handler:n,guid:n.guid,selector:i,needsContext:i&&k.expr.match.needsContext.test(i),namespace:h.join(".")},o),(p=u[d])||((p=u[d]=[]).delegateCount=0,f.setup&&!1!==f.setup.call(t,r,h,a)||t.addEventListener&&t.addEventListener(d,a)),f.add&&(f.add.call(t,c),c.handler.guid||(c.handler.guid=n.guid)),i?p.splice(p.delegateCount++,0,c):p.push(c),k.event.global[d]=!0)}},remove:function(e,t,n,r,i){var o,a,s,u,l,c,f,p,d,h,g,v=Q.hasData(e)&&Q.get(e);if(v&&(u=v.events)){l=(t=(t||"").match(R)||[""]).length;while(l--)if(d=g=(s=Ee.exec(t[l])||[])[1],h=(s[2]||"").split(".").sort(),d){f=k.event.special[d]||{},p=u[d=(r?f.delegateType:f.bindType)||d]||[],s=s[2]&&new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"),a=o=p.length;while(o--)c=p[o],!i&&g!==c.origType||n&&n.guid!==c.guid||s&&!s.test(c.namespace)||r&&r!==c.selector&&("**"!==r||!c.selector)||(p.splice(o,1),c.selector&&p.delegateCount--,f.remove&&f.remove.call(e,c));a&&!p.length&&(f.teardown&&!1!==f.teardown.call(e,h,v.handle)||k.removeEvent(e,d,v.handle),delete u[d])}else for(d in u)k.event.remove(e,d+t[l],n,r,!0);k.isEmptyObject(u)&&Q.remove(e,"handle events")}},dispatch:function(e){var t,n,r,i,o,a,s=k.event.fix(e),u=new Array(arguments.length),l=(Q.get(this,"events")||{})[s.type]||[],c=k.event.special[s.type]||{};for(u[0]=s,t=1;t<arguments.length;t++)u[t]=arguments[t];if(s.delegateTarget=this,!c.preDispatch||!1!==c.preDispatch.call(this,s)){a=k.event.handlers.call(this,s,l),t=0;while((i=a[t++])&&!s.isPropagationStopped()){s.currentTarget=i.elem,n=0;while((o=i.handlers[n++])&&!s.isImmediatePropagationStopped())s.rnamespace&&!1!==o.namespace&&!s.rnamespace.test(o.namespace)||(s.handleObj=o,s.data=o.data,void 0!==(r=((k.event.special[o.origType]||{}).handle||o.handler).apply(i.elem,u))&&!1===(s.result=r)&&(s.preventDefault(),s.stopPropagation()))}return c.postDispatch&&c.postDispatch.call(this,s),s.result}},handlers:function(e,t){var n,r,i,o,a,s=[],u=t.delegateCount,l=e.target;if(u&&l.nodeType&&!("click"===e.type&&1<=e.button))for(;l!==this;l=l.parentNode||this)if(1===l.nodeType&&("click"!==e.type||!0!==l.disabled)){for(o=[],a={},n=0;n<u;n++)void 0===a[i=(r=t[n]).selector+" "]&&(a[i]=r.needsContext?-1<k(i,this).index(l):k.find(i,this,null,[l]).length),a[i]&&o.push(r);o.length&&s.push({elem:l,handlers:o})}return l=this,u<t.length&&s.push({elem:l,handlers:t.slice(u)}),s},addProp:function(t,e){Object.defineProperty(k.Event.prototype,t,{enumerable:!0,configurable:!0,get:m(e)?function(){if(this.originalEvent)return e(this.originalEvent)}:function(){if(this.originalEvent)return this.originalEvent[t]},set:function(e){Object.defineProperty(this,t,{enumerable:!0,configurable:!0,writable:!0,value:e})}})},fix:function(e){return e[k.expando]?e:new k.Event(e)},special:{load:{noBubble:!0},click:{setup:function(e){var t=this||e;return pe.test(t.type)&&t.click&&A(t,"input")&&De(t,"click",ke),!1},trigger:function(e){var t=this||e;return pe.test(t.type)&&t.click&&A(t,"input")&&De(t,"click"),!0},_default:function(e){var t=e.target;return pe.test(t.type)&&t.click&&A(t,"input")&&Q.get(t,"click")||A(t,"a")}},beforeunload:{postDispatch:function(e){void 0!==e.result&&e.originalEvent&&(e.originalEvent.returnValue=e.result)}}}},k.removeEvent=function(e,t,n){e.removeEventListener&&e.removeEventListener(t,n)},k.Event=function(e,t){if(!(this instanceof k.Event))return new k.Event(e,t);e&&e.type?(this.originalEvent=e,this.type=e.type,this.isDefaultPrevented=e.defaultPrevented||void 0===e.defaultPrevented&&!1===e.returnValue?ke:Se,this.target=e.target&&3===e.target.nodeType?e.target.parentNode:e.target,this.currentTarget=e.currentTarget,this.relatedTarget=e.relatedTarget):this.type=e,t&&k.extend(this,t),this.timeStamp=e&&e.timeStamp||Date.now(),this[k.expando]=!0},k.Event.prototype={constructor:k.Event,isDefaultPrevented:Se,isPropagationStopped:Se,isImmediatePropagationStopped:Se,isSimulated:!1,preventDefault:function(){var e=this.originalEvent;this.isDefaultPrevented=ke,e&&!this.isSimulated&&e.preventDefault()},stopPropagation:function(){var e=this.originalEvent;this.isPropagationStopped=ke,e&&!this.isSimulated&&e.stopPropagation()},stopImmediatePropagation:function(){var e=this.originalEvent;this.isImmediatePropagationStopped=ke,e&&!this.isSimulated&&e.stopImmediatePropagation(),this.stopPropagation()}},k.each({altKey:!0,bubbles:!0,cancelable:!0,changedTouches:!0,ctrlKey:!0,detail:!0,eventPhase:!0,metaKey:!0,pageX:!0,pageY:!0,shiftKey:!0,view:!0,"char":!0,code:!0,charCode:!0,key:!0,keyCode:!0,button:!0,buttons:!0,clientX:!0,clientY:!0,offsetX:!0,offsetY:!0,pointerId:!0,pointerType:!0,screenX:!0,screenY:!0,targetTouches:!0,toElement:!0,touches:!0,which:function(e){var t=e.button;return null==e.which&&Te.test(e.type)?null!=e.charCode?e.charCode:e.keyCode:!e.which&&void 0!==t&&Ce.test(e.type)?1&t?1:2&t?3:4&t?2:0:e.which}},k.event.addProp),k.each({focus:"focusin",blur:"focusout"},function(e,t){k.event.special[e]={setup:function(){return De(this,e,Ne),!1},trigger:function(){return De(this,e),!0},delegateType:t}}),k.each({mouseenter:"mouseover",mouseleave:"mouseout",pointerenter:"pointerover",pointerleave:"pointerout"},function(e,i){k.event.special[e]={delegateType:i,bindType:i,handle:function(e){var t,n=e.relatedTarget,r=e.handleObj;return n&&(n===this||k.contains(this,n))||(e.type=r.origType,t=r.handler.apply(this,arguments),e.type=i),t}}}),k.fn.extend({on:function(e,t,n,r){return Ae(this,e,t,n,r)},one:function(e,t,n,r){return Ae(this,e,t,n,r,1)},off:function(e,t,n){var r,i;if(e&&e.preventDefault&&e.handleObj)return r=e.handleObj,k(e.delegateTarget).off(r.namespace?r.origType+"."+r.namespace:r.origType,r.selector,r.handler),this;if("object"==typeof e){for(i in e)this.off(i,t,e[i]);return this}return!1!==t&&"function"!=typeof t||(n=t,t=void 0),!1===n&&(n=Se),this.each(function(){k.event.remove(this,e,n,t)})}});var je=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi,qe=/<script|<style|<link/i,Le=/checked\s*(?:[^=]|=\s*.checked.)/i,He=/^\s*<!(?:\[CDATA\[|--)|(?:\]\]|--)>\s*$/g;function Oe(e,t){return A(e,"table")&&A(11!==t.nodeType?t:t.firstChild,"tr")&&k(e).children("tbody")[0]||e}function Pe(e){return e.type=(null!==e.getAttribute("type"))+"/"+e.type,e}function Re(e){return"true/"===(e.type||"").slice(0,5)?e.type=e.type.slice(5):e.removeAttribute("type"),e}function Me(e,t){var n,r,i,o,a,s,u,l;if(1===t.nodeType){if(Q.hasData(e)&&(o=Q.access(e),a=Q.set(t,o),l=o.events))for(i in delete a.handle,a.events={},l)for(n=0,r=l[i].length;n<r;n++)k.event.add(t,i,l[i][n]);J.hasData(e)&&(s=J.access(e),u=k.extend({},s),J.set(t,u))}}function Ie(n,r,i,o){r=g.apply([],r);var e,t,a,s,u,l,c=0,f=n.length,p=f-1,d=r[0],h=m(d);if(h||1<f&&"string"==typeof d&&!y.checkClone&&Le.test(d))return n.each(function(e){var t=n.eq(e);h&&(r[0]=d.call(this,e,t.html())),Ie(t,r,i,o)});if(f&&(t=(e=we(r,n[0].ownerDocument,!1,n,o)).firstChild,1===e.childNodes.length&&(e=t),t||o)){for(s=(a=k.map(ve(e,"script"),Pe)).length;c<f;c++)u=e,c!==p&&(u=k.clone(u,!0,!0),s&&k.merge(a,ve(u,"script"))),i.call(n[c],u,c);if(s)for(l=a[a.length-1].ownerDocument,k.map(a,Re),c=0;c<s;c++)u=a[c],he.test(u.type||"")&&!Q.access(u,"globalEval")&&k.contains(l,u)&&(u.src&&"module"!==(u.type||"").toLowerCase()?k._evalUrl&&!u.noModule&&k._evalUrl(u.src,{nonce:u.nonce||u.getAttribute("nonce")}):b(u.textContent.replace(He,""),u,l))}return n}function We(e,t,n){for(var r,i=t?k.filter(t,e):e,o=0;null!=(r=i[o]);o++)n||1!==r.nodeType||k.cleanData(ve(r)),r.parentNode&&(n&&oe(r)&&ye(ve(r,"script")),r.parentNode.removeChild(r));return e}k.extend({htmlPrefilter:function(e){return e.replace(je,"<$1></$2>")},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=oe(e);if(!(y.noCloneChecked||1!==e.nodeType&&11!==e.nodeType||k.isXMLDoc(e)))for(a=ve(c),r=0,i=(o=ve(e)).length;r<i;r++)s=o[r],u=a[r],void 0,"input"===(l=u.nodeName.toLowerCase())&&pe.test(s.type)?u.checked=s.checked:"input"!==l&&"textarea"!==l||(u.defaultValue=s.defaultValue);if(t)if(n)for(o=o||ve(e),a=a||ve(c),r=0,i=o.length;r<i;r++)Me(o[r],a[r]);else Me(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=k.event.special,o=0;void 0!==(n=e[o]);o++)if(G(n)){if(t=n[Q.expando]){if(t.events)for(r in t.events)i[r]?k.event.remove(n,r):k.removeEvent(n,r,t.handle);n[Q.expando]=void 0}n[J.expando]&&(n[J.expando]=void 0)}}}),k.fn.extend({detach:function(e){return We(this,e,!0)},remove:function(e){return We(this,e)},text:function(e){return _(this,function(e){return void 0===e?k.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=e)})},null,e,arguments.length)},append:function(){return Ie(this,arguments,function(e){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||Oe(this,e).appendChild(e)})},prepend:function(){return Ie(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=Oe(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return Ie(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){return Ie(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this.nextSibling)})},empty:function(){for(var e,t=0;null!=(e=this[t]);t++)1===e.nodeType&&(k.cleanData(ve(e,!1)),e.textContent="");return this},clone:function(e,t){return e=null!=e&&e,t=null==t?e:t,this.map(function(){return k.clone(this,e,t)})},html:function(e){return _(this,function(e){var t=this[0]||{},n=0,r=this.length;if(void 0===e&&1===t.nodeType)return t.innerHTML;if("string"==typeof e&&!qe.test(e)&&!ge[(de.exec(e)||["",""])[1].toLowerCase()]){e=k.htmlPrefilter(e);try{for(;n<r;n++)1===(t=this[n]||{}).nodeType&&(k.cleanData(ve(t,!1)),t.innerHTML=e);t=0}catch(e){}}t&&this.empty().append(e)},null,e,arguments.length)},replaceWith:function(){var n=[];return Ie(this,arguments,function(e){var t=this.parentNode;k.inArray(this,n)<0&&(k.cleanData(ve(this)),t&&t.replaceChild(e,this))},n)}}),k.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){k.fn[e]=function(e){for(var t,n=[],r=k(e),i=r.length-1,o=0;o<=i;o++)t=o===i?this:this.clone(!0),k(r[o])[a](t),u.apply(n,t.get());return this.pushStack(n)}});var $e=new RegExp("^("+te+")(?!px)[a-z%]+$","i"),Fe=function(e){var t=e.ownerDocument.defaultView;return t&&t.opener||(t=C),t.getComputedStyle(e)},Be=new RegExp(re.join("|"),"i");function _e(e,t,n){var r,i,o,a,s=e.style;return(n=n||Fe(e))&&(""!==(a=n.getPropertyValue(t)||n[t])||oe(e)||(a=k.style(e,t)),!y.pixelBoxStyles()&&$e.test(a)&&Be.test(t)&&(r=s.width,i=s.minWidth,o=s.maxWidth,s.minWidth=s.maxWidth=s.width=a,a=n.width,s.width=r,s.minWidth=i,s.maxWidth=o)),void 0!==a?a+"":a}function ze(e,t){return{get:function(){if(!e())return(this.get=t).apply(this,arguments);delete this.get}}}!function(){function e(){if(u){s.style.cssText="position:absolute;left:-11111px;width:60px;margin-top:1px;padding:0;border:0",u.style.cssText="position:relative;display:block;box-sizing:border-box;overflow:scroll;margin:auto;border:1px;padding:1px;width:60%;top:1%",ie.appendChild(s).appendChild(u);var e=C.getComputedStyle(u);n="1%"!==e.top,a=12===t(e.marginLeft),u.style.right="60%",o=36===t(e.right),r=36===t(e.width),u.style.position="absolute",i=12===t(u.offsetWidth/3),ie.removeChild(s),u=null}}function t(e){return Math.round(parseFloat(e))}var n,r,i,o,a,s=E.createElement("div"),u=E.createElement("div");u.style&&(u.style.backgroundClip="content-box",u.cloneNode(!0).style.backgroundClip="",y.clearCloneStyle="content-box"===u.style.backgroundClip,k.extend(y,{boxSizingReliable:function(){return e(),r},pixelBoxStyles:function(){return e(),o},pixelPosition:function(){return e(),n},reliableMarginLeft:function(){return e(),a},scrollboxSize:function(){return e(),i}}))}();var Ue=["Webkit","Moz","ms"],Xe=E.createElement("div").style,Ve={};function Ge(e){var t=k.cssProps[e]||Ve[e];return t||(e in Xe?e:Ve[e]=function(e){var t=e[0].toUpperCase()+e.slice(1),n=Ue.length;while(n--)if((e=Ue[n]+t)in Xe)return e}(e)||e)}var Ye=/^(none|table(?!-c[ea]).+)/,Qe=/^--/,Je={position:"absolute",visibility:"hidden",display:"block"},Ke={letterSpacing:"0",fontWeight:"400"};function Ze(e,t,n){var r=ne.exec(t);return r?Math.max(0,r[2]-(n||0))+(r[3]||"px"):t}function et(e,t,n,r,i,o){var a="width"===t?1:0,s=0,u=0;if(n===(r?"border":"content"))return 0;for(;a<4;a+=2)"margin"===n&&(u+=k.css(e,n+re[a],!0,i)),r?("content"===n&&(u-=k.css(e,"padding"+re[a],!0,i)),"margin"!==n&&(u-=k.css(e,"border"+re[a]+"Width",!0,i))):(u+=k.css(e,"padding"+re[a],!0,i),"padding"!==n?u+=k.css(e,"border"+re[a]+"Width",!0,i):s+=k.css(e,"border"+re[a]+"Width",!0,i));return!r&&0<=o&&(u+=Math.max(0,Math.ceil(e["offset"+t[0].toUpperCase()+t.slice(1)]-o-u-s-.5))||0),u}function tt(e,t,n){var r=Fe(e),i=(!y.boxSizingReliable()||n)&&"border-box"===k.css(e,"boxSizing",!1,r),o=i,a=_e(e,t,r),s="offset"+t[0].toUpperCase()+t.slice(1);if($e.test(a)){if(!n)return a;a="auto"}return(!y.boxSizingReliable()&&i||"auto"===a||!parseFloat(a)&&"inline"===k.css(e,"display",!1,r))&&e.getClientRects().length&&(i="border-box"===k.css(e,"boxSizing",!1,r),(o=s in e)&&(a=e[s])),(a=parseFloat(a)||0)+et(e,t,n||(i?"border":"content"),o,r,a)+"px"}function nt(e,t,n,r,i){return new nt.prototype.init(e,t,n,r,i)}k.extend({cssHooks:{opacity:{get:function(e,t){if(t){var n=_e(e,"opacity");return""===n?"1":n}}}},cssNumber:{animationIterationCount:!0,columnCount:!0,fillOpacity:!0,flexGrow:!0,flexShrink:!0,fontWeight:!0,gridArea:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnStart:!0,gridRow:!0,gridRowEnd:!0,gridRowStart:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{},style:function(e,t,n,r){if(e&&3!==e.nodeType&&8!==e.nodeType&&e.style){var i,o,a,s=V(t),u=Qe.test(t),l=e.style;if(u||(t=Ge(s)),a=k.cssHooks[t]||k.cssHooks[s],void 0===n)return a&&"get"in a&&void 0!==(i=a.get(e,!1,r))?i:l[t];"string"===(o=typeof n)&&(i=ne.exec(n))&&i[1]&&(n=le(e,t,i),o="number"),null!=n&&n==n&&("number"!==o||u||(n+=i&&i[3]||(k.cssNumber[s]?"":"px")),y.clearCloneStyle||""!==n||0!==t.indexOf("background")||(l[t]="inherit"),a&&"set"in a&&void 0===(n=a.set(e,n,r))||(u?l.setProperty(t,n):l[t]=n))}},css:function(e,t,n,r){var i,o,a,s=V(t);return Qe.test(t)||(t=Ge(s)),(a=k.cssHooks[t]||k.cssHooks[s])&&"get"in a&&(i=a.get(e,!0,n)),void 0===i&&(i=_e(e,t,r)),"normal"===i&&t in Ke&&(i=Ke[t]),""===n||n?(o=parseFloat(i),!0===n||isFinite(o)?o||0:i):i}}),k.each(["height","width"],function(e,u){k.cssHooks[u]={get:function(e,t,n){if(t)return!Ye.test(k.css(e,"display"))||e.getClientRects().length&&e.getBoundingClientRect().width?tt(e,u,n):ue(e,Je,function(){return tt(e,u,n)})},set:function(e,t,n){var r,i=Fe(e),o=!y.scrollboxSize()&&"absolute"===i.position,a=(o||n)&&"border-box"===k.css(e,"boxSizing",!1,i),s=n?et(e,u,n,a,i):0;return a&&o&&(s-=Math.ceil(e["offset"+u[0].toUpperCase()+u.slice(1)]-parseFloat(i[u])-et(e,u,"border",!1,i)-.5)),s&&(r=ne.exec(t))&&"px"!==(r[3]||"px")&&(e.style[u]=t,t=k.css(e,u)),Ze(0,t,s)}}}),k.cssHooks.marginLeft=ze(y.reliableMarginLeft,function(e,t){if(t)return(parseFloat(_e(e,"marginLeft"))||e.getBoundingClientRect().left-ue(e,{marginLeft:0},function(){return e.getBoundingClientRect().left}))+"px"}),k.each({margin:"",padding:"",border:"Width"},function(i,o){k.cssHooks[i+o]={expand:function(e){for(var t=0,n={},r="string"==typeof e?e.split(" "):[e];t<4;t++)n[i+re[t]+o]=r[t]||r[t-2]||r[0];return n}},"margin"!==i&&(k.cssHooks[i+o].set=Ze)}),k.fn.extend({css:function(e,t){return _(this,function(e,t,n){var r,i,o={},a=0;if(Array.isArray(t)){for(r=Fe(e),i=t.length;a<i;a++)o[t[a]]=k.css(e,t[a],!1,r);return o}return void 0!==n?k.style(e,t,n):k.css(e,t)},e,t,1<arguments.length)}}),((k.Tween=nt).prototype={constructor:nt,init:function(e,t,n,r,i,o){this.elem=e,this.prop=n,this.easing=i||k.easing._default,this.options=t,this.start=this.now=this.cur(),this.end=r,this.unit=o||(k.cssNumber[n]?"":"px")},cur:function(){var e=nt.propHooks[this.prop];return e&&e.get?e.get(this):nt.propHooks._default.get(this)},run:function(e){var t,n=nt.propHooks[this.prop];return this.options.duration?this.pos=t=k.easing[this.easing](e,this.options.duration*e,0,1,this.options.duration):this.pos=t=e,this.now=(this.end-this.start)*t+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),n&&n.set?n.set(this):nt.propHooks._default.set(this),this}}).init.prototype=nt.prototype,(nt.propHooks={_default:{get:function(e){var t;return 1!==e.elem.nodeType||null!=e.elem[e.prop]&&null==e.elem.style[e.prop]?e.elem[e.prop]:(t=k.css(e.elem,e.prop,""))&&"auto"!==t?t:0},set:function(e){k.fx.step[e.prop]?k.fx.step[e.prop](e):1!==e.elem.nodeType||!k.cssHooks[e.prop]&&null==e.elem.style[Ge(e.prop)]?e.elem[e.prop]=e.now:k.style(e.elem,e.prop,e.now+e.unit)}}}).scrollTop=nt.propHooks.scrollLeft={set:function(e){e.elem.nodeType&&e.elem.parentNode&&(e.elem[e.prop]=e.now)}},k.easing={linear:function(e){return e},swing:function(e){return.5-Math.cos(e*Math.PI)/2},_default:"swing"},k.fx=nt.prototype.init,k.fx.step={};var rt,it,ot,at,st=/^(?:toggle|show|hide)$/,ut=/queueHooks$/;function lt(){it&&(!1===E.hidden&&C.requestAnimationFrame?C.requestAnimationFrame(lt):C.setTimeout(lt,k.fx.interval),k.fx.tick())}function ct(){return C.setTimeout(function(){rt=void 0}),rt=Date.now()}function ft(e,t){var n,r=0,i={height:e};for(t=t?1:0;r<4;r+=2-t)i["margin"+(n=re[r])]=i["padding"+n]=e;return t&&(i.opacity=i.width=e),i}function pt(e,t,n){for(var r,i=(dt.tweeners[t]||[]).concat(dt.tweeners["*"]),o=0,a=i.length;o<a;o++)if(r=i[o].call(n,t,e))return r}function dt(o,e,t){var n,a,r=0,i=dt.prefilters.length,s=k.Deferred().always(function(){delete u.elem}),u=function(){if(a)return!1;for(var e=rt||ct(),t=Math.max(0,l.startTime+l.duration-e),n=1-(t/l.duration||0),r=0,i=l.tweens.length;r<i;r++)l.tweens[r].run(n);return s.notifyWith(o,[l,n,t]),n<1&&i?t:(i||s.notifyWith(o,[l,1,0]),s.resolveWith(o,[l]),!1)},l=s.promise({elem:o,props:k.extend({},e),opts:k.extend(!0,{specialEasing:{},easing:k.easing._default},t),originalProperties:e,originalOptions:t,startTime:rt||ct(),duration:t.duration,tweens:[],createTween:function(e,t){var n=k.Tween(o,l.opts,e,t,l.opts.specialEasing[e]||l.opts.easing);return l.tweens.push(n),n},stop:function(e){var t=0,n=e?l.tweens.length:0;if(a)return this;for(a=!0;t<n;t++)l.tweens[t].run(1);return e?(s.notifyWith(o,[l,1,0]),s.resolveWith(o,[l,e])):s.rejectWith(o,[l,e]),this}}),c=l.props;for(!function(e,t){var n,r,i,o,a;for(n in e)if(i=t[r=V(n)],o=e[n],Array.isArray(o)&&(i=o[1],o=e[n]=o[0]),n!==r&&(e[r]=o,delete e[n]),(a=k.cssHooks[r])&&"expand"in a)for(n in o=a.expand(o),delete e[r],o)n in e||(e[n]=o[n],t[n]=i);else t[r]=i}(c,l.opts.specialEasing);r<i;r++)if(n=dt.prefilters[r].call(l,o,c,l.opts))return m(n.stop)&&(k._queueHooks(l.elem,l.opts.queue).stop=n.stop.bind(n)),n;return k.map(c,pt,l),m(l.opts.start)&&l.opts.start.call(o,l),l.progress(l.opts.progress).done(l.opts.done,l.opts.complete).fail(l.opts.fail).always(l.opts.always),k.fx.timer(k.extend(u,{elem:o,anim:l,queue:l.opts.queue})),l}k.Animation=k.extend(dt,{tweeners:{"*":[function(e,t){var n=this.createTween(e,t);return le(n.elem,e,ne.exec(t),n),n}]},tweener:function(e,t){m(e)?(t=e,e=["*"]):e=e.match(R);for(var n,r=0,i=e.length;r<i;r++)n=e[r],dt.tweeners[n]=dt.tweeners[n]||[],dt.tweeners[n].unshift(t)},prefilters:[function(e,t,n){var r,i,o,a,s,u,l,c,f="width"in t||"height"in t,p=this,d={},h=e.style,g=e.nodeType&&se(e),v=Q.get(e,"fxshow");for(r in n.queue||(null==(a=k._queueHooks(e,"fx")).unqueued&&(a.unqueued=0,s=a.empty.fire,a.empty.fire=function(){a.unqueued||s()}),a.unqueued++,p.always(function(){p.always(function(){a.unqueued--,k.queue(e,"fx").length||a.empty.fire()})})),t)if(i=t[r],st.test(i)){if(delete t[r],o=o||"toggle"===i,i===(g?"hide":"show")){if("show"!==i||!v||void 0===v[r])continue;g=!0}d[r]=v&&v[r]||k.style(e,r)}if((u=!k.isEmptyObject(t))||!k.isEmptyObject(d))for(r in f&&1===e.nodeType&&(n.overflow=[h.overflow,h.overflowX,h.overflowY],null==(l=v&&v.display)&&(l=Q.get(e,"display")),"none"===(c=k.css(e,"display"))&&(l?c=l:(fe([e],!0),l=e.style.display||l,c=k.css(e,"display"),fe([e]))),("inline"===c||"inline-block"===c&&null!=l)&&"none"===k.css(e,"float")&&(u||(p.done(function(){h.display=l}),null==l&&(c=h.display,l="none"===c?"":c)),h.display="inline-block")),n.overflow&&(h.overflow="hidden",p.always(function(){h.overflow=n.overflow[0],h.overflowX=n.overflow[1],h.overflowY=n.overflow[2]})),u=!1,d)u||(v?"hidden"in v&&(g=v.hidden):v=Q.access(e,"fxshow",{display:l}),o&&(v.hidden=!g),g&&fe([e],!0),p.done(function(){for(r in g||fe([e]),Q.remove(e,"fxshow"),d)k.style(e,r,d[r])})),u=pt(g?v[r]:0,r,p),r in v||(v[r]=u.start,g&&(u.end=u.start,u.start=0))}],prefilter:function(e,t){t?dt.prefilters.unshift(e):dt.prefilters.push(e)}}),k.speed=function(e,t,n){var r=e&&"object"==typeof e?k.extend({},e):{complete:n||!n&&t||m(e)&&e,duration:e,easing:n&&t||t&&!m(t)&&t};return k.fx.off?r.duration=0:"number"!=typeof r.duration&&(r.duration in k.fx.speeds?r.duration=k.fx.speeds[r.duration]:r.duration=k.fx.speeds._default),null!=r.queue&&!0!==r.queue||(r.queue="fx"),r.old=r.complete,r.complete=function(){m(r.old)&&r.old.call(this),r.queue&&k.dequeue(this,r.queue)},r},k.fn.extend({fadeTo:function(e,t,n,r){return this.filter(se).css("opacity",0).show().end().animate({opacity:t},e,n,r)},animate:function(t,e,n,r){var i=k.isEmptyObject(t),o=k.speed(e,n,r),a=function(){var e=dt(this,k.extend({},t),o);(i||Q.get(this,"finish"))&&e.stop(!0)};return a.finish=a,i||!1===o.queue?this.each(a):this.queue(o.queue,a)},stop:function(i,e,o){var a=function(e){var t=e.stop;delete e.stop,t(o)};return"string"!=typeof i&&(o=e,e=i,i=void 0),e&&!1!==i&&this.queue(i||"fx",[]),this.each(function(){var e=!0,t=null!=i&&i+"queueHooks",n=k.timers,r=Q.get(this);if(t)r[t]&&r[t].stop&&a(r[t]);else for(t in r)r[t]&&r[t].stop&&ut.test(t)&&a(r[t]);for(t=n.length;t--;)n[t].elem!==this||null!=i&&n[t].queue!==i||(n[t].anim.stop(o),e=!1,n.splice(t,1));!e&&o||k.dequeue(this,i)})},finish:function(a){return!1!==a&&(a=a||"fx"),this.each(function(){var e,t=Q.get(this),n=t[a+"queue"],r=t[a+"queueHooks"],i=k.timers,o=n?n.length:0;for(t.finish=!0,k.queue(this,a,[]),r&&r.stop&&r.stop.call(this,!0),e=i.length;e--;)i[e].elem===this&&i[e].queue===a&&(i[e].anim.stop(!0),i.splice(e,1));for(e=0;e<o;e++)n[e]&&n[e].finish&&n[e].finish.call(this);delete t.finish})}}),k.each(["toggle","show","hide"],function(e,r){var i=k.fn[r];k.fn[r]=function(e,t,n){return null==e||"boolean"==typeof e?i.apply(this,arguments):this.animate(ft(r,!0),e,t,n)}}),k.each({slideDown:ft("show"),slideUp:ft("hide"),slideToggle:ft("toggle"),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"},fadeToggle:{opacity:"toggle"}},function(e,r){k.fn[e]=function(e,t,n){return this.animate(r,e,t,n)}}),k.timers=[],k.fx.tick=function(){var e,t=0,n=k.timers;for(rt=Date.now();t<n.length;t++)(e=n[t])()||n[t]!==e||n.splice(t--,1);n.length||k.fx.stop(),rt=void 0},k.fx.timer=function(e){k.timers.push(e),k.fx.start()},k.fx.interval=13,k.fx.start=function(){it||(it=!0,lt())},k.fx.stop=function(){it=null},k.fx.speeds={slow:600,fast:200,_default:400},k.fn.delay=function(r,e){return r=k.fx&&k.fx.speeds[r]||r,e=e||"fx",this.queue(e,function(e,t){var n=C.setTimeout(e,r);t.stop=function(){C.clearTimeout(n)}})},ot=E.createElement("input"),at=E.createElement("select").appendChild(E.createElement("option")),ot.type="checkbox",y.checkOn=""!==ot.value,y.optSelected=at.selected,(ot=E.createElement("input")).value="t",ot.type="radio",y.radioValue="t"===ot.value;var ht,gt=k.expr.attrHandle;k.fn.extend({attr:function(e,t){return _(this,k.attr,e,t,1<arguments.length)},removeAttr:function(e){return this.each(function(){k.removeAttr(this,e)})}}),k.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?k.prop(e,t,n):(1===o&&k.isXMLDoc(e)||(i=k.attrHooks[t.toLowerCase()]||(k.expr.match.bool.test(t)?ht:void 0)),void 0!==n?null===n?void k.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:null==(r=k.find.attr(e,t))?void 0:r)},attrHooks:{type:{set:function(e,t){if(!y.radioValue&&"radio"===t&&A(e,"input")){var n=e.value;return e.setAttribute("type",t),n&&(e.value=n),t}}}},removeAttr:function(e,t){var n,r=0,i=t&&t.match(R);if(i&&1===e.nodeType)while(n=i[r++])e.removeAttribute(n)}}),ht={set:function(e,t,n){return!1===t?k.removeAttr(e,n):e.setAttribute(n,n),n}},k.each(k.expr.match.bool.source.match(/\w+/g),function(e,t){var a=gt[t]||k.find.attr;gt[t]=function(e,t,n){var r,i,o=t.toLowerCase();return n||(i=gt[o],gt[o]=r,r=null!=a(e,t,n)?o:null,gt[o]=i),r}});var vt=/^(?:input|select|textarea|button)$/i,yt=/^(?:a|area)$/i;function mt(e){return(e.match(R)||[]).join(" ")}function xt(e){return e.getAttribute&&e.getAttribute("class")||""}function bt(e){return Array.isArray(e)?e:"string"==typeof e&&e.match(R)||[]}k.fn.extend({prop:function(e,t){return _(this,k.prop,e,t,1<arguments.length)},removeProp:function(e){return this.each(function(){delete this[k.propFix[e]||e]})}}),k.extend({prop:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return 1===o&&k.isXMLDoc(e)||(t=k.propFix[t]||t,i=k.propHooks[t]),void 0!==n?i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=k.find.attr(e,"tabindex");return t?parseInt(t,10):vt.test(e.nodeName)||yt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),y.optSelected||(k.propHooks.selected={get:function(e){var t=e.parentNode;return t&&t.parentNode&&t.parentNode.selectedIndex,null},set:function(e){var t=e.parentNode;t&&(t.selectedIndex,t.parentNode&&t.parentNode.selectedIndex)}}),k.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){k.propFix[this.toLowerCase()]=this}),k.fn.extend({addClass:function(t){var e,n,r,i,o,a,s,u=0;if(m(t))return this.each(function(e){k(this).addClass(t.call(this,e,xt(this)))});if((e=bt(t)).length)while(n=this[u++])if(i=xt(n),r=1===n.nodeType&&" "+mt(i)+" "){a=0;while(o=e[a++])r.indexOf(" "+o+" ")<0&&(r+=o+" ");i!==(s=mt(r))&&n.setAttribute("class",s)}return this},removeClass:function(t){var e,n,r,i,o,a,s,u=0;if(m(t))return this.each(function(e){k(this).removeClass(t.call(this,e,xt(this)))});if(!arguments.length)return this.attr("class","");if((e=bt(t)).length)while(n=this[u++])if(i=xt(n),r=1===n.nodeType&&" "+mt(i)+" "){a=0;while(o=e[a++])while(-1<r.indexOf(" "+o+" "))r=r.replace(" "+o+" "," ");i!==(s=mt(r))&&n.setAttribute("class",s)}return this},toggleClass:function(i,t){var o=typeof i,a="string"===o||Array.isArray(i);return"boolean"==typeof t&&a?t?this.addClass(i):this.removeClass(i):m(i)?this.each(function(e){k(this).toggleClass(i.call(this,e,xt(this),t),t)}):this.each(function(){var e,t,n,r;if(a){t=0,n=k(this),r=bt(i);while(e=r[t++])n.hasClass(e)?n.removeClass(e):n.addClass(e)}else void 0!==i&&"boolean"!==o||((e=xt(this))&&Q.set(this,"__className__",e),this.setAttribute&&this.setAttribute("class",e||!1===i?"":Q.get(this,"__className__")||""))})},hasClass:function(e){var t,n,r=0;t=" "+e+" ";while(n=this[r++])if(1===n.nodeType&&-1<(" "+mt(xt(n))+" ").indexOf(t))return!0;return!1}});var wt=/\r/g;k.fn.extend({val:function(n){var r,e,i,t=this[0];return arguments.length?(i=m(n),this.each(function(e){var t;1===this.nodeType&&(null==(t=i?n.call(this,e,k(this).val()):n)?t="":"number"==typeof t?t+="":Array.isArray(t)&&(t=k.map(t,function(e){return null==e?"":e+""})),(r=k.valHooks[this.type]||k.valHooks[this.nodeName.toLowerCase()])&&"set"in r&&void 0!==r.set(this,t,"value")||(this.value=t))})):t?(r=k.valHooks[t.type]||k.valHooks[t.nodeName.toLowerCase()])&&"get"in r&&void 0!==(e=r.get(t,"value"))?e:"string"==typeof(e=t.value)?e.replace(wt,""):null==e?"":e:void 0}}),k.extend({valHooks:{option:{get:function(e){var t=k.find.attr(e,"value");return null!=t?t:mt(k.text(e))}},select:{get:function(e){var t,n,r,i=e.options,o=e.selectedIndex,a="select-one"===e.type,s=a?null:[],u=a?o+1:i.length;for(r=o<0?u:a?o:0;r<u;r++)if(((n=i[r]).selected||r===o)&&!n.disabled&&(!n.parentNode.disabled||!A(n.parentNode,"optgroup"))){if(t=k(n).val(),a)return t;s.push(t)}return s},set:function(e,t){var n,r,i=e.options,o=k.makeArray(t),a=i.length;while(a--)((r=i[a]).selected=-1<k.inArray(k.valHooks.option.get(r),o))&&(n=!0);return n||(e.selectedIndex=-1),o}}}}),k.each(["radio","checkbox"],function(){k.valHooks[this]={set:function(e,t){if(Array.isArray(t))return e.checked=-1<k.inArray(k(e).val(),t)}},y.checkOn||(k.valHooks[this].get=function(e){return null===e.getAttribute("value")?"on":e.value})}),y.focusin="onfocusin"in C;var Tt=/^(?:focusinfocus|focusoutblur)$/,Ct=function(e){e.stopPropagation()};k.extend(k.event,{trigger:function(e,t,n,r){var i,o,a,s,u,l,c,f,p=[n||E],d=v.call(e,"type")?e.type:e,h=v.call(e,"namespace")?e.namespace.split("."):[];if(o=f=a=n=n||E,3!==n.nodeType&&8!==n.nodeType&&!Tt.test(d+k.event.triggered)&&(-1<d.indexOf(".")&&(d=(h=d.split(".")).shift(),h.sort()),u=d.indexOf(":")<0&&"on"+d,(e=e[k.expando]?e:new k.Event(d,"object"==typeof e&&e)).isTrigger=r?2:3,e.namespace=h.join("."),e.rnamespace=e.namespace?new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,e.result=void 0,e.target||(e.target=n),t=null==t?[e]:k.makeArray(t,[e]),c=k.event.special[d]||{},r||!c.trigger||!1!==c.trigger.apply(n,t))){if(!r&&!c.noBubble&&!x(n)){for(s=c.delegateType||d,Tt.test(s+d)||(o=o.parentNode);o;o=o.parentNode)p.push(o),a=o;a===(n.ownerDocument||E)&&p.push(a.defaultView||a.parentWindow||C)}i=0;while((o=p[i++])&&!e.isPropagationStopped())f=o,e.type=1<i?s:c.bindType||d,(l=(Q.get(o,"events")||{})[e.type]&&Q.get(o,"handle"))&&l.apply(o,t),(l=u&&o[u])&&l.apply&&G(o)&&(e.result=l.apply(o,t),!1===e.result&&e.preventDefault());return e.type=d,r||e.isDefaultPrevented()||c._default&&!1!==c._default.apply(p.pop(),t)||!G(n)||u&&m(n[d])&&!x(n)&&((a=n[u])&&(n[u]=null),k.event.triggered=d,e.isPropagationStopped()&&f.addEventListener(d,Ct),n[d](),e.isPropagationStopped()&&f.removeEventListener(d,Ct),k.event.triggered=void 0,a&&(n[u]=a)),e.result}},simulate:function(e,t,n){var r=k.extend(new k.Event,n,{type:e,isSimulated:!0});k.event.trigger(r,null,t)}}),k.fn.extend({trigger:function(e,t){return this.each(function(){k.event.trigger(e,t,this)})},triggerHandler:function(e,t){var n=this[0];if(n)return k.event.trigger(e,t,n,!0)}}),y.focusin||k.each({focus:"focusin",blur:"focusout"},function(n,r){var i=function(e){k.event.simulate(r,e.target,k.event.fix(e))};k.event.special[r]={setup:function(){var e=this.ownerDocument||this,t=Q.access(e,r);t||e.addEventListener(n,i,!0),Q.access(e,r,(t||0)+1)},teardown:function(){var e=this.ownerDocument||this,t=Q.access(e,r)-1;t?Q.access(e,r,t):(e.removeEventListener(n,i,!0),Q.remove(e,r))}}});var Et=C.location,kt=Date.now(),St=/\?/;k.parseXML=function(e){var t;if(!e||"string"!=typeof e)return null;try{t=(new C.DOMParser).parseFromString(e,"text/xml")}catch(e){t=void 0}return t&&!t.getElementsByTagName("parsererror").length||k.error("Invalid XML: "+e),t};var Nt=/\[\]$/,At=/\r?\n/g,Dt=/^(?:submit|button|image|reset|file)$/i,jt=/^(?:input|select|textarea|keygen)/i;function qt(n,e,r,i){var t;if(Array.isArray(e))k.each(e,function(e,t){r||Nt.test(n)?i(n,t):qt(n+"["+("object"==typeof t&&null!=t?e:"")+"]",t,r,i)});else if(r||"object"!==w(e))i(n,e);else for(t in e)qt(n+"["+t+"]",e[t],r,i)}k.param=function(e,t){var n,r=[],i=function(e,t){var n=m(t)?t():t;r[r.length]=encodeURIComponent(e)+"="+encodeURIComponent(null==n?"":n)};if(null==e)return"";if(Array.isArray(e)||e.jquery&&!k.isPlainObject(e))k.each(e,function(){i(this.name,this.value)});else for(n in e)qt(n,e[n],t,i);return r.join("&")},k.fn.extend({serialize:function(){return k.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var e=k.prop(this,"elements");return e?k.makeArray(e):this}).filter(function(){var e=this.type;return this.name&&!k(this).is(":disabled")&&jt.test(this.nodeName)&&!Dt.test(e)&&(this.checked||!pe.test(e))}).map(function(e,t){var n=k(this).val();return null==n?null:Array.isArray(n)?k.map(n,function(e){return{name:t.name,value:e.replace(At,"\r\n")}}):{name:t.name,value:n.replace(At,"\r\n")}}).get()}});var Lt=/%20/g,Ht=/#.*$/,Ot=/([?&])_=[^&]*/,Pt=/^(.*?):[ \t]*([^\r\n]*)$/gm,Rt=/^(?:GET|HEAD)$/,Mt=/^\/\//,It={},Wt={},$t="*/".concat("*"),Ft=E.createElement("a");function Bt(o){return function(e,t){"string"!=typeof e&&(t=e,e="*");var n,r=0,i=e.toLowerCase().match(R)||[];if(m(t))while(n=i[r++])"+"===n[0]?(n=n.slice(1)||"*",(o[n]=o[n]||[]).unshift(t)):(o[n]=o[n]||[]).push(t)}}function _t(t,i,o,a){var s={},u=t===Wt;function l(e){var r;return s[e]=!0,k.each(t[e]||[],function(e,t){var n=t(i,o,a);return"string"!=typeof n||u||s[n]?u?!(r=n):void 0:(i.dataTypes.unshift(n),l(n),!1)}),r}return l(i.dataTypes[0])||!s["*"]&&l("*")}function zt(e,t){var n,r,i=k.ajaxSettings.flatOptions||{};for(n in t)void 0!==t[n]&&((i[n]?e:r||(r={}))[n]=t[n]);return r&&k.extend(!0,e,r),e}Ft.href=Et.href,k.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:Et.href,type:"GET",isLocal:/^(?:about|app|app-storage|.+-extension|file|res|widget):$/.test(Et.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":$t,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":JSON.parse,"text xml":k.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(e,t){return t?zt(zt(e,k.ajaxSettings),t):zt(k.ajaxSettings,e)},ajaxPrefilter:Bt(It),ajaxTransport:Bt(Wt),ajax:function(e,t){"object"==typeof e&&(t=e,e=void 0),t=t||{};var c,f,p,n,d,r,h,g,i,o,v=k.ajaxSetup({},t),y=v.context||v,m=v.context&&(y.nodeType||y.jquery)?k(y):k.event,x=k.Deferred(),b=k.Callbacks("once memory"),w=v.statusCode||{},a={},s={},u="canceled",T={readyState:0,getResponseHeader:function(e){var t;if(h){if(!n){n={};while(t=Pt.exec(p))n[t[1].toLowerCase()+" "]=(n[t[1].toLowerCase()+" "]||[]).concat(t[2])}t=n[e.toLowerCase()+" "]}return null==t?null:t.join(", ")},getAllResponseHeaders:function(){return h?p:null},setRequestHeader:function(e,t){return null==h&&(e=s[e.toLowerCase()]=s[e.toLowerCase()]||e,a[e]=t),this},overrideMimeType:function(e){return null==h&&(v.mimeType=e),this},statusCode:function(e){var t;if(e)if(h)T.always(e[T.status]);else for(t in e)w[t]=[w[t],e[t]];return this},abort:function(e){var t=e||u;return c&&c.abort(t),l(0,t),this}};if(x.promise(T),v.url=((e||v.url||Et.href)+"").replace(Mt,Et.protocol+"//"),v.type=t.method||t.type||v.method||v.type,v.dataTypes=(v.dataType||"*").toLowerCase().match(R)||[""],null==v.crossDomain){r=E.createElement("a");try{r.href=v.url,r.href=r.href,v.crossDomain=Ft.protocol+"//"+Ft.host!=r.protocol+"//"+r.host}catch(e){v.crossDomain=!0}}if(v.data&&v.processData&&"string"!=typeof v.data&&(v.data=k.param(v.data,v.traditional)),_t(It,v,t,T),h)return T;for(i in(g=k.event&&v.global)&&0==k.active++&&k.event.trigger("ajaxStart"),v.type=v.type.toUpperCase(),v.hasContent=!Rt.test(v.type),f=v.url.replace(Ht,""),v.hasContent?v.data&&v.processData&&0===(v.contentType||"").indexOf("application/x-www-form-urlencoded")&&(v.data=v.data.replace(Lt,"+")):(o=v.url.slice(f.length),v.data&&(v.processData||"string"==typeof v.data)&&(f+=(St.test(f)?"&":"?")+v.data,delete v.data),!1===v.cache&&(f=f.replace(Ot,"$1"),o=(St.test(f)?"&":"?")+"_="+kt+++o),v.url=f+o),v.ifModified&&(k.lastModified[f]&&T.setRequestHeader("If-Modified-Since",k.lastModified[f]),k.etag[f]&&T.setRequestHeader("If-None-Match",k.etag[f])),(v.data&&v.hasContent&&!1!==v.contentType||t.contentType)&&T.setRequestHeader("Content-Type",v.contentType),T.setRequestHeader("Accept",v.dataTypes[0]&&v.accepts[v.dataTypes[0]]?v.accepts[v.dataTypes[0]]+("*"!==v.dataTypes[0]?", "+$t+"; q=0.01":""):v.accepts["*"]),v.headers)T.setRequestHeader(i,v.headers[i]);if(v.beforeSend&&(!1===v.beforeSend.call(y,T,v)||h))return T.abort();if(u="abort",b.add(v.complete),T.done(v.success),T.fail(v.error),c=_t(Wt,v,t,T)){if(T.readyState=1,g&&m.trigger("ajaxSend",[T,v]),h)return T;v.async&&0<v.timeout&&(d=C.setTimeout(function(){T.abort("timeout")},v.timeout));try{h=!1,c.send(a,l)}catch(e){if(h)throw e;l(-1,e)}}else l(-1,"No Transport");function l(e,t,n,r){var i,o,a,s,u,l=t;h||(h=!0,d&&C.clearTimeout(d),c=void 0,p=r||"",T.readyState=0<e?4:0,i=200<=e&&e<300||304===e,n&&(s=function(e,t,n){var r,i,o,a,s=e.contents,u=e.dataTypes;while("*"===u[0])u.shift(),void 0===r&&(r=e.mimeType||t.getResponseHeader("Content-Type"));if(r)for(i in s)if(s[i]&&s[i].test(r)){u.unshift(i);break}if(u[0]in n)o=u[0];else{for(i in n){if(!u[0]||e.converters[i+" "+u[0]]){o=i;break}a||(a=i)}o=o||a}if(o)return o!==u[0]&&u.unshift(o),n[o]}(v,T,n)),s=function(e,t,n,r){var i,o,a,s,u,l={},c=e.dataTypes.slice();if(c[1])for(a in e.converters)l[a.toLowerCase()]=e.converters[a];o=c.shift();while(o)if(e.responseFields[o]&&(n[e.responseFields[o]]=t),!u&&r&&e.dataFilter&&(t=e.dataFilter(t,e.dataType)),u=o,o=c.shift())if("*"===o)o=u;else if("*"!==u&&u!==o){if(!(a=l[u+" "+o]||l["* "+o]))for(i in l)if((s=i.split(" "))[1]===o&&(a=l[u+" "+s[0]]||l["* "+s[0]])){!0===a?a=l[i]:!0!==l[i]&&(o=s[0],c.unshift(s[1]));break}if(!0!==a)if(a&&e["throws"])t=a(t);else try{t=a(t)}catch(e){return{state:"parsererror",error:a?e:"No conversion from "+u+" to "+o}}}return{state:"success",data:t}}(v,s,T,i),i?(v.ifModified&&((u=T.getResponseHeader("Last-Modified"))&&(k.lastModified[f]=u),(u=T.getResponseHeader("etag"))&&(k.etag[f]=u)),204===e||"HEAD"===v.type?l="nocontent":304===e?l="notmodified":(l=s.state,o=s.data,i=!(a=s.error))):(a=l,!e&&l||(l="error",e<0&&(e=0))),T.status=e,T.statusText=(t||l)+"",i?x.resolveWith(y,[o,l,T]):x.rejectWith(y,[T,l,a]),T.statusCode(w),w=void 0,g&&m.trigger(i?"ajaxSuccess":"ajaxError",[T,v,i?o:a]),b.fireWith(y,[T,l]),g&&(m.trigger("ajaxComplete",[T,v]),--k.active||k.event.trigger("ajaxStop")))}return T},getJSON:function(e,t,n){return k.get(e,t,n,"json")},getScript:function(e,t){return k.get(e,void 0,t,"script")}}),k.each(["get","post"],function(e,i){k[i]=function(e,t,n,r){return m(t)&&(r=r||n,n=t,t=void 0),k.ajax(k.extend({url:e,type:i,dataType:r,data:t,success:n},k.isPlainObject(e)&&e))}}),k._evalUrl=function(e,t){return k.ajax({url:e,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,converters:{"text script":function(){}},dataFilter:function(e){k.globalEval(e,t)}})},k.fn.extend({wrapAll:function(e){var t;return this[0]&&(m(e)&&(e=e.call(this[0])),t=k(e,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&t.insertBefore(this[0]),t.map(function(){var e=this;while(e.firstElementChild)e=e.firstElementChild;return e}).append(this)),this},wrapInner:function(n){return m(n)?this.each(function(e){k(this).wrapInner(n.call(this,e))}):this.each(function(){var e=k(this),t=e.contents();t.length?t.wrapAll(n):e.append(n)})},wrap:function(t){var n=m(t);return this.each(function(e){k(this).wrapAll(n?t.call(this,e):t)})},unwrap:function(e){return this.parent(e).not("body").each(function(){k(this).replaceWith(this.childNodes)}),this}}),k.expr.pseudos.hidden=function(e){return!k.expr.pseudos.visible(e)},k.expr.pseudos.visible=function(e){return!!(e.offsetWidth||e.offsetHeight||e.getClientRects().length)},k.ajaxSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};var Ut={0:200,1223:204},Xt=k.ajaxSettings.xhr();y.cors=!!Xt&&"withCredentials"in Xt,y.ajax=Xt=!!Xt,k.ajaxTransport(function(i){var o,a;if(y.cors||Xt&&!i.crossDomain)return{send:function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain||e["X-Requested-With"]||(e["X-Requested-With"]="XMLHttpRequest"),e)r.setRequestHeader(n,e[n]);o=function(e){return function(){o&&(o=a=r.onload=r.onerror=r.onabort=r.ontimeout=r.onreadystatechange=null,"abort"===e?r.abort():"error"===e?"number"!=typeof r.status?t(0,"error"):t(r.status,r.statusText):t(Ut[r.status]||r.status,r.statusText,"text"!==(r.responseType||"text")||"string"!=typeof r.responseText?{binary:r.response}:{text:r.responseText},r.getAllResponseHeaders()))}},r.onload=o(),a=r.onerror=r.ontimeout=o("error"),void 0!==r.onabort?r.onabort=a:r.onreadystatechange=function(){4===r.readyState&&C.setTimeout(function(){o&&a()})},o=o("abort");try{r.send(i.hasContent&&i.data||null)}catch(e){if(o)throw e}},abort:function(){o&&o()}}}),k.ajaxPrefilter(function(e){e.crossDomain&&(e.contents.script=!1)}),k.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(e){return k.globalEval(e),e}}}),k.ajaxPrefilter("script",function(e){void 0===e.cache&&(e.cache=!1),e.crossDomain&&(e.type="GET")}),k.ajaxTransport("script",function(n){var r,i;if(n.crossDomain||n.scriptAttrs)return{send:function(e,t){r=k("<script>").attr(n.scriptAttrs||{}).prop({charset:n.scriptCharset,src:n.url}).on("load error",i=function(e){r.remove(),i=null,e&&t("error"===e.type?404:200,e.type)}),E.head.appendChild(r[0])},abort:function(){i&&i()}}});var Vt,Gt=[],Yt=/(=)\?(?=&|$)|\?\?/;k.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var e=Gt.pop()||k.expando+"_"+kt++;return this[e]=!0,e}}),k.ajaxPrefilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Yt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType||"").indexOf("application/x-www-form-urlencoded")&&Yt.test(e.data)&&"data");if(a||"jsonp"===e.dataTypes[0])return r=e.jsonpCallback=m(e.jsonpCallback)?e.jsonpCallback():e.jsonpCallback,a?e[a]=e[a].replace(Yt,"$1"+r):!1!==e.jsonp&&(e.url+=(St.test(e.url)?"&":"?")+e.jsonp+"="+r),e.converters["script json"]=function(){return o||k.error(r+" was not called"),o[0]},e.dataTypes[0]="json",i=C[r],C[r]=function(){o=arguments},n.always(function(){void 0===i?k(C).removeProp(r):C[r]=i,e[r]&&(e.jsonpCallback=t.jsonpCallback,Gt.push(r)),o&&m(i)&&i(o[0]),o=i=void 0}),"script"}),y.createHTMLDocument=((Vt=E.implementation.createHTMLDocument("").body).innerHTML="<form></form><form></form>",2===Vt.childNodes.length),k.parseHTML=function(e,t,n){return"string"!=typeof e?[]:("boolean"==typeof t&&(n=t,t=!1),t||(y.createHTMLDocument?((r=(t=E.implementation.createHTMLDocument("")).createElement("base")).href=E.location.href,t.head.appendChild(r)):t=E),o=!n&&[],(i=D.exec(e))?[t.createElement(i[1])]:(i=we([e],t,o),o&&o.length&&k(o).remove(),k.merge([],i.childNodes)));var r,i,o},k.fn.load=function(e,t,n){var r,i,o,a=this,s=e.indexOf(" ");return-1<s&&(r=mt(e.slice(s)),e=e.slice(0,s)),m(t)?(n=t,t=void 0):t&&"object"==typeof t&&(i="POST"),0<a.length&&k.ajax({url:e,type:i||"GET",dataType:"html",data:t}).done(function(e){o=arguments,a.html(r?k("<div>").append(k.parseHTML(e)).find(r):e)}).always(n&&function(e,t){a.each(function(){n.apply(this,o||[e.responseText,t,e])})}),this},k.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(e,t){k.fn[t]=function(e){return this.on(t,e)}}),k.expr.pseudos.animated=function(t){return k.grep(k.timers,function(e){return t===e.elem}).length},k.offset={setOffset:function(e,t,n){var r,i,o,a,s,u,l=k.css(e,"position"),c=k(e),f={};"static"===l&&(e.style.position="relative"),s=c.offset(),o=k.css(e,"top"),u=k.css(e,"left"),("absolute"===l||"fixed"===l)&&-1<(o+u).indexOf("auto")?(a=(r=c.position()).top,i=r.left):(a=parseFloat(o)||0,i=parseFloat(u)||0),m(t)&&(t=t.call(e,n,k.extend({},s))),null!=t.top&&(f.top=t.top-s.top+a),null!=t.left&&(f.left=t.left-s.left+i),"using"in t?t.using.call(e,f):c.css(f)}},k.fn.extend({offset:function(t){if(arguments.length)return void 0===t?this:this.each(function(e){k.offset.setOffset(this,t,e)});var e,n,r=this[0];return r?r.getClientRects().length?(e=r.getBoundingClientRect(),n=r.ownerDocument.defaultView,{top:e.top+n.pageYOffset,left:e.left+n.pageXOffset}):{top:0,left:0}:void 0},position:function(){if(this[0]){var e,t,n,r=this[0],i={top:0,left:0};if("fixed"===k.css(r,"position"))t=r.getBoundingClientRect();else{t=this.offset(),n=r.ownerDocument,e=r.offsetParent||n.documentElement;while(e&&(e===n.body||e===n.documentElement)&&"static"===k.css(e,"position"))e=e.parentNode;e&&e!==r&&1===e.nodeType&&((i=k(e).offset()).top+=k.css(e,"borderTopWidth",!0),i.left+=k.css(e,"borderLeftWidth",!0))}return{top:t.top-i.top-k.css(r,"marginTop",!0),left:t.left-i.left-k.css(r,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var e=this.offsetParent;while(e&&"static"===k.css(e,"position"))e=e.offsetParent;return e||ie})}}),k.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(t,i){var o="pageYOffset"===i;k.fn[t]=function(e){return _(this,function(e,t,n){var r;if(x(e)?r=e:9===e.nodeType&&(r=e.defaultView),void 0===n)return r?r[i]:e[t];r?r.scrollTo(o?r.pageXOffset:n,o?n:r.pageYOffset):e[t]=n},t,e,arguments.length)}}),k.each(["top","left"],function(e,n){k.cssHooks[n]=ze(y.pixelPosition,function(e,t){if(t)return t=_e(e,n),$e.test(t)?k(e).position()[n]+"px":t})}),k.each({Height:"height",Width:"width"},function(a,s){k.each({padding:"inner"+a,content:s,"":"outer"+a},function(r,o){k.fn[o]=function(e,t){var n=arguments.length&&(r||"boolean"!=typeof e),i=r||(!0===e||!0===t?"margin":"border");return _(this,function(e,t,n){var r;return x(e)?0===o.indexOf("outer")?e["inner"+a]:e.document.documentElement["client"+a]:9===e.nodeType?(r=e.documentElement,Math.max(e.body["scroll"+a],r["scroll"+a],e.body["offset"+a],r["offset"+a],r["client"+a])):void 0===n?k.css(e,t,i):k.style(e,t,n,i)},s,n?e:void 0,n)}})}),k.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(e,n){k.fn[n]=function(e,t){return 0<arguments.length?this.on(n,null,e,t):this.trigger(n)}}),k.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),k.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,"**"):this.off(t,e||"**",n)}}),k.proxy=function(e,t){var n,r,i;if("string"==typeof t&&(n=e[t],t=e,e=n),m(e))return r=s.call(arguments,2),(i=function(){return e.apply(t||this,r.concat(s.call(arguments)))}).guid=e.guid=e.guid||k.guid++,i},k.holdReady=function(e){e?k.readyWait++:k.ready(!0)},k.isArray=Array.isArray,k.parseJSON=JSON.parse,k.nodeName=A,k.isFunction=m,k.isWindow=x,k.camelCase=V,k.type=w,k.now=Date.now,k.isNumeric=function(e){var t=k.type(e);return("number"===t||"string"===t)&&!isNaN(e-parseFloat(e))},"function"==typeof define&&define.amd&&define("jquery",[],function(){return k});var Qt=C.jQuery,Jt=C.$;return k.noConflict=function(e){return C.$===k&&(C.$=Jt),e&&C.jQuery===k&&(C.jQuery=Qt),k},e||(C.jQuery=C.$=k),k});
\ No newline at end of file
diff --git a/templates/dashboard.html b/templates/dashboard.html
index c3c694b..f4c3c61 100644
--- a/templates/dashboard.html
+++ b/templates/dashboard.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -25,354 +25,70 @@
 {##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
 {###}
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{#    It’s the ship that made the Kessel Run in less than 12 parsecs.    #}
+{#    It's the ship that made the Kessel Run in less than 12 parsecs.    #}
 {#    Sorry about the mess.    #}
 
 {% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section, automation_card, empty_state %}
 
-{% block additional_css %}
-
-{% endblock %}
 {% block title %}JAWA Dashboard{% endblock %}
 
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top">
+{{ hero_section(
+    title="JAWA Dashboard",
+    subtitle=(total_webhooks or '0')|string ~ " webhooks &middot; " ~ (total_cron or '0')|string ~ " timed automations &middot; <a href='" ~ session.get('url', '') ~ "' target='_blank' style='color: rgba(255,255,255,0.9);'>" ~ session.get('url', '') ~ "</a>",
+    create_url="/automations/jamfpro/new",
+    create_label="Create Webhook",
+    secondary_url="/templates",
+    secondary_label="Browse Templates"
+) }}
+<div class="container">
+    {% set ns = namespace(has_any=false) %}
+    {% for tag, data in categorized.items() %}
+        {% if data.get('items', []) %}{% set ns.has_any = true %}{% endif %}
+    {% endfor %}
+
+    {% if not ns.has_any %}
+        <div class="form-container">
+            {{ empty_state("No Jamf Pro webhooks to display.", "/automations/jamfpro/new") }}
+            {{ empty_state("No Okta webhooks to display.", "/automations/okta/new") }}
+            {{ empty_state("No Custom webhooks to display.", "/automations/custom/new") }}
+            {{ empty_state("No Timed Automations to display.", "/automations/cron/new") }}
         </div>
-        <div class="overflow-auto">
-            <div class="table-view overflow-auto">
-            <div class="d-flex justify-content-center">
-                <h4>JAWA Dashboard</h4>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Active JPS</b>: &nbsp; <a class="overflow-hidden" href="{{ session.get('url') }}"
-                                             target="_blank">{{ session['url'] }}</a> <br>
-            </div>
-            <div class="d-flex justify-content-center"><b>Setup Options</b>:
-                <a href="{{ url_for('setup') }}">Configure JAWA</a><br>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Total webhooks</b>: &nbsp;<a href="/webhooks">{{ total_webhooks or '0' }}</a> &nbsp;&nbsp;<strong>Active
-                JPS
-                webhooks</strong>: &nbsp;<a href="/webhooks/jamf">{{ jamfpro_list|length or '0' }}</a>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Total timed automations</b>: &nbsp;<a href="/cron">{{ total_cron or '0' }}</a><br>
-            </div>
+    {% else %}
+        {# Webhooks section #}
+        {% set webhook_tags = ['jamfpro', 'okta', 'custom'] %}
+        {% set wns = namespace(has_webhooks=false) %}
+        {% for tag in webhook_tags %}
+            {% if categorized.get(tag, {}).get('items', []) %}{% set wns.has_webhooks = true %}{% endif %}
+        {% endfor %}
+
+        {% if wns.has_webhooks %}
+        <div class="section-header">
+            <h3>Webhooks</h3>
+            <a href="/automations" style="font-size: 0.85rem; color: var(--color-primary);">View all</a>
         </div>
-    {% if not jamfpro_list and not okta_list and not custom_list and not cron_list %}
-        <div class="form-container">
-            <div class="table-view" style="max-width: fit-content; text-align: center">
-                <div class="table-responsive">
-                    No Jamf Pro webhooks to display. <a href="/webhooks/jamf/new">Create one now.</a>
-                </div>
-            </div>
-            <div class="table-view" style="max-width: fit-content; text-align: center;">
-                <div class="table-responsive">
-                   &nbsp; &nbsp; No Okta webhooks to display. <a href="/webhooks/okta/new">Create one now. &nbsp;</a>
-                </div>
-            </div>
-            <div class="table-view" style="max-width: fit-content; text-align: center;">
-                <div class="table-responsive">
-                    No Custom webhooks to display. <a href="/webhooks/custom/new">Create one now.</a>
-                </div>
-            </div>
-            <div class="table-view" style="max-width: fit-content; text-align: center;">
-                <div class="table-responsive">
-                    No Timed Automations to display. <a href="/cron/new">Create one now.</a>
-                </div>
-            </div>
+        <div class="row dash-list justify-content-center" style="margin-right: 0; margin-left: 0">
+            {% for tag in webhook_tags %}
+                {% for item in categorized.get(tag, {}).get('items', []) %}
+                    {{ automation_card(item, categorized[tag].handler, loop.index, tag) }}
+                {% endfor %}
+            {% endfor %}
         </div>
-    {% endif %}
-{#        <div class="form-container justify-content-center">#}
-            <div class="row dash-list justify-content-center" style="margin-right: 0; margin-left: 0">
-                {% if jamfpro_list %}
-                    {% for row in jamfpro_list %}
-                        {% if row.url == session['url'] %}
-                            <div class="card col-lg-auto webhooks-list container-bg border-info d-flex flex-column">
-                                <h4 class="overflow-hidden card-header font-weight-bolder">Jamf Pro</h4>
-                                <img src="/static/img/webhook.png" class="img img-circle img-fluid card-img mx-auto btn-padded">
-                                <div class="card-body flex-column d-flex webhooks-list">
-                                    <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                    <div class="modal-footer"></div>
-                                        <button class="btn btn-jawa text-white overflow-hidden stretched-link mt-auto"
-                                                title="{{ row.name }}" data-toggle="modal"
-                                                data-target="#automationDetails-{{ row.name }}">
-                                            View Details
-                                        </button>
-
-                                    <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                         role="dialog"
-                                         aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                                        <div class="modal-dialog modal-dialog-centered" role="document">
-                                            <div class="modal-content">
-                                                <div class="modal-header">
-                                                    <h5 class="modal-title text-center w-100"
-                                                        id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                    <button type="button" class="close" data-dismiss="modal"
-                                                            aria-label="Close">
-                                                        <span aria-hidden="true">&times;</span>
-                                                    </button>
-                                                </div>
-                                                <div class="modal-body text-left">
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                        <b>Automation name</b>: {{ row.name }} (<a
-                                                            href="{{ url }}/webhooks.html?id={{ row.jamf_id }}"
-                                                            target="_blank">View in Jamf</a>)
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Event</b>: {{ row.event }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Script path</b>: {{ row.script }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Description</b>: {{ row.description }}
-                                                    </div>
-
-                                                </div>
-                                                <div class="modal-footer">
-                                                    <button type="button" class="btn btn-secondary"
-                                                            data-dismiss="modal">
-                                                        Close
-                                                    </button>
-                                                    <a type="button" class="btn btn-jawa"
-                                                       href="../webhooks/jamf/edit?name={{ row.name }}">Edit</a>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-
-                            </div>
-                        {% endif %}
-                    {% endfor %}
-                {% endif %}
-                {% if okta_list %}
-                    {% for row in okta_list %}
-                        <div class="card col-lg-auto webhooks-list container-bg border-info d-flex"
-                             style="width: 10rem; padding: 3px; margin: 10px">
-                            <h4 class="overflow-hidden card-header font-weight-bolder">Okta</h4>
-                            <img src="/static/img/webhook.png" class="img img-circle img-fluid card-img mx-auto btn-padded">
-                            <div class="card-body flex-column d-flex webhooks-list">
-                                <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                <div class="modal-footer"></div>
-                                <button class="btn-jawa btn text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                        title="{{ row.name }}" data-toggle="modal" data-target="#automationDetailsOkta">
-                                    View Details
-                                </button>
-                                <div class="modal fade" id="automationDetailsOkta" tabindex="-1" role="dialog"
-                                     aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                                    <div class="modal-dialog modal-dialog-centered" role="document">
-                                        <div class="modal-content">
-                                            <div class="modal-header">
-                                                <h5 class="modal-title text-center w-100"
-                                                    id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                <button type="button" class="close" data-dismiss="modal"
-                                                        aria-label="Close">
-                                                    <span aria-hidden="true">&times;</span>
-                                                </button>
-                                            </div>
-                                            <div class="modal-body text-left">
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Automation name</b>: {{ row.name }}
-                                                </div>
+        {% endif %}
 
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Event</b>: {{ row.okta_event }}
-                                                </div>
-                                                <div class="overflow-auto log-frame text-break"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Script path</b>: {{ row.script }}
-                                                </div>
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Okta URL</b>: {{ row.okta_url }}
-                                                </div>
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Description</b>: {{ row.description }}
-                                                </div>
-                                            </div>
-                                            <div class="modal-footer">
-                                                <button type="button" class="btn btn-secondary" data-dismiss="modal">
-                                                    Close
-                                                </button>
-                                                <a type="button" class="btn btn-danger"
-                                                   href="../webhooks/delete?target_webhook={{ row.name }}">Delete</a>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    {% endfor %}
-
-                {% endif %}
-                {% if custom_list %}
-                    {% for row in custom_list %}
-                        {% if row.url == session['url'] %}
-                            <div class="card col-lg-auto webhooks-list container-bg border-info d-flex"
-                                 style="width: 10rem; padding: 3px; margin: 10px">
-                                <h4 class="overflow-hidden card-header font-weight-bolder">Custom</h4>
-                                <img src="/static/img/webhook.png" class="img img-circle img-fluid card-img mx-auto btn-padded">
-                                <div class="card-body flex-column d-flex webhooks-list">
-                                    <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                    <div class="modal-footer"></div>
-                                    <button class="btn-jawa btn text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                            title="{{ row.name }}" data-toggle="modal"
-                                            data-target="#automationDetails-{{ row.name }}">
-                                        View Details
-                                    </button>
-
-                                    <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                         role="dialog" aria-labelledby="automationDetailsCenterTitle"
-                                         aria-hidden="true">
-                                        <div class="modal-dialog modal-dialog-centered" role="document">
-                                            <div class="modal-content">
-                                                <div class="modal-header">
-                                                    <h5 class="modal-title text-center w-100"
-                                                        id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                    <button type="button" class="close" data-dismiss="modal"
-                                                            aria-label="Close">
-                                                        <span aria-hidden="true">&times;</span>
-                                                    </button>
-                                                </div>
-                                                <div class="modal-body text-left">
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                        <b>Automation name</b>: {{ row.name }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Script path</b>: {{ row.script }}
-                                                    </div>
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Description</b>: {{ row.description }}
-                                                    </div>
-
-                                                </div>
-                                                <div class="modal-footer">
-                                                    <button type="button" class="btn btn-secondary"
-                                                            data-dismiss="modal">
-                                                        Close
-                                                    </button>
-                                                    <a type="button" class="btn btn-jawa"
-                                                       href="../webhooks/custom/edit?name={{ row.name }}">Edit</a>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-
-                        {% endif %}
-                    {% endfor %}
-                {% endif %}
-
-                {% if cron_list %}
-                    {% for row in cron_list %}
-                        <div class="card col-lg-auto webhooks-list container-bg border-info d-flex"
-                             style="width: 10rem; padding: 3px; margin: 10px">
-                            <h4 class="overflow-hidden card-header font-weight-bolder">Cron</h4>
-                            <img src="/static/img/timed_automation.png"
-                                 class="img img-circle img-fluid card-img mx-auto btn-padded">
-                            <div class="card-body flex-column d-flex webhooks-list">
-                                <h6 class="overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                <div class="modal-footer"></div>
-                                <button class="btn btn-jawa text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                        title="{{ row.name }}" data-toggle="modal"
-                                        data-target="#automationDetails-{{ row.name }}">
-                                    View Details
-                                </button>
-                            </div>
-                            <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                 role="dialog" aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                                <div class="modal-dialog modal-dialog-centered" role="document">
-                                    <div class="modal-content">
-                                        <div class="modal-header">
-                                            <h5 class="modal-title text-center w-100"
-                                                id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                            <button type="button" class="close" data-dismiss="modal"
-                                                    aria-label="Close">
-                                                <span aria-hidden="true">&times;</span>
-                                            </button>
-                                        </div>
-                                        <div class="modal-body text-left">
-                                            <tr>
-                                                <td>
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                        <b>Automation name</b>: {{ row.name }}
-                                                    </div>
-                                                </td>
-
-                                                <td>
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Frequency</b>: {{ row.frequency }}
-                                                    </div>
-                                                </td>
-                                                <td>
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Script path</b>: {{ row.script }}
-                                                    </div>
-                                                </td>
-                                                <td>
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Description</b>: {{ row.description }}
-                                                    </div>
-                                                </td>
-                                            </tr>
-                                        </div>
-                                        <div class="modal-footer">
-                                            <button type="button" class="btn btn-secondary"
-                                                    data-dismiss="modal">
-                                                Close
-                                            </button>
-                                            <a type="button" class="btn btn-jawa"
-                                               href="../cron/edit?name={{ row.name }}">Edit</a>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    {% endfor %}
-                {% endif %}
+        {# Cron section #}
+        {% if categorized.get('cron', {}).get('items', []) %}
+        <div class="section-header mt-4">
+            <h3>Timed Automations</h3>
+            <a href="/automations/cron" style="font-size: 0.85rem; color: var(--color-primary);">View all</a>
         </div>
-    </div>
-
-{% endblock %}
-{% block additional_js %}
-    <script>
-        $(document).ready(function () {
-            $(".submit").click(function () {
-                $(".submit").addClass("loading");
-                setTimeout(function () {
-                    $(".submit").addClass("hide-loading");
-                    // For failed icon just replace ".done" with ".failed"
-                    $(".done").addClass("finish");
-                }, 1000000);
-                setTimeout(function () {
-                    $(".submit").removeClass("loading");
-                    $(".submit").removeClass("hide-loading");
-                    $(".done").removeClass("finish");
-                    $(".failed").removeClass("finish");
-                }, 1000000);
-            })
-        });
-    </script>
+        <div class="row dash-list justify-content-center" style="margin-right: 0; margin-left: 0">
+            {% for item in categorized.get('cron', {}).get('items', []) %}
+                {{ automation_card(item, categorized.cron.handler, loop.index, 'cron') }}
+            {% endfor %}
+        </div>
+        {% endif %}
+    {% endif %}
+</div>
 {% endblock %}
diff --git a/templates/error.html b/templates/error.html
index 455aa92..9b22a9e 100644
--- a/templates/error.html
+++ b/templates/error.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -29,9 +29,9 @@
 {% extends "shared/_layout.html" %}
 {% block title %}{{ error }}{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/dashboard">JAWA Dashboard</a></div>
+<div class="container" style="padding-top: 5rem;">
+    <div class="page-sub-nav">
+        <a href="/dashboard">JAWA Dashboard</a>
     </div>
     <div class="form-container">
         <div class="error">
@@ -40,12 +40,13 @@
                 <div class="success-wrap alert success-form">{{ error_message }}
                     {% if link %}<a href="{{ link }}" target="_blank">{{ link }}</a> {% endif %}</div>
                 <div class="text-center">
-                    <a type=submit onclick="history.back(-1)" value=Back
-                       class="btn btn-secondary button-align">&laquo;Back</a>
-                    <a href="/dashboard" type=submit value=Logout
+                    <button type="button" onclick="history.back(-1)"
+                       class="btn btn-secondary button-align">&laquo;Back</button>
+                    <a href="/dashboard"
                        class="btn btn-jawa button-align">Dashboard</a>
                 </div>
             </div>
         </div>
     </div>
+</div>
 {% endblock %}
\ No newline at end of file
diff --git a/templates/home.html b/templates/home.html
index d652103..9a5cf03 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -29,13 +29,12 @@
 {% extends "shared/_layout.html" %}
 {% block title %}JAWA Login{% endblock %}
 {% block content %}
-<div class="d-flex justify-content-center">
-<div class="alert login-form-container overflow-auto mx-auto my-auto">
+<div class="login-form-container overflow-auto mx-auto">
 
     <form action="/login" class="table-view" method="post">
         <div class="d-flex justify-content-center">
             <div style="max-width: 90%">
-                <img src="{{ url_for('static', filename='img/jawa_icon.png') }}" class="img-fluid"></div>
+                <img src="{{ url_for('static', filename='img/jawa_icon.png') }}" class="img-fluid" alt="JAWA"></div>
         </div>
         <h1 class="d-flex justify-content-center">{% if app_name %}{{ app_name }}{% else %}{% endif %}</h1>
         {% if error_message %}
@@ -50,21 +49,25 @@ <h1 class="d-flex justify-content-center">{% if app_name %}{{ app_name }}{% else
         {% endif %}
         {% if jsslock %}
             {% if jps_url2 %}
+                <label for="active_url" class="visually-hidden">Jamf Pro Server</label>
                 <select class="form-control text-center" name="active_url" id="active_url">
                     <option value="{{ jps_url }}">{{ jps_url }}</option>
                     <option value="{{ jps_url2 }}">{{ jps_url2 }}</option>
                 </select>
             {% endif %}
         {% else %}
-            <input name="url" type="url" placeholder="Jamf Pro URL" pattern="https?://.+" title="Use https://" required
+            <label for="login-url" class="visually-hidden">Jamf Pro URL</label>
+            <input id="login-url" name="url" type="url" placeholder="Jamf Pro URL" pattern="https?://.+" title="Use https://" required
                    class="form-control text-center" autofocus>
         {% endif %}
-        <input name="username" type="text" placeholder="Username" required class="form-control text-center" autofocus>
-        <input name="password" type="password" placeholder="Password" required class="form-control text-center">
+        <label for="login-username" class="visually-hidden">Username</label>
+        <input id="login-username" name="username" type="text" placeholder="Username" required class="form-control text-center" autofocus>
+        <label for="login-password" class="visually-hidden">Password</label>
+        <input id="login-password" name="password" type="password" placeholder="Password" required class="form-control text-center">
 
         <p>
         <div class="d-flex justify-content-center">
-            <input class="btn btn-jawa" type=submit value=Login>
+            <input class="btn btn-jawa" type="submit" value="Login">
         </div>
         </p>
         <p class="text-center">Please read the <a href="https://github.com/jamf/jawa/blob/main/README.md"
diff --git a/templates/log/home.html b/templates/log/home.html
index dc2cc44..c786b44 100644
--- a/templates/log/home.html
+++ b/templates/log/home.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -27,35 +27,237 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {% extends "shared/_layout.html" %}
 {% block title %}JAWA Log{% endblock %}
+
+{% block additional_css %}
+<style>
+    .log-toolbar {
+        display: flex;
+        gap: 0.5rem;
+        flex-wrap: wrap;
+        align-items: center;
+        margin-bottom: 0.75rem;
+    }
+    .log-toolbar .log-search {
+        flex: 1;
+        min-width: 180px;
+        padding: 0.35rem 0.75rem;
+        border: 1px solid rgba(255,255,255,0.15);
+        border-radius: var(--radius-pill);
+        background: rgba(255,255,255,0.06);
+        color: var(--color-code-text);
+        font-family: var(--font-mono);
+        font-size: 0.78rem;
+    }
+    .log-toolbar .log-search::placeholder {
+        color: rgba(255,255,255,0.3);
+    }
+    .log-toolbar .log-search:focus {
+        outline: none;
+        border-color: var(--color-primary);
+        box-shadow: 0 0 0 2px rgba(60,106,167,0.25);
+    }
+    .level-filter {
+        padding: 0.25rem 0.6rem;
+        border: 1px solid rgba(255,255,255,0.12);
+        border-radius: var(--radius-pill);
+        font-size: 0.7rem;
+        font-weight: 600;
+        letter-spacing: 0.05em;
+        background: transparent;
+        cursor: pointer;
+        transition: all 0.15s ease;
+    }
+    .level-filter.active { border-color: currentColor; }
+    .level-filter[data-level="all"]      { color: var(--color-code-text); }
+    .level-filter[data-level="all"].active { background: rgba(255,255,255,0.1); }
+    .level-filter[data-level="debug"]    { color: #8a95a3; }
+    .level-filter[data-level="debug"].active { background: rgba(138,149,163,0.15); }
+    .level-filter[data-level="info"]     { color: #89d185; }
+    .level-filter[data-level="info"].active  { background: rgba(137,209,133,0.15); }
+    .level-filter[data-level="warning"]  { color: #e5c07b; }
+    .level-filter[data-level="warning"].active { background: rgba(229,192,123,0.15); }
+    .level-filter[data-level="error"]    { color: #f97583; }
+    .level-filter[data-level="error"].active { background: rgba(249,117,131,0.15); }
+    .level-filter[data-level="critical"] { color: #ff5370; }
+    .level-filter[data-level="critical"].active { background: rgba(255,83,112,0.15); }
+
+    .log-lines {
+        list-style: none;
+        margin: 0;
+        padding: 0;
+        counter-reset: logline;
+    }
+    .log-line {
+        display: flex;
+        padding: 1px 0;
+        border-bottom: 1px solid rgba(255,255,255,0.03);
+        transition: background-color 0.1s ease;
+    }
+    .log-line:hover {
+        background: rgba(255,255,255,0.04);
+    }
+    .log-line.highlight {
+        background: rgba(60,106,167,0.2);
+    }
+    .log-gutter {
+        flex-shrink: 0;
+        width: 3.5rem;
+        text-align: right;
+        padding-right: 0.75rem;
+        color: rgba(255,255,255,0.18);
+        user-select: none;
+        border-right: 1px solid rgba(255,255,255,0.06);
+        margin-right: 0.75rem;
+    }
+    .log-content {
+        flex: 1;
+        min-width: 0;
+        white-space: pre-wrap;
+        word-break: break-all;
+    }
+    /* Rainbow token colors */
+    .log-ts     { color: #78c8e6; }
+    .log-name   { color: #c792ea; }
+    .log-sep    { color: #5a6978; }
+    .log-msg    { color: var(--color-code-text); }
+    .log-level-debug    { color: #8a95a3; }
+    .log-level-info     { color: #89d185; font-weight: 600; }
+    .log-level-warning  { color: #e5c07b; font-weight: 600; }
+    .log-level-error    { color: #f97583; font-weight: 600; }
+    .log-level-critical { color: #ff5370; font-weight: 700; text-shadow: 0 0 6px rgba(255,83,112,0.4); }
+
+    .log-line-error   { border-left: 2px solid #f97583; padding-left: 0.5rem; }
+    .log-line-warning { border-left: 2px solid #e5c07b; padding-left: 0.5rem; }
+    .log-line-critical { border-left: 2px solid #ff5370; padding-left: 0.5rem; background: rgba(255,83,112,0.06); }
+
+    .log-count {
+        font-size: 0.72rem;
+        color: rgba(255,255,255,0.4);
+        margin-left: auto;
+        padding-left: 1rem;
+        white-space: nowrap;
+    }
+</style>
+{% endblock %}
+
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="{{ url_for('resources_view.files') }}">Files</a></div>
-        <div class="stat"><a href="{{ url_for('log_view.log_home') }}">Log</a></div>
+<div class="hero-section">
+    <div class="container">
+        <h2>Application Log</h2>
+        <p>View, search, and filter JAWA log entries.</p>
+        <div class="hero-cta">
+            <a href="/log/download" class="btn btn-hero-primary">Download Log</a>
+            <a href="{{ url_for('resources_view.files') }}" class="btn btn-hero-secondary">Files</a>
+        </div>
     </div>
+</div>
+<div class="container-fluid" style="max-width: 1800px; padding-left: 2rem; padding-right: 2rem;">
 
-    <div class="log-container">
 
+    <div class="log-container">
         <div class="log-view">
-            <div class="alert-warning overflow-auto log-frame success-wrap flex-column-reverse d-flex">
+            <div class="log-toolbar">
+                <input type="text" class="log-search" id="logSearch" placeholder="Search logs...">
+                <button class="level-filter active" data-level="all" onclick="filterLevel('all', this)">ALL</button>
+                <button class="level-filter" data-level="debug" onclick="filterLevel('debug', this)">DEBUG</button>
+                <button class="level-filter" data-level="info" onclick="filterLevel('info', this)">INFO</button>
+                <button class="level-filter" data-level="warning" onclick="filterLevel('warning', this)">WARNING</button>
+                <button class="level-filter" data-level="error" onclick="filterLevel('error', this)">ERROR</button>
+                <button class="level-filter" data-level="critical" onclick="filterLevel('critical', this)">CRITICAL</button>
+                <span class="log-count" id="logCount"></span>
+            </div>
+            <div class="overflow-auto log-frame">
+                <ul class="log-lines" id="logLines">
                 {% if log %}
                     {% for line in log %}
-                        <div class="inner">{{ line }}</div><br>
+                    <li class="log-line" data-raw="{{ line }}">
+                        <span class="log-gutter">{{ loop.index }}</span>
+                        <span class="log-content">{{ line }}</span>
+                    </li>
                     {% endfor %}
                 {% endif %}
-            </div>
-            <div class="download-button">
-                <div class="btn-group-sm">
-                    <button class="btn btn-light" onClick="window.location.reload();"><span
-                            class="glyphicon glyphicon-refresh"></span> Refresh
-                    </button>
-
-
-                    <a href="/log/download" button type=submit class="btn btn-jawa button-align">Download
-                        &raquo;</a>
-                </div>
+                </ul>
             </div>
         </div>
     </div>
+</div>
+{% endblock %}
+
+{% block additional_js %}
+<script>
+(function() {
+    var LOG_RE = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d+)( - )([\w.]+)( - )(DEBUG|INFO|WARNING|ERROR|CRITICAL)( - )([\s\S]*)$/;
+    var lines = document.querySelectorAll('.log-line');
+    var activeLevel = 'all';
+    var searchTerm = '';
+
+    lines.forEach(function(li) {
+        var raw = li.getAttribute('data-raw') || li.querySelector('.log-content').textContent;
+        var m = raw.match(LOG_RE);
+        if (m) {
+            var levelLower = m[5].toLowerCase();
+            li.setAttribute('data-level', levelLower);
+            var levelClass = 'log-level-' + levelLower;
+            var lineClass = '';
+            if (levelLower === 'error' || levelLower === 'warning' || levelLower === 'critical') {
+                lineClass = ' log-line-' + levelLower;
+            }
+            if (lineClass) li.className = 'log-line' + lineClass;
+            li.querySelector('.log-content').innerHTML =
+                '<span class="log-ts">' + esc(m[1]) + '</span>' +
+                '<span class="log-sep">' + esc(m[2]) + '</span>' +
+                '<span class="log-name">' + esc(m[3]) + '</span>' +
+                '<span class="log-sep">' + esc(m[4]) + '</span>' +
+                '<span class="' + levelClass + '">' + esc(m[5]) + '</span>' +
+                '<span class="log-sep">' + esc(m[6]) + '</span>' +
+                '<span class="log-msg">' + esc(m[7]) + '</span>';
+        } else {
+            li.setAttribute('data-level', 'info');
+        }
+    });
+
+    function esc(s) {
+        var d = document.createElement('div');
+        d.appendChild(document.createTextNode(s));
+        return d.innerHTML;
+    }
+
+    function applyFilters() {
+        var visible = 0;
+        var total = lines.length;
+        lines.forEach(function(li) {
+            var levelMatch = (activeLevel === 'all' || li.getAttribute('data-level') === activeLevel);
+            var raw = (li.getAttribute('data-raw') || '').toLowerCase();
+            var searchMatch = (!searchTerm || raw.indexOf(searchTerm) !== -1);
+            if (levelMatch && searchMatch) {
+                li.style.display = '';
+                visible++;
+                if (searchTerm) {
+                    li.classList.add('highlight');
+                } else {
+                    li.classList.remove('highlight');
+                }
+            } else {
+                li.style.display = 'none';
+                li.classList.remove('highlight');
+            }
+        });
+        document.getElementById('logCount').textContent = visible + ' / ' + total + ' lines';
+    }
+
+    window.filterLevel = function(level, btn) {
+        activeLevel = level;
+        document.querySelectorAll('.level-filter').forEach(function(b) { b.classList.remove('active'); });
+        btn.classList.add('active');
+        applyFilters();
+    };
+
+    document.getElementById('logSearch').addEventListener('input', function() {
+        searchTerm = this.value.toLowerCase();
+        applyFilters();
+    });
 
+    applyFilters();
+})();
+</script>
 {% endblock %}
diff --git a/templates/resources/delete.html b/templates/resources/delete.html
index 4b5ef7c..c72c0ee 100644
--- a/templates/resources/delete.html
+++ b/templates/resources/delete.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -28,13 +28,13 @@
 {% extends "shared/_layout.html" %}
 {% block title %}Confirm Delete{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/resources/files">Files</a></div>
-        <div class="stat"><a href="/log/home.html">Log</a></div>
+<div class="container" style="padding-top: 5rem;">
+    <div class="page-sub-nav">
+        <a href="/resources/files">Files</a>
+        <a href="/log/home.html">Log</a>
     </div>
     <div class="form-container">
-        <form action="#" method="POST" class="table-view"
+        <form action="#" method="POST" class="form-section"
               enctype="multipart/form-data">
             <h1>Confirm Delete:</h1>
             <div class="font-weight-bold text-center">Resource file -
@@ -57,6 +57,5 @@ <h1>Confirm Delete:</h1>
 
                     </button>
                 </div>
-{% endblock %}
-</div>
-</body>
\ No newline at end of file
+    </div>
+{% endblock %}
\ No newline at end of file
diff --git a/templates/resources/files.html b/templates/resources/files.html
index dd9d79f..bad112f 100644
--- a/templates/resources/files.html
+++ b/templates/resources/files.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2023 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -28,30 +28,32 @@
 {% extends "shared/_layout.html" %}
 {% block title %}JAWA Resource Files{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="{{ url_for('resources_view.files') }}">Files</a></div>
-        <div class="stat"><a href="{{ url_for('log_view.log_home') }}">Log</a></div>
+<div class="hero-section">
+    <div class="container">
+        <h2>Resource Files</h2>
+        <p>Upload, download, and manage script resources.</p>
+        <div class="hero-cta">
+            <a href="{{ url_for('log_view.log_home') }}" class="btn btn-hero-secondary">View Log</a>
+        </div>
     </div>
+</div>
+<div class="container">
     <div class="form-container">
-        <div class="table-view" style="max-width: fit-content">
+        <div class="form-section" style="max-width: fit-content">
             <div class="overflow-auto pre-scrollable" style="max-width: 100vw">
             <h4 class="d-flex justify-content-center alert-jawa" style="max-width: 100vw">Upload a file</h4>
             <p>Files directory:
             <pre><code>{{ files_repo }}/</code></pre>
             </p>
             <form action="#" method="post" enctype="multipart/form-data">
-                <div class="d-flex justify-content-center text-center custom-file">
-                    <input type="file" name="upload"  class="custom-file-input text-center"
-                           formenctype="multipart/form-data" id="upload" value="Upload"/> <br/>
-                    <div class="d-flex justify-content-center">
-                        <label class="custom-file-label text-center">Upload a file</label>
-                        <input type="submit" class=" btn btn-jawa" value="Upload" disabled
-                               style="margin: 5px; padding: 5px; width: 150px"/>
-                    </div>
+                <div class="mb-3">
+                    <input type="file" name="upload" class="form-control"
+                           formenctype="multipart/form-data" id="file-upload"/>
+                </div>
+                <div class="d-flex justify-content-center">
+                    <input type="submit" id="file-submit" class="btn btn-jawa" value="Upload" disabled
+                           style="margin: 5px; padding: 5px; width: 150px"/>
                 </div>
-                <input type="submit" class=" btn btn-jawa d-flex justify-content-center mx-auto" value="Upload" disabled
-                       style="margin: 5px; padding: 5px; width: 150px"/>
             </form>
         </div>
     </div>
@@ -90,30 +92,12 @@ <h4 class="d-flex justify-content-center alert-jawa">Uploaded files</h4>
             </div>
         </form>
     {% endif %}
+</div>
 {% endblock %}
 {% block additional_js %}
-    <script>
-        $(function () {
-            $("#upload_link").on('click', function (e) {
-                e.preventDefault();
-                $("#upload:hidden").trigger('click');
-            });
-        });
-        $(document).ready(
-            function () {
-                $('input:file').change(
-                    function () {
-                        if ($(this).val()) {
-                            $('input:submit').attr('disabled', false);
-                        }
-                    }
-                );
-            });
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
+<script>
+document.getElementById('file-upload').addEventListener('change', function() {
+    document.getElementById('file-submit').disabled = !this.value;
+});
+</script>
 {% endblock %}
\ No newline at end of file
diff --git a/templates/setup/branding.html b/templates/setup/branding.html
index c3a5dff..875f809 100644
--- a/templates/setup/branding.html
+++ b/templates/setup/branding.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -29,37 +29,42 @@
 {% extends "shared/_layout.html" %}
 {% block title %}JAWA Resource Files{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/setup">Setup</a></div>
-        <div class="stat"><a href="/cleanup">Cleanup</a></div>
-        <div class="stat"><a href="/branding">Branding</a></div>
+<div class="hero-section">
+    <div class="container">
+        <h2>Branding</h2>
+        <p>Customize your JAWA instance name and icon.</p>
+        <div class="hero-cta">
+            <a href="/setup" class="btn btn-hero-secondary">Setup</a>
+            <a href="/cleanup" class="btn btn-hero-secondary">Cleanup</a>
+            <a href="/setup/credentials" class="btn btn-hero-secondary">Credentials</a>
+        </div>
     </div>
+</div>
+<div class="container">
     <div class="form-container">
-        <div class="table-view log-frame overflow-auto" style="max-width: 42rem ; max-height: 66vh">
+        <div class="form-section log-frame overflow-auto" style="max-width: 42rem ; max-height: 66vh">
 
-            <h1 class="d-flex justify-content-center">
-                {% if app_name %}{{ app_name }}{% else %}JAWA{% endif %} Branding</h1>
             <div class="d-flex justify-content-center">
 
                 <form action="#" method="post" enctype="multipart/form-data">
                     <p>
                     <div class="d-flex justify-content-center">
                         <div class="img-thumbnail" style="max-width: 15vh">
-                            <img class="img-thumbnail align-items-center" src="/static/img/jawa_icon.png"><br/>
+                            <img class="img-thumbnail align-items-center" src="/static/img/jawa_icon.png" alt="App icon"><br/>
                         </div>
                     </div>
                     <div class="d-flex justify-content-center">
-                        <input id="upload" type="file" accept="image/*" name="upload" class="justify-content-center"
-                               formenctype="multipart/form-data" style="display:block"/>
-                        {#            <a href="#" id="upload_link">Upload files</a>#}
+                        <label for="brand-image-upload" class="visually-hidden">Upload app icon</label>
+                        <input id="brand-image-upload" type="file" accept="image/*" name="upload" class="form-control"
+                               formenctype="multipart/form-data"/>
                     </div>
                     </p>
                     <p>
                     <div class="d-flex justify-content-center">
-                        <input id="upload" type="text" placeholder="Change App Name" accept="image/*"
+                        <label for="brand-name-input" class="visually-hidden">App name</label>
+                        <input id="brand-name-input" type="text" placeholder="Change App Name"
                                name="new_name" value="{% if app_name %}{{ app_name }}{% endif %}"
-                               formenctype="multipart/form-data"/>
+                               class="form-control"/>
                     </div>
                     <br/>
                     <div class="d-flex justify-content-center">
@@ -69,23 +74,5 @@ <h1 class="d-flex justify-content-center">
             </div>
         </div>
     </div>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        $(function () {
-            $("#upload_link").on('click', function (e) {
-                e.preventDefault();
-                $("#upload:hidden").trigger('click');
-            });
-        });
-        $(document).ready(
-            function () {
-                $('input:file').change(
-                    function () {
-                        if ($(this).val()) {
-                            $('input:submit').attr('disabled', false);
-                        }
-                    }
-                );
-            });</script>
+</div>
 {% endblock %}
\ No newline at end of file
diff --git a/templates/setup/cleanup.html b/templates/setup/cleanup.html
index be65c4c..36ff3ee 100644
--- a/templates/setup/cleanup.html
+++ b/templates/setup/cleanup.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2023 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -29,15 +29,21 @@
 {% extends "shared/_layout.html" %}
 {% block title %}Cleanup Scripts{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/setup">Setup</a></div>
-        <div class="stat"><a href="/cleanup">Cleanup</a></div>
-        <div class="stat"><a href="/branding">Branding</a></div>
+<div class="hero-section">
+    <div class="container">
+        <h2>Cleanup</h2>
+        <p>Remove orphaned scripts and unused files.</p>
+        <div class="hero-cta">
+            <a href="/setup" class="btn btn-hero-secondary">Setup</a>
+            <a href="/branding" class="btn btn-hero-secondary">Branding</a>
+            <a href="/setup/credentials" class="btn btn-hero-secondary">Credentials</a>
+        </div>
     </div>
+</div>
+<div class="container">
     <div class="form-container">
 
-    <form method="post" action="/cleanup" class="table-view overflow-auto" enctype="multipart/form-data"
+    <form method="post" action="/cleanup" class="form-section overflow-auto" enctype="multipart/form-data"
           style="max-height: 66vh; max-width: 66vh">
         <h1 class="text-center">Cleanup</h1>
 {#        <p class="text-center">- Click "Clean Up!" to remove all old scripts.#}
@@ -66,23 +72,6 @@ <h6 class="text-center">
                     </div>
 
     </form>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        $(document).ready(function () {
-            $(".submit").click(function () {
-                $(".submit").addClass("loading");
-                setTimeout(function () {
-                    $(".submit").addClass("hide-loading");
-                    $(".done").addClass("finish");
-                }, 1000000);
-                setTimeout(function () {
-                    $(".submit").removeClass("loading");
-                    $(".submit").removeClass("hide-loading");
-                    $(".done").removeClass("finish");
-                    $(".failed").removeClass("finish");
-                }, 1000000);
-            })
-        });
-    </script>
+</div>
+</div>
 {% endblock %}
diff --git a/templates/setup/setup.html b/templates/setup/setup.html
index 7135e7e..93c0500 100644
--- a/templates/setup/setup.html
+++ b/templates/setup/setup.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -29,66 +29,55 @@
 {% extends "shared/_layout.html" %}
 {% block title %}JAWA Setup{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/setup">Setup</a></div>
-        <div class="stat"><a href="/cleanup">Cleanup</a></div>
-        <div class="stat"><a href="/branding">Branding</a></div>
+<div class="hero-section">
+    <div class="container">
+        <h2>Server Setup</h2>
+        <p>Configure JAWA server settings and integrations.</p>
+        <div class="hero-cta">
+            <a href="/cleanup" class="btn btn-hero-secondary">Cleanup</a>
+            <a href="/branding" class="btn btn-hero-secondary">Branding</a>
+            <a href="/setup/credentials" class="btn btn-hero-secondary">Credentials</a>
+        </div>
     </div>
+</div>
+<div class="container">
     <div class="form-container overflow-auto" style="max-height: 60vh">
         <div class="d-flex justify-content-center">
-            <div class="table-view log-frame overflow-auto" style="max-width: 100vh; max-height: 66vh">
-
-                <h1 class="d-flex justify-content-center">Server Setup</h1>
+            <div class="form-section log-frame overflow-auto" style="max-width: 100vh; max-height: 66vh">
 
-                <label class="text-center justify-content-center">
+                <p class="text-center justify-content-center">
                     Please read the <a href="https://github.com/jamf/JAWA/blob/main/README.md" style="color:#3c6aa7;"
                                        target="_blank">documentation</a> prior to using JAWA.
-
-                </label>
+                </p>
                 <form method="post" action="/setup" enctype="multipart/form-data">
 
-                    <input type="text" class="form-control text-center" name="address" pattern="https?://.+" title="Use https://"
+                    <label for="jawa-address" class="visually-hidden">JAWA Server Address FQDN</label>
+                    <input id="jawa-address" type="text" class="form-control text-center" name="address" pattern="https?://.+" title="Use https://"
                            value="{{ jawa_url if jawa_url }}" placeholder="JAWA Server Address FQDN" required autofocus>
 
-                    <div class="form-group form-check text-center">
+                    <div class="mb-3 form-check text-center">
                         <input type="checkbox" class="form-check-input text-center" name="jss-lock" id="jss-lock"
                                value={{ jps_url }} checked>
-                        <label class="form-check-label text-center" for="exampleCheck1"> Lock your JAWA to {{ jps_url }}</label>
+                        <label class="form-check-label text-center" for="jss-lock"> Lock your JAWA to {{ jps_url }}</label>
                     </div>
 
 
-                    {% if not jps_url2 %}
-                        <div class="form-group form-check text-center">
-                            <input type="checkbox" class="form-check-input" name="alternate-jps" id="alternate-jps"
-                                   value="enabled">
-                            <label class="form-check-label" for="exampleCheck1">Add an alternate Jamf Pro Server:</label>
-                        </div>
-
-                        <input type="text" class="form-control text-center" placeholder="Alternate Jamf Pro Server URL"
-                               name="alternate"
-                               pattern="https?://.+"
-                               title="Use https://"
-                               value="{{ jps_url2 if jps_url2 }}">
-                    {% else %}
-                        <div class="form-group form-check text-center">
-                            <input type="checkbox" class="form-check-input" name="alternate-jps" id="alternate-jps"
-                                   value="enabled"
-                                   checked>
-                            <label class="form-check-label" for="exampleCheck1">Add an alternate Jamf Pro Server:</label>
-                        </div>
-
-                        <input type="text" class="form-control text-center" placeholder="Alternate Jamf Pro Server URL" name="alternate"
-                               pattern="https?://.+"
-                               title="Use https://"
-                               value="{{ jps_url2 if jps_url2 }}">
-
-
+                    <div class="mb-3 form-check text-center">
+                        <input type="checkbox" class="form-check-input" name="alternate-jps" id="alternate-jps"
+                               value="enabled" {% if jps_url2 %}checked{% endif %}>
+                        <label class="form-check-label" for="alternate-jps">Add an alternate Jamf Pro Server:</label>
+                    </div>
 
-                    {% endif %}
+                    <label for="alternate-jps-url" class="visually-hidden">Alternate Jamf Pro Server URL</label>
+                    <input id="alternate-jps-url" type="text" class="form-control text-center"
+                           placeholder="Alternate Jamf Pro Server URL"
+                           name="alternate"
+                           pattern="https?://.+"
+                           title="Use https://"
+                           value="{{ jps_url2 if jps_url2 }}">
 
                     <div class="d-flex justify-content-center container-fluid">
-                        <button type=submit value="Setup" class="btn btn-jawa btn-padded">
+                        <button type="submit" value="Setup" class="btn btn-jawa btn-padded">
                             Setup
                         </button>
                     </div>
@@ -98,25 +87,6 @@ <h1 class="d-flex justify-content-center">Server Setup</h1>
     </div>
 
 
-    </form>
     </div>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        $(document).ready(function () {
-            $(".submit").click(function () {
-                $(".submit").addClass("loading");
-                setTimeout(function () {
-                    $(".submit").addClass("hide-loading");
-                    $(".done").addClass("finish");
-                }, 1000000);
-                setTimeout(function () {
-                    $(".submit").removeClass("loading");
-                    $(".submit").removeClass("hide-loading");
-                    $(".done").removeClass("finish");
-                    $(".failed").removeClass("finish");
-                }, 1000000);
-            })
-        });
-    </script>
+</div>
 {% endblock %}
diff --git a/templates/success.html b/templates/success.html
index f0a494e..bbb2f22 100644
--- a/templates/success.html
+++ b/templates/success.html
@@ -1,6 +1,6 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
+{## Copyright (c) 2026 Jamf.  All rights reserved.#}
 {###}
 {##       Redistribution and use in source and binary forms, with or without#}
 {##       modification, are permitted provided that the following conditions are met:#}
@@ -29,9 +29,9 @@
 {% extends "shared/_layout.html" %}
 {% block title %}Success!{% endblock %}
 {% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/dashboard">JAWA Dashboard</a></div>
+<div class="container" style="padding-top: 5rem;">
+    <div class="page-sub-nav">
+        <a href="/dashboard">JAWA Dashboard</a>
     </div>
     <div class="form-container">
     <form method="get" class="table-view success-view" action="/dashboard">
@@ -54,11 +54,12 @@ <h3 class="alert-jawa border text-center">Success!</h3>
         {% endif %}
         </div>
             <div class="d-flex justify-content-center">
-                <a type=submit onclick="history.back(-1)" value=Back
-                       class="btn btn-secondary button-align">&laquo;Back</a>
+                <button type="button" onclick="history.back(-1)"
+                       class="btn btn-secondary button-align">&laquo;Back</button>
                 <button type="submit" class="btn btn-jawa">
                     Dashboard<i class="fa" aria-hidden="true"></i>
                 </button>
             </div>
     </form>
+</div>
 {% endblock %}
diff --git a/views/home_view.py b/views/home_view.py
index cf4356e..824e185 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -1,6 +1,6 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 #
-# Copyright (c) 2022 Jamf.  All rights reserved.
+# Copyright (c) 2026 Jamf.  All rights reserved.
 #
 #       Redistribution and use in source and binary forms, with or without
 #       modification, are permitted provided that the following conditions are met:
@@ -29,7 +29,6 @@
 import base64
 import json
 import os
-from collections import defaultdict
 from typing import Union
 
 import requests
@@ -74,6 +73,70 @@
 
 blueprint = Blueprint("home_view", __name__, template_folder="templates")
 
+LOGOUT_ENDPOINT = "home_view.logout"
+DASHBOARD_ENDPOINT = "home_view.dashboard"
+HOME_TEMPLATE = "home.html"
+ERROR_TITLE_SESSION = "Session Timed Out"
+ERROR_MSG_SIGN_IN = "Please sign in again"
+
+
+def _resolve_url_from_server(form, server_json: dict) -> str:
+    """Determine the Jamf Pro URL from form data and server config."""
+    if form.get("active_url"):
+        return str(form.get("active_url"))
+    jps_url = server_json.get("jps_url")
+    if jps_url:
+        return str(jps_url)
+    return _strip_trailing_slash(form.get("url", ""))
+
+
+def _strip_trailing_slash(url: str) -> str:
+    """Remove a trailing slash from a URL string."""
+    return url.rstrip("/") if url.endswith("/") else url
+
+
+def _login_error(title: str, message) -> Response:
+    """Redirect to logout with an error."""
+    return redirect(
+        url_for(LOGOUT_ENDPOINT, error_title=title, error_message=message)
+    )
+
+
+def _validate_credentials() -> Union[Response, None]:
+    """Validate password and token, returning a redirect on failure."""
+    if request.form["password"] == "":
+        return _login_error("Authentication error", "Passwords can't be blank")
+    if not session.get("token"):
+        return _login_error("Could not fetch token", "try again")
+    return None
+
+
+def _verify_jamf_access() -> Union[Response, None]:
+    """Verify Jamf Pro API access, returning a redirect on failure."""
+    try:
+        resp = requests.get(
+            session["url"] + "/JSSResource/activationcode",
+            headers={
+                "Accept": "application/json",
+                "Authorization": f"Bearer {session.get('token')}",
+                "User-Agent": "JAWA%20v3.1.1",
+            },
+            verify=verify_ssl,
+        )
+        resp.raise_for_status()
+    except requests.exceptions.HTTPError as err:
+        logthis.info(f"Error occurred: {err}")
+        return _login_error(
+            "Login error", "check account credentials and privileges"
+        )
+    except requests.exceptions.ConnectTimeout as err:
+        logthis.info(f"Error occurred: {err}")
+        return _login_error("Connection Timeout", err)
+    except requests.exceptions.ConnectionError as err:
+        logthis.info(f"Error occurred: {err}")
+        return _login_error("HTTP Error", err)
+    return None
+
 
 @blueprint.route("/login", methods=["GET", "POST"])
 def login() -> Response:
@@ -81,27 +144,12 @@ def login() -> Response:
         if os.path.isfile(server_file):
             with open(server_file) as json_file:
                 server_json = json.load(json_file)
-            if request.form.get("active_url"):
-                session["url"] = str(request.form.get("active_url"))
-            elif server_json.get("jps_url", 0):
-                if (
-                    server_json["jps_url"] is not None
-                    and len(server_json["jps_url"]) != 0
-                ):
-                    session["url"] = str(server_json["jps_url"])
-            elif request.form.get("url")[-1:] == "/":
-                session["url"] = str(request.form.get("url")).rstrip(
-                    request.form.get("url")[-1]
-                )
-            else:
-                session["url"] = request.form["url"]
-
-        elif request.form.get("active_url")[-1:] == "/":
-            session["url"] = str(request.form.get("url")).rstrip(
-                request.form.get("url")[-1]
+            session["url"] = _resolve_url_from_server(
+                request.form, server_json
             )
         else:
-            session["url"] = request.form["url"]
+            session["url"] = _strip_trailing_slash(request.form.get("url", ""))
+
         session["username"] = request.form["username"]
         session["password"] = request.form["password"]
         session["b64_auth"] = base64.b64encode(
@@ -109,83 +157,35 @@ def login() -> Response:
         )
         get_token()
         logthis.info(
-            f"[{session.get('url')}] Attempting login for: {session.get('username')}"
+            f"[{session.get('url')}] Attempting login for: "
+            f"{session.get('username')}"
         )
 
-        if request.form["password"] == "":
-            title = "Authentication error"
-            msg = "Passwords can't be blank"
-            return redirect(
-                url_for(
-                    "home_view.logout", error_title=title, error_message=msg
-                )
-            )
-        if not session.get("token"):
-            return redirect(
-                url_for(
-                    "home_view.logout",
-                    error_title="Could not fetch token",
-                    error_message="try again",
-                )
-            )
-        try:
-            resp = requests.get(
-                session["url"] + "/JSSResource/activationcode",
-                headers={
-                    "Accept": "application/json",
-                    "Authorization": f"Bearer {session.get('token')}",
-                    "User-Agent": "JAWA%20v3.1.1",
-                },
-                verify=verify_ssl,
-            )
+        error = _validate_credentials()
+        if error:
+            return error
 
-            resp.raise_for_status()
-
-        except requests.exceptions.HTTPError as err:
-            logthis.info(f"Error occurred: {err}")
-            return redirect(
-                url_for(
-                    "home_view.logout",
-                    error_title="Login error",
-                    error_message="check account credentials and privileges",
-                )
-            )
-        except requests.exceptions.ConnectTimeout as err:
-            logthis.info(f"Error occurred: {err}")
-            return redirect(
-                url_for(
-                    "home_view.logout",
-                    error_title="Connection Timeout",
-                    error_message=err,
-                )
-            )
-        except requests.exceptions.ConnectionError as err:
-            logthis.info(f"Error occurred: {err}")
-            return redirect(
-                url_for(
-                    "home_view.logout",
-                    error_title="HTTP Error",
-                    error_message=err,
-                )
-            )
+        error = _verify_jamf_access()
+        if error:
+            return error
 
         logthis.info(
             f"[{session.get('url')}] Logging In: "
             + str(escape(session["username"]))
         )
 
-        return redirect(url_for("home_view.dashboard"))
+        return redirect(url_for(DASHBOARD_ENDPOINT))
 
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE_SESSION,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
 
-    return redirect(url_for("home_view.dashboard"))
+    return redirect(url_for(DASHBOARD_ENDPOINT))
 
 
 @blueprint.route("/logout")
@@ -203,56 +203,64 @@ def logout() -> Union[Response, str]:
     return load_home(error_title, error_message)
 
 
+def _load_server_config() -> dict:
+    """Load server.json, creating it if it doesn't exist."""
+    if not os.path.isfile(server_file):
+        with open(server_file, "w") as fout:
+            json.dump({}, fout)
+    with open(server_file, "r") as fin:
+        return json.load(fin)
+
+
+def _render_home(error_title="", error_message="", **kwargs) -> str:
+    """Render the home template with common error parameters."""
+    return render_template(
+        HOME_TEMPLATE,
+        error_title=error_title,
+        error_message=error_message,
+        **kwargs,
+    )
+
+
 def load_home(
     error_title: str = "", error_message: str = ""
 ) -> Union[Response, str]:
     if "username" in session:
-        return redirect(url_for("home_view.dashboard"))
-    if not os.path.isfile(server_file):
-        with open(server_file, "w") as fout:
-            json.dump({}, fout)
+        return redirect(url_for(DASHBOARD_ENDPOINT))
 
-    with open(server_file, "r") as fin:
-        server_json = json.load(fin)
+    server_json = _load_server_config()
     if not server_json:
-        return render_template("home.html")
+        return render_template(HOME_TEMPLATE)
+
     brand = server_json.get("brand")
+    jps_url = server_json.get("jps_url")
 
-    if (
-        "jps_url" not in server_json
-        or server_json["jps_url"] is None
-        or len(server_json["jps_url"]) == 0
-    ):
-        return render_template("home.html", app_name=brand)
-    if "alternate_jps" not in server_json:
-        return render_template(
-            "home.html",
-            app_name=brand,
-            error_title=error_title,
-            error_message=error_message,
-        )
+    if not jps_url:
+        return _render_home(app_name=brand)
+
+    alt_jps = server_json.get("alternate_jps")
+    if alt_jps is None:
+        return _render_home(error_title, error_message, app_name=brand)
 
-    if server_json["alternate_jps"] != "":
-        return render_template(
-            "home.html",
-            jps_url=server_json["jps_url"],
-            jps_url2=server_json["alternate_jps"],
+    if alt_jps != "":
+        return _render_home(
+            error_title,
+            error_message,
+            jps_url=jps_url,
+            jps_url2=alt_jps,
             welcome="true",
             jsslock="true",
             app_name=brand,
-            error_title=error_title,
-            error_message=error_message,
         )
 
-    session["url"] = server_json["jps_url"]
-    return render_template(
-        "home.html",
+    session["url"] = jps_url
+    return _render_home(
+        error_title,
+        error_message,
         jps_url=str(escape(session["url"])),
         welcome="true",
         jsslock="true",
         app_name=brand,
-        error_title=error_title,
-        error_message=error_message,
     )
 
 
@@ -261,72 +269,39 @@ def dashboard() -> Union[Response, str]:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE_SESSION,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
     logthis.info(
         f"[{session.get('url')}] {session.get('username')} rendering /dashboard."
     )
-    with open(webhooks_file) as webhook_json:
-        webhooks_installed = json.load(webhook_json)
-    jamf_pro_webhooks = []
-    okta_webhooks = []
-    custom_webhooks = []
-    for each_webhook in webhooks_installed:
-        data = defaultdict(lambda: "MISSING", each_webhook)
-        tag = data["tag"]
-        if tag == "jamfpro":
-            jamf_pro_webhooks.append(each_webhook)
-        elif tag == "okta":
-            okta_webhooks.append(each_webhook)
-        elif tag == "custom":
-            custom_webhooks.append(each_webhook)
-
-    data = []
-
-    if not os.path.isfile(cron_file):
-        with open(cron_file, "w") as outfile:
-            json.dump(data, outfile)
-
-    with open(cron_file, "r") as cron_json:
-        try:
-            cron_list = json.load(cron_json)
-        except json.decoder.JSONDecodeError:
-            with open(cron_file, "w") as cron_json:
-                cron_list = []
-                json.dump(cron_list, cron_json, indent=4)
-
-    cron_json = []
-    for cron in cron_list:
-        script = cron["script"].rsplit("/", 1)
-        cron_json.append(
-            {
-                "name": cron["name"],
-                "frequency": cron["frequency"],
-                "script": script[1],
-                "description": cron["description"],
-            }
-        )
 
-    webhook_url = session["url"]
+    from bin.data_store import get_all_webhooks, get_all_crons
+    from views._type_handlers import HANDLERS
+
+    all_webhooks = get_all_webhooks()
+    all_crons = get_all_crons()
+
+    categorized = {}
+    for tag, handler in HANDLERS.items():
+        if tag == "cron":
+            items = all_crons
+        else:
+            items = [w for w in all_webhooks if w.get("tag") == tag]
+        categorized[tag] = {"handler": handler, "items": items}
+
+    total_webhooks = len(all_webhooks)
+    total_cron = len(all_crons)
+
+    logthis.info(f"Total webhooks managed by JAWA: {total_webhooks}")
 
-    if not cron_json:
-        cron_json = ""
-    logthis.info(f"Total webhooks managed by JAWA: {len(webhooks_installed)}")
-    if webhook_json == cron_json:
-        return redirect(url_for("first_automation"))
     return render_template(
         "dashboard.html",
-        webhook_url=webhook_url,
-        jamfpro_list=jamf_pro_webhooks,
-        url=session.get("url"),
-        cron_list=cron_json,
-        okta_list=okta_webhooks,
-        custom_list=custom_webhooks,
-        total_webhooks=len(webhooks_installed),
-        total_cron=len(cron_json),
+        categorized=categorized,
+        total_webhooks=total_webhooks,
+        total_cron=total_cron,
         login="true",
         username=str(escape(session["username"])),
     )
diff --git a/views/log_view.py b/views/log_view.py
index 7cb3a2e..0aebd95 100644
--- a/views/log_view.py
+++ b/views/log_view.py
@@ -1,6 +1,6 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 #
-# Copyright (c) 2022 Jamf.  All rights reserved.
+# Copyright (c) 2026 Jamf.  All rights reserved.
 #
 #       Redistribution and use in source and binary forms, with or without
 #       modification, are permitted provided that the following conditions are met:
@@ -27,7 +27,6 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 import os
-import re
 import subprocess
 from datetime import datetime
 from time import sleep
@@ -59,27 +58,34 @@
 
 blueprint = Blueprint("log_view", __name__, template_folder="templates")
 
+ERROR_TITLE = "Session Timed Out"
+ERROR_MSG_SIGN_IN = "Please sign in again"
+LOGOUT_ENDPOINT = "home_view.logout"
+LOG_TEMPLATE = "log/home.html"
+LOG_TAIL_LINES = 500
+
+
+def _read_recent_logs() -> list:
+    """Read the last LOG_TAIL_LINES lines from the log file."""
+    with open(log_file, "r") as fin:
+        lines = [line.replace("\n", "") for line in fin.readlines()]
+    return lines[-LOG_TAIL_LINES:]
+
 
 @blueprint.route("/log/home.html", methods=["GET"])
 def log_home() -> Union[Response, str]:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
     logthis.debug(
         f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    with open(log_file, "r") as fin:
-        lines = [re.sub("\n", "", line) for line in fin.readlines()]
-        lines.reverse()
-        view_lines = lines[:500]
-    return render_template(
-        "log/home.html", username=session.get("username"), log=view_lines
-    )
+    return render_template(LOG_TEMPLATE, log=_read_recent_logs())
 
 
 @blueprint.route("/log/view", methods=["GET"])
@@ -87,21 +93,15 @@ def log_view() -> Union[Response, str]:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
     logthis.debug(
         f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    with open(log_file, "r") as fin:
-        lines = [re.sub("\n", "", line) for line in fin.readlines()]
-        lines.reverse()
-        view_lines = lines[:500]
-    return render_template(
-        "log/home.html", username=session.get("username"), log=view_lines
-    )
+    return render_template(LOG_TEMPLATE, log=_read_recent_logs())
 
 
 @blueprint.route("/log/live.html", methods=["GET"])
@@ -110,9 +110,9 @@ def stream() -> Response:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
     logthis.debug(
@@ -132,9 +132,9 @@ def yield_log() -> Response:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
     logthis.info(
@@ -162,9 +162,9 @@ def download_logs() -> Response:
     if "username" not in session:
         return redirect(
             url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
             )
         )
     logthis.info(

From c6cfb8dfb6012f38f71013ef6f0293cb69ac530f Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Wed, 11 Feb 2026 12:17:45 -0600
Subject: [PATCH 13/84] chore: wire blueprints and cleanup (#57)

* feat: implement backward compatibility redirects for legacy webhook routes

* feat: update layout and styles for improved UI

* chore: update .gitignore
---
 .gitignore                          |   4 +
 app.py                              | 131 +++++-
 templates/cron/delete.html          |  62 ---
 templates/cron/edit.html            | 218 ----------
 templates/cron/home.html            | 134 ------
 templates/cron/new.html             | 195 ---------
 templates/shared/_layout.html       | 136 +++---
 templates/webhooks/custom/edit.html | 156 -------
 templates/webhooks/custom/home.html | 129 ------
 templates/webhooks/custom/new.html  | 115 -----
 templates/webhooks/delete.html      |  64 ---
 templates/webhooks/home.html        | 312 -------------
 templates/webhooks/jamf/edit.html   | 266 ------------
 templates/webhooks/jamf/home.html   | 140 ------
 templates/webhooks/jamf/new.html    | 160 -------
 templates/webhooks/okta/home.html   | 131 ------
 templates/webhooks/okta/new.html    |  97 -----
 views/cron_view.py                  | 515 ----------------------
 views/custom_webhook.py             | 338 ---------------
 views/jamf_webhook.py               | 649 ----------------------------
 views/okta_webhook.py               | 247 -----------
 views/webhook_view.py               | 182 --------
 22 files changed, 182 insertions(+), 4199 deletions(-)
 delete mode 100644 templates/cron/delete.html
 delete mode 100644 templates/cron/edit.html
 delete mode 100644 templates/cron/home.html
 delete mode 100644 templates/cron/new.html
 delete mode 100644 templates/webhooks/custom/edit.html
 delete mode 100644 templates/webhooks/custom/home.html
 delete mode 100644 templates/webhooks/custom/new.html
 delete mode 100644 templates/webhooks/delete.html
 delete mode 100644 templates/webhooks/home.html
 delete mode 100644 templates/webhooks/jamf/edit.html
 delete mode 100644 templates/webhooks/jamf/home.html
 delete mode 100644 templates/webhooks/jamf/new.html
 delete mode 100644 templates/webhooks/okta/home.html
 delete mode 100644 templates/webhooks/okta/new.html
 delete mode 100644 views/cron_view.py
 delete mode 100644 views/custom_webhook.py
 delete mode 100644 views/jamf_webhook.py
 delete mode 100644 views/okta_webhook.py
 delete mode 100644 views/webhook_view.py

diff --git a/.gitignore b/.gitignore
index 17b625b..62e1d12 100644
--- a/.gitignore
+++ b/.gitignore
@@ -152,6 +152,10 @@ dmypy.json
 # ruff
 .ruff_cache
 
+# LLM generated files
+.claude/
+CLAUDE.md
+
 # JAWA runtime data
 data/server.json
 data/credentials.json
diff --git a/app.py b/app.py
index 59b04d4..f35b673 100644
--- a/app.py
+++ b/app.py
@@ -1,6 +1,6 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 #
-# Copyright (c) 2024 Jamf.  All rights reserved.
+# Copyright (c) 2026 Jamf.  All rights reserved.
 #
 #       Redistribution and use in source and binary forms, with or without
 #       modification, are permitted provided that the following conditions are met:
@@ -46,6 +46,7 @@
 from typing import Any, Dict, Union
 
 from bin import logger
+from bin.context_processors import inject_common_vars
 from bin.view_modifiers import response
 from views.home_view import load_home
 
@@ -63,6 +64,9 @@ def func() -> None:
     session.modified = True
 
 
+app.context_processor(inject_common_vars)
+
+
 def main() -> None:
     base_dir = os.path.dirname(__file__)
     logthis.info(f"JAWA initializing...\n Sandcrawler home:  {base_dir}")
@@ -99,18 +103,10 @@ def register_blueprints() -> None:
     from webhook import jawa_receiver
 
     app.register_blueprint(jawa_receiver.blueprint)
-    # Jamf Pro Webhooks view
-    from views import jamf_webhook
-
-    app.register_blueprint(jamf_webhook.blueprint)
-    # Okta Webhooks view
-    from views.okta_webhook import blueprint
-
-    app.register_blueprint(blueprint)
-    # Create a new Cron Job
-    from views.cron_view import blueprint
-
-    app.register_blueprint(blueprint)
+    # Legacy views (deprecated — routes handled by automation_view)
+    # from views import jamf_webhook
+    # from views.okta_webhook import blueprint
+    # from views.cron_view import blueprint
     # Log view
     from views import log_view
 
@@ -119,20 +115,115 @@ def register_blueprints() -> None:
     from views import resource_view
 
     app.register_blueprint(resource_view.blueprint)
-    # Custom Webhooks view
-    from views import custom_webhook
+    # Legacy views (deprecated — routes handled by automation_view)
+    # from views import custom_webhook
+    # from views import webhook_view
+    # Template catalog, enable, and import view
+    from views import template_view
 
-    app.register_blueprint(custom_webhook.blueprint)
-    # Webhooks Base view
-    from views import webhook_view
+    app.register_blueprint(template_view.blueprint)
+    # Search view
+    from views import search_view
 
-    app.register_blueprint(webhook_view.blueprint)
+    app.register_blueprint(search_view.blueprint)
+    # Credential management view
+    from views import credential_view
+
+    app.register_blueprint(credential_view.blueprint)
+    # Unified Automations view
+    from views import automation_view
+
+    app.register_blueprint(automation_view.blueprint)
     # Home, Dashboard and Login view
     from views import home_view
 
     app.register_blueprint(home_view.blueprint)
 
 
+# --- Backward-compatibility 301 redirects ---
+# Old webhook routes → new /automations/ routes
+
+
+@app.route("/webhooks")
+def _redir_webhooks():
+    return redirect("/automations", code=301)
+
+
+@app.route("/webhooks/jamf")
+def _redir_jamf_list():
+    return redirect("/automations/jamfpro", code=301)
+
+
+@app.route("/webhooks/jamf/new")
+def _redir_jamf_new():
+    return redirect("/automations/jamfpro/new", code=301)
+
+
+@app.route("/webhooks/jamf/edit")
+def _redir_jamf_edit():
+    name = request.args.get("name", "")
+    return redirect(f"/automations/jamfpro/{name}/edit", code=301)
+
+
+@app.route("/webhooks/okta")
+def _redir_okta_list():
+    return redirect("/automations/okta", code=301)
+
+
+@app.route("/webhooks/okta/new")
+def _redir_okta_new():
+    return redirect("/automations/okta/new", code=301)
+
+
+@app.route("/webhooks/custom")
+def _redir_custom_list():
+    return redirect("/automations/custom", code=301)
+
+
+@app.route("/webhooks/custom/new")
+def _redir_custom_new():
+    return redirect("/automations/custom/new", code=301)
+
+
+@app.route("/webhooks/custom/edit")
+def _redir_custom_edit():
+    name = request.args.get("name", "")
+    return redirect(f"/automations/custom/{name}/edit", code=301)
+
+
+@app.route("/cron")
+def _redir_cron_list():
+    return redirect("/automations/cron", code=301)
+
+
+@app.route("/cron/new")
+def _redir_cron_new():
+    return redirect("/automations/cron/new", code=301)
+
+
+@app.route("/cron/edit")
+def _redir_cron_edit():
+    name = request.args.get("name", "")
+    return redirect(f"/automations/cron/{name}/edit", code=301)
+
+
+@app.route("/cron/delete")
+def _redir_cron_delete():
+    name = request.args.get("target_job", "")
+    return redirect(f"/automations/cron/{name}/delete", code=301)
+
+
+@app.route("/webhooks/delete")
+def _redir_webhook_delete():
+    name = request.args.get("target_webhook", "")
+    # Need to look up the tag to route properly
+    from bin.data_store import get_webhook_by_name
+
+    webhook = get_webhook_by_name(name)
+    tag = webhook.get("tag", "custom") if webhook else "custom"
+    return redirect(f"/automations/{tag}/{name}/delete", code=301)
+
+
 # Server setup including making .json file necessary for webhooks
 @app.route("/setup", methods=["GET", "POST"])
 def setup() -> Union[Response, str]:
@@ -321,7 +412,7 @@ def error() -> Union[Response, str]:
 
 
 @app.errorhandler(404)
-def page_not_found() -> Union[Response, str]:
+def page_not_found(e) -> Union[Response, str]:
     if "username" in session:
         logthis.info(
             f"[{session.get('url')}] {session.get('username')} wandered off course  ({request.path}) - redirecting to /dashboard."
diff --git a/templates/cron/delete.html b/templates/cron/delete.html
deleted file mode 100644
index 41317e0..0000000
--- a/templates/cron/delete.html
+++ /dev/null
@@ -1,62 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-{% block title %}Confirm Delete{% endblock %}
-{% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/cron/new">New Timed Job</a></div>
-        <div class="stat"><a href="/cron">All Timed Automations</a></div>
-    </div>
-    <div class="form-container">
-        <form action="#" method="POST" class="table-view"
-              enctype="multipart/form-data">
-            <h1>Confirm Delete:</h1>
-            <div class="font-weight-bold text-center">Timed Automation -
-            {% if target_job %}{{ target_job }}{% endif %} </div>
-            <div class="d-flex justify-content-center">
-                <div class="confirm-delete-box">
-                    <i>Deleting a timed automation is a permanent action.</i>
-                    <br/>
-                    Are you sure?
-                    {#                Well, don't blame me. I'm an interpreter.     #}
-                    {#                    ~ C-3PO, a Star War                       #}
-                    {#                                                              #}
-                </div>
-                <br/>
-            </div>
-                <div class="d-flex dash-list justify-content-center">
-                    <button type=submit name="button_choice" value="Delete" class="btn btn-danger" style="margin: 5px">
-
-                        Delete
-
-                    </button>
-                </div>
-    </div>
-{% endblock %}
diff --git a/templates/cron/edit.html b/templates/cron/edit.html
deleted file mode 100644
index b0c262f..0000000
--- a/templates/cron/edit.html
+++ /dev/null
@@ -1,218 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{% extends "shared/_layout.html" %}
-{% block title %}Edit Timed Automation{% endblock %}
-{% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/cron/new">New Timed Job</a></div>
-        <div class="stat"><a href="/cron">All Timed Automations</a></div>
-    </div>
-
-
-
-    <div class="form-container">
-        <form action="/cron/edit?name={{ edit_name }}" method="POST" class="table-view"
-              enctype="multipart/form-data">
-            <div class="overflow-auto" style="max-height: 60vh; margin: auto">
-                <h1 class="text-center">Edit {% if request.args.get('name') %}{{ request.args.get('name') }}{% else %}Timed
-                    Automation{% endif %}</h1>
-                <input type="text" class="form-control text-center" placeholder="Edit Timed Automation Name (optional)"
-                       name="cron_name" pattern="[^' ']+"
-                       required autofocus value="{{ request.args.get('name') }}"
-                       oninvalid="this.setCustomValidity('Single-string name required. (i.e. single_string or string)')">
-                <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-                          class="form-control text-center">{{ description }}
-                </textarea>
-                <label class="form-check-label text-center">Frequency:</label>
-                <select name="frequency" class="form-control"
-                        onchange="java_script_:show(this.options[this.selectedIndex].value)">
-                    <option value=""></option>
-                    <option value="everyhour">Every Hour</option>
-                    <option value="everyday">Every Day</option>
-                    <option value="everyweek">Every Week</option>
-                    <option value="everymonth">Every Month</option>
-                    <option value="custom">Custom</option>
-                </select>
-                <div id="hiddenDiv" style="display:none">
-                    <label class="text-center">At what time?</label>
-                    <select name="daytime" class="text-center">
-                        <option value=""></option>
-                        {% for hour in hours %}
-                            <option value="{{ hour.id }}">{{ hour.value }}</option>
-                        {% endfor %}
-                    </select>
-                </div>
-
-                <div id="hiddenDivTwo" style="display:none" class="text-center">
-                    <label>On what day?</label>
-                    <select name="weekday" class="text-center">
-                        <option value=""></option>
-                        {% for day in days %}
-                            <option value="{{ day.cron }}">{{ day.value }}</option>
-                        {% endfor %}
-                    </select>
-                    <label class="text-center">At what time?</label>
-                    <select name="weektime">
-                        <option value=""></option>
-                        {% for hour in hours %}
-                            <option value="{{ hour.id }}">{{ hour.value }}</option>
-                        {% endfor %}
-                    </select>
-                </div>
-
-                <div id="hiddenDivThree" style="display:none">
-                    <labe class="text-center">On what day of the month?</label>
-                    <select name="monthday" class="text-center">
-                        <option value=""></option>
-                        <option value="1">1</option>
-                        <option value="2">2</option>
-                        <option value="3">3</option>
-                        <option value="4">4</option>
-                        <option value="5">5</option>
-                        <option value="6">6</option>
-                        <option value="7">7</option>
-                        <option value="8">8</option>
-                        <option value="9">9</option>
-                        <option value="10">10</option>
-                        <option value="11">11</option>
-                        <option value="12">12</option>
-                        <option value="13">13</option>
-                        <option value="14">14</option>
-                        <option value="15">15</option>
-                        <option value="16">16</option>
-                        <option value="17">17</option>
-                        <option value="18">18</option>
-                        <option value="19">19</option>
-                        <option value="20">20</option>
-                        <option value="21">21</option>
-                        <option value="22">22</option>
-                        <option value="23">23</option>
-                        <option value="24">24</option>
-                        <option value="25">25</option>
-                        <option value="26">26</option>
-                        <option value="27">27</option>
-                        <option value="28">28</option>
-                        <option value="29">29</option>
-                        <option value="30">30</option>
-                        <option value="31">31</option>
-                    </select>
-                    <label class="text-center">At what time?</label>
-                    <select name="monthtime" class="text-center">
-                        <option value=""></option>
-                        {% for hour in hours %}
-                            <option value="{{ hour.id }}">{{ hour.value }}</option>
-                        {% endfor %}
-                    </select>
-                </div>
-
-                <div id="hiddenDivFour" style="display:none" class="text-center">
-                </div>
-            </div>
-            <div id="hiddenDivFive" style="display:none">
-                <label class="text-center">Cron expression (<a href="https://crontab.guru" target="_blank">example</a>):</label>
-                <input type="text" name="customfreq"
-                       pattern="^((((\d+,)+\d+|(\d+(\/|-|#)\d+)|\d+L?|\*(\/\d+)?|L(-\d+)?|\?|[A-Z]{3}(-[A-Z]{3})?) ?){5,7})$"
-                       oninvalid="this.setCustomValidity('A script is required. Spaces cannot be in the name of the script.')">
-            </div>
-            <div class="d-flex justify-content-center text-center custom-file">
-                <input type="file" name="script" pattern="[^' ']+"  class="custom-file-input text-center"
-                                         title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
-                <label class="custom-file-label text-center">Upload a script</label>
-            </div>
-            <div class="d-flex justify-content-center btn-padded">
-                <button style="overflow: visible !important; height: 0 !important; width: 0 !important; margin: 0 !important; border: 0 !important; padding: 0 !important; display: block !important;" type="submit" value=""/>
-
-                <button type=submit name="button_choice" value="Delete" class="btn btn-danger"
-                        style="margin: 5px; padding: 5px; width: 150px"
-                >
-
-                    Delete
-
-                </button>
-                <button type=submit value="Custom_New" class="btn btn-jawa "
-                        style="margin: 5px; padding: 5px; width: 150px">
-
-                    Save
-
-                </button>
-            </div>
-            {% if success_msg %}
-
-                <h3 class="alert-success">Success!</h3>
-                <div class="form-container alert-warning">
-                <div>{{ success_msg }} <br></div>
-            {% endif %}
-        </form>
-    </div>
-{% endblock %}
-{% block additional_js %}
-    <script text="text/javascript">
-        function show(aval) {
-            if (aval == "everyday") {
-                hiddenDiv.style.display = 'inline-block';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-            } else if (aval == "everyweek") {
-                hiddenDivTwo.style.display = 'inline-block';
-                hiddenDiv.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-            } else if (aval == "everymonth") {
-                hiddenDivThree.style.display = 'inline-block';
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-            } else if (aval == "custom") {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'inline-block';
-            } else if (aval == "") {
-                hiddenDivFour.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-            } else {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-            }
-        }
-
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
\ No newline at end of file
diff --git a/templates/cron/home.html b/templates/cron/home.html
deleted file mode 100644
index 381ca4e..0000000
--- a/templates/cron/home.html
+++ /dev/null
@@ -1,134 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-
-{% block additional_css %}
-
-{% endblock %}
-{% block title %}Timed Automations Dashboard{% endblock %}
-{% block content %}
-    <div>
-    <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="row">
-            <div class="stat p-2 col-sm"><a href="/home.html">Dashboard</a></div>
-            <div class="stat p-2 col-sm"><a href="/cron/new">New Timed Job</a></div>
-            <div class="stat p-2 col-sm"><a href="/cron">View</a></div>
-        </div>
-    </div>
-    <div class="form-container" style="min-height: 82vh">
-        <div class="table-view overflow-auto" style="max-width: 55vh">
-            <div class="d-flex justify-content-center">
-                <h4 class="text-center">Timed Automations Dashboard</h4>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Total timed automations installed</b>: {{ cron_list|length or '0' }}<br>
-            </div>
-        </div>
-        {% if not cron_list %}
-            <div class="form-container">
-                <div class="table-view" style="max-width: fit-content; text-align: center;">
-                    <div class="table-responsive">
-                        No timed automations to display. <a href="/cron/new">Create one now.</a>
-                    </div>
-                </div>
-            </div></div>
-        {% else %}
-            <div class="form-container justify-content-center">
-            <div class="row dash-list justify-content-center">
-                {% for row in cron_list %}
-                    <div class="card col-lg-auto webhooks-list container-bg border-info"
-                         style="width: 10rem; padding: 3px; margin: 10px">
-                        <h4 class="overflow-hidden card-header font-weight-bolder">Cron</h4>
-                        <img src="/static/img/timed_automation.png"
-                             class="img img-circle img-fluid card-img mx-auto btn-padded">
-                        <div class="card-body flex-column d-flex webhooks-list">
-                            <h6 class="overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                            <button class="btn btn-jawa text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                    title="{{ row.name }}" data-toggle="modal"
-                                    data-target="#automationDetails-{{ row.name }}">
-                                View Details
-                            </button>
-                        </div>
-                        <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                             role="dialog" aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                            <div class="modal-dialog modal-dialog-centered" role="document">
-                                <div class="modal-content">
-                                    <div class="modal-header">
-                                        <h5 class="modal-title text-center w-100"
-                                            id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                        <button type="button" class="close" data-dismiss="modal"
-                                                aria-label="Close">
-                                            <span aria-hidden="true">&times;</span>
-                                        </button>
-                                    </div>
-                                    <div class="modal-body text-left">
-                                        <tr>
-                                            <td>
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                    <b>Automation name</b>: {{ row.name }}
-                                                </div>
-                                            </td>
-
-                                            <td>
-                                                <div class="overflow-auto log-frame text-break"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Frequency</b>: {{ row.frequency }}
-                                                </div>
-                                            </td>
-                                            <td>
-                                                <div class="overflow-auto log-frame text-break"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Script path</b>: {{ row.script }}
-                                                </div>
-                                            </td>
-                                            <td>
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Description</b>: {{ row.description }}
-                                                </div>
-                                            </td>
-                                        </tr>
-                                    </div>
-                                    <div class="modal-footer">
-                                        <button type="button" class="btn btn-secondary"
-                                                data-dismiss="modal">
-                                            Close
-                                        </button>
-                                        <a type="button" class="btn btn-jawa"
-                                           href="../cron/edit?name={{ row.name }}">Edit</a>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                {% endfor %}
-            </div>
-        {% endif %}
-{% endblock %}
diff --git a/templates/cron/new.html b/templates/cron/new.html
deleted file mode 100644
index fa91fe5..0000000
--- a/templates/cron/new.html
+++ /dev/null
@@ -1,195 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{% extends "shared/_layout.html" %}
-{% block title %}New Timed Automation{% endblock %}
-{% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-            <div class="row">
-                <div class="stat p-2 col-sm"><a href="/home.html">Dashboard</a></div>
-                <div class="stat p-2 col-sm"><a href="/cron/new">New Timed Job</a></div>
-                <div class="stat p-2 col-sm"><a href="/cron">View</a></div>
-            </div>
-        </div>
-    <div class="form-container">
-        <form method="post" class="table-view" action="/cron/new" enctype="multipart/form-data">
-            <h1>New Timed Job</h1>
-            <input type="text" class="form-control text-center" placeholder="Name of Timed Job (cron task)" name="cron_name"
-                   required autofocus pattern="[^' ']+"
-                   oninvalid="this.setCustomValidity('Single-string name required. (i.e. single_string or string)')">
-            <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-                      class="form-control text-center">{{ description }}</textarea>
-            <label class="form-check-label text-center">Frequency:</label>
-            <select name="frequency" class="form-control text-center"
-                    onchange="java_script_:show(this.options[this.selectedIndex].value)">
-                <option value=""></option>
-                <option value="everyhour">Every Hour</option>
-                <option value="everyday">Every Day</option>
-                <option value="everyweek">Every Week</option>
-                <option value="everymonth">Every Month</option>
-                <option value="custom">Custom</option>
-            </select>
-
-            <div id="hiddenDiv" style="display:none">
-                <label>At what time?</label>
-                <select name="daytime">
-                    <option value=""></option>
-                    {% for hour in hours %}
-                        <option value="{{ hour.id }}">{{ hour.value }}</option>
-                    {% endfor %}
-                </select>
-            </div>
-            <div id="hiddenDivTwo" style="display:none">
-                <label>On what day?</label>
-                <select name="weekday">
-                    <option value=""></option>
-                    {% for day in days %}
-                        <option value="{{ day.cron }}">{{ day.value }}</option>
-                    {% endfor %}
-                </select>
-                <label>At what time?</label>
-                <select name="weektime">
-                    <option value=""></option>
-                    {% for hour in hours %}
-                        <option value="{{ hour.id }}">{{ hour.value }}</option>
-                    {% endfor %}
-                </select>
-            </div>
-
-            <div id="hiddenDivThree" style="display:none">
-                <label>On what day of the month?</label>
-                <select name="monthday">
-                    <option value=""></option>
-                    <option value="1">1</option>
-                    <option value="2">2</option>
-                    <option value="3">3</option>
-                    <option value="4">4</option>
-                    <option value="5">5</option>
-                    <option value="6">6</option>
-                    <option value="7">7</option>
-                    <option value="8">8</option>
-                    <option value="9">9</option>
-                    <option value="10">10</option>
-                    <option value="11">11</option>
-                    <option value="12">12</option>
-                    <option value="13">13</option>
-                    <option value="14">14</option>
-                    <option value="15">15</option>
-                    <option value="16">16</option>
-                    <option value="17">17</option>
-                    <option value="18">18</option>
-                    <option value="19">19</option>
-                    <option value="20">20</option>
-                    <option value="21">21</option>
-                    <option value="22">22</option>
-                    <option value="23">23</option>
-                    <option value="24">24</option>
-                    <option value="25">25</option>
-                    <option value="26">26</option>
-                    <option value="27">27</option>
-                    <option value="28">28</option>
-                    <option value="29">29</option>
-                    <option value="30">30</option>
-                    <option value="31">31</option>
-                </select>
-
-                <label>At what time?</label>
-                <select name="monthtime">
-                    <option value=""></option>
-                    {% for hour in hours %}
-                        <option value="{{ hour.id }}">{{ hour.value }}</option>
-                    {% endfor %}
-                </select>
-            </div>
-            <div id="hiddenDivFour" style="display:none">
-            </div>
-                 <div id="hiddenDivFive" style="display:none">
-                     <label>Cron expression (<a href="https://crontab.guru" target="_blank">example</a>):</label>
-               <input type="text" name="customfreq" pattern="^((((\d+,)+\d+|(\d+(\/|-|#)\d+)|\d+L?|\*(\/\d+)?|L(-\d+)?|\?|[A-Z]{3}(-[A-Z]{3})?) ?){5,7})$" title="Use a valid cron expression.">
-            </div>
-            <div class="d-flex justify-content-center text-center custom-file">
-                <input type="file" name="script" pattern="[^' ']+" required class="custom-file-input text-center"
-                                         title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"
-                oninvalid="this.setCustomValidity('A script is required. Spaces cannot be in the name of the script.')">
-                <label class="custom-file-label text-center">Upload a script</label>
-            </div>
-            <div class="d-flex justify-content-center">
-                <input class="btn btn-jawa" type="submit" value="Create" style="margin: 5px; padding: 5px; width: 150px"/>
-            </div>
-        </form>
-    </div>
-{% endblock %}
-{% block additional_js %}
-    <script text="text/javascript">
-        function show(aval) {
-            if (aval == "everyday") {
-                hiddenDiv.style.display = 'inline-block';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'none';
-            } else if (aval == "everyweek") {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'inline-block';
-                hiddenDivThree.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'none';
-            } else if (aval == "everymonth") {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivThree.style.display = 'inline-block';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'none';
-            } else if (aval == "custom") {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'inline-block';
-            } else if (aval == "") {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'none';
-            } else {
-                hiddenDiv.style.display = 'none';
-                hiddenDivTwo.style.display = 'none';
-                hiddenDivThree.style.display = 'none';
-                hiddenDivFour.style.display = 'none';
-                hiddenDivFive.style.display = 'none';
-            }
-        }
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index 12f4874..c6a53ce 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -30,92 +30,90 @@
 <head>
     <meta charset="UTF-8">
     <title>{% block title %}{% endblock %}</title>
-    <link rel="stylesheet" href="/static/css/account.css">
-    <link rel="stylesheet" href="/static/css/bootstrap.css">
-    <link rel="stylesheet" href="/static/css/fonts.css">
-    <link rel="stylesheet" href="/static/css/main.css"/>
-    <link rel="stylesheet" href="/static/css/nav.css"/>
-    <link rel="stylesheet" href="/static/css/site.css"/>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
+          rel="stylesheet">
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css"
+          rel="stylesheet"
+          integrity="sha384-QWTKZyjpPEjISv5WaRU9OFeRpok6YctnYmDr5pNlyT2bRjXh0JMhjY6hW+ALEwIH"
+          crossorigin="anonymous">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/main.css') }}">
+    <link rel="stylesheet"
+          href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css">
     {% block additional_css %}
     {% endblock %}
     <link rel="apple-touch-icon" href="./static/img/jawa_icon.png">
     <link rel="shortcut icon" href="{{ url_for('static', filename='img/jawa_icon.png') }}">
 
     <meta name="theme-color" content="#6A2F30">
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/main.css') }}">
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
 </head>
 
-<body class="jawa-bg d-flex justify-content-center">
-{#<div class="">#}
+<body class="jawa-bg d-flex flex-column">
 
-<div class="d-flex justify-content-center">
-    <div class="d-flex justify-content-center">
-        {% if username %}
-            <nav class="navbar fixed-top navbar-toggleable-md navbar-inverse bg-inverse navbar-expand-md">
-                {% if username %}
-                    <a class="navbar-brand" href="/dashboard">
-                        <img src="/static/img/jawa_icon.png" style="max-width:42px;max-height:42px;"/></a>
-                    <div class="" style="font-size: 112%"> Welcome, {{ username.title() }}.</div>
-                {% else %}
-                    <a class="navbar-brand" href="/dashboard"></a>
-                {% endif %}
-                <button class="navbar-toggler navbar-toggle overflow-auto" type="button" data-toggle="collapse"
-                        data-target="#navbarSupportedContent"
-                        aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
-                    <div class="navbar-toggler-icon ">
-                        <div class="nav-expand-line"></div>
-                        <div class="nav-expand-line"></div>
-                        <div class="nav-expand-line"></div>
-                    </div>
-                </button>
-                <div class="collapse navbar-collapse" id="navbarSupportedContent">
-                    <ul class="navbar-nav ml-auto">
-                        {% if username %}
-                            <li class="nav-item"><a class="nav-link" href="/webhooks">Webhooks</a></li>
-                            <li class="nav-item"><a class="nav-link" href="/cron">Cron</a></li>
-                            <li class="nav-item"><a class="nav-link" href="/log/home.html">Extras</a></li>
-                            <li class="nav-item"><a class="nav-link" href="/setup">Setup</a></li>
-                            <li class="nav-item"><a class="nav-link" href="/logout" id="last_nav_link">Logout</a></li>
-                        {% endif %}
-                    </ul>
+{% if username %}
+    <nav class="navbar fixed-top navbar-dark navbar-expand-md">
+        <div class="container-fluid">
+            <a class="navbar-brand" href="/dashboard">
+                <img src="/static/img/jawa_icon.png" alt="JAWA"/></a>
+            <button class="navbar-toggler navbar-toggle overflow-auto" type="button" data-bs-toggle="collapse"
+                    data-bs-target="#navbarSupportedContent"
+                    aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
+                <div class="navbar-toggler-icon ">
+                    <div class="nav-expand-line"></div>
+                    <div class="nav-expand-line"></div>
+                    <div class="nav-expand-line"></div>
+                </div>
+            </button>
+            <div class="collapse navbar-collapse" id="navbarSupportedContent">
+                <ul class="navbar-nav me-auto">
+                    <li class="nav-item"><a class="nav-link" href="/dashboard">Dashboard</a></li>
+                    <li class="nav-item"><a class="nav-link" href="/automations">Automations</a></li>
+                    <li class="nav-item"><a class="nav-link" href="/templates">Templates</a></li>
+                    <li class="nav-item dropdown">
+                        <a class="nav-link dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown" aria-expanded="false">
+                            Extras
+                        </a>
+                        <ul class="dropdown-menu">
+                            <li><a class="dropdown-item" href="{{ url_for('log_view.log_home') }}">Log</a></li>
+                            <li><a class="dropdown-item" href="{{ url_for('resources_view.files') }}">Files</a></li>
+                            <li><hr class="dropdown-divider"></li>
+                            <li><a class="dropdown-item text-muted" href="#">Notebooks</a></li>
+                            <li><a class="dropdown-item text-muted" href="#">Webhook Reference</a></li>
+                        </ul>
+                    </li>
+                    <li class="nav-item"><a class="nav-link" href="/setup">Setup</a></li>
+                    <li class="nav-item"><a class="nav-link" href="/logout" id="last_nav_link">Logout</a></li>
+                </ul>
+                <div class="d-flex align-items-center position-relative">
+                    <input type="text" class="search-input" id="navbar-search" placeholder="Search..." autocomplete="off">
+                    <div class="search-dropdown" id="search-dropdown"></div>
                 </div>
-            </nav>
-        {% endif %}
-
-        {% block content %}
-        {% endblock %}
-    </div>
-</div>
-<footer class="footer fixed-bottom">
-    <div class="stat">
-        <div class="text-sm-left">
-            Discover what's possible with Jamf &
-        </div>
-    </div>
-    <div class="stat">
-        Jamf Automation + Webhook Assistant<br/>
-    </div>
-    <div class="stat">
-        <div style="justify-content: right;">
-            <div class="text-sm-right ">v3.1.1
             </div>
         </div>
-    </div>
+    </nav>
+{% endif %}
 
-    {% block footer %}
+<div class="main-content flex-grow-1 {% if not username %}main-content-no-nav{% endif %}">
+    {% block content %}
     {% endblock %}
-
+</div>
+<footer>
+    <div class="text-center">
+        Jamf Automation + Webhook Assistant &mdash; v3.1.1<br>
+        Discover what's possible with Jamf
+    </div>
 </footer>
-<script src="https://code.jquery.com/jquery-3.5.1.slim.min.js"
-        integrity="sha384-DfXdz2htPH0lsSSs5nCTpuj/zy4C+OGpamoFVy38MVBnE+IbbVYUew+OrCXaRkfj"
-        crossorigin="anonymous"></script>
-<script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js"
-        integrity="sha384-9/reFTGAW83EW2RDu2S0VKaIzap3H66lZH81PoYlFhbGU+6BZp6G7niu735Sk7lN"
-        crossorigin="anonymous"></script>
-<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"
-        integrity="sha384-B4gt1jrGC7Jh4AgTPSdUtOBvfO8shuf57BaghqFfPlYxofvL8/KUEfYiJOMMV+rV"
+<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"
+        integrity="sha384-YvpcrYf0tY3lHB60NNkmXc5s9fDVZLESaAA55NDzOxhy9GkcIdslK1eN7N6jIeHz"
         crossorigin="anonymous"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/languages/python.min.js"></script>
+<script>hljs.highlightAll();</script>
+{% if username %}
+<script src="{{ url_for('static', filename='js/search.js') }}"></script>
+{% endif %}
 {% block additional_js %}{% endblock %}
 
 </body>
diff --git a/templates/webhooks/custom/edit.html b/templates/webhooks/custom/edit.html
deleted file mode 100644
index f811558..0000000
--- a/templates/webhooks/custom/edit.html
+++ /dev/null
@@ -1,156 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2023 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-{% block title %}Custom Webhook{% endblock %}
-{% block content %}
-  <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-            <div class="row">
-                <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-                <div class="stat p-2 col-sm"><a href="/webhooks/custom/new">Create</a></div>
-                <div class="stat p-2 col-sm"><a href="/webhooks/custom">View</a></div>
-            </div>
-        </div>
-    <div class="form-container">
-        <form action="/webhooks/custom/edit?name={{ webhook_name }}" method="POST" class="table-view"
-              enctype="multipart/form-data">
-            <div class="overflow-auto text-center" style="max-height: 60vh; margin: auto">
-                <h1>Edit {% if webhook_name %}{{ webhook_name }}{% else %}Custom Webhook{% endif %}</h1>
-                {% if success_msg %}
-                    <h3 class="alert-jawa">Success!</h3>
-                    <div class="form-container text-center success-form">
-                        <div>{{ success_msg }} <br></div>
-                        <a href="{{ new_link }}" style="color:#3c6aa7;" target="_blank">{{ new_here }}</a>
-                    </div>
-                             {% if extra_notice %}
-                <p class="text-center">{{ extra_notice }}</p>
-            {% endif %}
-        {%  if custom_header %}
-            <pre class="success-form font-weight-bolder alert-jawa" style="text-wrap: balance"><div class="d-flex justify-content-center">{{ custom_header }}</div></pre>
-        {% endif %}
-                {% endif %}
-
-                <input name="custom_name" type="text" pattern="[^' ']+" placeholder="Edit Webhook Name (optional)"
-                       title="No spaces, please." class="form-control text-center" value="{{ webhook_name }}" autofocus>
-                {% if error %}
-                    <div class="alert-danger text-center">{{ error }}</div>
-                {% endif %}
-                <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-                          class="form-control text-center">{{ webhook_info[0].get('description') }}</textarea>
-                <div class="d-flex justify-content-center text-center custom-file">
-                    <input type="file" name="new_file" pattern="[^' ']+" class="custom-file-input text-center"
-                           title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
-                    <label class="custom-file-label text-center">Upload a script</label>
-                </div>
-                <div class="d-flex justify-content-center">
-                    <p>Examples: [<a href="{{ url_for('resources_view.python') }}" class="alert-link">Python</a>, <a
-                            href="{{ url_for('resources_view.bash') }}" class="alert-link">Bash</a>] </p></div>
-                <div class="d-flex justify-content-center">
-                    <label>
-                        <input type="checkbox" class="form-check-label" name="basic" value="basic"
-                               onchange="java_script_:show(this.value)"
-                                {% if webhook_info[0]['webhook_username'] != 'null' %} checked {% endif %}">
-                    </label><b>&nbsp;Basic Authentication (optional):</b></div>
-                <div class="d-flex justify-content-center">
-                    {% if webhook_info[0]['webhook_username'] == 'null' %}
-                        <div id="hiddenDiv2" style="display:none"> {% endif %}
-
-                    <input class="form-control-sm text-center" name="basic_username" title="Username (optional)"
-                           placeholder="Username (optional)" autocomplete="off"
-                           value="{% if webhook_info[0]['webhook_username'] != 'null' %}{{ webhook_info[0]['webhook_username'] }}{% endif %}">
-                    </b>
-                    <input name="new-password" autocomplete="off" class="form-control-sm text-center" type='password' title="Password (optional)"
-                           placeholder="Password (optional)"
-                           value="{% if webhook_info[0]['webhook_password'] != 'null' %}{{ webhook_info[0]['webhook_password'] }}{% endif %}">
-                    {% if webhook_info[0]['webhook_username'] == 'null' %}    </div> {% endif %}
-                </div>
-                <div class="d-flex justify-content-center"><label>
-                    <input type="checkbox" class="form-check-label text-center" name="custom" value="custom"
-                           onchange="java_script_:show(this.value)"
-                           {% if webhook_info[0].get('api_key', 'null') != 'null' %}checked{% endif %}>
-                </label><b>&nbsp;Custom Authentication (optional):</b></div>
-                <div class="d-flex justify-content-center">
-                    {% if webhook_info[0].get('api_key', 'null') == 'null' %}
-                        <div id="hiddenDiv3" style="display:none">{% endif %}
-                    {% if not webhook_info[0].get('api_key', 'null') == 'null' %}
-                        <div id="hiddenDiv3" style="display:inline-block">{% endif %}
-                    <input name="api_key" class="form-control-sm text-center" type='api_key' title="x-api-key (optional)"
-                           placeholder="x-api-key value (optional)" autocomplete="off"
-                           value="{% if webhook_info[0].get('api_key', 'null') != 'null' %}{{ webhook_info[0].get('api_key') }}{% endif %}">
-                    </div>
-                    </div>
-                    <div class="d-flex justify-content-center">
-                        <label><input name="output" class="form-check-label" type="checkbox"
-                                      {% if webhook_info[0].get('output') %}checked{% endif %}></label>
-                        <b>&nbsp; Send script output in response?</b>
-                    </div>
-
-                    <div class="d-flex justify-content-center btn-padded">
-
-                        <button style="overflow: visible !important; height: 0 !important; width: 0 !important;
-                         margin: 0 !important; border: 0 !important; padding: 0 !important; display: block !important;"
-                                type="submit" value=""/>
-
-                        <button type=submit name="button_choice" value="Delete" class="btn btn-danger"
-                                style="margin: 5px; padding: 5px; width: 150px">
-
-                            Delete
-
-                        </button>
-                        <button type=submit value="Custom_New" class="btn btn-jawa "
-                                style="margin: 5px; padding: 5px; width: 150px">
-
-                            Save
-
-                        </button>
-                    </div>
-
-                </div>
-
-            </div>
-    </div>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        function show(event) {
-            if (event === "basic") {
-                hiddenDiv2.style.display = 'inline-block';
-            }
-            if (event === "custom") {
-                hiddenDiv3.style.display = 'inline-block';
-            }
-        }
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
\ No newline at end of file
diff --git a/templates/webhooks/custom/home.html b/templates/webhooks/custom/home.html
deleted file mode 100644
index 84900ae..0000000
--- a/templates/webhooks/custom/home.html
+++ /dev/null
@@ -1,129 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-
-{% block additional_css %}
-
-{% endblock %}
-{% block title %}Custom Webhooks Dashboard{% endblock %}
-{% block content %}
-    <div>
-    <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="row">
-            <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/custom/new">Create</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/custom">View</a></div>
-        </div>
-    </div>
-    <div class="form-container" style="min-height: 82vh">
-        <div class="table-view overflow-auto" style="max-width: 55vh">
-            <div class="d-flex justify-content-center">
-                <h4 class="text-center">Custom Webhooks Dashboard</h4>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Total custom webhooks installed</b>: {{ custom_list|length or '0' }}<br>
-            </div>
-        </div>
-        {% if not custom_list %}
-            <div class="form-container">
-                <div class="table-view" style="max-width: fit-content; text-align: center;">
-                    <div class="table-responsive">
-                        No custom webhooks to display. <a href="/webhooks/custom/new">Create one now.</a>
-                    </div>
-                </div>
-            </div></div>
-        {% else %}
-            <div class="form-container justify-content-center">
-                <div class="row dash-list justify-content-center">
-                    {% for row in custom_list %}
-                        {% if row.url == session['url'] %}
-                            <div class="card col-lg-auto webhooks-list container-bg border-info d-flex"
-                                 style="width: 10rem; padding: 3px; margin: 10px">
-                                <h4 class="overflow-hidden card-header font-weight-bolder">Custom</h4>
-                                <img src="/static/img/webhook.png"
-                                     class="img img-circle img-fluid card-img mx-auto btn-padded">
-                                <div class="card-body flex-column d-flex webhooks-list">
-                                    <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                    <button class="btn-jawa btn text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                            title="{{ row.name }}" data-toggle="modal"
-                                            data-target="#automationDetails-{{ row.name }}">
-                                        View Details
-                                    </button>
-
-                                    <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                         role="dialog" aria-labelledby="automationDetailsCenterTitle"
-                                         aria-hidden="true">
-                                        <div class="modal-dialog modal-dialog-centered" role="document">
-                                            <div class="modal-content">
-                                                <div class="modal-header">
-                                                    <h5 class="modal-title text-center w-100"
-                                                        id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                    <button type="button" class="close" data-dismiss="modal"
-                                                            aria-label="Close">
-                                                        <span aria-hidden="true">&times;</span>
-                                                    </button>
-                                                </div>
-                                                <div class="modal-body text-left">
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                        <b>Automation name</b>: {{ row.name }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Script path</b>: {{ row.script }}
-                                                    </div>
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Description</b>: {{ row.description }}
-                                                    </div>
-
-                                                </div>
-                                                <div class="modal-footer">
-                                                    <button type="button" class="btn btn-secondary"
-                                                            data-dismiss="modal">
-                                                        Close
-                                                    </button>
-                                                    <a type="button" class="btn btn-jawa"
-                                                       href="../webhooks/custom/edit?name={{ row.name }}">Edit</a>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        {% endif %}
-                    {% endfor %}
-                </div>
-            </div>
-        {% endif %}
-{% endblock %}
-{% block additional_js %}
-
-{% endblock %}
diff --git a/templates/webhooks/custom/new.html b/templates/webhooks/custom/new.html
deleted file mode 100644
index bb7e287..0000000
--- a/templates/webhooks/custom/new.html
+++ /dev/null
@@ -1,115 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-{% block title %}Custom Webhook{% endblock %}
-{% block content %}
-  <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-            <div class="row">
-                <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-                <div class="stat p-2 col-sm"><a href="/webhooks/custom/new">Create</a></div>
-                <div class="stat p-2 col-sm"><a href="/webhooks/custom">View</a></div>
-            </div>
-        </div>
-    <div class="form-container">
-
-        <form action="/webhooks/custom/new" method="POST" class="table-view" enctype="multipart/form-data">
-            <h1 class="text-center">New Custom Webhook</h1>
-            <input name="custom_name" type="text" pattern="[^' ']+" placeholder="New Webhook Name (no spaces)" required
-                   title="No spaces, please." class="form-control text-center" value="{{ name }}" autofocus>
-            {% if error %}
-                <div class="alert-danger text-center">{{ error }}</div>
-            {% endif %}
-            <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-                      class="form-control text-center">{{ description }}</textarea>
-            <div class="d-flex justify-content-center text-center custom-file">
-                <input type="file" name="new_file" pattern="[^' ']+" required class="custom-file-input text-center"
-                                         title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
-                <label class="custom-file-label text-center">Upload a script</label>
-            </div>
-            <div class="d-flex justify-content-center">
-                <p>Examples: [<a href="{{ url_for('resources_view.python') }}" class="alert-link">Python</a>, <a
-                        href="{{ url_for('resources_view.bash') }}" class="alert-link">Bash</a>] </p></div>
-             <div class="d-flex justify-content-center"><label>
-                <input type="checkbox" class="form-check-input" name="basic" value="basic"
-                       onchange="java_script_:show(this.value)">
-            </label><b>Basic Authentication (optional):</b></div>
-            <div class="d-flex justify-content-center">
-                <div id="hiddenDiv2" style="display:none" class="center_box">
-                    <div class="d-flex justify-content-center">
-                    <input class="form-control-sm" name="basic_username" title="Username (optional)"
-                           autocomplete="off" placeholder="Username (optional)">
-                    </b>
-                    <input name="new-password" autocomplete="off" class="form-control-sm" type='password' title="Password (optional)"
-                           placeholder="Password (optional)"></div></div>
-            </div>
-                <div class="d-flex justify-content-center"><label>
-                    <input type="checkbox" class="form-check-input" name="custom" value="custom"
-                           onchange="java_script_:show(this.value)">
-                </label><b>Custom Authentication (optional):</b></div>
-                <div class="d-flex justify-content-center">
-                    <div id="hiddenDiv3" style="display:none">
-                        <input name="api_key" class="form-control-sm"  title="x-api-key (optional)"
-                               placeholder="x-api-key value (optional)" autocomplete="off"></div>
-                </div>
-        <div class="d-flex justify-content-center">
-            <label><input name="output" class="form-check-input" type="checkbox"></label>
-            <b>Send script output in response?</b>
-        </div>
-
-            <div class="d-flex justify-content-center">
-                <p></p>
-                <button type=submit value="Custom_New" class="btn btn-jawa" style="margin: 5px; padding: 5px; width: 150px">
-
-                    Create
-
-                </button>
-            </div>
-
-        </form>
-    </div>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        function show(event) {
-            if (event == "basic") {
-                hiddenDiv2.style.display = 'inline-block';
-            }
-            if (event == "custom") {
-                hiddenDiv3.style.display = 'inline-block';
-            }
-        }
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
\ No newline at end of file
diff --git a/templates/webhooks/delete.html b/templates/webhooks/delete.html
deleted file mode 100644
index 852f727..0000000
--- a/templates/webhooks/delete.html
+++ /dev/null
@@ -1,64 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{% extends "shared/_layout.html" %}
-{% block title %}Confirm Delete{% endblock %}
-{% block content %}
-<div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="stat"><a href="/webhooks/jamf">Jamf Pro</a></div>
-        <div class="stat"><a href="/webhooks/okta">Okta</a></div>
-        <div class="stat"><a href="/webhooks/custom">Custom</a></div>
-    </div>
-<div class="form-container">
-        <form action="#" method="POST" class="table-view"
-              enctype="multipart/form-data">
-            <h1>Confirm Delete:</h1>
-            <div class="font-weight-bold text-center">{{ tag.title() }} Webhook -
-            {% if target_webhook %}{{ target_webhook }}{% endif %}
-            </div>
-            <div class="d-flex justify-content-center">
-                <div class="confirm-delete-box">
-                    <i>Deleting a webhook is a permanent action.</i>
-                    <br/>
-                    Are you sure?
-                    {#                The possibility of successfully navigating an asteroid field is approximately   #}
-                    {#                3,720 to 1                                                                      #}
-                    {#                    ~ C-3PO, a Star War                                                         #}
-                    {#                                                                                                #}
-                </div>
-                <br/>
-            </div>
-                <div class="d-flex dash-list justify-content-center">
-                    <button type=submit name="button_choice" value="Delete" class="btn btn-danger" style="margin: 5px">
-
-                        Delete
-
-                    </button>
-                </div>
-    </div>
-{% endblock %}
\ No newline at end of file
diff --git a/templates/webhooks/home.html b/templates/webhooks/home.html
deleted file mode 100644
index ad1c6c4..0000000
--- a/templates/webhooks/home.html
+++ /dev/null
@@ -1,312 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-
-{% block additional_css %}
-
-{% endblock %}
-{% block title %}Webhooks Dashboard{% endblock %}
-
-{% block content %}
-    <div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-            <div class="row">
-                <div class="stat p-2 col-sm"><a href="/webhooks/jamf">Jamf Pro</a></div>
-                <div class="stat p-2 col-sm"><a href="/webhooks/okta">Okta</a></div>
-                <div class="stat p-2 col-sm"><a href="/webhooks/custom">Custom</a></div>
-            </div>
-        </div>
-        <div class="form-container table-view overflow-auto" style="max-width: 800px">
-            <div class="table-view overflow-auto">
-                <div class="d-flex justify-content-center">
-                    <h4>Webhooks Dashboard</h4>
-                </div>
-                <div class="d-flex justify-content-center">
-                    <b>Active JPS</b>: &nbsp; <a class="alert-link" href="{{ session.get('url') }}"
-                                                 target="_blank">{{ session['url'] }}</a> <br>
-                </div>
-                <div class="d-flex justify-content-center">
-                    <b>Total webhooks
-                        installed</b>: {{ jamf_list|length + okta_list|length + custom_list|length or '0' }}
-                </div>
-                <div class="d-flex justify-content-center">
-                    <a href="/webhooks/jamf"><b>Jamf Pro</b></a>: {{ jamf_list|length or '0' }} &nbsp;&nbsp;&nbsp;
-                    &nbsp; <a
-                        href="/webhooks/okta"><b>Okta</a></b>:
-                    {{ okta_list|length or '0' }} &nbsp;&nbsp;&nbsp;&nbsp; <a
-                        href="/webhooks/custom"><b>Custom</b></a>: {{ custom_list|length or '0' }}</div>
-            </div>
-        </div>
-        {#        </div>#}
-
-        {% if not jamf_list and not okta_list and not custom_list %}
-            <div class="form-container ">
-                <div class="table-view" style="max-width: fit-content; text-align: center;">
-                    <div class="table-responsive">
-                        No Jamf Pro webhooks to display. <a href="/webhooks/jamf/new">Create one now.</a>
-                    </div>
-                </div>
-                <div class="table-view" style="max-width: fit-content; text-align: center; ">
-                    <div class="table-responsive">
-                        &nbsp; &nbsp; No Okta webhooks to display. <a href="/webhooks/okta/new">Create one now.
-                        &nbsp;</a>
-                    </div>
-                </div>
-                <div class="table-view" style="max-width: fit-content; text-align: center; ">
-                    <div class="table-responsive">
-                        No Custom webhooks to display. <a href="/webhooks/custom/new">Create one now.</a>
-                    </div>
-                </div>
-
-            </div>
-        {% else %}
-            <div class="form-container justify-content-center">
-            <div class="row dash-list justify-content-center">
-                {% if jamf_list %}
-                    {% for row in jamf_list %}
-                        {% if row.url == session['url'] %}
-                            <div class="card col-lg-auto webhooks-list container-bg border-info d-flex flex-column">
-                                <h4 class="overflow-hidden card-header font-weight-bolder">Jamf Pro</h4>
-                                <img src="/static/img/webhook.png"
-                                     class="img img-circle img-fluid card-img mx-auto btn-padded">
-                                <div class="card-body flex-column d-flex webhooks-list">
-                                    <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                    <button class="btn btn-jawa text-white overflow-hidden stretched-link mt-auto"
-                                            title="{{ row.name }}" data-toggle="modal"
-                                            data-target="#automationDetails-{{ row.name }}">
-                                        View Details
-                                    </button>
-                                    <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                         role="dialog"
-                                         aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                                        <div class="modal-dialog modal-dialog-centered" role="document">
-                                            <div class="modal-content">
-                                                <div class="modal-header">
-                                                    <h5 class="modal-title text-center w-100"
-                                                        id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                    <button type="button" class="close" data-dismiss="modal"
-                                                            aria-label="Close">
-                                                        <span aria-hidden="true">&times;</span>
-                                                    </button>
-                                                </div>
-                                                <div class="modal-body text-left">
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                        <b>Automation name</b>: {{ row.name }} (<a
-                                                            href="{{ url }}/webhooks.html?id={{ row.jamf_id }}"
-                                                            target="_blank">View in Jamf</a>)
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Event</b>: {{ row.event }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Script path</b>: {{ row.script }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Description</b>: {{ row.description }}
-                                                    </div>
-
-                                                </div>
-                                                <div class="modal-footer">
-                                                    <button type="button" class="btn btn-secondary"
-                                                            data-dismiss="modal">
-                                                        Close
-                                                    </button>
-                                                    <a type="button" class="btn btn-jawa"
-                                                       href="../webhooks/jamf/edit?name={{ row.name }}">Edit</a>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-
-                            </div>
-                        {% endif %}
-                    {% endfor %}
-                {% endif %}
-                {% if okta_list %}
-                    {% for row in okta_list %}
-                        <div class="card col-lg-auto webhooks-list container-bg border-info d-flex"
-                             style="width: 10rem; padding: 3px; margin: 10px">
-                            <h4 class="overflow-hidden card-header font-weight-bolder">Okta</h4>
-                            <img src="/static/img/webhook.png"
-                                 class="img img-circle img-fluid card-img mx-auto btn-padded">
-                            <div class="card-body flex-column d-flex webhooks-list">
-                                <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                <button class="btn-jawa btn text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                        title="{{ row.name }}" data-toggle="modal" data-target="#automationDetailsOkta">
-                                    View Details
-                                </button>
-                                <div class="modal fade" id="automationDetailsOkta" tabindex="-1" role="dialog"
-                                     aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                                    <div class="modal-dialog modal-dialog-centered" role="document">
-                                        <div class="modal-content">
-                                            <div class="modal-header">
-                                                <h5 class="modal-title text-center w-100"
-                                                    id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                <button type="button" class="close" data-dismiss="modal"
-                                                        aria-label="Close">
-                                                    <span aria-hidden="true">&times;</span>
-                                                </button>
-                                            </div>
-                                            <div class="modal-body text-left">
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Automation name</b>: {{ row.name }}
-                                                </div>
-
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Event</b>: {{ row.okta_event }}
-                                                </div>
-                                                <div class="overflow-auto log-frame text-break"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Script path</b>: {{ row.script }}
-                                                </div>
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Okta URL</b>: {{ row.okta_url }}
-                                                </div>
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Description</b>: {{ row.description }}
-                                                </div>
-                                            </div>
-                                            <div class="modal-footer">
-                                                <button type="button" class="btn btn-secondary" data-dismiss="modal">
-                                                    Close
-                                                </button>
-                                                <a type="button" class="btn btn-danger"
-                                                   href="../webhooks/delete?target_webhook={{ row.name }}">Delete</a>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    {% endfor %}
-
-                {% endif %}
-                {% if custom_list %}
-                    {% for row in custom_list %}
-                        {% if row.url == session['url'] %}
-                            <div class="card col-lg-auto webhooks-list container-bg border-info d-flex"
-                                 style="width: 10rem; padding: 3px; margin: 10px">
-                                <h4 class="overflow-hidden card-header font-weight-bolder">Custom</h4>
-                                <img src="/static/img/webhook.png"
-                                     class="img img-circle img-fluid card-img mx-auto btn-padded">
-                                <div class="card-body flex-column d-flex webhooks-list">
-                                    <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                    <button class="btn-jawa btn text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                            title="{{ row.name }}" data-toggle="modal"
-                                            data-target="#automationDetails-{{ row.name }}">
-                                        View Details
-                                    </button>
-
-                                    <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                         role="dialog" aria-labelledby="automationDetailsCenterTitle"
-                                         aria-hidden="true">
-                                        <div class="modal-dialog modal-dialog-centered" role="document">
-                                            <div class="modal-content">
-                                                <div class="modal-header">
-                                                    <h5 class="modal-title text-center w-100"
-                                                        id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                    <button type="button" class="close" data-dismiss="modal"
-                                                            aria-label="Close">
-                                                        <span aria-hidden="true">&times;</span>
-                                                    </button>
-                                                </div>
-                                                <div class="modal-body text-left">
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                        <b>Automation name</b>: {{ row.name }}
-                                                    </div>
-
-                                                    <div class="overflow-auto log-frame text-break"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Script path</b>: {{ row.script }}
-                                                    </div>
-                                                    <div class="overflow-auto log-frame"
-                                                         style="max-width: 100vh; max-height: 10vh">
-                                                        <b>Description</b>: {{ row.description }}
-                                                    </div>
-
-                                                </div>
-                                                <div class="modal-footer">
-                                                    <button type="button" class="btn btn-secondary"
-                                                            data-dismiss="modal">
-                                                        Close
-                                                    </button>
-                                                    <a type="button" class="btn btn-jawa"
-                                                       href="../webhooks/custom/edit?name={{ row.name }}">Edit</a>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        {% endif %}
-                    {% endfor %}
-                {% endif %}
-            </div>
-        {% endif %}
-
-
-        </div>
-
-
-    </div>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        $(document).ready(function () {
-            $(".submit").click(function () {
-                $(".submit").addClass("loading");
-                setTimeout(function () {
-                    $(".submit").addClass("hide-loading");
-                    // For failed icon just replace ".done" with ".failed"
-                    $(".done").addClass("finish");
-                }, 1000000);
-                setTimeout(function () {
-                    $(".submit").removeClass("loading");
-                    $(".submit").removeClass("hide-loading");
-                    $(".done").removeClass("finish");
-                    $(".failed").removeClass("finish");
-                }, 1000000);
-            })
-        });
-
-    </script>
-{% endblock %}
diff --git a/templates/webhooks/jamf/edit.html b/templates/webhooks/jamf/edit.html
deleted file mode 100644
index 7e088c0..0000000
--- a/templates/webhooks/jamf/edit.html
+++ /dev/null
@@ -1,266 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2023 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-{% block title %}Edit Jamf Pro Webhook{% endblock %}
-{% block content %}
-<div>
-    <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="row">
-            <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/jamf/new">Create</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/jamf">View</a></div>
-        </div>
-    </div>
-    <div class="form-container">
-
-    <form method="post" action="/webhooks/jamf/edit?name={{ webhook_name }}" class="table-view"
-          enctype="multipart/form-data">
-    <div class="overflow-auto" style="max-height: 60vh; margin: auto">
-        <h1>Edit {% if webhook_name %}{{ webhook_name }}{% else %}Jamf Pro Webhook{% endif %}</h1>
-        {% if success_msg %}
-            <h3 class="alert-jawa">Success!</h3>
-            <div class="form-container text-center success-form">
-                <div class="font-weight-bold">{{ success_msg }} <br></div>
-
-
-            {% if smart_group_notice %}
-                <b>{{ smart_group_notice }}</b> <br> {{ smart_group_instructions }}
-            {% endif %}
-            <a href="{{ new_link }}" class="text-center" target="_blank">{{ new_here }}</a>
-            {% if extra_notice %} <p></p>
-                {% set re_notice = extra_notice | replace(" {", ": ~CAW~{") %}
-                {% for line in re_notice.split(" ~CAW~") %}
-                    <p>{{ line }}</p>
-                {% endfor %}
-            {% endif %}
-            {% if custom_header %}
-                <pre class="font-weight-bolder alert-jawa" style="text-wrap: balance"><div
-                        class="d-flex justify-content-center">{{ custom_header }}</div></pre>
-            {% endif %}
-            </div>
-        {% endif %}
-    </div>
-    <input name="webhook_name" value="{{ webhook_name }}" type="text" pattern="[^' ']+"
-           placeholder="Edit Webhook Name (optional)"
-           title="No spaces, please." class="form-control text-center" value="{{ name }}" autofocus>
-    {% if error %}
-        <div class="alert-danger text-center">{{ error }}</div>
-    {% endif %}
-    <div class="d-flex justify-content-center text-center">
-        <b>Jamf Event (optional):</b>
-    </div>
-    <select class="form-control text-center" name="event"
-            onchange="java_script_:show(this.options[this.selectedIndex].value)">
-        <option value=""></option>
-        <option value="ComputerAdded"
-                {% if webhook_info[0]['event'] == "ComputerAdded" %}selected {% endif %}>
-            ComputerAdded
-        </option>
-        <option value="ComputerCheckIn" {% if webhook_info[0]['event'] == "ComputerCheckIn" %}
-                selected {% endif %}>ComputerCheckIn
-        </option>
-        <option value="ComputerInventoryCompleted"
-                {% if webhook_info[0]['event'] == "ComputerInventoryCompleted" %} selected {% endif %}>
-            ComputerInventoryCompleted
-        </option>
-        <option value="ComputerPatchPolicyCompleted"
-                {% if webhook_info[0]['event'] == "ComputerPatchPolicyCompleted" %} selected {% endif %}>
-            ComputerPatchPolicyCompleted
-        </option>
-        <option value="ComputerPolicyFinished" {% if webhook_info[0]['event'] == "ComputerPolicyFinished" %}
-                selected {% endif %}>ComputerPolicyFinished
-        </option>
-        <option value="ComputerPushCapabilityChanged"
-                {% if webhook_info[0]['event'] == "ComputerPushCapabilityChanged" %} selected {% endif %}>
-            ComputerPushCapabilityChanged
-        </option>
-        <option value="DeviceAddedToDEP" {% if webhook_info[0]['event'] == "DeviceAddedToDEP" %}
-                selected {% endif %}>DeviceAddedToDEP
-        </option>
-        <option value="DeviceRateLimited" {% if webhook_info[0]['event'] == "DeviceRateLimited" %}
-                selected {% endif %}>DeviceRateLimited
-        </option>
-        <option value="JSSShutdown" {% if webhook_info[0]['event'] == "JSSShutdown" %} selected {% endif %}>
-            JSSShutdown
-        </option>
-        <option value="JSSStartup" {% if webhook_info[0]['event'] == "JSSStartup" %} selected {% endif %}>
-            JSSStartup
-        </option>
-        <option value="MobileDeviceCheckIn" {% if webhook_info[0]['event'] == "MobileDeviceCheckIn" %}
-                selected {% endif %}>MobileDeviceCheckIn
-        </option>
-        <option value="MobileDeviceCommandCompleted"
-                {% if webhook_info[0]['event'] == "MobileDeviceCommandCompleted" %} selected {% endif %}>
-            MobileDeviceCommandCompleted
-        </option>
-        <option value="MobileDeviceEnrolled" {% if webhook_info[0]['event'] == "MobileDeviceEnrolled" %}
-                selected {% endif %}>MobileDeviceEnrolled
-        </option>
-        <option value="MobileDeviceInventoryCompleted" {% if webhook_info[0]['event'] == "MobileDeviceInventoryCompleted" %}
-                selected {% endif %}>MobileDeviceInventoryCompleted
-        </option>
-        <option value="MobileDevicePushSent" {% if webhook_info[0]['event'] == "MobileDevicePushSent" %}
-                selected {% endif %}>MobileDevicePushSent
-        </option>
-        <option value="MobileDeviceUnEnrolled" {% if webhook_info[0]['event'] == "MobileDeviceUnEnrolled" %}
-                selected {% endif %}>MobileDeviceUnEnrolled
-        </option>
-        <option value="PatchSoftwareTitleUpdated"
-                {% if webhook_info[0]['event'] == "PatchSoftwareTitleUpdated" %} selected {% endif %}>
-            PatchSoftwareTitleUpdated
-        </option>
-        <option value="PushSent" {% if webhook_info[0]['event'] == "PushSent" %} selected {% endif %}>
-            PushSent
-        </option>
-        <option value="RestAPIOperation" {% if webhook_info[0]['event'] == "RestAPIOperation" %}
-                selected {% endif %}>RestAPIOperation
-        </option>
-        <option value="SCEPChallenge" {% if webhook_info[0]['event'] == "SCEPChallenge" %}
-                selected {% endif %}>
-            SCEPChallenge
-        </option>
-        <option value="SmartGroupComputerMembershipChange"
-                {% if webhook_info[0]['event'] == "SmartGroupComputerMembershipChange" %}
-                selected {% endif %}>
-            SmartGroupComputerMembershipChange
-        </option>
-        <option value="SmartGroupMobileDeviceMembershipChange"
-                {% if webhook_info[0]['event'] == "SmartGroupMobileDeviceMembershipChange" %}
-                selected {% endif %}>SmartGroupMobileDeviceMembershipChange
-        </option>
-        <option value="SmartGroupUserMembershipChange"
-                {% if webhook_info[0]['event'] == "SmartGroupUserMembershipChange" %}
-                selected {% endif %}>SmartGroupUserMembershipChange
-        </option>
-    </select>
-    <div id="hiddenDiv" class="text-center" style="display:none">
-        * Note: If utilizing the event for Smart Group Membership Change, after submitting, navigate to the
-        <a
-                href="{{ url }}/webhooks.html" style="color:#3c6aa7;" target="_blank">Webhooks</a> setting
-        in Jamf
-        Pro
-        and adjust the proper Smart Group for this Webhook.
-    </div>
-    <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-              class="form-control text-center">{{ webhook_info[0].get('description') }}</textarea>
-
-    <div class="d-flex justify-content-center text-center custom-file">
-        <input type="file" name="new_file" pattern="[^' ']+" class="custom-file-input text-center"
-               title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
-        <label class="custom-file-label text-center">Upload a script</label>
-    </div>
-    <div class="d-flex justify-content-center">
-        <p>Examples: [<a href="{{ url_for('resources_view.python') }}" class="alert-link">Python</a>, <a
-                href="{{ url_for('resources_view.bash') }}" class="alert-link">Bash</a>] </p></div>
-    <div class="d-flex justify-content-center">
-        <label>
-            <input type="radio" class="form-check-label" name="choice" value="basic"
-                   onchange="java_script_:show(this.value)"
-                    {% if webhook_info[0]['webhook_username'] != 'null' %} checked {% endif %}">
-        </label><b>&nbsp;Basic Authentication (optional):</b></div>
-    <div class="d-flex justify-content-center">
-        {% if webhook_info[0]['webhook_username'] == 'null' %}
-            <div id="hiddenDiv2" style="display:none">
-        {% endif %}
-        <input class="form-control-sm text-center" name="basic_username" title="Username (optional)" autocomplete="off"
-               placeholder="Username (optional)" style="padding: unset"
-               value="{% if webhook_info[0]['webhook_username'] != 'null' %}{{ webhook_info[0]['webhook_username'] }}{% endif %}">
-        </b>
-        <input name="basic_password" autocomplete="off" class="form-control-sm text-center" type='password' title="Password (optional)"
-               placeholder="Password (optional)"
-               value="{% if webhook_info[0]['webhook_password'] != 'null' %}{{ webhook_info[0]['webhook_password'] }}{% endif %}">
-        {% if webhook_info[0]['webhook_username'] == 'null' %}    </div> {% endif %}
-    </div>
-    <div class="d-flex justify-content-center"><label>
-        <input type="radio" class="form-check-label" name="choice" value="custom"
-               onchange="java_script_:show(this.value)"
-               {% if webhook_info[0].get('api_key', 'null') != 'null' %}checked{% endif %}>
-    </label><b>&nbsp;Custom Authentication (optional):</b>
-    </div>
-    <div class="d-flex justify-content-center">
-        {% if webhook_info[0].get('api_key', 'null') == 'null' %}
-            <div id="hiddenDiv3" style="display:none">{% endif %}
-        {% if not webhook_info[0].get('api_key', 'null') == 'null' %}
-            <div id="hiddenDiv3" style="display:inline-block">{% endif %}
-        <input name="api_key" class="form-control-sm text-center" type='api_key' title="x-api-key (optional)"
-               placeholder="x-api-key value (optional)" autocomplete="off"
-               value="{% if webhook_info[0].get('api_key', 'null') != 'null' %}{{ webhook_info[0].get('api_key') }}{% endif %}"></div>
-        </div>
-
-        <div class="d-flex justify-content-center btn-padded">
-
-            <button style="overflow: visible !important; height: 0 !important; width: 0 !important;
-                         margin: 0 !important; border: 0 !important; padding: 0 !important; display: block !important;"
-                                type="submit" value=""/>
-            <button type=submit name="button_choice" value="Delete" class="btn btn-danger"
-                    style="margin: 5px; padding: 5px; width: 150px">
-
-                Delete
-
-            </button>
-            <button type=submit value="Custom_New" class="btn btn-jawa "
-                    style="margin: 5px; padding: 5px; width: 150px">
-
-                Save
-
-            </button>
-        </div>
-
-
-    </div>
-
-{% endblock %}
-{% block additional_js %}
-    <script>
-        function show(event) {
-
-            if (event == "SmartGroupComputerMembershipChange") {
-                hiddenDiv.style.display = 'inline-block';
-                hiddenDivTwo.style.display = 'none';
-            }
-            if (event == "SmartGroupMobileDeviceMembershipChange") {
-                hiddenDiv.style.display = 'inline-block';
-                hiddenDivTwo.style.display = 'inline-block';
-            }
-            if (event == "basic") {
-                hiddenDiv2.style.display = 'inline-block';
-            }
-            if (event == "custom") {
-                hiddenDiv3.style.display = 'inline-block';
-            }
-        }
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
-
diff --git a/templates/webhooks/jamf/home.html b/templates/webhooks/jamf/home.html
deleted file mode 100644
index 4013125..0000000
--- a/templates/webhooks/jamf/home.html
+++ /dev/null
@@ -1,140 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-
-{% block additional_css %}
-
-{% endblock %}
-{% block title %}Jamf Webhooks Dashboard{% endblock %}
-{% block content %}
-    <div>
-    <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="row">
-            <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/jamf/new">Create</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/jamf">View</a></div>
-        </div>
-    </div>
-    <div class="form-container" style="min-height: 82vh">
-        <div class="table-view overflow-auto" style="max-width: 55vh">
-            <div class="d-flex justify-content-center">
-                <h4>Jamf Webhooks Dashboard</h4>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Active JPS</b>: <a href="{{ session.get('url') }}"
-                                      target="_blank">{{ session['url'] }}</a> <br>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Total webhooks installed</b>: {{ jamf_list|length or '0' }}<br>
-            </div>
-        </div>
-        {% if not jamf_list %}
-            <div class="form-container">
-                <div class="table-view" style="max-width: fit-content; text-align: center;">
-                    <div class="table-responsive">
-                        No Jamf Pro webhooks to display. <a href="/webhooks/jamf/new">Create one now.</a>
-                    </div>
-                </div>
-            </div></div>
-        {% else %}
-            <div class="form-container justify-content-center">
-            <div class="row dash-list justify-content-center">
-                {% for row in jamf_list %}
-                    {% if row.url == session['url'] %}
-                        <div class="card col-lg-auto webhooks-list container-bg border-info d-flex flex-column">
-                            <h4 class="overflow-hidden card-header font-weight-bolder">Jamf Pro</h4>
-                            <img src="/static/img/webhook.png"
-                                 class="img img-circle img-fluid card-img mx-auto btn-padded">
-                            <div class="card-body flex-column d-flex webhooks-list">
-                                <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                                <button class="btn btn-jawa text-white overflow-hidden stretched-link mt-auto"
-                                        title="{{ row.name }}" data-toggle="modal"
-                                        data-target="#automationDetails-{{ row.name }}">
-                                    View Details
-                                </button>
-                                <div class="modal fade" id="automationDetails-{{ row.name }}" tabindex="-1"
-                                     role="dialog"
-                                     aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                                    <div class="modal-dialog modal-dialog-centered" role="document">
-                                        <div class="modal-content">
-                                            <div class="modal-header">
-                                                <h5 class="modal-title text-center w-100"
-                                                    id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                                <button type="button" class="close" data-dismiss="modal"
-                                                        aria-label="Close">
-                                                    <span aria-hidden="true">&times;</span>
-                                                </button>
-                                            </div>
-                                            <div class="modal-body text-left">
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh; text-overflow: ellipsis">
-                                                    <b>Automation name</b>: {{ row.name }} (<a
-                                                        href="{{ url }}/webhooks.html?id={{ row.jamf_id }}"
-                                                        target="_blank">View in Jamf</a>)
-                                                </div>
-
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Event</b>: {{ row.event }}
-                                                </div>
-
-                                                <div class="overflow-auto log-frame text-break"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Script path</b>: {{ row.script }}
-                                                </div>
-
-                                                <div class="overflow-auto log-frame"
-                                                     style="max-width: 100vh; max-height: 10vh">
-                                                    <b>Description</b>: {{ row.description }}
-                                                </div>
-
-                                            </div>
-                                            <div class="modal-footer">
-                                                <button type="button" class="btn btn-secondary"
-                                                        data-dismiss="modal">
-                                                    Close
-                                                </button>
-                                                <a type="button" class="btn btn-jawa"
-                                                   href="../webhooks/jamf/edit?name={{ row.name }}">Edit</a>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-
-                        </div>
-                    {% endif %}
-                {% endfor %}
-            </div>
-        {% endif %}
-        </div>
-{% endblock %}
-{% block additional_js %}
-
-{% endblock %}
diff --git a/templates/webhooks/jamf/new.html b/templates/webhooks/jamf/new.html
deleted file mode 100644
index 89c3dee..0000000
--- a/templates/webhooks/jamf/new.html
+++ /dev/null
@@ -1,160 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2023 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-{% block title %}New Jamf Pro Webhook{% endblock %}
-{% block content %}
-<div>
-    <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="row">
-            <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/jamf/new">Create</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/jamf">View</a></div>
-        </div>
-    </div>
-    <div class="form-container">
-        <form method="post" action="/webhooks/jamf/new" class="table-view overflow-auto" enctype="multipart/form-data">
-            <h1>New Jamf Pro Webhook</h1>
-            <input name="webhook_name" type="text" pattern="[^' ']+" placeholder="New Webhook Name (no spaces)" required
-                   title="No spaces, please." class="form-control text-center" value="{{ name }}" autofocus>
-            {% if error %}
-                <div class="alert-danger text-center">{{ error }}</div>
-            {% endif %}
-            <div class="d-flex justify-content-center text-center">
-                <b>Jamf Event:</b>
-            </div>
-            <select class="form-control text-center" name="event"
-                    onchange="java_script_:show(this.options[this.selectedIndex].value)"
-                    required>
-                <option value=""></option>
-                <option value="ComputerAdded">ComputerAdded</option>
-                <option value="ComputerCheckIn">ComputerCheckIn</option>
-                <option value="ComputerInventoryCompleted">ComputerInventoryCompleted</option>
-                <option value="ComputerPatchPolicyCompleted">ComputerPatchPolicyCompleted</option>
-                <option value="ComputerPolicyFinished">ComputerPolicyFinished</option>
-                <option value="ComputerPushCapabilityChanged">ComputerPushCapabilityChanged</option>
-                <option value="DeviceAddedToDEP">DeviceAddedToDEP</option>
-                <option value="DeviceRateLimited">DeviceRateLimited</option>
-                <option value="JSSShutdown">JSSShutdown</option>
-                <option value="JSSStartup">JSSStartup</option>
-                <option value="MobileDeviceCheckIn">MobileDeviceCheckIn</option>
-                <option value="MobileDeviceCommandCompleted">MobileDeviceCommandCompleted</option>
-                <option value="MobileDeviceEnrolled">MobileDeviceEnrolled</option>
-                <option value="MobileDeviceInventoryCompleted">MobileDeviceInventoryCompleted</option>
-                <option value="MobileDevicePushSent">MobileDevicePushSent</option>
-                <option value="MobileDeviceUnEnrolled">MobileDeviceUnEnrolled</option>
-                <option value="PatchSoftwareTitleUpdated">PatchSoftwareTitleUpdated</option>
-                <option value="PushSent">PushSent</option>
-                <option value="RestAPIOperation">RestAPIOperation</option>
-                <option value="SCEPChallenge">SCEPChallenge</option>
-                <option value="SmartGroupComputerMembershipChange">SmartGroupComputerMembershipChange</option>
-                <option value="SmartGroupMobileDeviceMembershipChange">SmartGroupMobileDeviceMembershipChange</option>
-                <option value="SmartGroupUserMembershipChange">SmartGroupUserMembershipChange</option>
-            </select>
-
-            <div id="hiddenDiv" class="text-center" style="display:none">
-                * Note: If utilizing the event for Smart Group Membership Change, after submitting, navigate to the <a
-                    href="{{ url }}/webhooks.html" style="color:#3c6aa7;" target="_blank">Webhooks</a> setting in Jamf
-                Pro
-                and adjust the proper Smart Group for this Webhook.
-            </div>
-            <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-                      class="form-control text-center">{{ description }}</textarea>
-
-            <div class="d-flex justify-content-center text-center custom-file">
-                <input type="file" name="new_file" pattern="[^' ']+" required class="custom-file-input text-center"
-                                         title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
-                <label class="custom-file-label text-center">Upload a script</label>
-            </div>
-            <div class="d-flex justify-content-center">
-                <p>Examples: [<a href="{{ url_for('resources_view.python') }}" class="alert-link">Python</a>, <a
-                        href="{{ url_for('resources_view.bash') }}" class="alert-link">Bash</a>] </p></div>
-            <div class="d-flex justify-content-center"><label>
-                <input type="radio" name="choice" value="basic"
-                       onchange="java_script_:show(this.value)"> &nbsp;
-            </label>
-                <b>Basic Authentication (optional):</b>
-            </div>
-            <div class="d-flex justify-content-center">
-                <div id="hiddenDiv2" style="display:none" class="center_box">
-                    <div class="d-flex justify-content-center">
-                        <input class="form-control-sm" name="basic_username" title="Username (optional)"
-                               autocomplete="off" placeholder="Username (optional)" style="padding: unset">
-                        </b>
-                        <input name="basic_password" autocomplete="off" class="form-control-sm" type='password' title="Password (optional)"
-                               placeholder="Password (optional)" style="padding: unset">
-                    </div>
-                </div>
-            </div>
-            <div class="d-flex justify-content-center"><label>
-                <input type="radio" class="form-check-label" name="choice" value="custom"
-                       onchange="java_script_:show(this.value)"> &nbsp;
-            </label><b>Custom Authentication (optional):</b></div>
-            <div class="d-flex justify-content-center">
-                <div id="hiddenDiv3" style="display:none">
-                    <input name="api_key" class="form-control-sm" title="x-api-key (optional)"
-                           placeholder="x-api-key value (optional)" autocomplete="off"></div>
-            </div>
-            <div class="d-flex justify-content-center">
-                <p></p>
-                <button type=submit value="Custom_New" class="btn btn-jawa"
-                        style="margin: 5px; padding: 5px; width: 150px">Create
-                </button>
-            </div>
-
-        </form>
-    </div>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        function show(event) {
-            if (event == "SmartGroupComputerMembershipChange") {
-                hiddenDiv.style.display = 'inline-block';
-                hiddenDivTwo.style.display = 'none';
-            }
-            if (event == "SmartGroupMobileDeviceMembershipChange") {
-                hiddenDiv.style.display = 'inline-block';
-                hiddenDivTwo.style.display = 'inline-block';
-            }
-            if (event == "basic") {
-                hiddenDiv2.style.display = 'inline-block';
-            }
-            if (event == "custom") {
-                hiddenDiv3.style.display = 'inline-block';
-            }
-        }
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
-
-
diff --git a/templates/webhooks/okta/home.html b/templates/webhooks/okta/home.html
deleted file mode 100644
index 6304881..0000000
--- a/templates/webhooks/okta/home.html
+++ /dev/null
@@ -1,131 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-
-{% block additional_css %}
-
-{% endblock %}
-{% block title %}Okta Webhooks Dashboard{% endblock %}
-
-{% block content %}
-    <div>
-    <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-        <div class="row">
-            <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/okta/new">Create</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/okta">View</a></div>
-        </div>
-    </div>
-    <div class="form-container" style="min-height: 82vh">
-        <div class="table-view overflow-auto" style="max-width: 55vh">
-            <div class="d-flex justify-content-center">
-                <h4>Okta Webhooks Dashboard</h4>
-            </div>
-            <div class="d-flex justify-content-center">
-                <b>Total Okta webhooks installed</b>: {{ okta_list|length or '0' }}<br>
-            </div>
-        </div>
-        {% if not okta_list %}
-            <div class="form-container">
-                <div class="table-view" style="max-width: fit-content; text-align: center;">
-                    <div class="table-responsive">
-                        No Okta webhooks to display. <a href="/webhooks/okta/new">Create one now.</a>
-                    </div>
-                </div>
-            </div></div>
-        {% else %}
-            <div class="form-container justify-content-center">
-            <div class="row dash-list justify-content-center">
-            {% for row in okta_list %}
-                <div class="card col-lg-auto webhooks-list container-bg border-info d-flex flex-column"
-                     style="width: 10rem; padding: 3px; margin: 10px">
-                    <h4 class="overflow-hidden card-header font-weight-bolder">Okta</h4>
-                    <img src="/static/img/webhook.png" class="img img-circle img-fluid card-img btn-padded mx-auto">
-                    <div class="card-body flex-column d-flex webhooks-list">
-                        <h6 class=" overflow-hidden card-title font-weight-bolder">{{ row.name }}</h6>
-                        <button class="btn-jawa btn text-white overflow-hidden stretched-link align-self-end mt-auto"
-                                title="{{ row.name }}" data-toggle="modal" data-target="#automationDetailsOkta">
-                            View Details
-                        </button>
-                        <div class="modal fade" id="automationDetailsOkta" tabindex="-1" role="dialog"
-                             aria-labelledby="automationDetailsCenterTitle" aria-hidden="true">
-                            <div class="modal-dialog modal-dialog-centered" role="document">
-                                <div class="modal-content">
-                                    <div class="modal-header">
-                                        <h5 class="modal-title text-center w-100"
-                                            id="automationDetailsLongTitle">{{ row.name }}</h5>
-                                        <button type="button" class="close" data-dismiss="modal"
-                                                aria-label="Close">
-                                            <span aria-hidden="true">&times;</span>
-                                        </button>
-                                    </div>
-                                    <div class="modal-body text-left">
-                                        <div class="overflow-auto log-frame"
-                                             style="max-width: 100vh; max-height: 10vh">
-                                            <b>Automation name</b>: {{ row.name }}
-                                        </div>
-
-                                        <div class="overflow-auto log-frame"
-                                             style="max-width: 100vh; max-height: 10vh">
-                                            <b>Event</b>: {{ row.okta_event }}
-                                        </div>
-                                        <div class="overflow-auto log-frame text-break"
-                                             style="max-width: 100vh; max-height: 10vh">
-                                            <b>Script path</b>: {{ row.script }}
-                                        </div>
-                                        <div class="overflow-auto log-frame"
-                                             style="max-width: 100vh; max-height: 10vh">
-                                            <b>Okta URL</b>: {{ row.okta_url }}
-                                        </div>
-                                        <div class="overflow-auto log-frame"
-                                             style="max-width: 100vh; max-height: 10vh">
-                                            <b>Description</b>: {{ row.description }}
-                                        </div>
-                                    </div>
-                                    <div class="modal-footer">
-                                        <button type="button" class="btn btn-secondary" data-dismiss="modal">
-                                            Close
-                                        </button>
-                                        <a type="button" class="btn btn-danger"
-                                           href="../webhooks/delete?target_webhook={{ row.name }}">Delete</a>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            {% endfor %}
-        {% endif %}
-        </div>
-{% endblock %}
-{% block additional_js %}
-
-{% endblock %}
-
-
diff --git a/templates/webhooks/okta/new.html b/templates/webhooks/okta/new.html
deleted file mode 100644
index 0cd7fc8..0000000
--- a/templates/webhooks/okta/new.html
+++ /dev/null
@@ -1,97 +0,0 @@
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-{###}
-{## Copyright (c) 2022 Jamf.  All rights reserved.#}
-{###}
-{##       Redistribution and use in source and binary forms, with or without#}
-{##       modification, are permitted provided that the following conditions are met:#}
-{##               * Redistributions of source code must retain the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer.#}
-{##               * Redistributions in binary form must reproduce the above copyright#}
-{##                 notice, this list of conditions and the following disclaimer in the#}
-{##                 documentation and/or other materials provided with the distribution.#}
-{##               * Neither the name of the Jamf nor the names of its contributors may be#}
-{##                 used to endorse or promote products derived from this software without#}
-{##                 specific prior written permission.#}
-{###}
-{##       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY#}
-{##       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED#}
-{##       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE#}
-{##       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY#}
-{##       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES#}
-{##       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;#}
-{##       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND#}
-{##       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT#}
-{##       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS#}
-{##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
-{###}
-{## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
-
-{% extends "shared/_layout.html" %}
-{% block title %}New Okta Webhook{% endblock %}
-{% block content %}
-<div>
-        <div class="test-links sub_links sticky-top" style="min-width: 100vw">
-            <div class="row">
-                <div class="stat p-2 col-sm"><a href="/webhooks">All Webhooks</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/okta/new">Create</a></div>
-            <div class="stat p-2 col-sm"><a href="/webhooks/okta">View</a></div>
-            </div>
-        </div>
-    <div class="form-container">
-
-    <form method="post" class="table-view" enctype="multipart/form-data">
-        <h1>New Okta Webhook</h1>
-        <p class="text-center">
-        <input name="webhookname" type="text" pattern="[^' ']+" placeholder="New Webhook Name (no spaces)" required
-               title="No spaces, please." class="form-control text-center" value="{{ name }}" autofocus>
-            <input type="text" name="okta_server" class="form-control text-center" value="{{ okta_server }}"
-                   placeholder="Okta Server URI" required pattern="https?://.+" title="Use https://">
-            <input type="text" name="token" class="form-control text-center" value="{{ token }}" placeholder="Okta Token"
-                   required>
-            <input type="text" name="event" class="form-control text-center" value="{{ event }}" placeholder="Okta Event"
-                   required>
-            <a href="https://developer.okta.com/docs/reference/api/event-types/" style="color:#3c6aa7;" target="_blank">Okta
-                Event Types</a>
-            (example: user.lifecycle.deactivate)</p>
-        <textarea name="description" rows=3 type="text" placeholder="Description (optional)"
-                  class="form-control text-center">{{ description }}</textarea>
-        <div class="d-flex justify-content-center text-center custom-file">
-                <input type="file" name="script" pattern="[^' ']+" required class="custom-file-input text-center"
-                                         title="No Spaces in the filename!" accept=".sh,.py,.rs,.rlib,.swift,.cgi,.pl,.rb"/>
-                <label class="custom-file-label text-center">Upload a script</label>
-            </div>
-        <div class="d-flex justify-content-center">
-            <p>Examples: [<a href="{{ url_for('resources_view.python') }}" class="alert-link">Python</a>, <a
-                    href="{{ url_for('resources_view.bash') }}" class="alert-link">Bash</a>]
-            </p>
-        </div>
-        <div class="d-flex justify-content-center">
-            <input type="submit" class="btn btn-jawa" value="Create" style="margin: 5px; padding: 5px; width: 150px">
-    </form>
-{% endblock %}
-{% block additional_js %}
-    <script>
-        $(document).ready(function () {
-            $(".submit").click(function () {
-                $(".submit").addClass("loading");
-                setTimeout(function () {
-                    $(".submit").addClass("hide-loading");
-                    $(".done").addClass("finish");
-                }, 1000000);
-                setTimeout(function () {
-                    $(".submit").removeClass("loading");
-                    $(".submit").removeClass("hide-loading");
-                    $(".done").removeClass("finish");
-                    $(".failed").removeClass("finish");
-                }, 1000000);
-            })
-        });
-    </script>
-    <script type="application/javascript">
-        $('input[type="file"]').change(function (e) {
-            var fileName = e.target.files[0].name;
-            $('.custom-file-label').html(fileName);
-        });
-    </script>
-{% endblock %}
-</div>
diff --git a/views/cron_view.py b/views/cron_view.py
deleted file mode 100644
index 250b642..0000000
--- a/views/cron_view.py
+++ /dev/null
@@ -1,515 +0,0 @@
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# Copyright (c) 2023 Jamf.  All rights reserved.
-#
-#       Redistribution and use in source and binary forms, with or without
-#       modification, are permitted provided that the following conditions are met:
-#               * Redistributions of source code must retain the above copyright
-#                 notice, this list of conditions and the following disclaimer.
-#               * Redistributions in binary form must reproduce the above copyright
-#                 notice, this list of conditions and the following disclaimer in the
-#                 documentation and/or other materials provided with the distribution.
-#               * Neither the name of the Jamf nor the names of its contributors may be
-#                 used to endorse or promote products derived from this software without
-#                 specific prior written permission.
-#
-#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
-#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
-#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-
-from crontab import CronTab
-from flask import (
-    Blueprint,
-    Response,
-    redirect,
-    render_template,
-    request,
-    session,
-    url_for,
-)
-from markupsafe import escape
-import getpass
-import json
-import os
-from typing import Any, Dict, List, Tuple, Union
-
-from werkzeug.utils import secure_filename
-
-from bin import logger
-from bin.view_modifiers import response
-
-logthis = logger.setup_child_logger("jawa", __name__)
-
-cron_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "cron.json")
-)
-time_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "time.json")
-)
-scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "scripts")
-)
-
-blueprint = Blueprint("cron", __name__)
-
-
-@blueprint.route("/cron", methods=["GET", "POST"])
-@response(template_file="cron/home.html")
-def cron_home() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    logthis.debug(
-        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
-    )
-    with open(cron_json_file, "r") as fin:
-        cron_json = json.load(fin)
-    return {"username": session.get("username"), "cron_list": cron_json}
-
-
-@blueprint.route("/cron/new", methods=["GET", "POST"])
-def new_cron() -> Union[Response, str]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    logthis.debug(
-        f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
-    )
-    days, frequencies, hours = time_definitions()
-
-    if request.method != "POST":
-        return render_template(
-            "cron/new.html",
-            cron="cron",
-            frequencies=frequencies,
-            days=days,
-            hours=hours,
-            username=str(escape(session["username"])),
-        )
-
-    if " " in request.form.get("cron_name"):
-        error_message = "Single-string name only."
-        return render_template(
-            "error.html",
-            error_message=error_message,
-            error="error",
-            username=str(escape(session["username"])),
-        )
-
-    cron_description = request.form.get("description")
-    cron_name = request.form.get("cron_name")
-
-    if not os.path.isdir(scripts_dir):
-        os.mkdir(scripts_dir)
-    owd = os.getcwd()
-    os.chdir(scripts_dir)
-    script = request.files["script"]
-    if " " in script.filename:
-        script.filename = script.filename.replace(" ", "-")
-    new_script_name = f"cron_{cron_name}_{script.filename}"
-    script.save(secure_filename(new_script_name))
-    script_file = os.path.join(scripts_dir, new_script_name)
-
-    os.chmod(script_file, mode=0o0755)
-    os.chdir(owd)
-    frequency = request.form.get("frequency")
-
-    if not os.path.isfile(cron_json_file):
-        data = []
-        with open(cron_json_file, "w") as outfile:
-            json.dump(data, outfile, indent=4)
-
-    data = json.load(open(cron_json_file))
-
-    for i in data:
-        # Mister Krabs
-        if str(i["name"]) == cron_name:
-            error_message = "Name already exists!"
-            return render_template(
-                "error.html",
-                error_message=error_message,
-                error="error",
-                username=str(escape(session["username"])),
-            )
-    try:
-        cron = CronTab(user=True)
-    except IOError as err:
-        logthis.info(
-            f"Error accessing crontab for {getpass.getuser()} - {err}"
-        )
-        os.remove(script_file)
-        return render_template(
-            "error.html", error=err, username=session.get("username")
-        )
-
-    if frequency == "everyhour":
-        job1 = cron.new(command=script_file, comment=cron_name)
-        job1.every().hours()
-        job1.minute.on(0)
-        cron.write()
-
-    if frequency == "everyday":
-        time = request.form.get("daytime")
-        job1 = cron.new(command=script_file, comment=cron_name)
-        job1.day.every(1)
-        job1.hour.on(time)
-        job1.minute.on(0)
-        cron.write()
-
-    if frequency == "everyweek":
-        day = request.form.get("weekday")
-        time = request.form.get("weektime")
-        job1 = cron.new(command=script_file, comment=cron_name)
-        job1.dow.on(day)
-        job1.hour.on(time)
-        job1.minute.on(0)
-        cron.write()
-
-    if frequency == "everymonth":
-        day = request.form.get("monthday")
-        time = request.form.get("monthtime")
-        job1 = cron.new(command=script_file, comment=cron_name)
-        job1.day.on(day)
-        job1.hour.on(time)
-        job1.minute.on(0)
-        cron.write()
-
-    if frequency == "custom":
-        custom_frequency = request.form.get("customfreq")
-        try:
-            job1 = cron.new(command=script_file, comment=cron_name)
-            job1.setall(f"{custom_frequency}")
-            cron.write()
-        except (KeyError, ValueError) as err:
-            return render_template(
-                "error.html",
-                error="Custom Crontab Frequency Error",
-                error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  Please check your syntax and try again.\nCheck your syntax:  ",
-                link=f"https://crontab.guru/#{custom_frequency}",
-                username=str(escape(session["username"])),
-            )
-
-        frequency = f"Custom [ {custom_frequency} ]"
-
-    data.append(
-        {
-            "name": cron_name,
-            "description": cron_description,
-            "frequency": frequency,
-            "script": script_file,
-        }
-    )
-
-    with open(cron_json_file, "w") as outfile:
-        json.dump(data, outfile, indent=4)
-    success_msg = f"[{session.get('url')}] {session.get('username')} created {cron_name} to run at the frequency:\n {frequency}."
-    logthis.info(f"{success_msg}")
-
-    return render_template(
-        "success.html",
-        webhooks="success",
-        success_msg=success_msg,
-        username=str(escape(session["username"])),
-    )
-
-
-def time_definitions() -> Tuple[List, List, List]:
-    with open(time_json_file, "r+") as fin:
-        content = fin.read()
-        time_data = json.loads(content)
-    days_data = time_data["days"]
-    hours_data = time_data["hours"]
-    frequencies_data = time_data["frequencies"]
-    i = 0
-    days = []
-    for item in days_data:
-        days.append(days_data[i])
-        i += 1
-    i = 0
-    hours = []
-    for item in hours_data:
-        hours.append(hours_data[i])
-        i += 1
-    i = 0
-    frequencies = []
-    for item in frequencies_data:
-        frequencies.append(frequencies_data[i])
-        i += 1
-    return days, frequencies, hours
-
-
-@blueprint.route("/cron/delete", methods=["GET", "POST"])
-def delete_cron() -> Union[Response, str]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    logthis.debug(
-        f"[{session.get('url')}] {session.get('username')} viewed {request.path}"
-    )
-    target_job = request.args.get("target_job")
-    with open(cron_json_file) as fin:
-        cron_json = json.load(fin)
-    names = [str(cron_json[i]["name"]) for i, item in enumerate(cron_json)]
-    if not names:
-        return render_template(
-            "cron/home.html", username=str(escape(session["username"]))
-        )
-
-    if request.method != "POST":
-        return render_template(
-            "cron/delete.html",
-            content=names,
-            target_job=target_job,
-            delete_cron="delete_cron",
-            username=str(escape(session["username"])),
-        )
-    target_job = request.args.get("target_job")
-
-    data = json.load(open(cron_json_file))
-
-    for d in data:
-        if d["name"] == target_job:
-            script_path = d["script"]
-            new_script_path = f"{script_path}.old"
-            if os.path.exists(script_path):
-                os.rename(script_path, new_script_path)
-
-    try:
-        cron = CronTab(user=True)
-    except IOError as err:
-        logthis.info(
-            f"Error accessing crontab for {getpass.getuser()} - {err}"
-        )
-        return render_template(
-            "error.html", error=err, username=session.get("username")
-        )
-
-    for job in cron:
-        if job.comment == target_job:
-            logthis.info(
-                f"[{session.get('url')}] {session.get('username')} removed cron job {target_job}"
-            )
-            cron.remove(job)
-            cron.write()
-
-    data[:] = [d for d in data if d.get("name") != target_job]
-
-    with open(cron_json_file, "w") as outfile:
-        json.dump(data, outfile, indent=4)
-    success_msg = f"[{session.get('url')}] {session.get('username')} successfully deleted the Timed Automation: {target_job}."
-    return render_template(
-        "success.html",
-        success_msg=success_msg,
-        username=str(escape(session["username"])),
-    )
-
-
-@blueprint.route("/cron/edit", methods=["GET", "POST"])
-def edit_cron() -> Union[Response, str]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    logthis.debug(
-        f"[{session.get('url')}] {session.get('username')} viewed {request.path}"
-    )
-
-    try:
-        cron = CronTab(user=True)
-    except IOError as err:
-        logthis.info(
-            f"Error accessing crontab for {getpass.getuser()} - {err}"
-        )
-        return render_template(
-            "error.html", error=err, username=session.get("username")
-        )
-
-    with open(cron_json_file) as fin:
-        cron_json = json.load(fin)
-    names = []
-    name = request.args.get("name")
-    for i, item in enumerate(cron_json):
-        names.append(str(cron_json[i]["name"]))
-        if item.get("name") == name:
-            description = item.get("description")
-    if not name:
-        logthis.info(
-            f"{request.path} - Warning: No name provided for editing, redirecting to cron home"
-        )
-
-        return redirect(url_for("cron.cron_home"))
-    logthis.debug(
-        f"[{session.get('url')}] {session.get('username').title()} checking for job '{name}' in {cron.user}'s crontab"
-    )
-
-    check_for_name = [True for job in cron if job.comment == name]
-    logthis.debug(
-        f"Does {name} exist in {cron.user}'s crontab? {check_for_name}"
-    )
-
-    if not check_for_name:
-        logthis.debug(
-            f"JAWA is not aware of any job named {name} in {cron.user}'s crontab"
-        )
-        return redirect(url_for("cron.cron_home"))
-
-    if not names:
-        return render_template(
-            "cron/home.html", username=str(escape(session["username"]))
-        )
-
-    if request.method != "POST":
-        days, frequencies, hours = time_definitions()
-        return render_template(
-            "cron/edit.html",
-            content=names,
-            edit_name=name,
-            description=description,
-            days=days,
-            hours=hours,
-            frequencies=frequencies,
-            username=str(escape(session["username"])),
-        )
-
-    if " " in request.form.get("cron_name"):
-        error_message = "Single-string name only."
-        return render_template(
-            "error.html",
-            error_message=error_message,
-            error="error",
-            username=str(escape(session["username"])),
-        )
-
-    button_choice = request.form.get("button_choice")
-    if button_choice == "Delete":
-        logthis.debug(
-            f"[{session.get('url')}] {session.get('username')} is considering deleting a Timed Automation ({name})..."
-        )
-        return redirect(url_for("cron.delete_cron", target_job=name))
-
-    for each_cron in cron_json:
-        if each_cron.get("name") == name:
-            new_cron_name = request.form.get("cron_name")
-            if not new_cron_name:
-                new_cron_name = name
-            each_cron["name"] = new_cron_name
-            description = request.form.get("description")
-            if not description:
-                description = each_cron.get("description")
-            each_cron["description"] = description
-            frequency = request.form.get("frequency")
-            frequency_change = False
-            if not frequency:
-                frequency = each_cron.get("frequency")
-            else:
-                frequency_change = True
-            if frequency == "custom":
-                frequency_change = True
-                custom_frequency = request.form.get("customfreq")
-                each_cron["frequency"] = f"Custom [ {custom_frequency} ]"
-            else:
-                each_cron["frequency"] = frequency
-            if request.files.get("script"):
-                script = request.files.get("script")
-                if " " in script.filename:
-                    script.filename = script.filename.replace(" ", "-")
-                if script.filename:
-                    if not os.path.isdir(scripts_dir):
-                        os.mkdir(scripts_dir)
-                    owd = os.getcwd()
-                    os.chdir(scripts_dir)
-                    new_script_name = f"cron_{new_cron_name}_{script.filename}"
-                    script.save(secure_filename(new_script_name))
-                    script_file = os.path.join(scripts_dir, new_script_name)
-                    os.chmod(script_file, mode=0o0755)
-                    os.chdir(owd)
-                    each_cron["script"] = script_file
-                else:
-                    script_file = each_cron.get("script")
-            else:
-                script_file = each_cron.get("script")
-
-    for each_job in cron:
-        if each_job.comment == name:
-            each_job.command = script_file
-            each_job.comment = new_cron_name
-            if frequency_change:
-                if frequency == "everyhour":
-                    each_job.every().hours()
-                    each_job.minute.on(0)
-
-                if frequency == "everyday":
-                    time = request.form.get("daytime")
-                    each_job.day.every(1)
-                    each_job.hour.on(time)
-                    each_job.minute.on(0)
-
-                if frequency == "everyweek":
-                    day = request.form.get("weekday")
-                    time = request.form.get("weektime")
-                    each_job.dow.on(day)
-                    each_job.hour.on(time)
-                    each_job.minute.on(0)
-
-                if frequency == "everymonth":
-                    day = request.form.get("monthday")
-                    time = request.form.get("monthtime")
-                    each_job.day.on(day)
-                    each_job.hour.on(time)
-                    each_job.minute.on(0)
-                if frequency == "custom":
-                    custom_frequency = request.form.get("customfreq")
-                    try:
-                        each_job.setall(f"{custom_frequency}")
-                    except (KeyError, ValueError) as err:
-                        custom_frequency = custom_frequency.replace(" ", "_")
-                        return render_template(
-                            "error.html",
-                            error="Custom Crontab Frequency Error",
-                            error_message=f"The custom job frequency that was presented is invalid:  '{err}'.  "
-                            f"Please check your syntax and try again.\n"
-                            f"Check your syntax:  ",
-                            link=f"https://crontab.guru/#{custom_frequency}",
-                            username=str(escape(session["username"])),
-                        )
-            cron.write()
-
-    with open(cron_json_file, "w") as outfile:
-        json.dump(cron_json, outfile, indent=4)
-    success_msg = f"[{session.get('url')}] {session.get('username')} edited {new_cron_name} to run at the frequency:  {frequency}."
-    logthis.info(f"{success_msg}")
-
-    return render_template(
-        "success.html",
-        success_msg=success_msg,
-        webhooks="success",
-        username=str(escape(session["username"])),
-    )
diff --git a/views/custom_webhook.py b/views/custom_webhook.py
deleted file mode 100644
index 0bfeab5..0000000
--- a/views/custom_webhook.py
+++ /dev/null
@@ -1,338 +0,0 @@
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# Copyright (c) 2025 Jamf.  All rights reserved.
-#
-#       Redistribution and use in source and binary forms, with or without
-#       modification, are permitted provided that the following conditions are met:
-#               * Redistributions of source code must retain the above copyright
-#                 notice, this list of conditions and the following disclaimer.
-#               * Redistributions in binary form must reproduce the above copyright
-#                 notice, this list of conditions and the following disclaimer in the
-#                 documentation and/or other materials provided with the distribution.
-#               * Neither the name of the Jamf nor the names of its contributors may be
-#                 used to endorse or promote products derived from this software without
-#                 specific prior written permission.
-#
-#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
-#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
-#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-
-from collections import defaultdict
-from flask import (
-    Blueprint,
-    Response,
-    redirect,
-    render_template,
-    request,
-    session,
-    url_for,
-)
-import json
-from markupsafe import escape
-import os
-from typing import Any, Dict, Union
-
-from werkzeug.utils import secure_filename
-
-from bin.view_modifiers import response
-from bin import logger
-
-ERROR_TITLE = "Session Timed Out"
-LOGOUT_ENDPOINT = "home_view.logout"
-ERROR_MESSAGE = "Please sign in again"
-
-logthis = logger.setup_child_logger("jawa", __name__)
-
-blueprint = Blueprint("custom_webhook", __name__, template_folder="templates")
-
-server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
-)
-okta_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "okta_json.json")
-)
-okta_verification_file = os.path.abspath(
-    os.path.join(
-        os.path.dirname(__file__), "..", "bin", "okta_verification.py"
-    )
-)
-webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
-)
-scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "scripts")
-)
-
-
-@blueprint.route("/webhooks/custom", methods=["GET", "POST"])
-@response(template_file="webhooks/custom/home.html")
-def custom_webhook() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                LOGOUT_ENDPOINT,
-                error_title=ERROR_TITLE,
-                error_message=ERROR_MESSAGE,
-            )
-        )
-    with open(webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
-    custom_webhooks_list = []
-    for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
-        tag = data["tag"]
-        if tag == "custom":
-            custom_webhooks_list.append(each_webhook)
-
-    return {
-        "username": session.get("username"),
-        "custom_list": custom_webhooks_list,
-    }
-
-
-@blueprint.route("/webhooks/custom/edit", methods=["GET", "POST"])
-@response(template_file="webhooks/custom/edit.html")
-def edit_webhook() -> Union[Response, Dict[str, Any]]:
-    session_check = validate_session()
-    if session_check:
-        return session_check
-    name = request.args.get("name")
-    check_for_name, name, webhooks_json = check_for_dupes(name)
-    if not check_for_name:
-        logthis.info(f"JAWA is not aware of any custom webhook named {name}")
-        return redirect(url_for("custom_webhook.custom_webhook"))
-    if request.method == "POST":
-        result = process_edit_webhook(
-            request.form, request.files, session, name, webhooks_json
-        )
-        if "redirect" in result:
-            return redirect(result["redirect"])
-        return result
-    webhook_info = [
-        each_webhook
-        for each_webhook in webhooks_json
-        if each_webhook["name"] == name
-    ]
-    return {
-        "username": session.get("username"),
-        "webhook_name": name,
-        "webhook_info": webhook_info,
-    }
-
-
-@blueprint.route("/webhooks/custom/new", methods=["GET", "POST"])
-def new_webhook() -> Union[Response, Dict[str, Any], str]:
-    session_check = validate_session()
-    if session_check:
-        return session_check
-    if request.method == "POST":
-        result = process_new_webhook(request.form, request.files, session)
-        if not result:
-            return render_template(
-                "webhooks/custom/new.html", username=session.get("username")
-            )
-        if "template" in result:
-            return render_template(
-                result["template"],
-                webhooks=result["webhooks"],
-                success_msg=result["success_msg"],
-                extra_notice=result["extra_notice"],
-                custom_header=result["custom_header"],
-                username=result["username"],
-            )
-        return result
-    return render_template(
-        "webhooks/custom/new.html", username=session.get("username")
-    )
-
-
-def check_for_dupes(name):
-    if name:
-        name = escape(name)
-    logthis.info(f"Checking for custom webhook '{name}'")
-    with open(webhooks_file) as fin:
-        webhooks_json = json.load(fin)
-    check_for_name = [
-        True for each_webhook in webhooks_json if each_webhook["name"] == name
-    ]
-    logthis.info(f"Name exists? {check_for_name}")
-    return check_for_name, name, webhooks_json
-
-
-def validate_session():
-    if "username" not in session:
-        return redirect(
-            url_for(
-                LOGOUT_ENDPOINT,
-                error_title=ERROR_TITLE,
-                error_message=ERROR_MESSAGE,
-            )
-        )
-    return None
-
-
-def get_form_value(form, key, default="null"):
-    value = form.get(key)
-    return value if value else default
-
-
-def handle_file_upload(file, custom_name, scripts_dir):
-    if not file:
-        return None
-    owd = os.getcwd()
-    if not os.path.isdir(scripts_dir):
-        os.mkdir(scripts_dir)
-    os.chdir(scripts_dir)
-    if " " in file.filename:
-        file.filename = file.filename.replace(" ", "-")
-    new_filename = f"{custom_name}-{file.filename}"
-    file.save(secure_filename(new_filename))
-    new_filename = os.path.join(scripts_dir, new_filename)
-    os.chmod(new_filename, mode=0o0755)
-    os.chdir(owd)
-    return new_filename
-
-
-def process_new_webhook(form, files, session):
-    new_custom_name = form.get("custom_name")
-    description = form.get("description")
-    output = form.get("output")
-    if not new_custom_name:
-        return None
-    with open(webhooks_file, "r") as json_file:
-        webhooks_json = json.load(json_file)
-    if any(each.get("name") == new_custom_name for each in webhooks_json):
-        error_message = "Name already exists!"
-        logthis.info(f"Could not create new webhook. Message: {error_message}")
-        return {
-            "error": error_message,
-            "username": session.get("username"),
-            "name": new_custom_name,
-            "description": description,
-        }
-    new_filename = handle_file_upload(
-        files.get("new_file"), new_custom_name, scripts_dir
-    )
-    new_webhook_user = get_form_value(form, "basic_username")
-    new_webhook_pass = get_form_value(form, "new-password")
-    if form.get("custom"):
-        api_key = get_form_value(form, "api_key")
-        extra_notice = (
-            "Use the following in your request headers for authentication: "
-        )
-        custom_header = {"x-api-key": f"{api_key}"}
-    else:
-        extra_notice = None
-        custom_header = None
-        api_key = "null"
-    webhooks_json.append(
-        {
-            "url": str(session["url"]),
-            "jawa_admin": str(session["username"]),
-            "name": new_custom_name,
-            "webhook_username": new_webhook_user,
-            "webhook_password": new_webhook_pass,
-            "api_key": api_key,
-            "script": new_filename,
-            "description": description,
-            "tag": "custom",
-            "output": output,
-        }
-    )
-    with open(webhooks_file, "w") as outfile:
-        json.dump(webhooks_json, outfile, indent=4)
-    success_msg = "New webhook created:"
-    return {
-        "template": "success.html",
-        "webhooks": "success",
-        "success_msg": success_msg,
-        "extra_notice": extra_notice,
-        "custom_header": custom_header,
-        "username": str(escape(session["username"])),
-    }
-
-
-def update_webhook(each_webhook, form, files, name):
-    output = form.get("output")
-    new_custom_name = get_form_value(form, "custom_name", name)
-    description = form.get("description")
-    new_webhook_user = (
-        get_form_value(form, "basic_username") if form.get("basic") else "null"
-    )
-    new_webhook_pass = (
-        get_form_value(form, "new-password") if form.get("basic") else "null"
-    )
-    if form.get("custom"):
-        new_webhook_apikey = get_form_value(form, "api_key")
-        extra_notice = (
-            "Use the following in your request headers for authentication: "
-        )
-        custom_header = {"x-api-key": f"{new_webhook_apikey}"}
-    else:
-        new_webhook_apikey = "null"
-        extra_notice = None
-        custom_header = None
-    each_webhook["webhook_username"] = new_webhook_user
-    each_webhook["webhook_password"] = new_webhook_pass
-    each_webhook["api_key"] = new_webhook_apikey
-    new_filename = handle_file_upload(
-        files.get("new_file"), new_custom_name, scripts_dir
-    )
-    if new_filename:
-        each_webhook["script"] = new_filename
-    each_webhook["name"] = new_custom_name
-    if description:
-        each_webhook["description"] = description
-    each_webhook["output"] = output
-    return extra_notice, custom_header, new_custom_name
-
-
-def process_edit_webhook(form, files, session, name, webhooks_json):
-    button_choice = form.get("button_choice")
-    if button_choice == "Delete":
-        logthis.info(
-            f"{session.get('username')} is considering deleting a custom webhook ({name})..."
-        )
-        return {
-            "redirect": url_for("webhooks.delete_webhook", target_webhook=name)
-        }
-    for each_webhook in webhooks_json:
-        if each_webhook["name"] == name:
-            logthis.info(
-                f"{session.get('username')} is editing a custom webhook ({name})..."
-            )
-            extra_notice, custom_header, new_custom_name = update_webhook(
-                each_webhook, form, files, name
-            )
-            with open(webhooks_file, "w") as fout:
-                json.dump(webhooks_json, fout, indent=4)
-            webhook_info = [each_webhook]
-            return {
-                "webhooks": "success",
-                "success_msg": f"Edited custom webhook {new_custom_name}.",
-                "username": session.get("username"),
-                "webhook_info": webhook_info,
-                "webhook_name": new_custom_name,
-                "description": each_webhook.get("description"),
-                "extra_notice": extra_notice,
-                "custom_header": custom_header,
-            }
-    webhook_info = [
-        each_webhook
-        for each_webhook in webhooks_json
-        if each_webhook["name"] == name
-    ]
-    return {
-        "username": session.get("username"),
-        "webhook_name": name,
-        "webhook_info": webhook_info,
-    }
diff --git a/views/jamf_webhook.py b/views/jamf_webhook.py
deleted file mode 100644
index efe9902..0000000
--- a/views/jamf_webhook.py
+++ /dev/null
@@ -1,649 +0,0 @@
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# Copyright (c) 2024 Jamf.  All rights reserved.
-#
-#       Redistribution and use in source and binary forms, with or without
-#       modification, are permitted provided that the following conditions are met:
-#               * Redistributions of source code must retain the above copyright
-#                 notice, this list of conditions and the following disclaimer.
-#               * Redistributions in binary form must reproduce the above copyright
-#                 notice, this list of conditions and the following disclaimer in the
-#                 documentation and/or other materials provided with the distribution.
-#               * Neither the name of the Jamf nor the names of its contributors may be
-#                 used to endorse or promote products derived from this software without
-#                 specific prior written permission.
-#
-#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
-#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
-#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-
-from collections import defaultdict
-from flask import (
-    Blueprint,
-    Response,
-    redirect,
-    render_template,
-    request,
-    session,
-    url_for,
-)
-from markupsafe import escape
-import json
-import os
-import re
-from typing import Any, Dict, Union
-
-import requests
-from werkzeug.utils import secure_filename
-
-from bin.tokens import validate_token, get_token
-from bin.view_modifiers import response
-from bin import logger
-
-logthis = logger.setup_child_logger("jawa", __name__)
-
-server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
-)
-webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
-)
-scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "scripts")
-)
-verify_ssl = True
-blueprint = Blueprint("jamf_pro_webhooks", __name__)
-
-
-@blueprint.route("/webhooks/jamf", methods=["GET"])
-@response(template_file="webhooks/jamf/home.html")
-def jamf_webhook() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    with open(webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
-    jamf_pro_list = []
-    for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
-        tag = data["tag"]
-        if tag == "jamfpro":
-            jamf_pro_list.append(each_webhook)
-
-    return {
-        "username": session.get("username"),
-        "jamf_list": jamf_pro_list,
-        "url": session.get("url"),
-    }
-
-
-@blueprint.route("/webhooks/jamf/new", methods=["GET", "POST"])
-def jamf_pro_new() -> Union[Response, str]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    if not os.path.isfile(server_json_file):
-        return render_template(
-            "setup/setup.html",
-            setup="setup",
-            jps_url=str(escape(session["url"])),
-            username=str(escape(session["username"])),
-        )
-    with open(server_json_file, "r") as fin:
-        server_json = json.load(fin)
-    if server_json == []:
-        return render_template(
-            "setup/setup.html",
-            setup="setup",
-            jps_url=str(escape(session["url"])),
-            username=str(escape(session["username"])),
-        )
-    if not server_json.get("jawa_address"):
-        return redirect(url_for("setup"))
-    if not os.path.isfile(webhooks_file):
-        data = []
-        with open(webhooks_file, "w") as outfile:
-            json.dump(data, outfile, indent=4)
-
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    if request.method != "POST":
-        return render_template(
-            "webhooks/jamf/new.html",
-            webhooks="webhooks",
-            url=session["url"],
-            username=str(escape(session["username"])),
-        )
-    if not validate_token(session["expires"]):
-        get_token()
-    if request.form.get("webhook_name") != "":
-        check = 0
-        if " " in request.form.get("webhook_name"):
-            error_message = "Single-string name only."
-            return render_template(
-                "error.html",
-                error_message=error_message,
-                error="error",
-                username=str(escape(session["username"])),
-            )
-
-        with open(webhooks_file) as json_file:
-            data = json.load(json_file)
-
-            x = 0
-            id_list = []
-            while True:
-                try:
-                    id_list.append(data[x]["name"])
-                    x += 1
-                    str_error = None
-                except Exception as str_error:
-                    if not str_error:
-                        continue
-                    break
-            for id_name in id_list:
-                check = 1 if id_name == request.form.get("webhook_name") else 0
-        if check != 0:
-            error_message = "Name already exists!"
-            return render_template(
-                "error.html",
-                error_message=error_message,
-                error="error",
-                username=str(escape(session["username"])),
-            )
-
-        with open(server_json_file) as json_file:
-            data = json.load(json_file)
-            server_address = data.get("jawa_address")
-            if not server_address:
-                return redirect(url_for("setup"))
-        if not os.path.isdir(scripts_dir):
-            os.mkdir(scripts_dir)
-        owd = os.getcwd()
-        os.chdir(scripts_dir)
-
-        new_file = request.files.get("new_file")
-        if " " in new_file.filename:
-            new_file.filename = new_file.filename.replace(" ", "-")
-
-        new_file.save(secure_filename(new_file.filename))
-
-        old_script_file = os.path.abspath(
-            os.path.join(scripts_dir, f"{new_file.filename}")
-        )
-        new_script_file = os.path.join(
-            scripts_dir,
-            f"{request.form.get('webhook_name')}-{new_file.filename}",
-        )
-        os.rename(old_script_file, new_script_file)
-
-        os.chmod(new_script_file, mode=0o0755)
-        os.chdir(owd)
-        if request.form.get("event") in [
-            "SmartGroupMobileDeviceMembershipChange",
-            "SmartGroupComputerMembershipChange",
-            "SmartGroupUserMembershipChange",
-        ]:
-            smart_group_notice = "NOTICE!  This webhook is not yet enabled."
-            smart_group_instructions = (
-                "Specify desired Smart Group and enable: "
-            )
-            webhook_enablement = "false"
-
-        else:
-            smart_group_notice = ""
-            smart_group_instructions = ""
-            webhook_enablement = "true"
-
-        if (
-            request.form.get("event")
-            == "SmartGroupMobileDeviceMembershipChange"
-        ):
-            extra_xml = (
-                "<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
-                            <display_fields>\
-                                <display_field>\
-                                    <name>Asset Tag</name>\
-                                </display_field>\
-                                <display_field>\
-                                    <name>Building</name>\
-                                </display_field>\
-                                <display_field>\
-                                    <name>Department</name>\
-                                </display_field>\
-                                <display_field>\
-                                    <name>Email Address</name>\
-                                </display_field>\
-                                <display_field>\
-                                    <name>Last Inventory Update</name>\
-                                </display_field>\
-                                <display_field>\
-                                    <name>Last Enrollment</name>\
-                                </display_field>\
-                            </display_fields>"
-            )
-        else:
-            extra_xml = ""
-
-        # Check for auth values
-        auth_xml = "<authentication_type>NONE</authentication_type>"
-        if request.form.get("choice") == "basic":
-            if (
-                request.form.get("basic_username") != ""
-                or request.form.get("basic_password") != ""
-            ):
-                auth_xml = "<authentication_type>BASIC</authentication_type>"
-                if request.form.get("basic_username") == "":
-                    auth_xml += "<username>null</username>"
-                else:
-                    auth_xml += f"<username>{request.form.get('basic_username')}</username>"
-                if request.form.get("basic_password") == "":
-                    auth_xml += "<password>null</password>"
-                else:
-                    auth_xml += f"<password>{request.form.get('basic_password')}</password>"
-
-        data = (
-            f"<webhook>"
-            f"<name>{request.form.get('webhook_name')}</name>"
-            f"<enabled>{webhook_enablement}</enabled>"
-            f"<url>{server_address}/hooks/{request.form.get('webhook_name')}</url>"
-            f"<content_type>application/json</content_type>"
-            f"<event>{request.form.get('event')}</event>"
-            f"{auth_xml}"
-            f"{extra_xml}"
-            f"</webhook>"
-        )
-
-        full_url = session["url"] + "/JSSResource/webhooks/id/0"
-        logthis.info(
-            f"{session.get('username')} creating a new JPS webhook {request.form.get('webhook_name')}."
-        )
-        webhook_response = requests.post(
-            full_url,
-            headers={
-                "Content-Type": "application/xml",
-                "Authorization": f"Bearer {session['token']}",
-                "User-Agent": "JAWA%20v3.1.1",
-            },
-            data=data,
-            verify=verify_ssl,
-        )
-        logthis.info(
-            f"[{webhook_response.status_code}]  {webhook_response.text}"
-        )
-        if webhook_response.status_code == 409:
-            error_message = f'The webhooks name "{request.form.get("webhook_name")}" already exists in your Jamf Pro Server.'
-            return render_template(
-                "error.html",
-                error_message=error_message,
-                error="error",
-                username=str(escape(session["username"])),
-            )
-
-        result = re.search("<id>(.*)</id>", webhook_response.text)
-        jamf_id = result.group(1)
-        new_link = "{}/webhooks.html?id={}&o=r".format(
-            session["url"], result.group(1)
-        )
-        logthis.info(
-            f"{session.get('username')} created a new webhook. "
-            f"Name: {request.form.get('webhook_name')} "
-            f"Jamf link: {new_link}"
-        )
-        custom_header = ""
-        data = json.load(open(webhooks_file))
-        if request.form.get("choice") == "basic":
-            webhook_username = request.form.get("basic_username", "null")
-            webhook_password = request.form.get("basic_password", "null")
-        else:
-            webhook_username = "null"
-            webhook_password = "null"
-        if request.form.get("choice") == "custom":
-            webhook_apikey = request.form.get("api_key", "null")
-            extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks:"
-            custom_header = {"x-api-key": f"{webhook_apikey}"}
-        else:
-            webhook_apikey = "null"
-            extra_notice = None
-
-        data.append(
-            {
-                "url": str(session["url"]),
-                "jawa_admin": str(session["username"]),
-                "name": request.form.get("webhook_name"),
-                "webhook_username": webhook_username,
-                "webhook_password": webhook_password,
-                "api_key": webhook_apikey,
-                "event": request.form.get("event"),
-                "script": new_script_file,
-                "description": request.form.get("description"),
-                "tag": "jamfpro",
-                "jamf_id": jamf_id,
-            }
-        )
-
-        with open(webhooks_file, "w") as outfile:
-            json.dump(data, outfile, indent=4)
-
-        new_here = request.form.get("webhook_name")
-        success_msg = "New webhook created:"
-
-    return render_template(
-        "success.html",
-        webhooks="success",
-        smart_group_instructions=smart_group_instructions,
-        smart_group_notice=smart_group_notice,
-        new_link=new_link,
-        new_here=new_here,
-        success_msg=success_msg,
-        extra_notice=extra_notice,
-        custom_header=custom_header,
-        username=str(escape(session["username"])),
-    )
-
-
-# Edit Existing Webhook
-@blueprint.route("/webhooks/jamf/edit", methods=["GET", "POST"])
-@response(template_file="webhooks/jamf/edit.html")
-def jamf_pro_edit() -> Union[Response, str, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    name = request.args.get("name")
-    if name:
-        name = escape(name)
-    with open(webhooks_file) as fin:
-        webhooks_json = json.load(fin)
-    check_for_name = [
-        True for each_webhook in webhooks_json if each_webhook["name"] == name
-    ]
-    if not check_for_name:
-        logthis.info(f"Webhook '{name}' not in json")
-        return redirect(url_for("jamf_pro_webhooks.jamf_webhook"))
-
-    extra_notice = None
-    custom_header = None
-    smart_group_notice = None
-    smart_group_instructions = None
-
-    webhook_info = [
-        each_webhook
-        for each_webhook in webhooks_json
-        if each_webhook["name"] == name
-    ]
-    if request.method == "POST":
-        button_choice = request.form.get("button_choice")
-        if button_choice == "Delete":
-            return redirect(
-                url_for("webhooks.delete_webhook", target_webhook=name)
-            )
-
-        if not validate_token(session["expires"]):
-            get_token()
-        for each_webhook in webhooks_json:
-            if each_webhook["name"] == name:
-                new_webhook_name = request.form.get("webhook_name")
-                if not new_webhook_name:
-                    new_webhook_name = name
-                description = request.form.get("description")
-                new_event = request.form.get("event")
-                custom_header = ""
-                if request.form.get("choice") == "basic":
-                    webhook_user = request.form.get("basic_username", "null")
-                    webhook_pass = request.form.get("basic_password", "null")
-                else:
-                    webhook_user = "null"
-                    webhook_pass = "null"
-                if request.form.get("choice") == "custom":
-                    webhook_apikey = request.form.get("api_key", "null")
-                    extra_notice = "Copy and paste the following into the Header Authentication section of Jamf Pro webhooks "
-                    custom_header = {"x-api-key": f"{webhook_apikey}"}
-                else:
-                    webhook_apikey = "null"
-                    extra_notice = None
-
-                if request.files.get("new_file"):
-                    new_script = request.files.get("new_file")
-                    owd = os.getcwd()
-                    os.chdir(scripts_dir)
-
-                    if " " in new_script.filename:
-                        new_script.filename = new_script.filename.replace(
-                            " ", "-"
-                        )
-
-                    new_filename = f"{new_webhook_name}-{new_script.filename}"
-                    new_script.save(secure_filename(new_filename))
-                    new_filename = os.path.join(
-                        scripts_dir,
-                        f"{new_webhook_name}-{new_script.filename}",
-                    )
-                    os.chmod(new_filename, mode=0o0755)
-                    os.chdir(owd)
-                    each_webhook["script"] = new_filename
-                else:
-                    new_filename = each_webhook["script"]
-                if new_webhook_name:
-                    each_webhook["name"] = new_webhook_name
-                if description:
-                    each_webhook["description"] = description
-                if new_event:
-                    each_webhook["event"] = new_event
-                if webhook_user and webhook_user != "":
-                    each_webhook["webhook_username"] = webhook_user
-                else:
-                    each_webhook["webhook_username"] = "null"
-                if webhook_pass and webhook_pass != "":
-                    each_webhook["webhook_password"] = webhook_pass
-                else:
-                    each_webhook["webhook_password"] = "null"
-                if webhook_apikey and webhook_apikey != "":
-                    each_webhook["api_key"] = webhook_apikey
-                else:
-                    each_webhook["webhook_password"] = "null"
-                each_webhook["jawa_admin"] = session.get("username")
-                if each_webhook.get("event") in [
-                    "SmartGroupMobileDeviceMembershipChange",
-                    "SmartGroupComputerMembershipChange",
-                    "SmartGroupUserMembershipChange",
-                ]:
-                    smart_group_notice = (
-                        "NOTICE!  This webhook is currently disabled."
-                    )
-                    smart_group_instructions = (
-                        "Please verify the linked Smart Group and re-enable: "
-                    )
-                    webhook_enablement = "false"
-
-                else:
-                    smart_group_notice = ""
-                    smart_group_instructions = ""
-                    webhook_enablement = "true"
-
-                if (
-                    each_webhook.get("event")
-                    == "SmartGroupMobileDeviceMembershipChange"
-                ):
-                    extra_xml = (
-                        "<enable_display_fields_for_group_object>true</enable_display_fields_for_group_object>\
-                                    <display_fields>\
-                                        <display_field>\
-                                            <name>Asset Tag</name>\
-                                        </display_field>\
-                                        <display_field>\
-                                            <name>Building</name>\
-                                        </display_field>\
-                                        <display_field>\
-                                            <name>Department</name>\
-                                        </display_field>\
-                                        <display_field>\
-                                            <name>Email Address</name>\
-                                        </display_field>\
-                                        <display_field>\
-                                            <name>Last Inventory Update</name>\
-                                        </display_field>\
-                                        <display_field>\
-                                            <name>Last Enrollment</name>\
-                                        </display_field>\
-                                    </display_fields>"
-                    )
-                else:
-                    extra_xml = ""
-                    # Check for auth values
-                auth_xml = "<authentication_type>NONE</authentication_type>"
-                if request.form.get("choice") == "basic":
-                    if (
-                        request.form.get("basic_username") != ""
-                        or request.form.get("basic_password") != ""
-                    ):
-                        auth_xml = (
-                            "<authentication_type>BASIC</authentication_type>"
-                        )
-                        if (
-                            request.form.get("basic_username") == "null"
-                            and request.form.get("basic_password") == "null"
-                        ):
-                            auth_xml = "<authentication_type>NONE</authentication_type>"
-
-                        if request.form.get("basic_username") == "":
-                            auth_xml += "<username>null</username>"
-                        else:
-                            auth_xml += f"<username>{request.form.get('basic_username')}</username>"
-                        if request.form.get("basic_password") == "":
-                            auth_xml += "<password>null</password>"
-                        else:
-                            auth_xml += f"<password>{request.form.get('basic_password')}</password>"
-                with open(server_json_file) as fin:
-                    server_json = json.load(fin)
-                server_address = server_json["jawa_address"]
-                data = (
-                    f"<webhook>"
-                    f"<name>{each_webhook.get('name')}</name>"
-                    f"<enabled>{webhook_enablement}</enabled>"
-                    f"<url>{server_address}/hooks/{each_webhook.get('name')}</url>"
-                    f"<content_type>application/json</content_type>"
-                    f"<event>{each_webhook.get('event')}</event>"
-                    f"{auth_xml}"
-                    f"{extra_xml}"
-                    f"</webhook>"
-                )
-
-                full_url = f"{session['url']}/JSSResource/webhooks/id/{each_webhook.get('jamf_id')}"
-
-                logthis.debug(
-                    f"{session.get('username')} editing the JPS webhook {name}."
-                )
-                try:
-                    webhook_response = requests.put(
-                        full_url,
-                        headers={
-                            "Content-Type": "application/xml",
-                            "Authorization": f"Bearer {session['token']}",
-                            "User-Agent": "JAWA%20v3.1.1",
-                        },
-                        data=data,
-                        verify=verify_ssl,
-                    )
-                except Exception as err:
-                    error_message = (
-                        f"The request could not be sent to your Jamf Pro server,"
-                        f"check your network connection. Details: {err}"
-                    )
-                    return render_template(
-                        "error.html",
-                        error_message=error_message,
-                        error="error",
-                        username=str(escape(session["username"])),
-                    )
-                logthis.debug(
-                    f"[{webhook_response.status_code}]  {webhook_response.text}"
-                )
-                if webhook_response.status_code == 409:
-                    error_message = f'The webhooks name "{name}" already exists in your Jamf Pro Server.'
-                    logthis.info(
-                        f"[{session.get('url')}] {session.get('username').title()} - error editing webhook. {error_message}"
-                    )
-                    return redirect(
-                        url_for(
-                            "error",
-                            error="Duplicate",
-                            error_message=error_message,
-                            username=session.get("username"),
-                        )
-                    )
-                elif webhook_response.status_code == 401:
-                    error_message = (
-                        f"{session.get('username').title()} doesn't have privileges to update webhooks."
-                        f"Check your account privileges in Jamf Pro Settings"
-                    )
-                    logthis.info(f"[{session.get('url')}] {error_message}")
-                    return redirect(
-                        url_for(
-                            "error",
-                            error="Insufficient privileges",
-                            error_message=error_message,
-                            username=session.get("username"),
-                        )
-                    )
-                with open(webhooks_file, "w") as fout:
-                    json.dump(webhooks_json, fout, indent=4)
-                result = re.search("<id>(.*)</id>", webhook_response.text)
-                jamf_id = result.group(1)
-                new_link = f"{format(session.get('url'))}/webhooks.html?id={jamf_id}&o=r"
-                success_msg = "Webhook edited:"
-                logthis.info(
-                    f"{session.get('username')} edited a Jamf webhook. "
-                    f"Name: {name} "
-                    f"Jamf link: {new_link}"
-                )
-                return {
-                    "webhooks": "success",
-                    "smart_group_instructions": smart_group_instructions,
-                    "smart_group_notice": smart_group_notice,
-                    "new_link": new_link,
-                    "new_here": new_webhook_name,
-                    "success_msg": success_msg,
-                    "extra_notice": extra_notice,
-                    "custom_header": custom_header,
-                    "username": session.get("username"),
-                    "webhook_info": webhook_info,
-                    "webhook_name": name,
-                    "description": each_webhook.get("description"),
-                }
-
-    return {
-        "username": session.get("username"),
-        "webhook_name": name,
-        "url": session.get("url"),
-        "webhook_info": webhook_info,
-    }
diff --git a/views/okta_webhook.py b/views/okta_webhook.py
deleted file mode 100644
index 9ed8771..0000000
--- a/views/okta_webhook.py
+++ /dev/null
@@ -1,247 +0,0 @@
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# Copyright (c) 2023 Jamf.  All rights reserved.
-#
-#       Redistribution and use in source and binary forms, with or without
-#       modification, are permitted provided that the following conditions are met:
-#               * Redistributions of source code must retain the above copyright
-#                 notice, this list of conditions and the following disclaimer.
-#               * Redistributions in binary form must reproduce the above copyright
-#                 notice, this list of conditions and the following disclaimer in the
-#                 documentation and/or other materials provided with the distribution.
-#               * Neither the name of the Jamf nor the names of its contributors may be
-#                 used to endorse or promote products derived from this software without
-#                 specific prior written permission.
-#
-#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
-#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
-#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-
-from collections import defaultdict
-import json
-from flask import (
-    Blueprint,
-    Response,
-    redirect,
-    render_template,
-    request,
-    session,
-    url_for,
-)
-from markupsafe import escape
-import os
-from typing import Any, Dict, Union
-
-import requests
-from werkzeug.utils import secure_filename
-
-from bin.view_modifiers import response
-from bin import logger
-
-logthis = logger.setup_child_logger("jawa", __name__)
-
-blueprint = Blueprint("okta_webhook", __name__)
-
-server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
-)
-okta_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "okta_json.json")
-)
-okta_verification_file = os.path.abspath(
-    os.path.join(
-        os.path.dirname(__file__), "..", "bin", "okta_verification.py"
-    )
-)
-webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
-)
-scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "scripts")
-)
-
-
-@blueprint.route("/webhooks/okta", methods=["GET", "POST"])
-@response(template_file="webhooks/okta/home.html")
-def okta_webhook() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    with open(webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
-    okta_webhooks_list = []
-    for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
-        tag = data["tag"]
-        if tag == "okta":
-            okta_webhooks_list.append(each_webhook)
-    return {
-        "key": "Have a good weekend my dude.",
-        "username": session.get("username"),
-        "okta_list": okta_webhooks_list,
-    }
-
-
-@blueprint.route("/webhooks/okta/new", methods=["GET", "POST"])
-def okta_new() -> Union[Response, str]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    os.chmod(okta_verification_file, mode=0o0755)
-    if not os.path.isfile(webhooks_file):
-        data = []
-        with open(webhooks_file, "w") as outfile:
-            json.dump(data, outfile, indent=4)
-    with open(server_json_file) as json_file:
-        data = json.load(json_file)
-        server_address = data.get("jawa_address")
-        if not server_address:
-            return redirect(url_for("setup"))
-    if request.method != "POST":
-        return render_template(
-            "webhooks/okta/new.html",
-            setup="setup",
-            username=str(escape(session["username"])),
-        )
-    if " " in request.form.get("webhookname"):
-        error_message = "Single-string name only."
-        return render_template(
-            "error.html",
-            error_message=error_message,
-            error="error",
-            username=str(escape(session["username"])),
-        )
-    if not os.path.isdir(scripts_dir):
-        os.mkdir(scripts_dir)
-
-    okta_server = request.form.get("okta_server")
-    okta_token = request.form.get("token")
-    okta_name = request.form.get("webhookname")
-    okta_event = request.form.get("event")
-    description = request.form.get("description")
-    webhook_server_url = server_address + "/hooks/" + okta_name
-    logthis.info(webhook_server_url)
-    owd = os.getcwd()
-    os.chdir(scripts_dir)
-
-    f = request.files["script"]
-    if " " in f.filename:
-        f.filename = f.filename.replace(" ", "-")
-
-    f.save(secure_filename(f.filename))
-
-    old_script_file = os.path.join(scripts_dir, f.filename)
-    data = json.load(open(webhooks_file))
-    script_file = os.path.join(scripts_dir, okta_name + "_" + f.filename)
-    os.rename(old_script_file, script_file)
-    new_file = script_file
-    okta_info = json.load(open(webhooks_file))
-    os.chdir(owd)
-    for i in data:
-        if str(i["name"]) == okta_name:
-            error_message = "Name already exists!"
-            logthis.info("okta webhook erorr")
-            return render_template(
-                "error.html",
-                error_message=error_message,
-                error="error",
-                username=str(escape(session["username"])),
-            )
-
-    os.chmod(os.path.join(scripts_dir, new_file), mode=0o0755)
-
-    data = {
-        "name": okta_name,
-        "events": {"type": "EVENT_TYPE", "items": [okta_event]},
-        "channel": {
-            "type": "HTTP",
-            "version": "1.0.0",
-            "config": {
-                "uri": webhook_server_url,
-                "headers": [
-                    {"key": "X-Other-Header", "value": "some-other-value"}
-                ],
-                "authScheme": {
-                    "type": "HEADER",
-                    "key": "Authorization",
-                    "value": "${api_key}",
-                },
-            },
-        },
-    }
-
-    data = json.dumps(data, indent=4)
-
-    # Makes hook in Okta, gets id
-    resp = requests.post(
-        f"{okta_server}/api/v1/eventHooks",
-        headers={
-            "Accept": "application/json",
-            "Authorization": f"SSWS {okta_token}",
-            "Content-Type": "application/json",
-        },
-        data=data,
-    )
-    response_json = resp.json()
-    okta_id = response_json.get("id")
-
-    okta_info.append(
-        {
-            "name": okta_name,
-            "okta_id": okta_id,
-            "okta_event": okta_event,
-            "okta_url": okta_server,
-            "okta_token": okta_token,
-            "script": script_file,
-            "description": description,
-            "webhook_username": "null",
-            "webhook_password": "null",
-            "tag": "okta",
-        }
-    )
-    if okta_id:
-        with open(webhooks_file, "w") as outfile:
-            json.dump(okta_info, outfile, indent=4)
-
-    # Verify/activate
-    resp = requests.post(
-        f"{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify",
-        headers={"Authorization": f"SSWS {okta_token}"},
-    )
-    verification = resp.json()
-    if "errorCode" in verification:
-        error_message = (
-            "Okta was unable to verify the webhook.  Check network settings."
-        )
-        return render_template(
-            "error.html",
-            error_message=error_message,
-            error="Event Verification Error",
-            username=str(escape(session["username"])),
-        )
-
-    return render_template(
-        "success.html",
-        username=session.get("username"),
-        login="true",
-        success_msg="Okta Webhook Created.",
-    )
diff --git a/views/webhook_view.py b/views/webhook_view.py
deleted file mode 100644
index 16bb9d6..0000000
--- a/views/webhook_view.py
+++ /dev/null
@@ -1,182 +0,0 @@
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# Copyright (c) 2024 Jamf.  All rights reserved.
-#
-#       Redistribution and use in source and binary forms, with or without
-#       modification, are permitted provided that the following conditions are met:
-#               * Redistributions of source code must retain the above copyright
-#                 notice, this list of conditions and the following disclaimer.
-#               * Redistributions in binary form must reproduce the above copyright
-#                 notice, this list of conditions and the following disclaimer in the
-#                 documentation and/or other materials provided with the distribution.
-#               * Neither the name of the Jamf nor the names of its contributors may be
-#                 used to endorse or promote products derived from this software without
-#                 specific prior written permission.
-#
-#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
-#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
-#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-
-from collections import defaultdict
-from flask import Blueprint, Response, redirect, request, session, url_for
-import json
-from markupsafe import escape
-import os
-import time
-from typing import Any, Dict, Union
-
-import requests
-
-from bin import logger
-from bin.tokens import validate_token, get_token
-from bin.view_modifiers import response
-
-logthis = logger.setup_child_logger("jawa", __name__)
-
-blueprint = Blueprint("webhooks", __name__, template_folder="templates")
-
-server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
-)
-okta_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "okta_json.json")
-)
-okta_verification_file = os.path.abspath(
-    os.path.join(
-        os.path.dirname(__file__), "..", "bin", "okta_verification.py"
-    )
-)
-webhooks_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "webhooks.json")
-)
-scripts_dir = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "scripts")
-)
-
-
-@blueprint.route("/webhooks/delete", methods=["GET", "POST"])
-@response(template_file="webhooks/delete.html")
-def delete_webhook() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    target_webhook = request.args.get("target_webhook")
-    if not target_webhook:
-        return redirect(url_for("custom_webhook.custom_webhook"))
-    target_webhook = escape(target_webhook)
-    with open(webhooks_file) as fin:
-        webhook_json = json.load(fin)
-    tag = [
-        each_webhook["tag"]
-        for each_webhook in webhook_json
-        if each_webhook["name"] == target_webhook
-    ]
-
-    if request.method == "POST":
-        logthis.info(f"Deleting {tag} webhook: {target_webhook}")
-        for each_webhook in webhook_json:
-            if each_webhook["name"] == target_webhook:
-                script_file = each_webhook["script"]
-                if os.path.exists(script_file):
-                    os.rename(script_file, f"{script_file}.old")
-                if each_webhook["tag"] == "jamfpro":
-                    if not validate_token(session["expires"]):
-                        get_token()
-                    data = (
-                        f"<webhook><name>{each_webhook['name']}.old.{time.time()}</name>"
-                        f"<enabled>false</enabled></webhook>"
-                    )
-                    full_url = f"{session['url']}/JSSResource/webhooks/name/{each_webhook['name']}"
-                    requests.put(
-                        full_url,
-                        headers={
-                            "Content-Type": "application/xml",
-                            "Authorization": f"Bearer {session['token']}",
-                            "User-Agent": "JAWA%20v3.1.1",
-                        },
-                        data=data,
-                    )
-                elif each_webhook["tag"] == "okta":
-                    try:
-                        requests.post(
-                            f"{each_webhook.get('okta_url')}/api/v1/eventHooks/{each_webhook.get('okta_id')}/lifecycle/deactivate",
-                            headers={
-                                "Authorization": "SSWS {}".format(
-                                    each_webhook.get("okta_token")
-                                )
-                            },
-                        )
-                        requests.delete(
-                            f"{each_webhook.get('okta_url')}/api/v1/eventHooks/{each_webhook.get('okta_id')}",
-                            headers={
-                                "Authorization": "SSWS {}".format(
-                                    each_webhook.get("okta_token")
-                                )
-                            },
-                        )
-                    except requests.exceptions.MissingSchema as err:
-                        return redirect(
-                            url_for(
-                                "error",
-                                error=err,
-                                username=session.get("username"),
-                            )
-                        )
-
-                webhook_json.remove(each_webhook)
-                with open(webhooks_file, "w") as fout:
-                    json.dump(webhook_json, fout, indent=4)
-        return redirect(url_for("webhooks.webhooks"))
-    return {
-        "username": session.get("username"),
-        "target_webhook": target_webhook,
-        "tag": tag[0],
-    }
-
-
-@blueprint.route("/webhooks", methods=["GET", "POST"])
-@response(template_file="webhooks/home.html")
-def webhooks() -> Union[Response, Dict[str, Any]]:
-    if "username" not in session:
-        return redirect(
-            url_for(
-                "home_view.logout",
-                error_title="Session Timed Out",
-                error_message="Please sign in again",
-            )
-        )
-    with open(webhooks_file, "r") as fin:
-        webhooks_json = json.load(fin)
-    jamf_pro_webhooks_list = []
-    okta_webhooks_list = []
-    custom_webhooks_list = []
-    for each_webhook in webhooks_json:
-        data = defaultdict(lambda: "MISSING", each_webhook)
-        tag = data["tag"]
-        if tag == "custom":
-            custom_webhooks_list.append(each_webhook)
-        elif tag == "jamfpro":
-            jamf_pro_webhooks_list.append(each_webhook)
-        elif tag == "okta":
-            okta_webhooks_list.append(each_webhook)
-    return {
-        "username": session.get("username"),
-        "custom_list": custom_webhooks_list,
-        "jamf_list": jamf_pro_webhooks_list,
-        "okta_list": okta_webhooks_list,
-        "url": session.get("url"),
-    }

From 11d5714c23d5d23f9255def304a513373794bd77 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 12 Feb 2026 22:02:33 -0600
Subject: [PATCH 14/84] feat: add session timeout warning modal and extend
 session duration to 15 minutes

---
 app.py                        |  2 +-
 templates/shared/_layout.html | 82 +++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/app.py b/app.py
index f35b673..fe9460c 100644
--- a/app.py
+++ b/app.py
@@ -73,7 +73,7 @@ def main() -> None:
     environment_setup(base_dir)
     register_blueprints()
     app.secret_key = str(uuid.uuid4())
-    app.permanent_session_lifetime = timedelta(minutes=10)
+    app.permanent_session_lifetime = timedelta(minutes=15)
     serve(
         app, url_scheme="https", host="0.0.0.0", port=8000, threads=15
     )  # Serve me the sky with a big slice of lemon
diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index c6a53ce..0596e82 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -113,6 +113,88 @@
 <script>hljs.highlightAll();</script>
 {% if username %}
 <script src="{{ url_for('static', filename='js/search.js') }}"></script>
+
+<!-- Session Timeout Warning Modal -->
+<div class="modal fade" id="sessionTimeoutModal" tabindex="-1" aria-labelledby="sessionTimeoutLabel" aria-hidden="true" data-bs-backdrop="static" data-bs-keyboard="false">
+    <div class="modal-dialog modal-dialog-centered modal-sm">
+        <div class="modal-content">
+            <div class="modal-header border-0 pb-0">
+                <h5 class="modal-title" id="sessionTimeoutLabel">Session Expiring</h5>
+            </div>
+            <div class="modal-body text-center pt-2">
+                <p class="mb-2">Your session will expire in</p>
+                <span class="session-countdown-seconds" id="countdownDisplay">45</span>
+                <p class="mt-2 mb-0 text-muted" style="font-size: 0.85rem;">seconds</p>
+            </div>
+            <div class="modal-footer border-0 justify-content-center pt-0">
+                <button type="button" class="btn btn-jawa" id="staySignedInBtn">Stay Signed In</button>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+(function () {
+    var SESSION_DURATION = 15 * 60;
+    var WARNING_BEFORE = 45;
+    var remaining = SESSION_DURATION;
+    var warningShown = false;
+    var countdownInterval = null;
+    var modal = null;
+
+    function getModal() {
+        if (!modal) {
+            var el = document.getElementById("sessionTimeoutModal");
+            if (el) modal = new bootstrap.Modal(el);
+        }
+        return modal;
+    }
+
+    function resetTimer() {
+        remaining = SESSION_DURATION;
+        warningShown = false;
+        if (countdownInterval) {
+            clearInterval(countdownInterval);
+            countdownInterval = null;
+        }
+        var m = getModal();
+        if (m) {
+            try { m.hide(); } catch (e) {}
+        }
+    }
+
+    function showWarning() {
+        warningShown = true;
+        var display = document.getElementById("countdownDisplay");
+        if (display) display.textContent = remaining;
+        var m = getModal();
+        if (m) m.show();
+        countdownInterval = setInterval(function () {
+            remaining--;
+            if (display) display.textContent = Math.max(remaining, 0);
+            if (remaining <= 0) {
+                clearInterval(countdownInterval);
+                window.location.href = "/logout";
+            }
+        }, 1000);
+    }
+
+    setInterval(function () {
+        if (!warningShown) {
+            remaining--;
+            if (remaining <= WARNING_BEFORE) {
+                showWarning();
+            }
+        }
+    }, 1000);
+
+    document.getElementById("staySignedInBtn").addEventListener("click", function () {
+        fetch("/dashboard", {method: "GET", credentials: "same-origin"})
+            .then(function () { resetTimer(); })
+            .catch(function () { resetTimer(); });
+    });
+})();
+</script>
 {% endif %}
 {% block additional_js %}{% endblock %}
 

From 8c1ecccc7b97f15ab0819dc6c340557e7e0a5bc6 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 12 Feb 2026 22:04:32 -0600
Subject: [PATCH 15/84] feat: update static file references to use url_for for
 better cache management

---
 app.py                            |   3 +-
 bin/context_processors.py         |  26 ++++++-
 static/css/main.css               | 121 +++++++++++++++++++++---------
 templates/automations/create.html |  11 ++-
 templates/automations/detail.html |  10 +--
 templates/automations/edit.html   |  18 +++--
 templates/home.html               |   6 +-
 templates/log/home.html           |   2 +-
 templates/resources/delete.html   |  51 ++++++-------
 templates/resources/files.html    |  20 +++--
 templates/setup/branding.html     |   4 +-
 templates/setup/cleanup.html      |  11 +--
 templates/setup/credentials.html  |   6 +-
 templates/setup/setup.html        |  10 +--
 templates/shared/_layout.html     |   4 +-
 templates/shared/_macros.html     |  10 +--
 16 files changed, 192 insertions(+), 121 deletions(-)

diff --git a/app.py b/app.py
index fe9460c..397f8bf 100644
--- a/app.py
+++ b/app.py
@@ -46,7 +46,7 @@
 from typing import Any, Dict, Union
 
 from bin import logger
-from bin.context_processors import inject_common_vars
+from bin.context_processors import inject_common_vars, register_static_cache_bust
 from bin.view_modifiers import response
 from views.home_view import load_home
 
@@ -65,6 +65,7 @@ def func() -> None:
 
 
 app.context_processor(inject_common_vars)
+register_static_cache_bust(app)
 
 
 def main() -> None:
diff --git a/bin/context_processors.py b/bin/context_processors.py
index 34f0a67..290ace8 100644
--- a/bin/context_processors.py
+++ b/bin/context_processors.py
@@ -26,7 +26,31 @@
 #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
-from flask import session
+import hashlib
+import os
+
+from flask import Flask, session
+
+
+def _compute_static_hash(static_folder: str) -> str:
+    """Return a short MD5 hex digest of the max mtime across all static files."""
+    max_mtime = 0.0
+    for root, _dirs, files in os.walk(static_folder):
+        for fname in files:
+            mtime = os.path.getmtime(os.path.join(root, fname))
+            if mtime > max_mtime:
+                max_mtime = mtime
+    return hashlib.md5(str(max_mtime).encode()).hexdigest()[:10]
+
+
+def register_static_cache_bust(app: Flask) -> None:
+    """Append ``?v=<hash>`` to every ``url_for('static', ...)`` URL."""
+    static_hash = _compute_static_hash(app.static_folder)
+
+    @app.url_defaults
+    def _add_static_hash(endpoint: str, values: dict) -> None:
+        if endpoint == "static":
+            values["v"] = static_hash
 
 
 def inject_common_vars() -> dict:
diff --git a/static/css/main.css b/static/css/main.css
index d6af3b9..8a8f0af 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -161,14 +161,8 @@ h3 {
 }
 
 .ajax-button {
-    position: relative;
-    display: inline-block;
-    width: 100px;
-    height: 40px;
-    left: 50%;
-    top: 50%;
-    margin-left: -50px;
-    margin-top: -20px;
+    display: flex;
+    justify-content: center;
     text-align: center;
 }
 
@@ -323,7 +317,7 @@ h3 {
 
 .dash-list {
     text-align: center;
-    margin-bottom: 10vh;
+    margin-bottom: 2rem;
 }
 
 
@@ -349,7 +343,7 @@ h3 {
 .card {
     padding: 0.5rem;
     margin: 10px;
-    max-width: 260px;
+    max-width: 280px;
     border: 1px solid var(--color-border);
     border-radius: var(--radius-lg);
     transition: transform 0.2s ease, box-shadow 0.2s ease, border-color 0.2s ease;
@@ -372,23 +366,24 @@ h3 {
 /* ===== Buttons ===== */
 .btn-jawa {
     color: #fff;
-    background-color: var(--color-navbar);
-    border-color: var(--color-navbar);
-    border-radius: var(--radius-sm);
+    background-color: var(--color-primary);
+    border-color: var(--color-primary);
+    border-radius: var(--radius-md);
     font-weight: 500;
-    transition: background-color 0.15s ease;
+    transition: background-color 0.15s ease, border-color 0.15s ease;
 }
 
 .btn-jawa:hover {
-    background-color: var(--color-navbar-dark);
-    border-color: var(--color-navbar-dark);
+    background-color: var(--color-primary-hover);
+    border-color: var(--color-primary-hover);
     color: #fff;
 }
 
 .btn-jawa:disabled {
-    background: unset;
-    border: unset;
-    color: transparent;
+    background: var(--color-primary);
+    border-color: var(--color-primary);
+    color: #fff;
+    opacity: 0.5;
 }
 
 a.btn-jawa,
@@ -399,22 +394,47 @@ a.btn-jawa:visited {
 
 .alert-jawa {
     color: #FFFFFF;
-    background-color: var(--color-navbar);
-    border-color: #c3e6cb;
+    background-color: var(--color-primary);
+    border-color: var(--color-primary);
     border-radius: 1rem;
     padding-top: 0.2rem;
     padding-bottom: 0.2rem;
 }
 
 .btn-danger {
-    margin: 5px;
-    padding: 5px;
-    width: 150px;
-    border-radius: 1rem;
+    background-color: #c0392b;
+    border-color: #c0392b;
+    border-radius: var(--radius-md);
+    color: #fff;
+    font-weight: 500;
+    transition: background-color 0.15s ease, border-color 0.15s ease;
+}
+
+.btn-danger:hover {
+    background-color: #a93226;
+    border-color: #a93226;
+    color: #fff;
 }
 
 .btn-secondary {
-    border-radius: 1rem;
+    background-color: var(--color-surface-hover);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    color: var(--color-text);
+    font-weight: 500;
+    transition: background-color 0.15s ease, border-color 0.15s ease;
+}
+
+.btn-secondary:hover {
+    background-color: var(--color-border);
+    border-color: var(--color-border);
+    color: var(--color-text);
+}
+
+a.btn-secondary,
+a.btn-secondary:visited {
+    color: var(--color-text);
+    text-decoration: none;
 }
 
 .card-img {
@@ -447,7 +467,7 @@ a.btn-jawa:visited {
 }
 
 .btn-group-sm .btn {
-    border-radius: 0.5rem;
+    border-radius: var(--radius-sm);
 }
 
 /* ===== Navbar (from nav.css) ===== */
@@ -636,7 +656,7 @@ footer a {
 }
 
 .log-frame {
-    max-height: 65vh;
+    max-height: 60vh;
 }
 
 .log-form {
@@ -708,7 +728,7 @@ footer a {
 .log-container {
     padding: 10px;
     max-width: 100vw;
-    margin-bottom: -30px;
+    margin-bottom: 1rem;
 }
 
 .login-form-container {
@@ -750,7 +770,7 @@ form.table-view {
 form.files-form {
     margin: auto;
     max-height: 45vh;
-    max-width: fit-content;
+    max-width: 800px;
     background-color: var(--color-surface);
     color: var(--color-text);
     border: 1px solid var(--color-border);
@@ -837,6 +857,20 @@ form.files-form {
     border: 1px solid var(--color-border);
     border-radius: var(--radius-lg);
     padding: 2rem;
+    max-width: 800px;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+.content-narrow {
+    max-width: 800px;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+.btn-action {
+    min-width: 120px;
+    padding: 0.45rem 1.25rem;
 }
 
 /* ===== Code / Script Previews ===== */
@@ -900,7 +934,7 @@ code {
     margin-bottom: 2rem;
     position: relative;
     overflow: hidden;
-    text-align: left;
+    text-align: center;
 }
 
 .hero-section::before {
@@ -920,7 +954,7 @@ code {
     letter-spacing: -1px;
     margin: 0 0 0.5rem;
     color: #fff;
-    text-align: left;
+    text-align: center;
     position: relative;
 }
 
@@ -928,12 +962,13 @@ code {
     color: rgba(255, 255, 255, 0.85);
     font-size: 1.05rem;
     margin: 0;
-    text-align: left;
+    text-align: center;
     position: relative;
 }
 
 .hero-cta {
     display: flex;
+    justify-content: center;
     gap: 0.75rem;
     margin-top: 1.25rem;
     position: relative;
@@ -1180,7 +1215,8 @@ a.btn-hero-secondary:visited {
     display: none;
 }
 
-.search-result-item {
+.search-result-item,
+.search-result-item:visited {
     display: block;
     padding: 0.5rem 0.75rem;
     font-size: 0.85rem;
@@ -1192,6 +1228,7 @@ a.btn-hero-secondary:visited {
 
 .search-result-item:hover {
     background: var(--color-surface);
+    color: var(--color-text);
 }
 
 .search-result-title {
@@ -1225,3 +1262,19 @@ a.btn-hero-secondary:visited {
 .navbar .dropdown-menu .dropdown-divider {
     border-color: var(--color-border);
 }
+
+/* ===== Session Timeout Warning ===== */
+.session-countdown-seconds {
+    display: inline-block;
+    font-size: 2.5rem;
+    font-weight: 700;
+    font-variant-numeric: tabular-nums;
+    color: var(--color-navbar);
+    line-height: 1;
+}
+
+#sessionTimeoutModal .modal-content {
+    border-radius: var(--radius-lg);
+    border: 1px solid var(--color-border);
+    box-shadow: var(--shadow-lg);
+}
diff --git a/templates/automations/create.html b/templates/automations/create.html
index 424b68c..fc6aa3d 100644
--- a/templates/automations/create.html
+++ b/templates/automations/create.html
@@ -3,7 +3,13 @@
 {% block title %}New {{ handler.display_name }} | JAWA{% endblock %}
 
 {% block content %}
-<div class="container" style="padding-top: 5rem;">
+<div class="hero-section">
+    <div class="container">
+        <h2>New {{ handler.display_name }} {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h2>
+        <p>Configure and create a new automation.</p>
+    </div>
+</div>
+<div class="container">
     <div class="page-sub-nav">
         <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
         <a href="/automations/{{ auto_type }}/new" class="active">Create</a>
@@ -25,8 +31,7 @@ <h1>New {{ handler.display_name }}
             {% endif %}
 
             <div class="d-flex justify-content-center">
-                <button type="submit" class="btn btn-jawa"
-                        style="margin: 5px; padding: 5px; width: 150px">Create</button>
+                <button type="submit" class="btn btn-jawa btn-action">Create</button>
             </div>
         </form>
     </div>
diff --git a/templates/automations/detail.html b/templates/automations/detail.html
index 50caa7b..6732500 100644
--- a/templates/automations/detail.html
+++ b/templates/automations/detail.html
@@ -18,7 +18,7 @@
         {% endif %}
     </div>
 
-    <div class="form-section" style="max-width: 700px; margin: 0 auto;">
+    <div class="form-section">
         <div class="d-flex align-items-center mb-3">
             <span class="badge {{ handler.badge_class }} me-2">{{ handler.display_name }}</span>
             <h4 class="mb-0">{{ automation.name }}</h4>
@@ -29,17 +29,17 @@ <h4 class="mb-0">{{ automation.name }}</h4>
         {% endfor %}
 
         {% if automation.jamf_id and auto_type == 'jamfpro' %}
-        <div class="overflow-auto log-frame text-break" style="max-width: 100%; max-height: 10vh">
+        <div class="overflow-auto text-break" style="max-height: 10vh">
             <b>View in Jamf</b>: <a href="{{ session_url }}/webhooks.html?id={{ automation.jamf_id }}" target="_blank">Open in Jamf Pro</a>
         </div>
         {% endif %}
 
         <div class="d-flex justify-content-center mt-4 gap-2">
-            <a href="/automations/{{ auto_type }}" class="btn btn-secondary" style="border-radius: 1rem;">Back</a>
+            <a href="/automations/{{ auto_type }}" class="btn btn-secondary btn-action">Back</a>
             {% if handler.supports_edit %}
-            <a href="/automations/{{ auto_type }}/{{ automation.name }}/edit" class="btn btn-jawa">Edit</a>
+            <a href="/automations/{{ auto_type }}/{{ automation.name }}/edit" class="btn btn-jawa btn-action">Edit</a>
             {% endif %}
-            <a href="/automations/{{ auto_type }}/{{ automation.name }}/delete" class="btn btn-danger">Delete</a>
+            <a href="/automations/{{ auto_type }}/{{ automation.name }}/delete" class="btn btn-danger btn-action">Delete</a>
         </div>
     </div>
 </div>
diff --git a/templates/automations/edit.html b/templates/automations/edit.html
index 3e32f9b..1360bb5 100644
--- a/templates/automations/edit.html
+++ b/templates/automations/edit.html
@@ -3,7 +3,13 @@
 {% block title %}Edit {{ automation_name }} | JAWA{% endblock %}
 
 {% block content %}
-<div class="container" style="padding-top: 5rem;">
+<div class="hero-section">
+    <div class="container">
+        <h2>Edit {{ handler.display_name }} {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h2>
+        <p>Modify settings for {{ automation_name }}.</p>
+    </div>
+</div>
+<div class="container">
     <div class="page-sub-nav">
         <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
         <a href="/automations/{{ auto_type }}/{{ automation_name }}">Detail</a>
@@ -26,11 +32,11 @@ <h1>Edit {{ handler.display_name }}
 
             <div class="d-flex justify-content-center gap-2">
                 <a href="/automations/{{ auto_type }}/{{ automation_name }}"
-                   class="btn btn-secondary" style="margin: 5px; padding: 5px; width: 150px; border-radius: 1rem;">Cancel</a>
-                <button type="submit" name="button_choice" value="Save" class="btn btn-jawa"
-                        style="margin: 5px; padding: 5px; width: 150px">Save</button>
-                <button type="submit" name="button_choice" value="Delete" class="btn btn-danger"
-                        style="margin: 5px; padding: 5px; width: 150px">Delete</button>
+                   class="btn btn-secondary btn-action">Cancel</a>
+                <button type="submit" name="button_choice" value="Save"
+                        class="btn btn-jawa btn-action">Save</button>
+                <button type="submit" name="button_choice" value="Delete"
+                        class="btn btn-danger btn-action">Delete</button>
             </div>
         </form>
     </div>
diff --git a/templates/home.html b/templates/home.html
index 9a5cf03..c9de366 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -65,11 +65,9 @@ <h1 class="d-flex justify-content-center">{% if app_name %}{{ app_name }}{% else
         <label for="login-password" class="visually-hidden">Password</label>
         <input id="login-password" name="password" type="password" placeholder="Password" required class="form-control text-center">
 
-        <p>
-        <div class="d-flex justify-content-center">
-            <input class="btn btn-jawa" type="submit" value="Login">
+        <div class="d-flex justify-content-center mt-3">
+            <input class="btn btn-jawa btn-action" type="submit" value="Login">
         </div>
-        </p>
         <p class="text-center">Please read the <a href="https://github.com/jamf/jawa/blob/main/README.md"
                               target="_blank">documentation</a> prior to using JAWA!</p>
 
diff --git a/templates/log/home.html b/templates/log/home.html
index c786b44..2d527cc 100644
--- a/templates/log/home.html
+++ b/templates/log/home.html
@@ -151,7 +151,7 @@ <h2>Application Log</h2>
         </div>
     </div>
 </div>
-<div class="container-fluid" style="max-width: 1800px; padding-left: 2rem; padding-right: 2rem;">
+<div class="container-fluid" style="max-width: 1800px;">
 
 
     <div class="log-container">
diff --git a/templates/resources/delete.html b/templates/resources/delete.html
index c72c0ee..1ce942b 100644
--- a/templates/resources/delete.html
+++ b/templates/resources/delete.html
@@ -26,36 +26,29 @@
 {###}
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section %}
 {% block title %}Confirm Delete{% endblock %}
 {% block content %}
-<div class="container" style="padding-top: 5rem;">
-    <div class="page-sub-nav">
-        <a href="/resources/files">Files</a>
-        <a href="/log/home.html">Log</a>
-    </div>
-    <div class="form-container">
-        <form action="#" method="POST" class="form-section"
-              enctype="multipart/form-data">
-            <h1>Confirm Delete:</h1>
-            <div class="font-weight-bold text-center">Resource file -
-            {% if target_file %}{{ target_file }}{% endif %} </div>
-            <div class="d-flex justify-content-center">
-                <div class="confirm-delete-box">
-                    <i>Deleting a file is a permanent action.</i>
-                    <br/>
-                    Are you sure?
-                    {#                Don't you call me a mindless philosopher!     #}
-                    {#                    ~ C-3PO, a Star War                       #}
-                    {#                                                              #}
-                </div>
-                <br/>
+{{ hero_section(
+    title="Delete Resource File",
+    subtitle="Confirm deletion of " ~ (target_file or "file"),
+    secondary_url="/resources/files",
+    secondary_label="Back to Files"
+) }}
+<div class="container content-narrow">
+    <div class="confirm-delete-box">
+        <div class="alert alert-warning text-center mb-3" role="alert">
+            <strong>{{ target_file }}</strong><br>
+            Deleting a file is a permanent action.
+        </div>
+        {#                Don't you call me a mindless philosopher!     #}
+        {#                    ~ C-3PO, a Star War                       #}
+        <form action="#" method="POST" enctype="multipart/form-data">
+            <div class="d-flex justify-content-center gap-2">
+                <a href="/resources/files" class="btn btn-secondary btn-action">Cancel</a>
+                <button type="submit" class="btn btn-danger btn-action">Delete</button>
             </div>
-                <div class="d-flex dash-list justify-content-center">
-                    <button type=submit name="button_choice" value="Delete" class="btn btn-danger" style="margin: 5px">
-
-                        Delete
-
-                    </button>
-                </div>
+        </form>
     </div>
-{% endblock %}
\ No newline at end of file
+</div>
+{% endblock %}
diff --git a/templates/resources/files.html b/templates/resources/files.html
index bad112f..d6cdbc3 100644
--- a/templates/resources/files.html
+++ b/templates/resources/files.html
@@ -39,9 +39,9 @@ <h2>Resource Files</h2>
 </div>
 <div class="container">
     <div class="form-container">
-        <div class="form-section" style="max-width: fit-content">
-            <div class="overflow-auto pre-scrollable" style="max-width: 100vw">
-            <h4 class="d-flex justify-content-center alert-jawa" style="max-width: 100vw">Upload a file</h4>
+        <div class="form-section">
+            <div class="overflow-auto pre-scrollable">
+            <h4 class="text-center mb-3">Upload a file</h4>
             <p>Files directory:
             <pre><code>{{ files_repo }}/</code></pre>
             </p>
@@ -51,8 +51,7 @@ <h4 class="d-flex justify-content-center alert-jawa" style="max-width: 100vw">Up
                            formenctype="multipart/form-data" id="file-upload"/>
                 </div>
                 <div class="d-flex justify-content-center">
-                    <input type="submit" id="file-submit" class="btn btn-jawa" value="Upload" disabled
-                           style="margin: 5px; padding: 5px; width: 150px"/>
+                    <input type="submit" id="file-submit" class="btn btn-jawa btn-action" value="Upload" disabled/>
                 </div>
             </form>
         </div>
@@ -64,10 +63,9 @@ <h4 class="d-flex justify-content-center alert-jawa" style="max-width: 100vw">Up
         {% endif %}
     {% if files %}
         <form class="files-form overflow-auto">
-
-            <h4 class="d-flex justify-content-center alert-jawa">Uploaded files</h4>
+            <h4 class="text-center mb-3">Uploaded files</h4>
             <div class="btn-padded">
-                <table id="files_table" class="table" style="max-width: 100vw">
+                <table id="files_table" class="table">
                     <tr>
                         <th>Name</th>
                         <th>Date Modified</th>
@@ -82,11 +80,11 @@ <h4 class="d-flex justify-content-center alert-jawa">Uploaded files</h4>
                 </table>
             </div>
             <div class="d-flex justify-content-center">
-                <button type=submit name="button_choice" value="Download"
-                        class="btn btn-jawa button-align alert-jawa" style="margin: 5px; padding: 5px; width: 150px">
+                <button type="submit" name="button_choice" value="Download"
+                        class="btn btn-jawa btn-action">
                     Download
                 </button>
-                <button name="button_choice" type=submit value="Delete" class="btn btn-danger button-align alert-soft">
+                <button name="button_choice" type="submit" value="Delete" class="btn btn-danger btn-action">
                     Delete
                 </button>
             </div>
diff --git a/templates/setup/branding.html b/templates/setup/branding.html
index 875f809..cd894e2 100644
--- a/templates/setup/branding.html
+++ b/templates/setup/branding.html
@@ -42,7 +42,7 @@ <h2>Branding</h2>
 </div>
 <div class="container">
     <div class="form-container">
-        <div class="form-section log-frame overflow-auto" style="max-width: 42rem ; max-height: 66vh">
+        <div class="form-section overflow-auto">
 
             <div class="d-flex justify-content-center">
 
@@ -50,7 +50,7 @@ <h2>Branding</h2>
                     <p>
                     <div class="d-flex justify-content-center">
                         <div class="img-thumbnail" style="max-width: 15vh">
-                            <img class="img-thumbnail align-items-center" src="/static/img/jawa_icon.png" alt="App icon"><br/>
+                            <img class="img-thumbnail align-items-center" src="{{ url_for('static', filename='img/jawa_icon.png') }}" alt="App icon"><br/>
                         </div>
                     </div>
                     <div class="d-flex justify-content-center">
diff --git a/templates/setup/cleanup.html b/templates/setup/cleanup.html
index 36ff3ee..dc52c21 100644
--- a/templates/setup/cleanup.html
+++ b/templates/setup/cleanup.html
@@ -43,8 +43,7 @@ <h2>Cleanup</h2>
 <div class="container">
     <div class="form-container">
 
-    <form method="post" action="/cleanup" class="form-section overflow-auto" enctype="multipart/form-data"
-          style="max-height: 66vh; max-width: 66vh">
+    <form method="post" action="/cleanup" class="form-section overflow-auto" enctype="multipart/form-data">
         <h1 class="text-center">Cleanup</h1>
 {#        <p class="text-center">- Click "Clean Up!" to remove all old scripts.#}
 {#        - Old scripts are scripts kept as an archive file with the extension ".old".</br>#}
@@ -65,11 +64,9 @@ <h6 class="text-center">
 
             </p>
         {% endfor %}
-        <div class="col-xs-12 button-holder">
-                        <div class="ajax-button">
-                            <input class="btn btn-jawa" type="submit" value="Clean Up!"/>
-                        </div>
-                    </div>
+        <div class="d-flex justify-content-center mt-3">
+            <input class="btn btn-jawa btn-action" type="submit" value="Clean Up!"/>
+        </div>
 
     </form>
 </div>
diff --git a/templates/setup/credentials.html b/templates/setup/credentials.html
index 0ed1823..9cb5488 100644
--- a/templates/setup/credentials.html
+++ b/templates/setup/credentials.html
@@ -12,7 +12,7 @@ <h2>API Credentials</h2>
         </div>
     </div>
 </div>
-<div class="container" style="max-width: 800px;">
+<div class="container content-narrow">
 
     {% if credentials %}
     <div class="form-section mb-4">
@@ -46,12 +46,12 @@ <h2>API Credentials</h2>
         </table>
     </div>
     {% else %}
-    <div class="form-section text-center mb-4" style="max-width: 500px; margin: 0 auto;">
+    <div class="form-section text-center mb-4">
         <p style="color: var(--color-text-muted);">No credential sets configured yet.</p>
     </div>
     {% endif %}
 
-    <div class="form-section" style="max-width: 550px; margin: 0 auto;">
+    <div class="form-section">
         <h5 class="text-center mb-3" style="font-size: 1rem; font-weight: 600;">Add Credential Set</h5>
         <form method="post" action="/setup/credentials/add">
             <div class="mb-3">
diff --git a/templates/setup/setup.html b/templates/setup/setup.html
index 93c0500..a412ca8 100644
--- a/templates/setup/setup.html
+++ b/templates/setup/setup.html
@@ -41,12 +41,11 @@ <h2>Server Setup</h2>
     </div>
 </div>
 <div class="container">
-    <div class="form-container overflow-auto" style="max-height: 60vh">
-        <div class="d-flex justify-content-center">
-            <div class="form-section log-frame overflow-auto" style="max-width: 100vh; max-height: 66vh">
+    <div class="form-container overflow-auto">
+        <div class="form-section overflow-auto">
 
                 <p class="text-center justify-content-center">
-                    Please read the <a href="https://github.com/jamf/JAWA/blob/main/README.md" style="color:#3c6aa7;"
+                    Please read the <a href="https://github.com/jamf/JAWA/blob/main/README.md"
                                        target="_blank">documentation</a> prior to using JAWA.
                 </p>
                 <form method="post" action="/setup" enctype="multipart/form-data">
@@ -85,8 +84,5 @@ <h2>Server Setup</h2>
             </form>
         </div>
     </div>
-
-
-    </div>
 </div>
 {% endblock %}
diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index 0596e82..036f902 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -43,7 +43,7 @@
           href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css">
     {% block additional_css %}
     {% endblock %}
-    <link rel="apple-touch-icon" href="./static/img/jawa_icon.png">
+    <link rel="apple-touch-icon" href="{{ url_for('static', filename='img/jawa_icon.png') }}">
     <link rel="shortcut icon" href="{{ url_for('static', filename='img/jawa_icon.png') }}">
 
     <meta name="theme-color" content="#6A2F30">
@@ -56,7 +56,7 @@
     <nav class="navbar fixed-top navbar-dark navbar-expand-md">
         <div class="container-fluid">
             <a class="navbar-brand" href="/dashboard">
-                <img src="/static/img/jawa_icon.png" alt="JAWA"/></a>
+                <img src="{{ url_for('static', filename='img/jawa_icon.png') }}" alt="JAWA"/></a>
             <button class="navbar-toggler navbar-toggle overflow-auto" type="button" data-bs-toggle="collapse"
                     data-bs-target="#navbarSupportedContent"
                     aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
index f24452b..be3afe4 100644
--- a/templates/shared/_macros.html
+++ b/templates/shared/_macros.html
@@ -24,7 +24,7 @@ <h2>{{ title }}</h2>
 {% macro automation_card(item, handler, loop_index, auto_type, session_url="") %}
 <div class="card col-md-6 col-lg-3 webhooks-list container-bg border-info d-flex flex-column">
     <span class="badge {{ handler.badge_class }} mb-2">{{ handler.display_name }}</span>
-    <img src="/static/img/{{ handler.icon }}" class="card-img mx-auto" alt="{{ handler.display_name }}">
+    <img src="{{ url_for('static', filename='img/' ~ handler.icon) }}" class="card-img mx-auto" alt="{{ handler.display_name }}">
     <div class="card-body flex-column d-flex webhooks-list">
         <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
         <a class="btn btn-jawa text-white overflow-hidden mt-auto"
@@ -36,13 +36,13 @@ <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
 {% endmacro %}
 
 {% macro detail_field(label, value) %}
-<div class="overflow-auto log-frame text-break" style="max-width: 100%; max-height: 10vh">
+<div class="overflow-auto text-break" style="max-height: 10vh">
     <b>{{ label }}</b>: {{ value }}
 </div>
 {% endmacro %}
 
 {% macro empty_state(message, create_url="", create_label="Create one now") %}
-<div class="form-section" style="max-width: fit-content; text-align: center; margin: 1rem auto;">
+<div class="form-section" style="text-align: center; margin: 1rem auto;">
     <div class="table-responsive">
         {{ message }}
         {% if create_url %}
@@ -57,8 +57,8 @@ <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
     <h4>Delete {{ item_type }}: {{ item_name }}?</h4>
     <p>This action cannot be undone.</p>
     <form method="POST" action="{{ delete_url }}">
-        <a href="javascript:history.back()" class="btn btn-secondary" style="margin: 5px; padding: 5px; width: 150px;">Cancel</a>
-        <button type="submit" class="btn btn-danger">Delete</button>
+        <a href="javascript:history.back()" class="btn btn-secondary btn-action">Cancel</a>
+        <button type="submit" class="btn btn-danger btn-action">Delete</button>
     </form>
 </div>
 {% endmacro %}

From c0c50dbcc8fe02e3bdf6384f5b350726125a90f6 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 12 Feb 2026 22:32:32 -0600
Subject: [PATCH 16/84] feat: enhance error handling and logging

---
 app.py                               |  22 +++--
 bin/logger.py                        |  34 ++++++++
 bin/tokens.py                        |   6 +-
 templates/log/home.html              |  45 ++++++++++
 views/_type_handlers/cron_handler.py |   2 +-
 views/_type_handlers/jamf_handler.py | 120 ++++++++++++++++++++++-----
 views/_type_handlers/okta_handler.py | 114 +++++++++++++++++++++----
 views/home_view.py                   |   6 +-
 views/log_view.py                    |  34 +++++++-
 views/resource_view.py               |  30 +++++--
 views/template_view.py               |   8 +-
 webhook/jawa_receiver.py             |  43 ++++++----
 12 files changed, 388 insertions(+), 76 deletions(-)

diff --git a/app.py b/app.py
index 397f8bf..88b528c 100644
--- a/app.py
+++ b/app.py
@@ -71,13 +71,19 @@ def func() -> None:
 def main() -> None:
     base_dir = os.path.dirname(__file__)
     logthis.info(f"JAWA initializing...\n Sandcrawler home:  {base_dir}")
-    environment_setup(base_dir)
-    register_blueprints()
-    app.secret_key = str(uuid.uuid4())
-    app.permanent_session_lifetime = timedelta(minutes=15)
-    serve(
-        app, url_scheme="https", host="0.0.0.0", port=8000, threads=15
-    )  # Serve me the sky with a big slice of lemon
+    try:
+        environment_setup(base_dir)
+        register_blueprints()
+        app.secret_key = str(uuid.uuid4())
+        app.permanent_session_lifetime = timedelta(minutes=15)
+        serve(
+            app, url_scheme="https", host="0.0.0.0", port=8000, threads=15
+        )  # Serve me the sky with a big slice of lemon
+    except Exception as err:
+        logthis.critical(
+            f"JAWA failed to start: {err}. Check port availability."
+        )
+        raise
 
 
 def environment_setup(project_dir: str) -> None:
@@ -401,7 +407,7 @@ def error() -> Union[Response, str]:
         error_message = escape(error_message)
     if "username" not in session:
         return redirect(url_for("home_view.logout"))
-    logthis.info(
+    logthis.warning(
         f"[{session.get('url')}] {session.get('username').title()} was a victim of a series of accidents, as are we all. (/error)"
     )
     return render_template(
diff --git a/bin/logger.py b/bin/logger.py
index c1ac61c..14288bf 100644
--- a/bin/logger.py
+++ b/bin/logger.py
@@ -70,3 +70,37 @@ def setup_child_logger(
 
 
 logthis = setup_logger(logger_name, f"{logger_name}.log")
+
+
+def is_debug_enabled() -> bool:
+    """Check if DEBUG logging is currently enabled."""
+    logger = logging.getLogger(logger_name)
+    return logger.level == logging.DEBUG
+
+
+def toggle_debug() -> str:
+    """
+    Toggle between DEBUG and INFO log levels.
+
+    Returns:
+        String indicating the new level ("DEBUG" or "INFO")
+    """
+    logger = logging.getLogger(logger_name)
+
+    if logger.level == logging.DEBUG:
+        # Switch to INFO
+        new_level = logging.INFO
+        level_name = "INFO"
+    else:
+        # Switch to DEBUG
+        new_level = logging.DEBUG
+        level_name = "DEBUG"
+
+    logger.setLevel(new_level)
+
+    # Also update all handlers
+    for handler in logger.handlers:
+        handler.setLevel(new_level)
+
+    logger.info(f"Log level changed to {level_name}")
+    return level_name
diff --git a/bin/tokens.py b/bin/tokens.py
index 08cd0b9..e9f70a4 100644
--- a/bin/tokens.py
+++ b/bin/tokens.py
@@ -46,7 +46,7 @@ def get_token() -> Optional[Response]:
         session["token"] = data.get("token")
         session["expires"] = data.get("expires")
     except Exception as err:
-        logthis.info(
+        logthis.error(
             f"[{session.get('url')}] Could not get a token using session credentials: {err}.  Logging out."
         )
         return redirect(
@@ -67,7 +67,7 @@ def validate_token(expires: str) -> bool:
     if time_to_expire > timedelta(0):
         return True
     else:
-        logthis.info(
+        logthis.warning(
             f"[{session.get('url')}] API token expired ({time_to_expire}). Attempting to fetch new token..."
         )
         return False
@@ -82,7 +82,7 @@ def invalidate_token() -> None:
             headers={"Authorization": f"Bearer {session.get('token')}"},
         )
     except Exception as err:
-        logthis.info(
+        logthis.error(
             f"[{session.get('url')}] Error accessing Jamf Pro API endpoint for token invalidation. {err}"
         )
         return
diff --git a/templates/log/home.html b/templates/log/home.html
index 2d527cc..c0ec0d8 100644
--- a/templates/log/home.html
+++ b/templates/log/home.html
@@ -30,6 +30,42 @@
 
 {% block additional_css %}
 <style>
+    .btn-hero-debug {
+        padding: 0.55rem 1.1rem;
+        border: 1.5px solid rgba(138,149,163,0.3);
+        background: rgba(138,149,163,0.08);
+        color: #8a95a3;
+        font-size: 0.8rem;
+        font-weight: 600;
+        letter-spacing: 0.05em;
+        border-radius: var(--radius-pill);
+        transition: all 0.2s ease;
+        cursor: pointer;
+    }
+    .btn-hero-debug:hover {
+        border-color: #8a95a3;
+        background: rgba(138,149,163,0.15);
+        transform: translateY(-1px);
+    }
+    .btn-hero-debug.btn-debug-active {
+        border-color: #89d185;
+        background: rgba(137,209,133,0.12);
+        color: #89d185;
+        box-shadow: 0 0 12px rgba(137,209,133,0.3);
+    }
+    .btn-hero-debug.btn-debug-active:hover {
+        background: rgba(137,209,133,0.2);
+        box-shadow: 0 0 16px rgba(137,209,133,0.4);
+    }
+    .debug-indicator {
+        display: inline-block;
+        animation: pulse 2s ease-in-out infinite;
+    }
+    @keyframes pulse {
+        0%, 100% { opacity: 1; }
+        50% { opacity: 0.5; }
+    }
+
     .log-toolbar {
         display: flex;
         gap: 0.5rem;
@@ -148,6 +184,15 @@ <h2>Application Log</h2>
         <div class="hero-cta">
             <a href="/log/download" class="btn btn-hero-primary">Download Log</a>
             <a href="{{ url_for('resources_view.files') }}" class="btn btn-hero-secondary">Files</a>
+            <form method="POST" action="{{ url_for('log_view.toggle_debug') }}" style="display: inline;">
+                <button type="submit" class="btn btn-hero-debug {% if debug_enabled %}btn-debug-active{% endif %}">
+                    {% if debug_enabled %}
+                    <span class="debug-indicator">●</span> DEBUG ON
+                    {% else %}
+                    DEBUG OFF
+                    {% endif %}
+                </button>
+            </form>
         </div>
     </div>
 </div>
diff --git a/views/_type_handlers/cron_handler.py b/views/_type_handlers/cron_handler.py
index 44dc7af..85282f9 100644
--- a/views/_type_handlers/cron_handler.py
+++ b/views/_type_handlers/cron_handler.py
@@ -47,7 +47,7 @@ def _get_crontab() -> CronTab:
     try:
         return CronTab(user=True)
     except IOError as err:
-        logthis.info(
+        logthis.error(
             f"Error accessing crontab for {getpass.getuser()} - {err}"
         )
         raise AutomationError("Crontab Error", str(err))
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index 424c36b..1aeee25 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -224,24 +224,63 @@ def process_create(
             f"{webhook_name}."
         )
 
-        resp = requests.post(
-            full_url,
-            headers={
-                "Content-Type": XML,
-                "Authorization": f"Bearer {session_data['token']}",
-                "User-Agent": USER_AGENT_STRING,
-            },
-            data=xml_data,
-            verify=VERIFY_SSL,
-        )
+        try:
+            resp = requests.post(
+                full_url,
+                headers={
+                    "Content-Type": XML,
+                    "Authorization": f"Bearer {session_data['token']}",
+                    "User-Agent": USER_AGENT_STRING,
+                },
+                data=xml_data,
+                verify=VERIFY_SSL,
+                timeout=30,
+            )
+        except requests.exceptions.Timeout as err:
+            logthis.error(
+                f"Timeout creating Jamf webhook {webhook_name}: {err}"
+            )
+            raise AutomationError(
+                "Connection Timeout",
+                f"Request to Jamf Pro server timed out after 30 seconds. {err}",
+            )
+        except requests.exceptions.ConnectionError as err:
+            logthis.error(
+                f"Connection error creating Jamf webhook {webhook_name}: {err}"
+            )
+            raise AutomationError(
+                "Connection Error",
+                f"Could not connect to Jamf Pro server. Check network connectivity. {err}",
+            )
+        except Exception as err:
+            logthis.error(
+                f"Unexpected error creating Jamf webhook {webhook_name}: {err}"
+            )
+            raise AutomationError(
+                "API Error", f"Failed to create webhook in Jamf Pro. {err}"
+            )
+
         logthis.info(f"[{resp.status_code}]  {resp.text}")
 
         if resp.status_code == 409:
+            logthis.error(
+                f"Duplicate webhook name {webhook_name} in Jamf Pro (status 409)"
+            )
             raise AutomationError(
                 "Duplicate",
                 f'The webhook name "{webhook_name}" already exists in '
                 f"your Jamf Pro Server.",
             )
+        elif resp.status_code >= 400:
+            logthis.error(
+                f"Jamf API error creating webhook {webhook_name}: "
+                f"HTTP {resp.status_code} - {resp.text}"
+            )
+            raise AutomationError(
+                "API Error",
+                f"Jamf Pro returned HTTP {resp.status_code}. "
+                f"Check permissions and server configuration.",
+            )
 
         result = re.search("<id>(.*)</id>", resp.text)
         jamf_id = result.group(1) if result else ""
@@ -345,8 +384,23 @@ def process_edit(
                 },
                 data=xml_data,
                 verify=VERIFY_SSL,
+                timeout=30,
+            )
+        except requests.exceptions.Timeout as err:
+            logthis.error(f"Timeout editing Jamf webhook {new_name}: {err}")
+            raise AutomationError(
+                "Connection Timeout",
+                f"Request to Jamf Pro server timed out after 30 seconds. {err}",
+            )
+        except requests.exceptions.ConnectionError as err:
+            logthis.error(f"Connection error editing Jamf webhook {new_name}: {err}")
+            raise AutomationError(
+                "Connection Error",
+                f"The request could not be sent to your Jamf Pro server, "
+                f"check your network connection. Details: {err}",
             )
         except Exception as err:
+            logthis.error(f"Unexpected error editing Jamf webhook {new_name}: {err}")
             raise AutomationError(
                 "Connection Error",
                 f"The request could not be sent to your Jamf Pro server, "
@@ -354,18 +408,35 @@ def process_edit(
             )
 
         if resp.status_code == 409:
+            logthis.error(
+                f"Duplicate webhook name {new_name} in Jamf Pro (status 409)"
+            )
             raise AutomationError(
                 "Duplicate",
                 f'The webhook name "{new_name}" already exists in '
                 f"your Jamf Pro Server.",
             )
         elif resp.status_code == 401:
+            logthis.error(
+                f"Insufficient privileges for {session_data.get('username')} "
+                f"to edit webhook {new_name} (status 401)"
+            )
             raise AutomationError(
                 "Insufficient privileges",
                 f"{session_data.get('username')} doesn't have privileges "
                 f"to update webhooks. Check your account privileges in "
                 f"Jamf Pro Settings.",
             )
+        elif resp.status_code >= 400:
+            logthis.error(
+                f"Jamf API error editing webhook {new_name}: "
+                f"HTTP {resp.status_code} - {resp.text}"
+            )
+            raise AutomationError(
+                "API Error",
+                f"Jamf Pro returned HTTP {resp.status_code}. "
+                f"Check permissions and server configuration.",
+            )
 
         # Save updated list
         save_all_webhooks(all_items)
@@ -403,15 +474,26 @@ def process_delete(
             f"{session_data['url']}/JSSResource/webhooks/name/"
             f"{automation['name']}"
         )
-        requests.put(
-            full_url,
-            headers={
-                "Content-Type": XML,
-                "Authorization": f"Bearer {session_data['token']}",
-                "User-Agent": USER_AGENT_STRING,
-            },
-            data=data,
-        )
+        try:
+            resp = requests.put(
+                full_url,
+                headers={
+                    "Content-Type": XML,
+                    "Authorization": f"Bearer {session_data['token']}",
+                    "User-Agent": USER_AGENT_STRING,
+                },
+                data=data,
+                timeout=30,
+            )
+            if resp.status_code >= 400:
+                logthis.error(
+                    f"Error disabling Jamf webhook {automation['name']}: "
+                    f"HTTP {resp.status_code}"
+                )
+        except Exception as err:
+            logthis.error(
+                f"Failed to disable Jamf webhook {automation['name']}: {err}"
+            )
         retire_script(automation.get("script", ""))
         return None
 
diff --git a/views/_type_handlers/okta_handler.py b/views/_type_handlers/okta_handler.py
index 5a4b9a2..6c00c64 100644
--- a/views/_type_handlers/okta_handler.py
+++ b/views/_type_handlers/okta_handler.py
@@ -116,19 +116,53 @@ def process_create(
         }
 
         # Create hook in Okta
-        resp = requests.post(
-            f"{okta_server}/api/v1/eventHooks",
-            headers={
-                "Accept": "application/json",
-                "Authorization": f"SSWS {okta_token}",
-                "Content-Type": "application/json",
-            },
-            data=json.dumps(payload, indent=4),
-        )
-        response_json = resp.json()
+        try:
+            resp = requests.post(
+                f"{okta_server}/api/v1/eventHooks",
+                headers={
+                    "Accept": "application/json",
+                    "Authorization": f"SSWS {okta_token}",
+                    "Content-Type": "application/json",
+                },
+                data=json.dumps(payload, indent=4),
+                timeout=30,
+            )
+        except requests.exceptions.Timeout as err:
+            logthis.error(f"Timeout creating Okta webhook {okta_name}: {err}")
+            raise AutomationError(
+                "Connection Timeout",
+                f"Request to Okta server timed out after 30 seconds. {err}",
+            )
+        except requests.exceptions.ConnectionError as err:
+            logthis.error(f"Connection error creating Okta webhook {okta_name}: {err}")
+            raise AutomationError(
+                "Connection Error",
+                f"Could not connect to Okta server. Check network connectivity. {err}",
+            )
+        except Exception as err:
+            logthis.error(f"Unexpected error creating Okta webhook {okta_name}: {err}")
+            raise AutomationError(
+                "API Error", f"Failed to create webhook in Okta. {err}"
+            )
+
+        try:
+            response_json = resp.json()
+        except json.JSONDecodeError as err:
+            logthis.error(
+                f"Invalid JSON response from Okta for webhook {okta_name}: {err}"
+            )
+            raise AutomationError(
+                "API Error",
+                f"Okta returned invalid JSON response. Status: {resp.status_code}",
+            )
+
         okta_id = response_json.get("id")
 
         if not okta_id:
+            logthis.error(
+                f"Failed to create Okta webhook {okta_name}. "
+                f"Response: {response_json}"
+            )
             raise AutomationError(
                 "Okta Error",
                 "Failed to create the event hook in Okta. "
@@ -149,12 +183,38 @@ def process_create(
         }
 
         # Verify/activate the hook
-        verify_resp = requests.post(
-            f"{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify",
-            headers={"Authorization": f"SSWS {okta_token}"},
-        )
-        verification = verify_resp.json()
+        try:
+            verify_resp = requests.post(
+                f"{okta_server}/api/v1/eventHooks/{okta_id}/lifecycle/verify",
+                headers={"Authorization": f"SSWS {okta_token}"},
+                timeout=30,
+            )
+            verification = verify_resp.json()
+        except requests.exceptions.Timeout as err:
+            logthis.error(f"Timeout verifying Okta webhook {okta_name}: {err}")
+            raise AutomationError(
+                "Connection Timeout",
+                f"Verification request timed out after 30 seconds. {err}",
+            )
+        except requests.exceptions.ConnectionError as err:
+            logthis.error(f"Connection error verifying Okta webhook {okta_name}: {err}")
+            raise AutomationError(
+                "Connection Error",
+                f"Could not connect to Okta for verification. {err}",
+            )
+        except json.JSONDecodeError as err:
+            logthis.error(f"Invalid verification response for webhook {okta_name}: {err}")
+            raise AutomationError(
+                "API Error", f"Okta returned invalid verification response. {err}"
+            )
+        except Exception as err:
+            logthis.error(f"Unexpected error verifying Okta webhook {okta_name}: {err}")
+            raise AutomationError("API Error", f"Failed to verify webhook. {err}")
+
         if "errorCode" in verification:
+            logthis.warning(
+                f"Okta webhook verification failed for {okta_name}: {verification}"
+            )
             raise AutomationError(
                 "Event Verification Error",
                 "Okta was unable to verify the webhook. "
@@ -187,16 +247,36 @@ def process_delete(
             okta_id = automation.get("okta_id", "")
             okta_token = automation.get("okta_token", "")
             # Deactivate then delete
-            requests.post(
+            deactivate_resp = requests.post(
                 f"{okta_url}/api/v1/eventHooks/{okta_id}/lifecycle/deactivate",
                 headers={"Authorization": f"SSWS {okta_token}"},
+                timeout=30,
             )
-            requests.delete(
+            if deactivate_resp.status_code >= 400:
+                logthis.error(
+                    f"Error deactivating Okta webhook {automation.get('name')}: "
+                    f"HTTP {deactivate_resp.status_code}"
+                )
+
+            delete_resp = requests.delete(
                 f"{okta_url}/api/v1/eventHooks/{okta_id}",
                 headers={"Authorization": f"SSWS {okta_token}"},
+                timeout=30,
             )
+            if delete_resp.status_code >= 400:
+                logthis.error(
+                    f"Error deleting Okta webhook {automation.get('name')}: "
+                    f"HTTP {delete_resp.status_code}"
+                )
         except requests.exceptions.MissingSchema as err:
+            logthis.error(
+                f"Invalid Okta URL for webhook {automation.get('name')}: {err}"
+            )
             return str(err)
+        except Exception as err:
+            logthis.error(
+                f"Failed to delete Okta webhook {automation.get('name')}: {err}"
+            )
         retire_script(automation.get("script", ""))
         return None
 
diff --git a/views/home_view.py b/views/home_view.py
index 824e185..e56e3c2 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -125,15 +125,15 @@ def _verify_jamf_access() -> Union[Response, None]:
         )
         resp.raise_for_status()
     except requests.exceptions.HTTPError as err:
-        logthis.info(f"Error occurred: {err}")
+        logthis.error(f"Error occurred: {err}")
         return _login_error(
             "Login error", "check account credentials and privileges"
         )
     except requests.exceptions.ConnectTimeout as err:
-        logthis.info(f"Error occurred: {err}")
+        logthis.error(f"Error occurred: {err}")
         return _login_error("Connection Timeout", err)
     except requests.exceptions.ConnectionError as err:
-        logthis.info(f"Error occurred: {err}")
+        logthis.error(f"Error occurred: {err}")
         return _login_error("HTTP Error", err)
     return None
 
diff --git a/views/log_view.py b/views/log_view.py
index 0aebd95..d4056d9 100644
--- a/views/log_view.py
+++ b/views/log_view.py
@@ -85,7 +85,11 @@ def log_home() -> Union[Response, str]:
     logthis.debug(
         f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    return render_template(LOG_TEMPLATE, log=_read_recent_logs())
+    return render_template(
+        LOG_TEMPLATE,
+        log=_read_recent_logs(),
+        debug_enabled=logger.is_debug_enabled(),
+    )
 
 
 @blueprint.route("/log/view", methods=["GET"])
@@ -101,7 +105,11 @@ def log_view() -> Union[Response, str]:
     logthis.debug(
         f"[{session.get('url')}] {session.get('username').title()} viewed {request.path}"
     )
-    return render_template(LOG_TEMPLATE, log=_read_recent_logs())
+    return render_template(
+        LOG_TEMPLATE,
+        log=_read_recent_logs(),
+        debug_enabled=logger.is_debug_enabled(),
+    )
 
 
 @blueprint.route("/log/live.html", methods=["GET"])
@@ -177,3 +185,25 @@ def download_logs() -> Response:
         as_attachment=True,
         download_name=f"{datetime.now()}-jawa.log",
     )
+
+
+@blueprint.route("/log/toggle-debug", methods=["POST"])
+def toggle_debug() -> Response:
+    """Toggle DEBUG logging on/off."""
+    if "username" not in session:
+        return redirect(
+            url_for(
+                LOGOUT_ENDPOINT,
+                error_title=ERROR_TITLE,
+                error_message=ERROR_MSG_SIGN_IN,
+            )
+        )
+
+    new_level = logger.toggle_debug()
+
+    logthis.info(
+        f"[{session.get('url')}] {session.get('username')} "
+        f"toggled debug logging to {new_level}"
+    )
+
+    return redirect(url_for("log_view.log_home"))
diff --git a/views/resource_view.py b/views/resource_view.py
index 56d2dbd..ce3bc87 100644
--- a/views/resource_view.py
+++ b/views/resource_view.py
@@ -96,7 +96,7 @@ def files() -> Union[Response, Tuple[str, int]]:
                 f"[{session.get('url')}] {session.get('username')} downloading file: {target_file}."
             )
             if target_file_dir != files_dir:
-                logthis.info(
+                logthis.warning(
                     f"WARNING: [{session.get('url')}] {session.get('username')} attempted to download a file from a forbidden path: {target_file_path}."
                 )
                 return (
@@ -176,7 +176,7 @@ def delete_file() -> Union[Response, Tuple[str, int]]:
         )
 
     if target_file_dir != files_dir:
-        logthis.info(
+        logthis.warning(
             f"WARNING: [{session.get('url')}] {session.get('username')} attempted to delete a file from a forbidden path: {target_file_path}."
         )
         return (
@@ -187,12 +187,28 @@ def delete_file() -> Union[Response, Tuple[str, int]]:
         f"[{session.get('url')}] {session.get('username')} deleting file: {target_file}."
     )
     if os.path.exists(os.path.join(files_dir, target_file)):
-        os.remove(os.path.join(files_dir, target_file))
-        logthis.info(
-            f"[{session.get('url')}] {session.get('username')} successfully deleted the Resource file: {target_file}."
-        )
-        return redirect(url_for("resources_view.files"))
+        try:
+            os.remove(os.path.join(files_dir, target_file))
+            logthis.info(
+                f"[{session.get('url')}] {session.get('username')} successfully deleted the Resource file: {target_file}."
+            )
+            return redirect(url_for("resources_view.files"))
+        except Exception as err:
+            logthis.error(
+                f"[{session.get('url')}] {session.get('username')} failed to delete Resource file {target_file}: {err}"
+            )
+            error = "Error deleting file."
+            error_message = f"Permission denied or file in use: {target_file}. {err}"
+            return render_template(
+                "error.html",
+                error=error,
+                error_message=error_message,
+                username=str(escape(session["username"])),
+            )
     else:
+        logthis.error(
+            f"[{session.get('url')}] {session.get('username')} attempted to delete non-existent file: {target_file}"
+        )
         error = "Error deleting file."
         error_message = f"File does not exist {target_file}."
         return render_template(
diff --git a/views/template_view.py b/views/template_view.py
index 4a0d15f..2539af8 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -137,8 +137,12 @@ def _register_webhook(entry: dict) -> None:
     """Append a webhook entry and save to disk."""
     webhooks = _load_webhooks()
     webhooks.append(entry)
-    with open(WEBHOOKS_FILE, "w", encoding="utf-8") as f:
-        json.dump(webhooks, f, indent=2)
+    try:
+        with open(WEBHOOKS_FILE, "w", encoding="utf-8") as f:
+            json.dump(webhooks, f, indent=2)
+    except (IOError, OSError) as err:
+        logthis.error(f"Failed to save webhook to {WEBHOOKS_FILE}: {err}")
+        raise
 
 
 def _apply_credentials(
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 7aad87a..275643f 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -87,16 +87,31 @@ def run_script(webhook_data: JSONType, webhook_name: str) -> Optional[bytes]:
 
 def script_results(webhook_data: JSONType, each_webhook: Dict) -> bytes:
     webhook_data = json.dumps(webhook_data)
-    proc = subprocess.Popen(
-        [each_webhook["script"], f"{webhook_data}"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-    )
-    output = proc.stdout.read()
-    for each_line in output.decode().split("\n"):
-        if each_line:
-            logthis.info(f"{each_webhook.get('name')} - {each_line}")
-    return output
+    try:
+        proc = subprocess.Popen(
+            [each_webhook["script"], f"{webhook_data}"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+        )
+        output = proc.stdout.read()
+        return_code = proc.wait()
+
+        for each_line in output.decode().split("\n"):
+            if each_line:
+                logthis.info(f"{each_webhook.get('name')} - {each_line}")
+
+        if return_code != 0:
+            logthis.error(
+                f"Script execution failed for {each_webhook.get('name')} "
+                f"with exit code {return_code}"
+            )
+
+        return output
+    except Exception as err:
+        logthis.error(
+            f"Error executing script for webhook {each_webhook.get('name')}: {err}"
+        )
+        return str(err).encode()
 
 
 def custom_output_options(
@@ -124,18 +139,18 @@ def webhook_handler(
     try:
         webhook_data = request.get_json()
     except Exception as err:
-        logthis.debug(
+        logthis.warning(
             f"Error loading JSON ({err}). Trying to load from form payload."
         )
         webhook_data = json.loads(request.form.get("payload"))
     if not webhook_data:
-        logthis.info(
+        logthis.warning(
             f"418.  Error processing /hooks/{webhook_name} - no data provided. I'm a teapot."
         )
         return "418 - I'm a teapot.", 418
     logthis.debug(f"{webhook_name} payload: {webhook_data}")
     if request.method != "POST":
-        logthis.info(
+        logthis.warning(
             f"Invalid request, {request.method} for /hooks/{webhook_name}."
         )
         return (
@@ -170,7 +185,7 @@ def webhook_handler(
                 "result": "valid webhook received",
             }
     else:
-        logthis.info(
+        logthis.warning(
             f"401 - Incorrect authentication provided for /hooks/{webhook_name}."
         )
         return (

From e6d03db2bf56c5fbb4116849b08d649a0ca35789 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 12 Feb 2026 22:58:07 -0600
Subject: [PATCH 17/84] feat: redesign error and success pages with improved UI
 components

---
 static/css/main.css    |   3 +
 templates/error.html   | 157 +++++++++++++++++++++++++----
 templates/success.html | 221 +++++++++++++++++++++++++++++++++++------
 3 files changed, 334 insertions(+), 47 deletions(-)

diff --git a/static/css/main.css b/static/css/main.css
index 8a8f0af..6d303da 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -52,6 +52,7 @@ body {
     color: var(--color-text);
     -webkit-font-smoothing: antialiased;
     -moz-osx-font-smoothing: grayscale;
+    min-height: 100vh;
 }
 
 a {
@@ -549,6 +550,8 @@ footer {
     color: rgba(255, 255, 255, 0.75);
     background-color: var(--color-navbar);
     font-size: 0.8rem;
+    margin-top: auto;
+    flex-shrink: 0;
 }
 
 footer a {
diff --git a/templates/error.html b/templates/error.html
index 9b22a9e..edd8d21 100644
--- a/templates/error.html
+++ b/templates/error.html
@@ -28,24 +28,147 @@
 
 {% extends "shared/_layout.html" %}
 {% block title %}{{ error }}{% endblock %}
+
+{% block additional_css %}
+<style>
+    .error-container {
+        min-height: calc(100vh - 200px);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 2rem 1rem;
+    }
+    .error-card {
+        background: var(--color-surface-raised);
+        border: 1px solid var(--color-border);
+        border-radius: 12px;
+        padding: 2.5rem;
+        max-width: 650px;
+        width: 100%;
+        box-shadow: 0 4px 20px rgba(249, 117, 131, 0.12);
+    }
+    .error-icon {
+        width: 64px;
+        height: 64px;
+        margin: 0 auto 1.5rem;
+        background: rgba(249, 117, 131, 0.1);
+        border: 2px solid rgba(249, 117, 131, 0.3);
+        border-radius: 50%;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        color: #d63447;
+        font-size: 2rem;
+        font-weight: bold;
+        animation: errorShake 0.5s ease-out;
+    }
+    @keyframes errorShake {
+        0%, 100% { transform: translateX(0); }
+        25% { transform: translateX(-8px); }
+        75% { transform: translateX(8px); }
+    }
+    .error-title {
+        color: #d63447;
+        font-size: 1.75rem;
+        font-weight: 600;
+        text-align: center;
+        margin-bottom: 1.25rem;
+    }
+    .error-message {
+        color: var(--color-text);
+        font-size: 1rem;
+        line-height: 1.6;
+        text-align: center;
+        margin-bottom: 1.5rem;
+    }
+    .error-link {
+        background: var(--color-primary-light);
+        border: 1px solid rgba(60, 106, 167, 0.2);
+        border-radius: 8px;
+        padding: 0.75rem 1rem;
+        margin: 1.5rem 0;
+        text-align: center;
+        word-break: break-all;
+    }
+    .error-link a {
+        color: var(--color-primary);
+        text-decoration: none;
+        font-weight: 500;
+        font-size: 0.9rem;
+    }
+    .error-link a:hover {
+        color: var(--color-primary-hover);
+        text-decoration: underline;
+    }
+    .error-actions {
+        display: flex;
+        gap: 0.75rem;
+        justify-content: center;
+        margin-top: 2rem;
+        flex-wrap: wrap;
+    }
+    .btn-error-secondary {
+        background: var(--color-surface);
+        border: 1px solid var(--color-border);
+        color: var(--color-text);
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        text-decoration: none;
+        display: inline-block;
+    }
+    .btn-error-secondary:hover {
+        background: var(--color-surface-hover);
+        border-color: var(--color-text-secondary);
+        color: var(--color-text);
+        transform: translateY(-1px);
+        text-decoration: none;
+    }
+    .btn-error-primary {
+        background: var(--color-primary);
+        border: 1px solid var(--color-primary);
+        color: white;
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        text-decoration: none;
+        display: inline-block;
+    }
+    .btn-error-primary:hover {
+        background: var(--color-primary-hover);
+        border-color: var(--color-primary-hover);
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(60, 106, 167, 0.3);
+        text-decoration: none;
+    }
+</style>
+{% endblock %}
+
 {% block content %}
-<div class="container" style="padding-top: 5rem;">
-    <div class="page-sub-nav">
-        <a href="/dashboard">JAWA Dashboard</a>
-    </div>
-    <div class="form-container">
-        <div class="error">
-            <div class="success-form">
-                <div class="alert-jawa">{{ error }}</div>
-                <div class="success-wrap alert success-form">{{ error_message }}
-                    {% if link %}<a href="{{ link }}" target="_blank">{{ link }}</a> {% endif %}</div>
-                <div class="text-center">
-                    <button type="button" onclick="history.back(-1)"
-                       class="btn btn-secondary button-align">&laquo;Back</button>
-                    <a href="/dashboard"
-                       class="btn btn-jawa button-align">Dashboard</a>
-                </div>
-            </div>
+<div class="error-container">
+    <div class="error-card">
+        <div class="error-icon">✕</div>
+        <h1 class="error-title">{{ error }}</h1>
+
+        <div class="error-message">
+            {{ error_message }}
+        </div>
+
+        {% if link %}
+        <div class="error-link">
+            <a href="{{ link }}" target="_blank">{{ link }}</a>
+        </div>
+        {% endif %}
+
+        <div class="error-actions">
+            <button type="button" onclick="history.back()" class="btn-error-secondary">
+                ← Back
+            </button>
+            <a href="/dashboard" class="btn-error-primary">
+                Dashboard →
+            </a>
         </div>
     </div>
 </div>
diff --git a/templates/success.html b/templates/success.html
index bbb2f22..c9dbaf9 100644
--- a/templates/success.html
+++ b/templates/success.html
@@ -28,38 +28,199 @@
 
 {% extends "shared/_layout.html" %}
 {% block title %}Success!{% endblock %}
+
+{% block additional_css %}
+<style>
+    .success-container {
+        min-height: calc(100vh - 200px);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 2rem 1rem;
+    }
+    .success-card {
+        background: var(--color-surface-raised);
+        border: 1px solid var(--color-border);
+        border-radius: 12px;
+        padding: 2.5rem;
+        max-width: 650px;
+        width: 100%;
+        box-shadow: 0 4px 20px rgba(106, 47, 48, 0.08);
+    }
+    .success-icon {
+        width: 64px;
+        height: 64px;
+        margin: 0 auto 1.5rem;
+        background: rgba(137, 209, 133, 0.12);
+        border: 2px solid rgba(137, 209, 133, 0.3);
+        border-radius: 50%;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        color: #4a9646;
+        font-size: 2rem;
+        font-weight: bold;
+        animation: successPulse 0.6s ease-out;
+    }
+    @keyframes successPulse {
+        0% {
+            transform: scale(0.8);
+            opacity: 0;
+        }
+        50% {
+            transform: scale(1.1);
+        }
+        100% {
+            transform: scale(1);
+            opacity: 1;
+        }
+    }
+    .success-title {
+        color: #4a9646;
+        font-size: 1.75rem;
+        font-weight: 600;
+        text-align: center;
+        margin-bottom: 1.25rem;
+    }
+    .success-message {
+        color: var(--color-text);
+        font-size: 1rem;
+        line-height: 1.6;
+        text-align: center;
+        margin-bottom: 1.5rem;
+        white-space: pre-line;
+    }
+    .success-notice {
+        background: var(--color-primary-light);
+        border-left: 3px solid var(--color-primary);
+        padding: 1rem 1.25rem;
+        border-radius: 6px;
+        margin: 1.5rem 0;
+        font-size: 0.9rem;
+        color: var(--color-text);
+    }
+    .success-notice strong {
+        color: var(--color-primary);
+        display: block;
+        margin-bottom: 0.5rem;
+    }
+    .success-link {
+        background: var(--color-primary-light);
+        border: 1px solid rgba(60, 106, 167, 0.2);
+        border-radius: 8px;
+        padding: 0.75rem 1rem;
+        margin: 1.5rem 0;
+        text-align: center;
+    }
+    .success-link a {
+        color: var(--color-primary);
+        text-decoration: none;
+        font-weight: 500;
+        transition: all 0.2s ease;
+    }
+    .success-link a:hover {
+        color: var(--color-primary-hover);
+        text-decoration: underline;
+    }
+    .success-header-display {
+        background: var(--color-surface-hover);
+        border: 1px solid var(--color-border);
+        border-radius: 8px;
+        padding: 1rem;
+        margin: 1rem 0;
+        font-family: var(--font-mono);
+        font-size: 0.85rem;
+        color: var(--color-text);
+        text-align: center;
+        overflow-x: auto;
+    }
+    .success-actions {
+        display: flex;
+        gap: 0.75rem;
+        justify-content: center;
+        margin-top: 2rem;
+        flex-wrap: wrap;
+    }
+    .btn-success-secondary {
+        background: var(--color-surface);
+        border: 1px solid var(--color-border);
+        color: var(--color-text);
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        text-decoration: none;
+    }
+    .btn-success-secondary:hover {
+        background: var(--color-surface-hover);
+        border-color: var(--color-text-secondary);
+        color: var(--color-text);
+        transform: translateY(-1px);
+        text-decoration: none;
+    }
+    .btn-success-primary {
+        background: var(--color-primary);
+        border: 1px solid var(--color-primary);
+        color: white;
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        text-decoration: none;
+    }
+    .btn-success-primary:hover {
+        background: var(--color-primary-hover);
+        border-color: var(--color-primary-hover);
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(60, 106, 167, 0.3);
+        text-decoration: none;
+    }
+</style>
+{% endblock %}
+
 {% block content %}
-<div class="container" style="padding-top: 5rem;">
-    <div class="page-sub-nav">
-        <a href="/dashboard">JAWA Dashboard</a>
-    </div>
-    <div class="form-container">
-    <form method="get" class="table-view success-view" action="/dashboard">
-        <h3 class="alert-jawa border text-center">Success!</h3>
-        <div class="success-view success-form success-wrap overflow-auto" style="max-width: 100vh">
-            <p class="text-center">
-                {% for each_line in success_msg.split('\n') %}
-                {{ each_line }}<br/>
-                </p>
-            {% endfor %}
-            {% if smart_group_notice %}
-                <p class="text-center"><b>{{ smart_group_notice }}</b> <br/> {{ smart_group_instructions }}</p>
-            {% endif %}
-            <p><a href="{{ new_link }}" style="color:#3c6aa7;" target="_blank">{{ new_here }}</a></p>
-            {% if extra_notice %}
-                <p class="text-center">{{ extra_notice }}</p>
-            {% endif %}
-        {%  if custom_header %}
-            <pre class="success-form font-weight-bolder" style="text-wrap: balance"><div class="d-flex justify-content-center">{{ custom_header }}</div></pre>
+<div class="success-container">
+    <div class="success-card">
+        <div class="success-icon">✓</div>
+        <h1 class="success-title">Success!</h1>
+
+        <div class="success-message">
+            {{ success_msg }}
+        </div>
+
+        {% if smart_group_notice %}
+        <div class="success-notice">
+            <strong>{{ smart_group_notice }}</strong>
+            {{ smart_group_instructions }}
+        </div>
         {% endif %}
+
+        {% if new_link and new_here %}
+        <div class="success-link">
+            <a href="{{ new_link }}" target="_blank">{{ new_here }}</a>
         </div>
-            <div class="d-flex justify-content-center">
-                <button type="button" onclick="history.back(-1)"
-                       class="btn btn-secondary button-align">&laquo;Back</button>
-                <button type="submit" class="btn btn-jawa">
-                    Dashboard<i class="fa" aria-hidden="true"></i>
-                </button>
-            </div>
-    </form>
+        {% endif %}
+
+        {% if extra_notice %}
+        <div class="success-notice">
+            {{ extra_notice }}
+        </div>
+        {% endif %}
+
+        {% if custom_header %}
+        <div class="success-header-display">
+            {{ custom_header }}
+        </div>
+        {% endif %}
+
+        <div class="success-actions">
+            <button type="button" onclick="history.back()" class="btn-success-secondary">
+                ← Back
+            </button>
+            <a href="/dashboard" class="btn-success-primary">
+                Dashboard →
+            </a>
+        </div>
+    </div>
 </div>
 {% endblock %}

From 580f78bc294a63f14b01f46141448db4540f170d Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 12 Feb 2026 23:34:35 -0600
Subject: [PATCH 18/84] feat: enhance UI

---
 static/css/main.css                 |  26 +++--
 templates/automations/create.html   | 107 ++++++++++++++-----
 templates/automations/delete.html   |  16 +--
 templates/automations/detail.html   |   8 +-
 templates/automations/edit.html     | 153 ++++++++++++++++++++++------
 templates/automations/list.html     |  12 +--
 templates/automations/list_all.html |  12 +--
 templates/resources/delete.html     | 142 +++++++++++++++++++++++---
 templates/search_results.html       |   2 +-
 templates/shared/_macros.html       | 133 ++++++++++++++++++++++--
 templates/workflows/catalog.html    |   4 +-
 templates/workflows/detail.html     |   2 +-
 12 files changed, 511 insertions(+), 106 deletions(-)

diff --git a/static/css/main.css b/static/css/main.css
index 6d303da..5d537dd 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -103,7 +103,7 @@ header h1.logo:hover {
  * Centering the body content
  */
 .container {
-    max-width: 1100px;
+    max-width: 1400px;
     margin: 0 auto;
     padding-left: 1rem;
     padding-right: 1rem;
@@ -895,7 +895,7 @@ code {
 /* ===== Page Sub-Navigation (pill-style) ===== */
 .page-sub-nav {
     display: flex;
-    justify-content: center;
+    justify-content: left;
     gap: 0.5rem;
     flex-wrap: wrap;
     padding: 0.75rem 0;
@@ -937,7 +937,10 @@ code {
     margin-bottom: 2rem;
     position: relative;
     overflow: hidden;
-    text-align: center;
+}
+
+.hero-section .container {
+    max-width: 1400px;
 }
 
 .hero-section::before {
@@ -957,7 +960,7 @@ code {
     letter-spacing: -1px;
     margin: 0 0 0.5rem;
     color: #fff;
-    text-align: center;
+    text-align: left;
     position: relative;
 }
 
@@ -965,13 +968,13 @@ code {
     color: rgba(255, 255, 255, 0.85);
     font-size: 1.05rem;
     margin: 0;
-    text-align: center;
+    text-align: left;
     position: relative;
 }
 
 .hero-cta {
     display: flex;
-    justify-content: center;
+    justify-content: left;
     gap: 0.75rem;
     margin-top: 1.25rem;
     position: relative;
@@ -1170,6 +1173,8 @@ a.btn-hero-secondary:visited {
     color: var(--color-text-secondary);
     cursor: pointer;
     transition: all 0.15s ease;
+    text-decoration: none;
+    display: inline-block;
 }
 
 .filter-btn:hover,
@@ -1179,6 +1184,15 @@ a.btn-hero-secondary:visited {
     border-color: var(--color-primary);
 }
 
+.filter-btn:visited {
+    color: var(--color-text-secondary);
+}
+
+.filter-btn:visited:hover,
+.filter-btn:visited.active {
+    color: #fff;
+}
+
 /* ===== Navbar Search ===== */
 .search-input {
     background: rgba(255, 255, 255, 0.12);
diff --git a/templates/automations/create.html b/templates/automations/create.html
index fc6aa3d..4435283 100644
--- a/templates/automations/create.html
+++ b/templates/automations/create.html
@@ -2,39 +2,98 @@
 
 {% block title %}New {{ handler.display_name }} | JAWA{% endblock %}
 
+{% block additional_css %}
+<style>
+    .form-page-container {
+        max-width: 700px;
+        margin: 2rem auto;
+        padding: 0 1rem 2rem;
+    }
+    .form-card {
+        background: var(--color-surface-raised);
+        border: 1px solid var(--color-border);
+        border-radius: 12px;
+        padding: 2.5rem;
+        box-shadow: 0 2px 12px rgba(106, 47, 48, 0.06);
+    }
+    .form-card h1 {
+        color: var(--color-text);
+        font-size: 1.75rem;
+        font-weight: 600;
+        text-align: center;
+        margin-bottom: 2rem;
+        padding-bottom: 1rem;
+        border-bottom: 2px solid var(--color-border);
+    }
+    .form-card .form-control {
+        width: 100%;
+        margin-bottom: 1rem;
+    }
+    .form-card textarea.form-control {
+        resize: vertical;
+        min-height: 80px;
+    }
+    .form-actions {
+        margin-top: 2rem;
+        padding-top: 1.5rem;
+        border-top: 1px solid var(--color-border);
+        display: flex;
+        gap: 0.75rem;
+        justify-content: center;
+    }
+    .btn-form-primary {
+        background: var(--color-primary);
+        border: 1px solid var(--color-primary);
+        color: white;
+        padding: 0.65rem 2rem;
+        border-radius: 8px;
+        font-weight: 500;
+        font-size: 0.95rem;
+        transition: all 0.2s ease;
+        cursor: pointer;
+    }
+    .btn-form-primary:hover {
+        background: var(--color-primary-hover);
+        border-color: var(--color-primary-hover);
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(60, 106, 167, 0.25);
+    }
+</style>
+{% endblock %}
+
 {% block content %}
 <div class="hero-section">
     <div class="container">
         <h2>New {{ handler.display_name }} {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h2>
         <p>Configure and create a new automation.</p>
+        <div class="hero-cta">
+            <a href="/automations/{{ auto_type }}" class="btn btn-hero-secondary">
+                ← Back to {{ handler.display_name }}
+            </a>
+        </div>
     </div>
 </div>
-<div class="container">
-    <div class="page-sub-nav">
-        <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
-        <a href="/automations/{{ auto_type }}/new" class="active">Create</a>
-    </div>
-    <div class="form-container">
-        <form method="POST" action="/automations/{{ auto_type }}/new"
-              class="form-section overflow-auto" enctype="multipart/form-data">
-            <h1>New {{ handler.display_name }}
-                {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h1>
 
-            {% if auto_type == 'jamfpro' %}
-                {% include "automations/_partials/_jamf_fields.html" %}
-            {% elif auto_type == 'okta' %}
-                {% include "automations/_partials/_okta_fields.html" %}
-            {% elif auto_type == 'custom' %}
-                {% include "automations/_partials/_custom_fields.html" %}
-            {% elif auto_type == 'cron' %}
-                {% include "automations/_partials/_cron_fields.html" %}
-            {% endif %}
+<div class="form-page-container">
+    <form method="POST" action="/automations/{{ auto_type }}/new"
+          class="form-card" enctype="multipart/form-data">
+        <h1>New {{ handler.display_name }}
+            {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h1>
 
-            <div class="d-flex justify-content-center">
-                <button type="submit" class="btn btn-jawa btn-action">Create</button>
-            </div>
-        </form>
-    </div>
+        {% if auto_type == 'jamfpro' %}
+            {% include "automations/_partials/_jamf_fields.html" %}
+        {% elif auto_type == 'okta' %}
+            {% include "automations/_partials/_okta_fields.html" %}
+        {% elif auto_type == 'custom' %}
+            {% include "automations/_partials/_custom_fields.html" %}
+        {% elif auto_type == 'cron' %}
+            {% include "automations/_partials/_cron_fields.html" %}
+        {% endif %}
+
+        <div class="form-actions">
+            <button type="submit" class="btn-form-primary">Create Automation</button>
+        </div>
+    </form>
 </div>
 {% endblock %}
 
diff --git a/templates/automations/delete.html b/templates/automations/delete.html
index 1a2d6dc..a41bf21 100644
--- a/templates/automations/delete.html
+++ b/templates/automations/delete.html
@@ -6,14 +6,14 @@
 {% block content %}
 {{ hero_section(
     title="Delete " ~ handler.display_name,
-    subtitle="Confirm deletion of " ~ automation_name
+    subtitle="Confirm deletion of automation",
+    secondary_url="/automations/" ~ auto_type,
+    secondary_label="Back to " ~ handler.display_name
 ) }}
 
-<div class="container">
-    {{ delete_confirmation(
-        automation_name,
-        handler.display_name,
-        "/automations/" ~ auto_type ~ "/" ~ automation_name ~ "/delete"
-    ) }}
-</div>
+{{ delete_confirmation(
+    automation_name,
+    handler.display_name,
+    "/automations/" ~ auto_type ~ "/" ~ automation_name ~ "/delete"
+) }}
 {% endblock %}
diff --git a/templates/automations/detail.html b/templates/automations/detail.html
index 6732500..95b9487 100644
--- a/templates/automations/detail.html
+++ b/templates/automations/detail.html
@@ -10,11 +10,11 @@
 ) }}
 
 <div class="container">
-    <div class="page-sub-nav">
-        <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
-        <a href="/automations/{{ auto_type }}/{{ automation.name }}" class="active">Detail</a>
+    <div class="text-center mb-4">
+        <a href="/automations/{{ auto_type }}" class="filter-btn">{{ handler.display_name }}</a>
+        <a href="/automations/{{ auto_type }}/{{ automation.name }}" class="filter-btn active">Detail</a>
         {% if handler.supports_edit %}
-        <a href="/automations/{{ auto_type }}/{{ automation.name }}/edit">Edit</a>
+        <a href="/automations/{{ auto_type }}/{{ automation.name }}/edit" class="filter-btn">Edit</a>
         {% endif %}
     </div>
 
diff --git a/templates/automations/edit.html b/templates/automations/edit.html
index 1360bb5..03d2800 100644
--- a/templates/automations/edit.html
+++ b/templates/automations/edit.html
@@ -2,44 +2,139 @@
 
 {% block title %}Edit {{ automation_name }} | JAWA{% endblock %}
 
+{% block additional_css %}
+<style>
+    .form-page-container {
+        max-width: 700px;
+        margin: 2rem auto;
+        padding: 0 1rem 2rem;
+    }
+    .form-card {
+        background: var(--color-surface-raised);
+        border: 1px solid var(--color-border);
+        border-radius: 12px;
+        padding: 2.5rem;
+        box-shadow: 0 2px 12px rgba(106, 47, 48, 0.06);
+    }
+    .form-card h1 {
+        color: var(--color-text);
+        font-size: 1.75rem;
+        font-weight: 600;
+        text-align: center;
+        margin-bottom: 2rem;
+        padding-bottom: 1rem;
+        border-bottom: 2px solid var(--color-border);
+    }
+    .form-card .form-control {
+        width: 100%;
+        margin-bottom: 1rem;
+    }
+    .form-card textarea.form-control {
+        resize: vertical;
+        min-height: 80px;
+    }
+    .form-actions {
+        margin-top: 2rem;
+        padding-top: 1.5rem;
+        border-top: 1px solid var(--color-border);
+        display: flex;
+        gap: 0.75rem;
+        justify-content: center;
+        flex-wrap: wrap;
+    }
+    .btn-form-cancel {
+        background: var(--color-surface);
+        border: 1px solid var(--color-border);
+        color: var(--color-text);
+        padding: 0.65rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        font-size: 0.95rem;
+        transition: all 0.2s ease;
+        text-decoration: none;
+        display: inline-block;
+    }
+    .btn-form-cancel:hover {
+        background: var(--color-surface-hover);
+        border-color: var(--color-text-secondary);
+        color: var(--color-text);
+        transform: translateY(-1px);
+        text-decoration: none;
+    }
+    .btn-form-primary {
+        background: var(--color-primary);
+        border: 1px solid var(--color-primary);
+        color: white;
+        padding: 0.65rem 2rem;
+        border-radius: 8px;
+        font-weight: 500;
+        font-size: 0.95rem;
+        transition: all 0.2s ease;
+        cursor: pointer;
+    }
+    .btn-form-primary:hover {
+        background: var(--color-primary-hover);
+        border-color: var(--color-primary-hover);
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(60, 106, 167, 0.25);
+    }
+    .btn-form-danger {
+        background: #d63447;
+        border: 1px solid #d63447;
+        color: white;
+        padding: 0.65rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        font-size: 0.95rem;
+        transition: all 0.2s ease;
+        cursor: pointer;
+    }
+    .btn-form-danger:hover {
+        background: #b8293a;
+        border-color: #b8293a;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(214, 52, 71, 0.25);
+    }
+</style>
+{% endblock %}
+
 {% block content %}
 <div class="hero-section">
     <div class="container">
         <h2>Edit {{ handler.display_name }} {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h2>
         <p>Modify settings for {{ automation_name }}.</p>
+        <div class="hero-cta">
+            <a href="/automations/{{ auto_type }}/{{ automation_name }}" class="btn btn-hero-secondary">
+                ← Back to Detail
+            </a>
+        </div>
     </div>
 </div>
-<div class="container">
-    <div class="page-sub-nav">
-        <a href="/automations/{{ auto_type }}">{{ handler.display_name }}</a>
-        <a href="/automations/{{ auto_type }}/{{ automation_name }}">Detail</a>
-        <a href="/automations/{{ auto_type }}/{{ automation_name }}/edit" class="active">Edit</a>
-    </div>
-    <div class="form-container">
-        <form method="POST" action="/automations/{{ auto_type }}/{{ automation_name }}/edit"
-              class="form-section overflow-auto" enctype="multipart/form-data">
-            <h1>Edit {{ handler.display_name }}
-                {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h1>
 
-            {% set edit_mode = true %}
-            {% if auto_type == 'jamfpro' %}
-                {% include "automations/_partials/_jamf_fields.html" %}
-            {% elif auto_type == 'custom' %}
-                {% include "automations/_partials/_custom_fields.html" %}
-            {% elif auto_type == 'cron' %}
-                {% include "automations/_partials/_cron_fields.html" %}
-            {% endif %}
+<div class="form-page-container">
+    <form method="POST" action="/automations/{{ auto_type }}/{{ automation_name }}/edit"
+          class="form-card" enctype="multipart/form-data">
+        <h1>Edit {{ handler.display_name }}
+            {% if auto_type == 'cron' %}Job{% else %}Webhook{% endif %}</h1>
 
-            <div class="d-flex justify-content-center gap-2">
-                <a href="/automations/{{ auto_type }}/{{ automation_name }}"
-                   class="btn btn-secondary btn-action">Cancel</a>
-                <button type="submit" name="button_choice" value="Save"
-                        class="btn btn-jawa btn-action">Save</button>
-                <button type="submit" name="button_choice" value="Delete"
-                        class="btn btn-danger btn-action">Delete</button>
-            </div>
-        </form>
-    </div>
+        {% set edit_mode = true %}
+        {% if auto_type == 'jamfpro' %}
+            {% include "automations/_partials/_jamf_fields.html" %}
+        {% elif auto_type == 'custom' %}
+            {% include "automations/_partials/_custom_fields.html" %}
+        {% elif auto_type == 'cron' %}
+            {% include "automations/_partials/_cron_fields.html" %}
+        {% endif %}
+
+        <div class="form-actions">
+            <a href="/automations/{{ auto_type }}/{{ automation_name }}"
+               class="btn-form-cancel">Cancel</a>
+            <button type="submit" name="button_choice" value="Save"
+                    class="btn-form-primary">Save Changes</button>
+            <button type="submit" name="button_choice" value="Delete"
+                    class="btn-form-danger">Delete</button>
+        </div>
+    </form>
 </div>
 {% endblock %}
 
diff --git a/templates/automations/list.html b/templates/automations/list.html
index 29dd8a5..6e34eeb 100644
--- a/templates/automations/list.html
+++ b/templates/automations/list.html
@@ -14,12 +14,12 @@
 ) }}
 
 <div class="container">
-    <div class="page-sub-nav">
-        <a href="/automations">All</a>
-        <a href="/automations/jamfpro" {% if auto_type == 'jamfpro' %}class="active"{% endif %}>Jamf Pro</a>
-        <a href="/automations/okta" {% if auto_type == 'okta' %}class="active"{% endif %}>Okta</a>
-        <a href="/automations/custom" {% if auto_type == 'custom' %}class="active"{% endif %}>Custom</a>
-        <a href="/automations/cron" {% if auto_type == 'cron' %}class="active"{% endif %}>Cron</a>
+    <div class="text-left mb-4">
+        <a href="/automations" class="filter-btn">All</a>
+        <a href="/automations/jamfpro" class="filter-btn {% if auto_type == 'jamfpro' %}active{% endif %}">Jamf Pro</a>
+        <a href="/automations/okta" class="filter-btn {% if auto_type == 'okta' %}active{% endif %}">Okta</a>
+        <a href="/automations/custom" class="filter-btn {% if auto_type == 'custom' %}active{% endif %}">Custom</a>
+        <a href="/automations/cron" class="filter-btn {% if auto_type == 'cron' %}active{% endif %}">Cron</a>
     </div>
 
     {% if not items %}
diff --git a/templates/automations/list_all.html b/templates/automations/list_all.html
index c4efcb4..012c7a9 100644
--- a/templates/automations/list_all.html
+++ b/templates/automations/list_all.html
@@ -14,12 +14,12 @@
 ) }}
 
 <div class="container">
-    <div class="page-sub-nav">
-        <a href="/automations" class="active">All</a>
-        <a href="/automations/jamfpro">Jamf Pro</a>
-        <a href="/automations/okta">Okta</a>
-        <a href="/automations/custom">Custom</a>
-        <a href="/automations/cron">Cron</a>
+    <div class="text-left mb-4">
+        <a href="/automations" class="filter-btn active">All</a>
+        <a href="/automations/jamfpro" class="filter-btn">Jamf Pro</a>
+        <a href="/automations/okta" class="filter-btn">Okta</a>
+        <a href="/automations/custom" class="filter-btn">Custom</a>
+        <a href="/automations/cron" class="filter-btn">Cron</a>
     </div>
 
     {% set ns = namespace(has_any=false) %}
diff --git a/templates/resources/delete.html b/templates/resources/delete.html
index 1ce942b..89d31c3 100644
--- a/templates/resources/delete.html
+++ b/templates/resources/delete.html
@@ -25,28 +25,146 @@
 {##       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.#}
 {###}
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
+
 {% extends "shared/_layout.html" %}
 {% from "shared/_macros.html" import hero_section %}
-{% block title %}Confirm Delete{% endblock %}
+
+{% block title %}Delete File | JAWA{% endblock %}
+
+{% block additional_css %}
+<style>
+    .delete-container {
+        min-height: calc(100vh - 300px);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 2rem 1rem;
+    }
+    .delete-card {
+        background: var(--color-surface-raised);
+        border: 1px solid var(--color-border);
+        border-radius: 12px;
+        padding: 2.5rem;
+        max-width: 550px;
+        width: 100%;
+        box-shadow: 0 4px 20px rgba(106, 47, 48, 0.08);
+    }
+    .delete-icon {
+        width: 64px;
+        height: 64px;
+        margin: 0 auto 1.5rem;
+        background: rgba(229, 192, 123, 0.12);
+        border: 2px solid rgba(229, 192, 123, 0.3);
+        border-radius: 50%;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        color: #c17d11;
+        font-size: 2rem;
+        font-weight: bold;
+    }
+    .delete-title {
+        color: var(--color-text);
+        font-size: 1.5rem;
+        font-weight: 600;
+        text-align: center;
+        margin-bottom: 1rem;
+    }
+    .delete-item-name {
+        background: var(--color-surface-hover);
+        border: 1px solid var(--color-border);
+        border-radius: 8px;
+        padding: 0.75rem 1rem;
+        margin: 1.5rem 0;
+        text-align: center;
+        font-family: var(--font-mono);
+        font-weight: 600;
+        color: var(--color-text);
+        word-break: break-word;
+    }
+    .delete-warning {
+        color: var(--color-text-secondary);
+        font-size: 0.95rem;
+        line-height: 1.5;
+        text-align: center;
+        margin-bottom: 2rem;
+    }
+    .delete-warning strong {
+        color: #c17d11;
+    }
+    .delete-actions {
+        display: flex;
+        gap: 0.75rem;
+        justify-content: center;
+        flex-wrap: wrap;
+    }
+    .btn-delete-cancel {
+        background: var(--color-surface);
+        border: 1px solid var(--color-border);
+        color: var(--color-text);
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        text-decoration: none;
+        display: inline-block;
+    }
+    .btn-delete-cancel:hover {
+        background: var(--color-surface-hover);
+        border-color: var(--color-text-secondary);
+        color: var(--color-text);
+        transform: translateY(-1px);
+        text-decoration: none;
+    }
+    .btn-delete-confirm {
+        background: #d63447;
+        border: 1px solid #d63447;
+        color: white;
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        cursor: pointer;
+    }
+    .btn-delete-confirm:hover {
+        background: #b8293a;
+        border-color: #b8293a;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(214, 52, 71, 0.3);
+    }
+</style>
+{% endblock %}
+
 {% block content %}
 {{ hero_section(
     title="Delete Resource File",
-    subtitle="Confirm deletion of " ~ (target_file or "file"),
+    subtitle="Confirm deletion of file",
     secondary_url="/resources/files",
     secondary_label="Back to Files"
 ) }}
-<div class="container content-narrow">
-    <div class="confirm-delete-box">
-        <div class="alert alert-warning text-center mb-3" role="alert">
-            <strong>{{ target_file }}</strong><br>
-            Deleting a file is a permanent action.
+
+<div class="delete-container">
+    <div class="delete-card">
+        <div class="delete-icon">⚠</div>
+        <h1 class="delete-title">Delete File?</h1>
+
+        <div class="delete-item-name">
+            {{ target_file }}
+        </div>
+
+        <div class="delete-warning">
+            <strong>This action cannot be undone.</strong><br>
+            This will permanently delete this file from the resources directory.
         </div>
-        {#                Don't you call me a mindless philosopher!     #}
-        {#                    ~ C-3PO, a Star War                       #}
+
         <form action="#" method="POST" enctype="multipart/form-data">
-            <div class="d-flex justify-content-center gap-2">
-                <a href="/resources/files" class="btn btn-secondary btn-action">Cancel</a>
-                <button type="submit" class="btn btn-danger btn-action">Delete</button>
+            <div class="delete-actions">
+                <a href="/resources/files" class="btn-delete-cancel">
+                    Cancel
+                </a>
+                <button type="submit" class="btn-delete-confirm">
+                    Delete File
+                </button>
             </div>
         </form>
     </div>
diff --git a/templates/search_results.html b/templates/search_results.html
index 7ef8315..21680a2 100644
--- a/templates/search_results.html
+++ b/templates/search_results.html
@@ -7,7 +7,7 @@ <h2>Search Results{% if query %} for "{{ query }}"{% endif %}</h2>
         <p>Search webhooks, cron jobs, templates, and pages.</p>
     </div>
 </div>
-<div class="container" style="max-width: 900px;">
+<div class="container" style="max-width: 1400px;">
 
     <form action="/search" method="get" class="mb-4">
         <div class="d-flex gap-2">
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
index be3afe4..862e134 100644
--- a/templates/shared/_macros.html
+++ b/templates/shared/_macros.html
@@ -53,13 +53,132 @@ <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
 {% endmacro %}
 
 {% macro delete_confirmation(item_name, item_type, delete_url) %}
-<div class="confirm-delete-box">
-    <h4>Delete {{ item_type }}: {{ item_name }}?</h4>
-    <p>This action cannot be undone.</p>
-    <form method="POST" action="{{ delete_url }}">
-        <a href="javascript:history.back()" class="btn btn-secondary btn-action">Cancel</a>
-        <button type="submit" class="btn btn-danger btn-action">Delete</button>
-    </form>
+<style>
+    .delete-container {
+        min-height: calc(100vh - 300px);
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 2rem 1rem;
+    }
+    .delete-card {
+        background: var(--color-surface-raised);
+        border: 1px solid var(--color-border);
+        border-radius: 12px;
+        padding: 2.5rem;
+        max-width: 550px;
+        width: 100%;
+        box-shadow: 0 4px 20px rgba(106, 47, 48, 0.08);
+    }
+    .delete-icon {
+        width: 64px;
+        height: 64px;
+        margin: 0 auto 1.5rem;
+        background: rgba(229, 192, 123, 0.12);
+        border: 2px solid rgba(229, 192, 123, 0.3);
+        border-radius: 50%;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        color: #c17d11;
+        font-size: 2rem;
+        font-weight: bold;
+    }
+    .delete-title {
+        color: var(--color-text);
+        font-size: 1.5rem;
+        font-weight: 600;
+        text-align: center;
+        margin-bottom: 1rem;
+    }
+    .delete-item-name {
+        background: var(--color-surface-hover);
+        border: 1px solid var(--color-border);
+        border-radius: 8px;
+        padding: 0.75rem 1rem;
+        margin: 1.5rem 0;
+        text-align: center;
+        font-family: var(--font-mono);
+        font-weight: 600;
+        color: var(--color-text);
+        word-break: break-word;
+    }
+    .delete-warning {
+        color: var(--color-text-secondary);
+        font-size: 0.95rem;
+        line-height: 1.5;
+        text-align: center;
+        margin-bottom: 2rem;
+    }
+    .delete-warning strong {
+        color: #c17d11;
+    }
+    .delete-actions {
+        display: flex;
+        gap: 0.75rem;
+        justify-content: center;
+        flex-wrap: wrap;
+    }
+    .btn-delete-cancel {
+        background: var(--color-surface);
+        border: 1px solid var(--color-border);
+        color: var(--color-text);
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        text-decoration: none;
+        display: inline-block;
+    }
+    .btn-delete-cancel:hover {
+        background: var(--color-surface-hover);
+        border-color: var(--color-text-secondary);
+        color: var(--color-text);
+        transform: translateY(-1px);
+        text-decoration: none;
+    }
+    .btn-delete-confirm {
+        background: #d63447;
+        border: 1px solid #d63447;
+        color: white;
+        padding: 0.6rem 1.5rem;
+        border-radius: 8px;
+        font-weight: 500;
+        transition: all 0.2s ease;
+        cursor: pointer;
+    }
+    .btn-delete-confirm:hover {
+        background: #b8293a;
+        border-color: #b8293a;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 12px rgba(214, 52, 71, 0.3);
+    }
+</style>
+<div class="delete-container">
+    <div class="delete-card">
+        <div class="delete-icon">⚠</div>
+        <h1 class="delete-title">Delete {{ item_type }}?</h1>
+
+        <div class="delete-item-name">
+            {{ item_name }}
+        </div>
+
+        <div class="delete-warning">
+            <strong>This action cannot be undone.</strong><br>
+            This will permanently delete this {{ item_type|lower }} and all associated data.
+        </div>
+
+        <form method="POST" action="{{ delete_url }}">
+            <div class="delete-actions">
+                <a href="javascript:history.back()" class="btn-delete-cancel">
+                    Cancel
+                </a>
+                <button type="submit" class="btn-delete-confirm">
+                    Delete {{ item_type }}
+                </button>
+            </div>
+        </form>
+    </div>
 </div>
 {% endmacro %}
 
diff --git a/templates/workflows/catalog.html b/templates/workflows/catalog.html
index 77292c7..dbbf147 100644
--- a/templates/workflows/catalog.html
+++ b/templates/workflows/catalog.html
@@ -11,8 +11,8 @@ <h2>Template Catalog</h2>
         </div>
     </div>
 </div>
-<div class="container" style="max-width: 1100px;">
-    <div class="text-center mb-4">
+<div class="container" style="max-width: 1400px;">
+    <div class="text-left mb-4">
         <button class="filter-btn active" onclick="filterWorkflows('all', this)">All</button>
         <button class="filter-btn" onclick="filterWorkflows('provisioning', this)">Provisioning</button>
         <button class="filter-btn" onclick="filterWorkflows('observability', this)">Observability</button>
diff --git a/templates/workflows/detail.html b/templates/workflows/detail.html
index ba1484b..db1ef38 100644
--- a/templates/workflows/detail.html
+++ b/templates/workflows/detail.html
@@ -1,7 +1,7 @@
 {% extends "shared/_layout.html" %}
 {% block title %}{{ workflow.title }} - JAWA{% endblock %}
 {% block content %}
-<div class="container" style="max-width: 1100px; padding-top: 2rem;">
+<div class="container" style="max-width: 1400px; padding-top: 2rem;">
     <div class="mb-3">
         <a href="/templates" style="color: var(--color-primary); font-size: 0.88rem;">&larr; Back to Catalog</a>
     </div>

From 609f9750f7da4428e67589d4fe175a36765a107c Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Tue, 7 Jul 2026 18:55:25 -0500
Subject: [PATCH 19/84] feat: add smoke-test harness and CI (ruff + pytest)
 (#62)

* feat: add CI pipeline, test fixtures, and smoke tests (#62)

- Add GitHub Actions CI workflow with Python version matrix.
- Define shared pytest fixtures for isolated environments and Jamf API mocks.
- Introduce initial smoke tests for blueprints, webhooks, and login flows.
- Configure ruff and pytest; update dev dependencies.

* chore: specify version for ruff in requirements-dev.txt
---
 .github/workflows/ci.yml   |  32 ++++++
 pytest.ini                 |   2 +
 requirements-dev.txt       |   3 +
 ruff.toml                  |   4 +-
 tests/README.md            |  32 ++++++
 tests/conftest.py          | 222 +++++++++++++++++++++++++++++++++++++
 tests/test_login.py        |  28 +++++
 tests/test_receiver.py     | 182 ++++++++++++++++++++++++++++++
 tests/test_smoke_routes.py | 103 +++++++++++++++++
 9 files changed, 607 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 pytest.ini
 create mode 100644 requirements-dev.txt
 create mode 100644 tests/README.md
 create mode 100644 tests/conftest.py
 create mode 100644 tests/test_login.py
 create mode 100644 tests/test_receiver.py
 create mode 100644 tests/test_smoke_routes.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..59f447a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Oldest supported and current — catches syntax drift both ways.
+        python-version: ["3.9", "3.14"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -r requirements-dev.txt
+
+      - name: Lint (ruff)
+        run: ruff check .
+
+      - name: Test (pytest)
+        run: python -m pytest -v
diff --git a/pytest.ini b/pytest.ini
new file mode 100644
index 0000000..5ee6477
--- /dev/null
+++ b/pytest.ini
@@ -0,0 +1,2 @@
+[pytest]
+testpaths = tests
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 0000000..95db73a
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,3 @@
+-r requirements.txt
+pytest~=8.0
+ruff~=0.15.0
diff --git a/ruff.toml b/ruff.toml
index c557e66..ba6e0a7 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -1,4 +1,6 @@
 line-length = 79
 
+exclude = ["data/workflows/scripts"]
+
 [format]
-quote-style = "double"
\ No newline at end of file
+quote-style = "double"
diff --git a/tests/README.md b/tests/README.md
new file mode 100644
index 0000000..da19f88
--- /dev/null
+++ b/tests/README.md
@@ -0,0 +1,32 @@
+# JAWA Test Suite
+
+Smoke tests for the JAWA web console and webhook receiver. The suite
+needs **no Jamf Pro server, no network access, and no root** — Jamf
+API calls are faked at the `requests` layer, script execution is
+stubbed at `subprocess.Popen`, and all data files are redirected into
+a per-test temp directory (test runs leave no artifacts in the repo).
+
+## Running
+
+```bash
+python3 -m venv .venv
+.venv/bin/pip install -r requirements-dev.txt
+.venv/bin/python -m pytest
+```
+
+## Layout
+
+- `conftest.py` — fixtures: temp data layout (`jawa_env`), faked
+  Jamf Pro (`fake_jamf`), and an authenticated console session
+  (`logged_in_client`).
+- `test_smoke_routes.py` — every blueprint surface renders without
+  a 500; legacy redirects; anonymous access is rejected.
+- `test_receiver.py` — `/hooks/<name>` auth validation and script
+  execution pipeline.
+- `test_login.py` — console login/logout against the faked Jamf.
+
+## xfail markers
+
+Tests marked `xfail(strict=True)` document known bugs (referenced by
+issue ID). When the bug is fixed, the test will XPASS and fail the
+run — remove the marker as part of the fix.
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..09abcba
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,222 @@
+"""Shared fixtures for the JAWA smoke-test harness.
+
+JAWA resolves every data path as a module-level absolute constant
+derived from the repo location, so these fixtures redirect each
+module's constants into a per-test temp directory. Jamf Pro HTTP
+calls are faked at the ``requests`` layer. No Jamf server, network
+access, or root privileges are required to run the suite.
+"""
+
+import json
+import logging
+import os
+import shutil
+import sys
+
+import pytest
+import requests
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if REPO_ROOT not in sys.path:
+    sys.path.insert(0, REPO_ROOT)
+
+# Importing bin.logger attaches a rotating file handler pointing at
+# the repo's data/jawa.log. Swap it for a NullHandler so test runs
+# leave no log artifacts in the working tree.
+_LOG_PATH = os.path.join(REPO_ROOT, "data", "jawa.log")
+_log_preexisting = os.path.exists(_LOG_PATH)
+
+from bin import logger  # noqa: E402,F401
+
+_root_logger = logging.getLogger("jawa")
+for _handler in list(_root_logger.handlers):
+    _handler.close()
+    _root_logger.removeHandler(_handler)
+_root_logger.addHandler(logging.NullHandler())
+
+if not _log_preexisting and os.path.exists(_LOG_PATH):
+    os.remove(_LOG_PATH)
+
+import app as jawa_app  # noqa: E402
+from bin import data_store  # noqa: E402
+from views import (  # noqa: E402
+    credential_view,
+    home_view,
+    log_view,
+    resource_view,
+    search_view,
+    template_view,
+)
+from webhook import jawa_receiver  # noqa: E402
+
+# The module-level Flask app is a singleton; register blueprints once.
+jawa_app.register_blueprints()
+
+JAMF_URL = "https://jamf.example.test"
+TOKEN_EXPIRES = "2099-01-01T00:00:00.000+0000"
+
+
+class FakeJamfResponse:
+    """Minimal stand-in for requests.Response."""
+
+    def __init__(self, payload=None, status_code=200):
+        self._payload = payload if payload is not None else {}
+        self.status_code = status_code
+
+    def json(self):
+        return self._payload
+
+    def raise_for_status(self):
+        if self.status_code >= 400:
+            raise requests.exceptions.HTTPError(
+                f"{self.status_code} Fake Jamf error"
+            )
+
+
+def _fake_jamf_post(url, **kwargs):
+    if url.endswith("/api/v1/auth/token"):
+        return FakeJamfResponse(
+            {"token": "test-token", "expires": TOKEN_EXPIRES}
+        )
+    if url.endswith("/api/v1/auth/invalidate-token"):
+        return FakeJamfResponse({}, status_code=204)
+    return FakeJamfResponse({})
+
+
+def _fake_jamf_get(url, **kwargs):
+    return FakeJamfResponse({})
+
+
+@pytest.fixture()
+def fake_jamf(monkeypatch):
+    """Fake every outbound HTTP verb JAWA uses against Jamf Pro."""
+    monkeypatch.setattr(requests, "post", _fake_jamf_post)
+    monkeypatch.setattr(requests, "get", _fake_jamf_get)
+    monkeypatch.setattr(
+        requests, "put", lambda *a, **k: FakeJamfResponse({})
+    )
+    monkeypatch.setattr(
+        requests, "delete", lambda *a, **k: FakeJamfResponse({})
+    )
+
+
+class JawaEnv:
+    """Handles to the per-test temp data layout."""
+
+    def __init__(self, root):
+        self.root = root
+        self.data_dir = root / "data"
+        self.scripts_dir = root / "scripts"
+        self.files_dir = root / "resources" / "files"
+        self.webhooks_file = self.data_dir / "webhooks.json"
+        self.cron_file = self.data_dir / "cron.json"
+        self.server_file = self.data_dir / "server.json"
+        self.credentials_file = self.data_dir / "credentials.json"
+        self.log_file = self.data_dir / "jawa.log"
+
+    def add_webhook(self, entry):
+        data = json.loads(self.webhooks_file.read_text())
+        data.append(entry)
+        self.webhooks_file.write_text(json.dumps(data))
+
+
+@pytest.fixture()
+def jawa_env(tmp_path, monkeypatch):
+    """Point every module-level path constant at a temp directory."""
+    env = JawaEnv(tmp_path)
+    env.data_dir.mkdir()
+    env.scripts_dir.mkdir()
+    env.files_dir.mkdir(parents=True)
+
+    env.webhooks_file.write_text("[]")
+    env.cron_file.write_text("[]")
+    env.credentials_file.write_text("[]")
+    env.server_file.write_text(
+        json.dumps(
+            {
+                "jawa_address": "https://jawa.example.test",
+                "jps_url": JAMF_URL,
+                "alternate_jps": "",
+            }
+        )
+    )
+    env.log_file.touch()
+    shutil.copy(
+        os.path.join(REPO_ROOT, "data", "time.json"),
+        env.data_dir / "time.json",
+    )
+
+    webhooks = str(env.webhooks_file)
+    cron = str(env.cron_file)
+    server = str(env.server_file)
+    creds = str(env.credentials_file)
+    scripts = str(env.scripts_dir)
+    log_file = str(env.log_file)
+
+    monkeypatch.setattr(data_store, "WEBHOOKS_FILE", webhooks)
+    monkeypatch.setattr(data_store, "CRON_FILE", cron)
+    monkeypatch.setattr(data_store, "SERVER_FILE", server)
+    monkeypatch.setattr(
+        data_store, "TIME_FILE", str(env.data_dir / "time.json")
+    )
+    monkeypatch.setattr(data_store, "SCRIPTS_DIR", scripts)
+
+    monkeypatch.setattr(home_view, "log_file", log_file)
+    monkeypatch.setattr(home_view, "server_file", server)
+    monkeypatch.setattr(home_view, "webhooks_file", webhooks)
+    monkeypatch.setattr(home_view, "cron_file", cron)
+    monkeypatch.setattr(
+        home_view, "resources_dir", str(env.root / "resources")
+    )
+    monkeypatch.setattr(home_view, "files_dir", str(env.files_dir))
+
+    monkeypatch.setattr(log_view, "log_file", log_file)
+    monkeypatch.setattr(log_view, "server_json_file", server)
+
+    monkeypatch.setattr(credential_view, "CREDENTIALS_FILE", creds)
+
+    monkeypatch.setattr(resource_view, "log_file", log_file)
+    monkeypatch.setattr(resource_view, "server_file", server)
+    monkeypatch.setattr(
+        resource_view, "resources_dir", str(env.root / "resources")
+    )
+    monkeypatch.setattr(resource_view, "files_dir", str(env.files_dir))
+
+    monkeypatch.setattr(search_view, "WEBHOOKS_FILE", webhooks)
+    monkeypatch.setattr(search_view, "CRON_FILE", cron)
+
+    monkeypatch.setattr(template_view, "SCRIPTS_DIR", scripts)
+    monkeypatch.setattr(template_view, "WEBHOOKS_FILE", webhooks)
+    monkeypatch.setattr(template_view, "CREDENTIALS_FILE", creds)
+
+    monkeypatch.setattr(jawa_receiver, "server_json_file", server)
+    monkeypatch.setattr(jawa_receiver, "jp_webhooks_file", webhooks)
+    monkeypatch.setattr(jawa_receiver, "scripts_dir", scripts)
+
+    # app.py keeps its own globals, set via environment_setup().
+    jawa_app.environment_setup(str(env.root))
+
+    jawa_app.app.config.update(TESTING=True)
+    jawa_app.app.secret_key = "jawa-test-secret"
+    return env
+
+
+@pytest.fixture()
+def client(jawa_env):
+    return jawa_app.app.test_client()
+
+
+@pytest.fixture()
+def logged_in_client(client, fake_jamf):
+    """A test client holding an authenticated console session."""
+    resp = client.post(
+        "/login",
+        data={
+            "url": JAMF_URL,
+            "username": "pytest-admin",
+            "password": "hunter2",
+        },
+    )
+    assert resp.status_code == 302, "login should redirect on success"
+    assert "/dashboard" in resp.headers["Location"]
+    return client
diff --git a/tests/test_login.py b/tests/test_login.py
new file mode 100644
index 0000000..78a179f
--- /dev/null
+++ b/tests/test_login.py
@@ -0,0 +1,28 @@
+"""Console login flow against a fully faked Jamf Pro."""
+
+
+def test_successful_login_reaches_dashboard(logged_in_client):
+    resp = logged_in_client.get("/dashboard")
+    assert resp.status_code == 200
+    assert b"dashboard" in resp.data.lower()
+
+
+def test_blank_password_is_rejected(client, fake_jamf):
+    resp = client.post(
+        "/login",
+        data={"url": "https://jamf.example.test", "username": "u",
+              "password": ""},
+    )
+    assert resp.status_code == 302
+    assert "/logout" in resp.headers["Location"]
+
+
+def test_logout_clears_session(logged_in_client):
+    logged_in_client.get("/logout")
+    resp = logged_in_client.get("/dashboard")
+    assert resp.status_code == 302
+
+
+def test_anonymous_home_renders(client):
+    resp = client.get("/")
+    assert resp.status_code == 200
diff --git a/tests/test_receiver.py b/tests/test_receiver.py
new file mode 100644
index 0000000..f721166
--- /dev/null
+++ b/tests/test_receiver.py
@@ -0,0 +1,182 @@
+"""Inbound webhook receiver: auth validation and script execution.
+
+Script execution is stubbed at subprocess.Popen, so these tests
+verify the full request -> validate -> execute pipeline without
+running real scripts.
+"""
+
+import base64
+import io
+import json
+import subprocess
+
+import pytest
+
+
+class RecordingPopen:
+    """Stands in for subprocess.Popen and records invocations."""
+
+    calls = []
+
+    def __init__(self, args, stdout=None, stderr=None):
+        RecordingPopen.calls.append(args)
+        self.stdout = io.BytesIO(b"script ran\n")
+
+    def wait(self):
+        return 0
+
+
+@pytest.fixture()
+def fake_popen(monkeypatch):
+    RecordingPopen.calls = []
+    monkeypatch.setattr(subprocess, "Popen", RecordingPopen)
+    return RecordingPopen
+
+
+def _basic_auth(user, password):
+    token = base64.b64encode(f"{user}:{password}".encode()).decode()
+    return {"Authorization": f"Basic {token}"}
+
+
+def _make_webhook(jawa_env, **overrides):
+    entry = {
+        "name": "testhook",
+        "tag": "custom",
+        "script": str(jawa_env.scripts_dir / "hook_script.sh"),
+        "webhook_username": "hookuser",
+        "webhook_password": "hookpass",
+        "api_key": "null",
+        "output": False,
+        "description": "harness webhook",
+    }
+    entry.update(overrides)
+    jawa_env.add_webhook(entry)
+    return entry
+
+
+PAYLOAD = {"webhook": {"webhookEvent": "ComputerCheckIn"}}
+
+
+def test_valid_auth_runs_script(client, jawa_env, fake_popen):
+    entry = _make_webhook(jawa_env)
+    resp = client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers=_basic_auth("hookuser", "hookpass"),
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["result"] == "valid webhook received"
+    assert len(fake_popen.calls) == 1
+    argv = fake_popen.calls[0]
+    assert argv[0] == entry["script"]
+    # The whole payload is passed as a single JSON argument.
+    assert json.loads(argv[1]) == PAYLOAD
+
+
+def test_wrong_password_is_rejected(client, jawa_env, fake_popen):
+    _make_webhook(jawa_env)
+    resp = client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers=_basic_auth("hookuser", "wrong"),
+    )
+    assert resp.status_code == 401
+    assert fake_popen.calls == []
+
+
+def test_unknown_webhook_is_rejected(client, jawa_env, fake_popen):
+    resp = client.post(
+        "/hooks/ghosthook",
+        json=PAYLOAD,
+        headers=_basic_auth("any", "any"),
+    )
+    assert resp.status_code == 401
+    assert fake_popen.calls == []
+
+
+def test_api_key_auth_runs_script(client, jawa_env, fake_popen):
+    _make_webhook(
+        jawa_env,
+        webhook_username="null",
+        webhook_password="null",
+        api_key="sekrit",
+    )
+    resp = client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers={"x-api-key": "sekrit"},
+    )
+    assert resp.status_code == 200
+    assert len(fake_popen.calls) == 1
+
+
+def test_noauth_webhook_accepts_anonymous_post(
+    client, jawa_env, fake_popen
+):
+    # Documented posture (ASSESSMENT.md): a webhook stored with the
+    # "null" sentinels is open to anyone who knows its name. If this
+    # test starts failing, the auth model changed on purpose --
+    # update the assessment.
+    _make_webhook(
+        jawa_env,
+        webhook_username="null",
+        webhook_password="null",
+        api_key="null",
+    )
+    resp = client.post("/hooks/testhook", json=PAYLOAD)
+    assert resp.status_code == 200
+    assert len(fake_popen.calls) == 1
+
+
+def test_custom_output_returns_script_result(
+    client, jawa_env, fake_popen
+):
+    _make_webhook(jawa_env, output=True)
+    resp = client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers=_basic_auth("hookuser", "hookpass"),
+    )
+    assert resp.status_code == 202
+    assert "script ran" in resp.get_json()["result"]
+
+
+def test_okta_verification_challenge_is_echoed(client, jawa_env):
+    resp = client.post(
+        "/hooks/anyhook",
+        headers={"x-okta-verification-challenge": "abc123"},
+    )
+    assert resp.status_code == 200
+    assert resp.get_json() == {"verification": "abc123"}
+
+
+def test_null_json_body_is_a_teapot(client, jawa_env, fake_popen):
+    resp = client.post(
+        "/hooks/testhook",
+        data="null",
+        content_type="application/json",
+    )
+    assert resp.status_code == 418
+    assert fake_popen.calls == []
+
+
+@pytest.mark.xfail(
+    reason="J4/B2: form-payload fallback is unguarded; a bodyless "
+    "POST raises instead of returning 4xx",
+    strict=True,
+)
+def test_bodyless_post_returns_4xx(client, jawa_env, fake_popen):
+    resp = client.post("/hooks/testhook")
+    assert 400 <= resp.status_code < 500
+    assert fake_popen.calls == []
+
+
+@pytest.mark.xfail(
+    reason="J4/B2: method check happens after body parsing, so a "
+    "bare GET crashes in the form fallback instead of 405ing",
+    strict=True,
+)
+def test_get_method_returns_405(client, jawa_env, fake_popen):
+    resp = client.get("/hooks/testhook")
+    assert resp.status_code == 405
+    assert fake_popen.calls == []
diff --git a/tests/test_smoke_routes.py b/tests/test_smoke_routes.py
new file mode 100644
index 0000000..9efd2ce
--- /dev/null
+++ b/tests/test_smoke_routes.py
@@ -0,0 +1,103 @@
+"""Route sweep: every blueprint surface renders without a 500.
+
+With TESTING enabled, unhandled exceptions propagate into the test
+instead of rendering a 500 page, so a crashing route fails loudly
+with its real traceback.
+"""
+
+import pytest
+
+# (path, ) GET routes reachable with an authenticated session.
+# /log/yield is deliberately absent: it is an infinite tail -f
+# stream and would hang the test client.
+AUTHED_ROUTES = [
+    "/",
+    "/home.html",
+    "/login",
+    "/dashboard",
+    "/setup",
+    "/cleanup",
+    "/success",
+    "/error",
+    "/automations",
+    "/automations/jamfpro",
+    "/automations/okta",
+    "/automations/custom",
+    "/automations/cron",
+    "/automations/jamfpro/new",
+    "/automations/okta/new",
+    "/automations/custom/new",
+    "/automations/cron/new",
+    "/templates",
+    "/templates/device-naming",
+    "/templates/device-naming/script",
+    "/templates/import",
+    "/setup/credentials",
+    "/resources/files",
+    "/branding",
+    "/python",
+    "/bash",
+    "/search?q=test",
+    "/api/search?q=test",
+    "/log/home.html",
+    "/log/view",
+    "/log/download",
+]
+
+# Legacy URLs that must permanently redirect to /automations/*.
+LEGACY_REDIRECTS = [
+    ("/webhooks", "/automations"),
+    ("/webhooks/jamf", "/automations/jamfpro"),
+    ("/webhooks/okta", "/automations/okta"),
+    ("/webhooks/custom", "/automations/custom"),
+    ("/cron", "/automations/cron"),
+]
+
+# Routes that must not expose content to an anonymous client.
+PROTECTED_ROUTES = [
+    "/dashboard",
+    "/setup",
+    "/cleanup",
+    "/automations",
+    "/automations/jamfpro",
+    "/templates",
+    "/setup/credentials",
+    "/resources/files",
+    "/branding",
+    "/log/home.html",
+]
+
+
+@pytest.mark.parametrize("path", AUTHED_ROUTES)
+def test_authed_route_does_not_error(logged_in_client, path):
+    resp = logged_in_client.get(path)
+    assert resp.status_code < 500
+
+
+@pytest.mark.parametrize("path,target", LEGACY_REDIRECTS)
+def test_legacy_route_redirects(logged_in_client, path, target):
+    resp = logged_in_client.get(path)
+    assert resp.status_code == 301
+    assert target in resp.headers["Location"]
+
+
+@pytest.mark.parametrize("path", PROTECTED_ROUTES)
+def test_protected_route_rejects_anonymous(client, path):
+    resp = client.get(path)
+    # Anonymous access must bounce to login/logout, never render.
+    assert resp.status_code in (301, 302)
+
+
+def test_unknown_automation_type_is_handled(logged_in_client):
+    # abort(404) is intercepted by the custom 404 handler, which
+    # sends signed-in users back to the dashboard.
+    resp = logged_in_client.get("/automations/nosuchtype")
+    assert resp.status_code in (301, 302)
+    assert "/dashboard" in resp.headers["Location"]
+
+
+def test_unknown_page_is_handled(logged_in_client):
+    # Custom 404 handler redirects signed-in users to the dashboard.
+    resp = logged_in_client.get("/definitely/not/a/page")
+    assert resp.status_code in (301, 302)
+    assert "/dashboard" in resp.headers["Location"]

From 81a54933228b333348c440dc546c892e2c6ef1b7 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:35:16 -0500
Subject: [PATCH 20/84] fix: template webhooks fire (B1) + reject path
 traversal in import (B7) (#63)

* fix: receiver tolerates missing webhook auth keys (B1)

* fix: route template webhooks through data_store with canonical auth shape (B1)

* fix: reject path-traversal script filenames in template import (B7)

* test: fix mis-targeted traversal assertion in template import test (B7)

* fix: store absolute script paths for template webhooks so they execute (B1)
---
 tests/test_receiver.py   |  18 +++++++
 tests/test_templates.py  | 107 +++++++++++++++++++++++++++++++++++++++
 views/template_view.py   |  65 ++++++++++++------------
 webhook/jawa_receiver.py |   9 +++-
 4 files changed, 163 insertions(+), 36 deletions(-)
 create mode 100644 tests/test_templates.py

diff --git a/tests/test_receiver.py b/tests/test_receiver.py
index f721166..674b32b 100644
--- a/tests/test_receiver.py
+++ b/tests/test_receiver.py
@@ -150,6 +150,24 @@ def test_okta_verification_challenge_is_echoed(client, jawa_env):
     assert resp.get_json() == {"verification": "abc123"}
 
 
+def test_legacy_entry_missing_auth_keys_self_heals(
+    client, jawa_env, fake_popen
+):
+    # A pre-fix template webhook: no auth keys at all. The tolerant
+    # receiver must treat missing keys as "null" (open) and fire,
+    # rather than returning a permanent 401 (bug B1).
+    _make_webhook(jawa_env)
+    # Strip the auth keys to simulate a legacy template entry.
+    data = json.loads(jawa_env.webhooks_file.read_text())
+    for key in ("webhook_username", "webhook_password", "api_key"):
+        data[0].pop(key, None)
+    jawa_env.webhooks_file.write_text(json.dumps(data))
+
+    resp = client.post("/hooks/testhook", json=PAYLOAD)
+    assert resp.status_code == 200
+    assert len(fake_popen.calls) == 1
+
+
 def test_null_json_body_is_a_teapot(client, jawa_env, fake_popen):
     resp = client.post(
         "/hooks/testhook",
diff --git a/tests/test_templates.py b/tests/test_templates.py
new file mode 100644
index 0000000..6ac4173
--- /dev/null
+++ b/tests/test_templates.py
@@ -0,0 +1,107 @@
+"""Template enable/import → the resulting webhook actually fires (B1)."""
+
+import io
+import json
+import os
+import subprocess
+
+import pytest
+
+from bin import data_store
+
+
+class RecordingPopen:
+    calls = []
+
+    def __init__(self, args, stdout=None, stderr=None):
+        RecordingPopen.calls.append(args)
+        self.stdout = io.BytesIO(b"ok\n")
+
+    def wait(self):
+        return 0
+
+
+@pytest.fixture()
+def fake_popen(monkeypatch):
+    RecordingPopen.calls = []
+    monkeypatch.setattr(subprocess, "Popen", RecordingPopen)
+    return RecordingPopen
+
+
+def test_enabled_template_writes_canonical_auth_shape(
+    logged_in_client, jawa_env
+):
+    resp = logged_in_client.post(
+        "/templates/device-naming/enable",
+        data={"webhook_name": "dn-hook"},
+    )
+    assert resp.status_code in (200, 302)
+    entry = data_store.get_webhook_by_name("dn-hook")
+    assert entry is not None
+    # Canonical shape: all three auth keys present, defaulting to "null".
+    assert entry["webhook_username"] == "null"
+    assert entry["webhook_password"] == "null"
+    assert entry["api_key"] == "null"
+
+
+def test_enabled_template_webhook_fires(
+    logged_in_client, jawa_env, fake_popen
+):
+    logged_in_client.post(
+        "/templates/device-naming/enable",
+        data={"webhook_name": "dn-hook"},
+    )
+    resp = logged_in_client.post(
+        "/hooks/dn-hook",
+        json={"webhook": {"webhookEvent": "ComputerCheckIn"}},
+    )
+    assert resp.status_code == 200
+    assert len(fake_popen.calls) == 1
+    # The receiver runs the script via a direct Popen with no directory
+    # prefix, so the stored "script" must be an absolute path that exists
+    # on disk -- otherwise the script silently never runs (bug B1).
+    argv = fake_popen.calls[0]
+    assert os.path.isabs(argv[0])
+    assert os.path.exists(argv[0])
+
+
+def _traversal_package():
+    return {
+        "name": "evil",
+        "trigger": {"event": "ComputerCheckIn"},
+        "script": {"filename": "../../evil.sh", "content": "#!/bin/sh\n"},
+    }
+
+
+def test_import_rejects_traversal_filename(logged_in_client, jawa_env):
+    import io as _io
+
+    payload = json.dumps(_traversal_package()).encode()
+    resp = logged_in_client.post(
+        "/templates/import",
+        data={"package": (_io.BytesIO(payload), "evil.jawa.json")},
+        content_type="multipart/form-data",
+    )
+    # Rejected via the existing error redirect; nothing written outside
+    # SCRIPTS_DIR, and no webhook registered.
+    assert resp.status_code in (302, 400)
+    assert data_store.get_webhook_by_name("evil") is None
+    import os
+
+    scripts_dir = str(jawa_env.scripts_dir)
+    traversal_target = os.path.normpath(
+        os.path.join(scripts_dir, "..", "..", "evil.sh")
+    )
+    assert not os.path.exists(traversal_target)
+    assert not os.path.exists(os.path.join(scripts_dir, "evil.sh"))
+
+
+def test_template_view_has_no_direct_webhook_io():
+    import inspect
+    from views import template_view
+
+    src = inspect.getsource(template_view)
+    assert "_register_webhook" not in src
+    assert "_load_webhooks" not in src
+    # No direct open() of the webhooks file remains.
+    assert "open(WEBHOOKS_FILE" not in src
diff --git a/views/template_view.py b/views/template_view.py
index 2539af8..199f516 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -41,8 +41,9 @@
     url_for,
 )
 from markupsafe import escape
+from werkzeug.utils import secure_filename
 
-from bin import logger
+from bin import data_store, logger
 from bin.view_modifiers import response
 
 blueprint = Blueprint(
@@ -102,49 +103,33 @@ def _load_credentials() -> List[Dict[str, Any]]:
 def _install_package(package: dict) -> None:
     """Install a .jawa.json workflow package into JAWA."""
     script = package["script"]
-    script_path = os.path.join(SCRIPTS_DIR, script["filename"])
+    safe_filename = secure_filename(script["filename"])
+    script_path = os.path.join(SCRIPTS_DIR, safe_filename)
     with open(script_path, "w", encoding="utf-8") as f:
         f.write(script["content"])
     os.chmod(script_path, 0o755)
 
-    _register_webhook(
+    data_store.add_webhook(
         {
             "name": package["name"],
+            "tag": "custom",
+            "url": session.get("url", ""),
             "event": package["trigger"]["event"],
-            "script": script["filename"],
+            "script": script_path,
+            "description": package.get("description", ""),
             "enabled": True,
+            "webhook_username": "null",
+            "webhook_password": "null",
+            "api_key": "null",
         }
     )
 
     logthis.info(
         f"Installed workflow package: {package['name']} "
-        f"(script: {script['filename']})"
+        f"(script: {safe_filename})"
     )
 
 
-def _load_webhooks() -> list:
-    """Load the current webhooks list from disk."""
-    if not os.path.isfile(WEBHOOKS_FILE):
-        return []
-    try:
-        with open(WEBHOOKS_FILE, "r", encoding="utf-8") as f:
-            return json.load(f)
-    except (json.JSONDecodeError, IOError):
-        return []
-
-
-def _register_webhook(entry: dict) -> None:
-    """Append a webhook entry and save to disk."""
-    webhooks = _load_webhooks()
-    webhooks.append(entry)
-    try:
-        with open(WEBHOOKS_FILE, "w", encoding="utf-8") as f:
-            json.dump(webhooks, f, indent=2)
-    except (IOError, OSError) as err:
-        logthis.error(f"Failed to save webhook to {WEBHOOKS_FILE}: {err}")
-        raise
-
-
 def _apply_credentials(
     script_content: str,
     workflow: dict,
@@ -183,7 +168,7 @@ def _apply_form_params(script_content: str, workflow: dict) -> str:
 
 
 def _write_script(name: str, content: str) -> str:
-    """Write script content to a unique file and return the filename."""
+    """Write script content to a unique file and return the absolute path."""
     safe_name = name.replace(" ", "_").replace("/", "_").lower()
     dest_filename = f"{safe_name}.py"
     dest_path = os.path.join(SCRIPTS_DIR, dest_filename)
@@ -197,7 +182,7 @@ def _write_script(name: str, content: str) -> str:
     with open(dest_path, "w", encoding="utf-8") as f:
         f.write(content)
     os.chmod(dest_path, 0o755)
-    return dest_filename
+    return dest_path
 
 
 def _validate_package(package: dict) -> Union[str, None]:
@@ -215,6 +200,14 @@ def _validate_package(package: dict) -> Union[str, None]:
     if "event" not in package["trigger"]:
         return "Trigger must have an event field."
 
+    filename = package["script"]["filename"]
+    safe = secure_filename(filename)
+    if not safe or safe != filename:
+        # secure_filename strips path separators / traversal; if the
+        # result is empty or differs, the package tried to write
+        # outside SCRIPTS_DIR (bug B7). Reject loudly, write nothing.
+        return f"Unsafe script filename: {filename}"
+
     return None
 
 
@@ -379,23 +372,27 @@ def enable_template(slug: str) -> Union[Response, str]:
         credentials,
     )
     script_content = _apply_form_params(script_content, workflow)
-    dest_filename = _write_script(webhook_name, script_content)
+    dest_path = _write_script(webhook_name, script_content)
 
-    _register_webhook(
+    data_store.add_webhook(
         {
             "name": webhook_name,
             "tag": "custom",
             "url": session.get("url", ""),
             "event": workflow.get("trigger_event", ""),
-            "script": dest_filename,
+            "script": dest_path,
             "description": workflow.get("description", ""),
             "enabled": True,
+            "webhook_username": "null",
+            "webhook_password": "null",
+            "api_key": "null",
         }
     )
 
     logthis.info(
         f"[{session.get('url')}] {session.get('username')} "
-        f"enabled template: {webhook_name} (script: {dest_filename})"
+        f"enabled template: {webhook_name} "
+        f"(script: {os.path.basename(dest_path)})"
     )
 
     return redirect(
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 275643f..8c3f4c1 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -69,8 +69,13 @@ def validate_webhook(
         if each_webhook["name"] == webhook_name:
             truth_test = True
             if (
-                each_webhook.get("webhook_username") != webhook_user
-                or each_webhook.get("webhook_password") != webhook_pass
+                # Missing auth keys default to the "null" no-auth
+                # sentinel so a legacy/hand-edited entry degrades to
+                # the documented open-webhook behavior, never a silent
+                # 401. Canonical shape is written by data_store; see
+                # template_view + custom_handler.
+                each_webhook.get("webhook_username", "null") != webhook_user
+                or each_webhook.get("webhook_password", "null") != webhook_pass
                 or each_webhook.get("api_key", "null") != webhook_apikey
             ):
                 truth_test = False

From 81839d1a9065a0d87caf746f38bab3db8475ea02 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:43:29 -0500
Subject: [PATCH 21/84] feat: real, admin-configurable session timeout + cookie
 hardening (B4) (#64)

* feat: add session-timeout ladder and fail-safe resolver (J6)

* fix: enforce session lifetime and harden session cookies (B4)

* feat: persist admin-configured session timeout at /setup (J6)

* feat: add session-timeout dropdown with extended-tier warnings to setup (J6)

* feat: drive session-timeout warning modal from configured value (J6)

The client-side timeout warning modal now counts down against the
effective server-resolved timeout instead of a hardcoded 15 minutes,
so it never advertises a window longer than the server enforces.

inject_common_vars now exposes session_timeout_seconds (deferred import
of _resolve_session_timeout to avoid a circular import), and the modal
JS reads it with a default(900) guard. Also wires the /setup timeout
help note to its select via aria-describedby.

* fix: get_server_config returns {} for non-dict server.json (J6 hardening)
---
 app.py                        |  41 ++++++++++-
 bin/context_processors.py     |   5 ++
 bin/data_store.py             |   3 +-
 templates/setup/setup.html    |  16 +++++
 templates/shared/_layout.html |   2 +-
 tests/test_session.py         | 128 ++++++++++++++++++++++++++++++++++
 views/home_view.py            |   1 +
 7 files changed, 192 insertions(+), 4 deletions(-)
 create mode 100644 tests/test_session.py

diff --git a/app.py b/app.py
index 88b528c..2dae99a 100644
--- a/app.py
+++ b/app.py
@@ -54,13 +54,37 @@
 logthis = logger.setup_child_logger("jawa", "app")
 error_message = ""
 
+SESSION_TIMEOUT_CHOICES = (15, 60, 240, 480)
+DEFAULT_SESSION_TIMEOUT = 15
+
+
+def _resolve_session_timeout(config: dict) -> int:
+    """Resolve the configured session timeout (minutes) against the
+    allowed ladder. Any missing / malformed / off-ladder value fails
+    safe to the 15-minute default (never longer)."""
+    value = config.get("session_timeout_minutes")
+    if type(value) is int and value in SESSION_TIMEOUT_CHOICES:
+        return value
+    return DEFAULT_SESSION_TIMEOUT
+
 # Initiate Flask
 app = Flask(__name__)
+app.config.update(
+    SESSION_COOKIE_SECURE=True,
+    SESSION_COOKIE_HTTPONLY=True,
+    SESSION_COOKIE_SAMESITE="Lax",
+)
 
 
-# Session heartbeat
+# Session heartbeat: slide the window and apply the admin-configured
+# timeout (fail-safe to 15 min) on every request, so a /setup change
+# takes effect immediately with no restart.
 @app.before_request
-def func() -> None:
+def _session_heartbeat() -> None:
+    from bin import data_store
+
+    minutes = _resolve_session_timeout(data_store.get_server_config())
+    app.permanent_session_lifetime = timedelta(minutes=minutes)
     session.modified = True
 
 
@@ -252,6 +276,15 @@ def setup() -> Union[Response, str]:
         jps_url = request.form.get("jss-lock")
         jps2_check = request.form.get("alternate-jamf")
         jps_url2 = request.form.get("alternate")
+        timeout_raw = request.form.get("session_timeout_minutes", "")
+        try:
+            timeout_val = int(timeout_raw)
+        except (TypeError, ValueError):
+            timeout_val = DEFAULT_SESSION_TIMEOUT
+        # Clamp to the allowed ladder; never store an off-ladder value.
+        session_timeout = _resolve_session_timeout(
+            {"session_timeout_minutes": timeout_val}
+        )
         logthis.info(
             f"{session.get('username')} made JAWA Setup Changes\n"
             f"JAWA URL: {server_url}\n"
@@ -270,6 +303,7 @@ def setup() -> Union[Response, str]:
                     "jawa_address": server_url,
                     "jps_url": jps_url,
                     "alternate_jps": jps_url2,
+                    "session_timeout_minutes": session_timeout,
                 }
                 json.dump(server_json, outfile)
         elif os.path.isfile(server_json_file):
@@ -278,6 +312,7 @@ def setup() -> Union[Response, str]:
                     "jawa_address": server_url,
                     "jps_url": jps_url,
                     "alternate_jps": jps_url2,
+                    "session_timeout_minutes": session_timeout,
                 }
                 json.dump(server_json, outfile)
             with open(server_json_file, "r") as fin:
@@ -306,6 +341,7 @@ def setup() -> Union[Response, str]:
                 json.dump(server_json, outfile)
         with open(server_json_file, "r") as fin:
             server_json = json.load(fin)
+        session_timeout = _resolve_session_timeout(server_json)
         jps_url2 = server_json.get("alternate_jps")
         if jps_url2 == str(escape(session["url"])):
             primary_jps = server_json["jps_url"]
@@ -318,6 +354,7 @@ def setup() -> Union[Response, str]:
             jps_url=primary_jps,
             jps_url2=jps_url2,
             jawa_url=jawa_url,
+            session_timeout=session_timeout,
             username=session.get("username"),
         )
 
diff --git a/bin/context_processors.py b/bin/context_processors.py
index 290ace8..04b9b99 100644
--- a/bin/context_processors.py
+++ b/bin/context_processors.py
@@ -55,7 +55,12 @@ def _add_static_hash(endpoint: str, values: dict) -> None:
 
 def inject_common_vars() -> dict:
     """Auto-inject session variables into all templates."""
+    from app import _resolve_session_timeout
+    from bin import data_store
+
+    minutes = _resolve_session_timeout(data_store.get_server_config())
     return {
         "username": session.get("username"),
         "session_url": session.get("url"),
+        "session_timeout_seconds": minutes * 60,
     }
diff --git a/bin/data_store.py b/bin/data_store.py
index ac3db43..fb77f9d 100644
--- a/bin/data_store.py
+++ b/bin/data_store.py
@@ -171,9 +171,10 @@ def get_server_config() -> Dict:
         return {}
     with open(SERVER_FILE, "r") as f:
         try:
-            return json.load(f)
+            data = json.load(f)
         except json.JSONDecodeError:
             return {}
+    return data if isinstance(data, dict) else {}
 
 
 def get_jawa_address() -> Optional[str]:
diff --git a/templates/setup/setup.html b/templates/setup/setup.html
index a412ca8..0b1a1b2 100644
--- a/templates/setup/setup.html
+++ b/templates/setup/setup.html
@@ -75,6 +75,22 @@ <h2>Server Setup</h2>
                            title="Use https://"
                            value="{{ jps_url2 if jps_url2 }}">
 
+                    <div class="mb-3 text-start">
+                        <label for="session-timeout" class="form-label">Session timeout</label>
+                        <select id="session-timeout" name="session_timeout_minutes" class="form-select" aria-describedby="session-timeout-help">
+                            <option value="15" {% if session_timeout == 15 %}selected{% endif %}>15 minutes (default)</option>
+                            <option value="60" {% if session_timeout == 60 %}selected{% endif %}>1 hour</option>
+                            <option value="240" {% if session_timeout == 240 %}selected{% endif %}>4 hours (Extended)</option>
+                            <option value="480" {% if session_timeout == 480 %}selected{% endif %}>8 hours (Extended)</option>
+                        </select>
+                        <small id="session-timeout-help" class="form-text text-muted">
+                            Longer sessions are convenient for workflow testing but increase risk:
+                            a signed-in console left unattended could be misused on-site. Extended
+                            tiers (4h/8h) are a deliberate trade-off; the 15-minute default is the
+                            most secure.
+                        </small>
+                    </div>
+
                     <div class="d-flex justify-content-center container-fluid">
                         <button type="submit" value="Setup" class="btn btn-jawa btn-padded">
                             Setup
diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index 036f902..7b06267 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -135,7 +135,7 @@ <h5 class="modal-title" id="sessionTimeoutLabel">Session Expiring</h5>
 
 <script>
 (function () {
-    var SESSION_DURATION = 15 * 60;
+    var SESSION_DURATION = {{ session_timeout_seconds | default(900) }};
     var WARNING_BEFORE = 45;
     var remaining = SESSION_DURATION;
     var warningShown = false;
diff --git a/tests/test_session.py b/tests/test_session.py
new file mode 100644
index 0000000..441f3a7
--- /dev/null
+++ b/tests/test_session.py
@@ -0,0 +1,128 @@
+"""Session timeout resolution, enforcement, and cookie hardening (J6/B4)."""
+
+import app as jawa_app
+
+
+def test_resolve_defaults_to_15_when_missing():
+    assert jawa_app._resolve_session_timeout({}) == 15
+
+
+def test_resolve_accepts_ladder_values():
+    for v in (15, 60, 240, 480):
+        assert jawa_app._resolve_session_timeout(
+            {"session_timeout_minutes": v}
+        ) == v
+
+
+def test_resolve_rejects_off_ladder_values():
+    # Off-ladder, wrong type, and absurd values all fail safe to 15.
+    # Bools and ladder-equal floats must also be rejected (strict int).
+    for bad in (0, 5, 999999, -10, "60", None, 61, True, False, 60.0):
+        assert jawa_app._resolve_session_timeout(
+            {"session_timeout_minutes": bad}
+        ) == 15
+
+
+def test_cookie_flags_are_hardened():
+    assert jawa_app.app.config["SESSION_COOKIE_SECURE"] is True
+    assert jawa_app.app.config["SESSION_COOKIE_HTTPONLY"] is True
+    assert jawa_app.app.config["SESSION_COOKIE_SAMESITE"] == "Lax"
+
+
+def test_login_makes_session_permanent(logged_in_client):
+    with logged_in_client.session_transaction() as sess:
+        assert sess.permanent is True
+
+
+def test_before_request_applies_configured_timeout(logged_in_client, jawa_env):
+    import json
+    # Configure an extended (4h) timeout.
+    data = json.loads(jawa_env.server_file.read_text())
+    data["session_timeout_minutes"] = 240
+    jawa_env.server_file.write_text(json.dumps(data))
+    # Any authed request runs before_request, which sets the lifetime.
+    logged_in_client.get("/dashboard")
+    from datetime import timedelta
+    assert jawa_app.app.permanent_session_lifetime == timedelta(minutes=240)
+
+
+def test_before_request_failsafe_on_bad_config(logged_in_client, jawa_env):
+    import json
+    data = json.loads(jawa_env.server_file.read_text())
+    data["session_timeout_minutes"] = 999999
+    jawa_env.server_file.write_text(json.dumps(data))
+    logged_in_client.get("/dashboard")
+    from datetime import timedelta
+    assert jawa_app.app.permanent_session_lifetime == timedelta(minutes=15)
+
+
+def test_setup_persists_valid_timeout(logged_in_client, jawa_env):
+    import json
+    logged_in_client.post(
+        "/setup",
+        data={
+            "address": "https://jawa.example.test",
+            "jss-lock": "https://jamf.example.test",
+            "alternate": "",
+            "session_timeout_minutes": "240",
+        },
+    )
+    data = json.loads(jawa_env.server_file.read_text())
+    assert data["session_timeout_minutes"] == 240
+
+
+def test_setup_rejects_off_ladder_timeout(logged_in_client, jawa_env):
+    import json
+    logged_in_client.post(
+        "/setup",
+        data={
+            "address": "https://jawa.example.test",
+            "jss-lock": "https://jamf.example.test",
+            "alternate": "",
+            "session_timeout_minutes": "999999",
+        },
+    )
+    data = json.loads(jawa_env.server_file.read_text())
+    # Off-ladder input is clamped to the safe default, never stored raw.
+    assert data["session_timeout_minutes"] == 15
+
+
+def test_setup_form_shows_timeout_control(logged_in_client, jawa_env):
+    import json
+    data = json.loads(jawa_env.server_file.read_text())
+    data["session_timeout_minutes"] = 240
+    jawa_env.server_file.write_text(json.dumps(data))
+    resp = logged_in_client.get("/setup")
+    body = resp.data.decode()
+    assert 'name="session_timeout_minutes"' in body
+    # Current value preselected.
+    assert 'value="240" selected' in body
+    # Extended tiers carry a security-trade-off note.
+    assert "Extended" in body
+
+
+def test_layout_injects_effective_timeout(logged_in_client, jawa_env):
+    import json
+    data = json.loads(jawa_env.server_file.read_text())
+    data["session_timeout_minutes"] = 60
+    jawa_env.server_file.write_text(json.dumps(data))
+    resp = logged_in_client.get("/dashboard")
+    body = resp.data.decode()
+    # 60 min -> 3600 s injected for the modal to count down against.
+    assert "3600" in body
+
+
+def test_non_dict_server_config_fails_safe(logged_in_client, jawa_env):
+    # A hand-edited server.json that isn't a JSON object must not 500
+    # every route; it must fall back to the 15-min default.
+    jawa_env.server_file.write_text("[]")
+    resp = logged_in_client.get("/dashboard")
+    assert resp.status_code == 200
+    from datetime import timedelta
+    assert jawa_app.app.permanent_session_lifetime == timedelta(minutes=15)
+
+
+def test_get_server_config_returns_dict_for_non_object(jawa_env):
+    from bin import data_store
+    jawa_env.server_file.write_text("42")
+    assert data_store.get_server_config() == {}
diff --git a/views/home_view.py b/views/home_view.py
index e56e3c2..3af0eca 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -174,6 +174,7 @@ def login() -> Response:
             + str(escape(session["username"]))
         )
 
+        session.permanent = True
         return redirect(url_for(DASHBOARD_ENDPOINT))
 
     if "username" not in session:

From 0a6d73523de056ad509f5bf0719b64e429f59ea5 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Fri, 10 Jul 2026 16:11:20 -0500
Subject: [PATCH 22/84] =?UTF-8?q?fix:=20bug-fix=20batch=20=E2=80=94=20rece?=
 =?UTF-8?q?iver,=20resource=20delete,=20error=20pages,=20login=20UX=20(B2/?=
 =?UTF-8?q?B3/B5=20+=20J6=20follow-up)=20(#65)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: allow opting out of Secure cookies for local http dev (J6 follow-up)

SESSION_COOKIE_SECURE was hardcoded True in the J6 work, which is
correct for production (HTTPS behind nginx) but breaks local
'python3 app.py' runs over http: the browser drops the Secure session
cookie, so login succeeds server-side but the session never returns,
producing a login loop. Default stays Secure; set JAWA_INSECURE_COOKIES=1
for local http development only. HttpOnly and SameSite are unchanged.

* fix: guard webhook receiver payload parsing and method check (B2)

* fix: handle empty/missing file selection in resource deletion (B3)

* feat: add branded 500/403/405 error handlers (B5)

* fix: surface login errors in all home render branches

* feat: retain username and JPS URL on failed login

* fix: only retain login fields after a failed login (prevent prefill phishing)

* fix: retain login fields via one-shot session flash, not query params (anti-phishing)
---
 app.py                       | 60 ++++++++++++++++++++++++-
 templates/home.html          |  3 +-
 tests/test_error_handlers.py | 31 +++++++++++++
 tests/test_login.py          | 86 ++++++++++++++++++++++++++++++++++++
 tests/test_receiver.py       | 10 -----
 tests/test_resources.py      | 14 ++++++
 tests/test_session.py        | 21 +++++++++
 views/home_view.py           | 25 +++++++++--
 views/resource_view.py       | 22 ++++++---
 webhook/jawa_receiver.py     | 24 +++++-----
 10 files changed, 264 insertions(+), 32 deletions(-)
 create mode 100644 tests/test_error_handlers.py
 create mode 100644 tests/test_resources.py

diff --git a/app.py b/app.py
index 2dae99a..0fddf9f 100644
--- a/app.py
+++ b/app.py
@@ -43,7 +43,7 @@
 )
 from markupsafe import escape
 from waitress import serve
-from typing import Any, Dict, Union
+from typing import Any, Dict, Tuple, Union
 
 from bin import logger
 from bin.context_processors import inject_common_vars, register_static_cache_bust
@@ -69,8 +69,14 @@ def _resolve_session_timeout(config: dict) -> int:
 
 # Initiate Flask
 app = Flask(__name__)
+# Secure cookies require HTTPS. JAWA runs HTTPS behind nginx in
+# production, so Secure defaults on. A Secure cookie is dropped by the
+# browser over plain http, which breaks local `python3 app.py` runs
+# (login succeeds but the session cookie never returns -> login loop).
+# Set JAWA_INSECURE_COOKIES=1 for local http development only.
+_secure_cookies = os.environ.get("JAWA_INSECURE_COOKIES") != "1"
 app.config.update(
-    SESSION_COOKIE_SECURE=True,
+    SESSION_COOKIE_SECURE=_secure_cookies,
     SESSION_COOKIE_HTTPONLY=True,
     SESSION_COOKIE_SAMESITE="Lax",
 )
@@ -468,5 +474,55 @@ def page_not_found(e) -> Union[Response, str]:
     return load_home()
 
 
+@app.errorhandler(500)
+def internal_error(e) -> Union[Response, Tuple[str, int]]:
+    logthis.exception(
+        f"500 at {request.path} for "
+        f"{session.get('username', 'anonymous')}"
+    )
+    if "username" in session:
+        return (
+            render_template(
+                "error.html",
+                username=session.get("username"),
+                error="Something went wrong",
+                error_message="An unexpected error occurred. "
+                "The details have been logged.",
+            ),
+            500,
+        )
+    return load_home(), 500
+
+
+@app.errorhandler(403)
+def forbidden(e) -> Union[Response, Tuple[str, int]]:
+    if "username" in session:
+        return (
+            render_template(
+                "error.html",
+                username=session.get("username"),
+                error="Forbidden",
+                error_message="You do not have access to that resource.",
+            ),
+            403,
+        )
+    return load_home(), 403
+
+
+@app.errorhandler(405)
+def method_not_allowed(e) -> Union[Response, Tuple[str, int]]:
+    if "username" in session:
+        return (
+            render_template(
+                "error.html",
+                username=session.get("username"),
+                error="Method not allowed",
+                error_message="That action isn't allowed here.",
+            ),
+            405,
+        )
+    return load_home(), 405
+
+
 if __name__ == "__main__":
     main()
diff --git a/templates/home.html b/templates/home.html
index c9de366..ff3581d 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -58,10 +58,11 @@ <h1 class="d-flex justify-content-center">{% if app_name %}{{ app_name }}{% else
         {% else %}
             <label for="login-url" class="visually-hidden">Jamf Pro URL</label>
             <input id="login-url" name="url" type="url" placeholder="Jamf Pro URL" pattern="https?://.+" title="Use https://" required
+                   value="{{ prev_url if prev_url }}"
                    class="form-control text-center" autofocus>
         {% endif %}
         <label for="login-username" class="visually-hidden">Username</label>
-        <input id="login-username" name="username" type="text" placeholder="Username" required class="form-control text-center" autofocus>
+        <input id="login-username" name="username" type="text" placeholder="Username" required value="{{ prev_username if prev_username }}" class="form-control text-center" autofocus>
         <label for="login-password" class="visually-hidden">Password</label>
         <input id="login-password" name="password" type="password" placeholder="Password" required class="form-control text-center">
 
diff --git a/tests/test_error_handlers.py b/tests/test_error_handlers.py
new file mode 100644
index 0000000..b22d4ab
--- /dev/null
+++ b/tests/test_error_handlers.py
@@ -0,0 +1,31 @@
+"""Branded 500/405 error handlers (J7/B5)."""
+
+import app as jawa_app
+
+
+def test_500_renders_branded_page_no_traceback(jawa_env):
+    # The app is a long-lived singleton that has already served requests,
+    # so a fresh route cannot be registered mid-suite. Invoke the handler
+    # directly inside a request context instead: the assertions that matter
+    # are the 500 status and that the internal detail is never leaked.
+    exc = RuntimeError("kaboom-secret-detail")
+    with jawa_app.app.test_request_context("/_boom_test"):
+        from flask import session
+
+        session["username"] = "pytest-admin"
+        session["url"] = "https://jamf.example.test"
+        body, status = jawa_app.internal_error(exc)
+
+    assert status == 500
+    # Branded page rendered; internal exception detail not leaked.
+    assert "error-card" in body
+    assert "kaboom-secret-detail" not in body
+
+
+def test_405_renders_branded_page(logged_in_client):
+    # /dashboard is GET-only; POST should 405 via the branded handler.
+    resp = logged_in_client.post("/dashboard")
+    assert resp.status_code == 405
+    body = resp.data.decode()
+    assert "error-card" in body
+    assert "Method not allowed" in body
diff --git a/tests/test_login.py b/tests/test_login.py
index 78a179f..f6e468a 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -26,3 +26,89 @@ def test_logout_clears_session(logged_in_client):
 def test_anonymous_home_renders(client):
     resp = client.get("/")
     assert resp.status_code == 200
+
+
+def test_login_error_surfaces_when_no_jps_configured(client, jawa_env):
+    # server.json with no jps_url is the branch that dropped errors.
+    import json
+    jawa_env.server_file.write_text(json.dumps({"brand": "JAWA"}))
+    resp = client.get(
+        "/logout?error_title=Authentication+error"
+        "&error_message=Passwords+can%27t+be+blank"
+    )
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert "Authentication error" in body
+    # logout() HTML-escapes the message before rendering, so the
+    # apostrophe surfaces as its entity in the login page body.
+    assert "Passwords can&#39;t be blank" in body
+
+
+def test_failed_login_retains_username_and_url(client, jawa_env, fake_jamf):
+    # The plain url input only renders when no jps_url is locked in
+    # server.json, which is the scenario where retaining the typed URL
+    # matters. The default fixture locks a jps_url, so clear it here.
+    import json
+    jawa_env.server_file.write_text(json.dumps({"brand": "JAWA"}))
+    resp = client.post(
+        "/login",
+        data={
+            "url": "https://jamf.example.test",
+            "username": "hojo",
+            "password": "",  # blank password -> auth failure
+        },
+        follow_redirects=True,
+    )
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert 'value="hojo"' in body
+    assert 'value="https://jamf.example.test"' in body
+    # Password must never be echoed back into the page.
+    assert 'type="password"' in body  # field still present
+    # (no password value assertion -- it must not be retained at all)
+
+
+def test_prev_url_not_reflected_without_error(client, jawa_env):
+    # A bare GET with prev_url but NO failed-login error must NOT
+    # pre-fill the JPS URL field (phishing pre-fill prevention).
+    import json
+    jawa_env.server_file.write_text(json.dumps({"brand": "JAWA"}))
+    resp = client.get("/?prev_url=https://evil-jamf.example&prev_username=admin")
+    body = resp.data.decode()
+    assert "https://evil-jamf.example" not in body
+    assert 'value="admin"' not in body
+
+
+def test_prev_url_not_reflected_via_logout_error_param(client, jawa_env):
+    # The prior gate keyed on error_title, which is attacker-suppliable
+    # via /logout query params. Confirm a crafted /logout link canNOT
+    # pre-fill the JPS URL / username (no session flash present).
+    import json
+    jawa_env.server_file.write_text(json.dumps({"brand": "JAWA"}))
+    resp = client.get(
+        "/logout?error_title=x&prev_url=https://evil-jamf.example"
+        "&prev_username=admin",
+        follow_redirects=True,
+    )
+    body = resp.data.decode()
+    assert "https://evil-jamf.example" not in body
+    assert 'value="admin"' not in body
+
+
+def test_failed_login_does_not_reflect_script_injection(
+    client, jawa_env, fake_jamf
+):
+    import json
+    jawa_env.server_file.write_text(json.dumps({"brand": "JAWA"}))
+    resp = client.post(
+        "/login",
+        data={
+            "url": "https://jamf.example.test",
+            "username": "<script>alert(1)</script>",
+            "password": "",
+        },
+        follow_redirects=True,
+    )
+    body = resp.data.decode()
+    # Autoescaped -- the raw tag must not appear unescaped in the body.
+    assert "<script>alert(1)</script>" not in body
diff --git a/tests/test_receiver.py b/tests/test_receiver.py
index 674b32b..6dfb729 100644
--- a/tests/test_receiver.py
+++ b/tests/test_receiver.py
@@ -178,22 +178,12 @@ def test_null_json_body_is_a_teapot(client, jawa_env, fake_popen):
     assert fake_popen.calls == []
 
 
-@pytest.mark.xfail(
-    reason="J4/B2: form-payload fallback is unguarded; a bodyless "
-    "POST raises instead of returning 4xx",
-    strict=True,
-)
 def test_bodyless_post_returns_4xx(client, jawa_env, fake_popen):
     resp = client.post("/hooks/testhook")
     assert 400 <= resp.status_code < 500
     assert fake_popen.calls == []
 
 
-@pytest.mark.xfail(
-    reason="J4/B2: method check happens after body parsing, so a "
-    "bare GET crashes in the form fallback instead of 405ing",
-    strict=True,
-)
 def test_get_method_returns_405(client, jawa_env, fake_popen):
     resp = client.get("/hooks/testhook")
     assert resp.status_code == 405
diff --git a/tests/test_resources.py b/tests/test_resources.py
new file mode 100644
index 0000000..0736315
--- /dev/null
+++ b/tests/test_resources.py
@@ -0,0 +1,14 @@
+"""Resource file deletion edge cases (J5/B3)."""
+
+
+def test_delete_with_no_file_selected_does_not_500(logged_in_client, jawa_env):
+    # POST with no target_file query param — must not raise NameError/500.
+    resp = logged_in_client.post("/resources/delete.html")
+    assert resp.status_code < 500
+
+
+def test_delete_nonexistent_file_does_not_500(logged_in_client, jawa_env):
+    resp = logged_in_client.post(
+        "/resources/delete.html?target_file=nope.txt"
+    )
+    assert resp.status_code < 500
diff --git a/tests/test_session.py b/tests/test_session.py
index 441f3a7..fb8ec5b 100644
--- a/tests/test_session.py
+++ b/tests/test_session.py
@@ -24,11 +24,32 @@ def test_resolve_rejects_off_ladder_values():
 
 
 def test_cookie_flags_are_hardened():
+    # Default (env var unset): Secure on, as in production.
     assert jawa_app.app.config["SESSION_COOKIE_SECURE"] is True
     assert jawa_app.app.config["SESSION_COOKIE_HTTPONLY"] is True
     assert jawa_app.app.config["SESSION_COOKIE_SAMESITE"] == "Lax"
 
 
+def test_insecure_cookies_opt_out_expression(monkeypatch):
+    # The Secure flag is computed at import as
+    # (JAWA_INSECURE_COOKIES != "1"). Verify that logic directly rather
+    # than reloading the app module (reload corrupts the shared app
+    # singleton other tests depend on). Secure-by-default; only the
+    # explicit "1" opt-out disables it.
+    def secure_for(env_value):
+        if env_value is None:
+            monkeypatch.delenv("JAWA_INSECURE_COOKIES", raising=False)
+        else:
+            monkeypatch.setenv("JAWA_INSECURE_COOKIES", env_value)
+        import os
+
+        return os.environ.get("JAWA_INSECURE_COOKIES") != "1"
+
+    assert secure_for(None) is True        # unset -> secure (prod)
+    assert secure_for("0") is True         # anything but "1" -> secure
+    assert secure_for("1") is False        # explicit opt-out -> insecure
+
+
 def test_login_makes_session_permanent(logged_in_client):
     with logged_in_client.session_transaction() as sess:
         assert sess.permanent is True
diff --git a/views/home_view.py b/views/home_view.py
index 3af0eca..457fef5 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -96,7 +96,15 @@ def _strip_trailing_slash(url: str) -> str:
 
 
 def _login_error(title: str, message) -> Response:
-    """Redirect to logout with an error."""
+    """Redirect to logout with an error. Stash the entered username
+    and JPS URL (never the password) in the session for one-shot
+    re-display on the login page. Using the signed session (not query
+    params) prevents an attacker from crafting a link that pre-fills
+    the JPS URL field (credential-target phishing)."""
+    session["login_retry"] = {
+        "username": request.form.get("username", ""),
+        "url": request.form.get("url", ""),
+    }
     return redirect(
         url_for(LOGOUT_ENDPOINT, error_title=title, error_message=message)
     )
@@ -214,11 +222,20 @@ def _load_server_config() -> dict:
 
 
 def _render_home(error_title="", error_message="", **kwargs) -> str:
-    """Render the home template with common error parameters."""
+    """Render the home template with common error parameters.
+
+    prev_username/prev_url come from a one-shot session flash set only
+    by _login_error (a genuine failed login), never from request args,
+    so they cannot be attacker-supplied via a crafted URL. Popped on
+    render so they don't persist. Password is never retained.
+    """
+    retry = session.pop("login_retry", None) or {}
     return render_template(
         HOME_TEMPLATE,
         error_title=error_title,
         error_message=error_message,
+        prev_username=retry.get("username", ""),
+        prev_url=retry.get("url", ""),
         **kwargs,
     )
 
@@ -231,13 +248,13 @@ def load_home(
 
     server_json = _load_server_config()
     if not server_json:
-        return render_template(HOME_TEMPLATE)
+        return _render_home(error_title, error_message)
 
     brand = server_json.get("brand")
     jps_url = server_json.get("jps_url")
 
     if not jps_url:
-        return _render_home(app_name=brand)
+        return _render_home(error_title, error_message, app_name=brand)
 
     alt_jps = server_json.get("alternate_jps")
     if alt_jps is None:
diff --git a/views/resource_view.py b/views/resource_view.py
index ce3bc87..48587de 100644
--- a/views/resource_view.py
+++ b/views/resource_view.py
@@ -167,14 +167,26 @@ def delete_file() -> Union[Response, Tuple[str, int]]:
             target_file=target_file,
             username=str(escape(session.get("username"))),
         )
-    if target_file:
-        target_file_dir = os.path.dirname(
-            os.path.abspath(os.path.join(files_dir, target_file))
+    if not target_file:
+        logthis.warning(
+            f"[{session.get('url')}] {session.get('username')} "
+            f"attempted a file deletion with no file selected."
         )
-        target_file_path = os.path.abspath(
-            os.path.join(files_dir, target_file)
+        return redirect(
+            url_for(
+                "error",
+                error="No file selected",
+                error_message="Select a file to delete.",
+            )
         )
 
+    target_file_dir = os.path.dirname(
+        os.path.abspath(os.path.join(files_dir, target_file))
+    )
+    target_file_path = os.path.abspath(
+        os.path.join(files_dir, target_file)
+    )
+
     if target_file_dir != files_dir:
         logthis.warning(
             f"WARNING: [{session.get('url')}] {session.get('username')} attempted to delete a file from a forbidden path: {target_file_path}."
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 8c3f4c1..08248c1 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -141,28 +141,32 @@ def webhook_handler(
         return okta_verification.verify_new_webhook(
             request.headers.get("x-okta-verification-challenge")
         )
+    if request.method != "POST":
+        logthis.warning(
+            f"Invalid request, {request.method} for /hooks/{webhook_name}."
+        )
+        return (
+            "405 - Method not allowed. These aren't the droids you're looking for. You can go about your business. "
+            "Move along.",
+            405,
+        )
     try:
         webhook_data = request.get_json()
     except Exception as err:
         logthis.warning(
             f"Error loading JSON ({err}). Trying to load from form payload."
         )
-        webhook_data = json.loads(request.form.get("payload"))
+        raw = request.form.get("payload")
+        try:
+            webhook_data = json.loads(raw) if raw else None
+        except (ValueError, TypeError):
+            webhook_data = None
     if not webhook_data:
         logthis.warning(
             f"418.  Error processing /hooks/{webhook_name} - no data provided. I'm a teapot."
         )
         return "418 - I'm a teapot.", 418
     logthis.debug(f"{webhook_name} payload: {webhook_data}")
-    if request.method != "POST":
-        logthis.warning(
-            f"Invalid request, {request.method} for /hooks/{webhook_name}."
-        )
-        return (
-            "405 - Method not allowed. These aren't the droids you're looking for. You can go about your business. "
-            "Move along.",
-            405,
-        )
     webhook_user = "null"
     webhook_pass = "null"
     webhook_apikey = "null"

From 105c6ce2df56392066bfe3f6a279db0968283218 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Fri, 10 Jul 2026 18:09:03 -0500
Subject: [PATCH 23/84] fix: link the Setup Required error page directly to
 /setup (#66)

Creating a jamfpro/okta automation before JAWA is configured raised a
'Setup Required' error page that dead-ended the user -- Back and
Dashboard only, no path to /setup where they actually need to go.
AutomationError already carried an optional link, but the two raise
sites passed none and the template rendered a link as a raw URL in a
new tab.

Now the raise sites pass link=/setup with a friendly label, and when a
link is present the error page renders it as the primary in-page action
button ('Go to Setup'), demoting Dashboard to secondary. Adds link_text
to AutomationError for the button label.
---
 templates/error.html                 | 17 +++++++----
 tests/test_setup_required.py         | 42 ++++++++++++++++++++++++++++
 views/_type_handlers/base.py         |  9 +++++-
 views/_type_handlers/jamf_handler.py |  6 +++-
 views/_type_handlers/okta_handler.py |  6 +++-
 views/automation_view.py             |  9 ++++--
 6 files changed, 77 insertions(+), 12 deletions(-)
 create mode 100644 tests/test_setup_required.py

diff --git a/templates/error.html b/templates/error.html
index edd8d21..62535af 100644
--- a/templates/error.html
+++ b/templates/error.html
@@ -156,19 +156,24 @@ <h1 class="error-title">{{ error }}</h1>
             {{ error_message }}
         </div>
 
-        {% if link %}
-        <div class="error-link">
-            <a href="{{ link }}" target="_blank">{{ link }}</a>
-        </div>
-        {% endif %}
-
         <div class="error-actions">
             <button type="button" onclick="history.back()" class="btn-error-secondary">
                 ← Back
             </button>
+            {% if link %}
+            {# A supplied link is the recommended next step: make it the
+               primary action (in-page) and demote Dashboard to secondary. #}
+            <a href="{{ link }}" class="btn-error-primary">
+                {{ link_text if link_text else link }} →
+            </a>
+            <a href="/dashboard" class="btn-error-secondary">
+                Dashboard →
+            </a>
+            {% else %}
             <a href="/dashboard" class="btn-error-primary">
                 Dashboard →
             </a>
+            {% endif %}
         </div>
     </div>
 </div>
diff --git a/tests/test_setup_required.py b/tests/test_setup_required.py
new file mode 100644
index 0000000..623857a
--- /dev/null
+++ b/tests/test_setup_required.py
@@ -0,0 +1,42 @@
+"""The 'Setup Required' error must link the user to /setup.
+
+Creating a jamfpro/okta automation before JAWA is configured raises
+AutomationError("Setup Required", ...). The error page must give the
+admin a direct, in-page way to reach /setup instead of dead-ending.
+"""
+
+import json
+
+
+def _unconfigure_jawa(jawa_env):
+    # Remove jawa_address so get_jawa_address() is falsy -> Setup Required.
+    jawa_env.server_file.write_text(json.dumps({"brand": "JAWA"}))
+
+
+def test_jamfpro_new_without_jawa_links_to_setup(logged_in_client, jawa_env):
+    _unconfigure_jawa(jawa_env)
+    resp = logged_in_client.post(
+        "/automations/jamfpro/new",
+        data={"webhook_name": "test-hook"},
+    )
+    body = resp.data.decode()
+    assert "Setup Required" in body
+    # The page offers a direct link to /setup (the action the user needs).
+    assert 'href="/setup"' in body
+    # Friendly label, not the raw path as the only text.
+    assert "Go to Setup" in body
+    # Internal navigation -- not a new tab.
+    assert 'href="/setup" target="_blank"' not in body
+
+
+def test_okta_new_without_jawa_links_to_setup(logged_in_client, jawa_env):
+    _unconfigure_jawa(jawa_env)
+    # Okta's handler reads the name from "webhookname" (no underscore).
+    resp = logged_in_client.post(
+        "/automations/okta/new",
+        data={"webhookname": "test-okta"},
+    )
+    body = resp.data.decode()
+    assert "Setup Required" in body
+    assert 'href="/setup"' in body
+    assert "Go to Setup" in body
diff --git a/views/_type_handlers/base.py b/views/_type_handlers/base.py
index d990adc..168f4fe 100644
--- a/views/_type_handlers/base.py
+++ b/views/_type_handlers/base.py
@@ -34,11 +34,18 @@ class AutomationError(Exception):
     """Raised when an automation operation fails."""
 
     def __init__(
-        self, title: str, message: str, link: Optional[str] = None
+        self,
+        title: str,
+        message: str,
+        link: Optional[str] = None,
+        link_text: Optional[str] = None,
     ) -> None:
         self.title = title
         self.message = message
         self.link = link
+        # Friendly label for the link when rendered as an action button;
+        # falls back to the raw link if omitted.
+        self.link_text = link_text
         super().__init__(message)
 
 
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index 1aeee25..f9565d2 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -183,7 +183,11 @@ def process_create(
         server_address = get_jawa_address()
         if not server_address:
             raise AutomationError(
-                "Setup Required", "Please configure JAWA address first."
+                "Setup Required",
+                "Configure your JAWA address and Jamf Pro server "
+                "before creating an automation.",
+                link="/setup",
+                link_text="Go to Setup",
             )
 
         # Ensure token is valid
diff --git a/views/_type_handlers/okta_handler.py b/views/_type_handlers/okta_handler.py
index 6c00c64..cf38960 100644
--- a/views/_type_handlers/okta_handler.py
+++ b/views/_type_handlers/okta_handler.py
@@ -75,7 +75,11 @@ def process_create(
         server_address = get_jawa_address()
         if not server_address:
             raise AutomationError(
-                "Setup Required", "Please configure JAWA address first."
+                "Setup Required",
+                "Configure your JAWA address and Jamf Pro server "
+                "before creating an automation.",
+                link="/setup",
+                link_text="Go to Setup",
             )
 
         # Ensure okta verification file is executable
diff --git a/views/automation_view.py b/views/automation_view.py
index 8f2fc65..d62e9eb 100644
--- a/views/automation_view.py
+++ b/views/automation_view.py
@@ -77,12 +77,15 @@ def _get_session_data() -> dict:
     }
 
 
-def _error_page(title: str, message: str, link: str = None) -> str:
+def _error_page(
+    title: str, message: str, link: str = None, link_text: str = None
+) -> str:
     return render_template(
         "error.html",
         error=title,
         error_message=message,
         link=link,
+        link_text=link_text,
         username=session.get("username"),
     )
 
@@ -175,7 +178,7 @@ def create(auto_type: str) -> Union[Response, str]:
             request.form, request.files, session_data
         )
     except AutomationError as err:
-        return _error_page(err.title, err.message, err.link)
+        return _error_page(err.title, err.message, err.link, err.link_text)
 
     # Persist the entry
     entry = result.get("entry")
@@ -288,7 +291,7 @@ def edit(auto_type: str, name: str) -> Union[Response, str]:
             all_items,
         )
     except AutomationError as err:
-        return _error_page(err.title, err.message, err.link)
+        return _error_page(err.title, err.message, err.link, err.link_text)
 
     return render_template(
         SUCCESS_TEMPLATE,

From dabb39416edce89c6c6f3067b8ff218275b37724 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Fri, 10 Jul 2026 18:15:47 -0500
Subject: [PATCH 24/84] fix: make session-timeout modal survive sleep via
 absolute deadline (#67)

The warning modal counted down a setInterval variable, which the
browser pauses/throttles during sleep or when the tab is backgrounded.
After a long idle the countdown never advanced, so no warning fired and
the server session had already expired -- the user just got a silent
bounce to login on their next click.

Track an absolute expiry timestamp instead and re-evaluate against the
real clock on tab focus/visibilitychange, not only on the interval. On
return: if already expired, redirect to /logout with a 'Session expired'
reason so the login page explains why (reusing the login-error banner);
if within the warning window, show the modal immediately with the
correct remaining seconds.
---
 templates/shared/_layout.html | 71 ++++++++++++++++++++++-------------
 tests/test_session.py         | 18 +++++++++
 2 files changed, 62 insertions(+), 27 deletions(-)

diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index 7b06267..5c16912 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -137,10 +137,17 @@ <h5 class="modal-title" id="sessionTimeoutLabel">Session Expiring</h5>
 (function () {
     var SESSION_DURATION = {{ session_timeout_seconds | default(900) }};
     var WARNING_BEFORE = 45;
-    var remaining = SESSION_DURATION;
+    // Absolute expiry timestamp (ms). Using a deadline instead of a
+    // decrementing counter makes the timer robust across sleep/tab
+    // throttling: a paused setInterval no longer under-counts. On
+    // return we recompute remaining from the real clock, so an
+    // already-expired session is caught immediately.
+    var deadline = Date.now() + SESSION_DURATION * 1000;
     var warningShown = false;
-    var countdownInterval = null;
     var modal = null;
+    // Session-expired reason, surfaced on the login page after redirect.
+    var EXPIRED_URL = "/logout?error_title=Session+expired"
+        + "&error_message=Please+sign+in+again";
 
     function getModal() {
         if (!modal) {
@@ -150,43 +157,53 @@ <h5 class="modal-title" id="sessionTimeoutLabel">Session Expiring</h5>
         return modal;
     }
 
+    function remainingSeconds() {
+        return Math.round((deadline - Date.now()) / 1000);
+    }
+
     function resetTimer() {
-        remaining = SESSION_DURATION;
+        deadline = Date.now() + SESSION_DURATION * 1000;
         warningShown = false;
-        if (countdownInterval) {
-            clearInterval(countdownInterval);
-            countdownInterval = null;
-        }
         var m = getModal();
         if (m) {
             try { m.hide(); } catch (e) {}
         }
     }
 
-    function showWarning() {
-        warningShown = true;
-        var display = document.getElementById("countdownDisplay");
-        if (display) display.textContent = remaining;
-        var m = getModal();
-        if (m) m.show();
-        countdownInterval = setInterval(function () {
-            remaining--;
-            if (display) display.textContent = Math.max(remaining, 0);
-            if (remaining <= 0) {
-                clearInterval(countdownInterval);
-                window.location.href = "/logout";
-            }
-        }, 1000);
+    function expireNow() {
+        window.location.href = EXPIRED_URL;
     }
 
-    setInterval(function () {
-        if (!warningShown) {
-            remaining--;
-            if (remaining <= WARNING_BEFORE) {
-                showWarning();
+    // Single source of truth, driven by both the interval and by
+    // focus/visibility changes so returning to a slept tab re-evaluates
+    // against the real clock instead of a stale counter.
+    function tick() {
+        var remaining = remainingSeconds();
+        if (remaining <= 0) {
+            // Session already gone (e.g. after a long idle/sleep):
+            // redirect to login with a reason rather than silently.
+            expireNow();
+            return;
+        }
+        if (remaining <= WARNING_BEFORE) {
+            var display = document.getElementById("countdownDisplay");
+            if (display) display.textContent = remaining;
+            if (!warningShown) {
+                warningShown = true;
+                var m = getModal();
+                if (m) m.show();
             }
         }
-    }, 1000);
+    }
+
+    setInterval(tick, 1000);
+    // Re-check the moment the tab regains focus/visibility — this is
+    // what makes the modal survive sleep, since timers are throttled or
+    // paused while the machine sleeps or the tab is backgrounded.
+    window.addEventListener("focus", tick);
+    document.addEventListener("visibilitychange", function () {
+        if (!document.hidden) tick();
+    });
 
     document.getElementById("staySignedInBtn").addEventListener("click", function () {
         fetch("/dashboard", {method: "GET", credentials: "same-origin"})
diff --git a/tests/test_session.py b/tests/test_session.py
index fb8ec5b..c4cf859 100644
--- a/tests/test_session.py
+++ b/tests/test_session.py
@@ -133,6 +133,24 @@ def test_layout_injects_effective_timeout(logged_in_client, jawa_env):
     assert "3600" in body
 
 
+def test_timeout_modal_is_sleep_robust(logged_in_client, jawa_env):
+    # The modal must track an absolute deadline and re-check on tab
+    # focus/visibility so it survives sleep (a decrementing setInterval
+    # counter pauses while the machine sleeps and under-counts).
+    # This is a structural assertion on the rendered JS; true
+    # sleep-survival is a manual browser check (see DESIGN relic).
+    resp = logged_in_client.get("/dashboard")
+    body = resp.data.decode()
+    # Deadline/real-clock based, not a decrementing counter.
+    assert "Date.now()" in body
+    assert "deadline" in body
+    # Re-evaluates when the tab regains focus / becomes visible.
+    assert "visibilitychange" in body
+    assert 'addEventListener("focus"' in body
+    # An already-expired session redirects to login with a reason.
+    assert "error_title=Session+expired" in body
+
+
 def test_non_dict_server_config_fails_safe(logged_in_client, jawa_env):
     # A hand-edited server.json that isn't a JSON object must not 500
     # every route; it must fall back to the 15-min default.

From 0b0061a564a22fc61f290552ab507b4e668bc889 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Fri, 10 Jul 2026 20:33:24 -0500
Subject: [PATCH 25/84] chore: remove dead code fossils (mongoengine,
 load_home, stale comments, okta stub) (#68)

- Drop unused mongoengine dependency (never imported anywhere).
- Delete bin/load_home.py (dead duplicate; the live load_home is in
  views/home_view.py, and the dead file had a broken import).
- Remove the commented-out legacy blueprint imports in register_blueprints.
- Remove the empty okta_verification.main() stub and its __main__ guard;
  verify_new_webhook (the real function) is retained.

No behavior change. App boots, ruff clean, full harness green.
---
 app.py                   |  7 ----
 bin/load_home.py         | 79 ----------------------------------------
 bin/okta_verification.py |  8 ----
 requirements.txt         |  1 -
 4 files changed, 95 deletions(-)
 delete mode 100644 bin/load_home.py

diff --git a/app.py b/app.py
index 0fddf9f..fb73160 100644
--- a/app.py
+++ b/app.py
@@ -140,10 +140,6 @@ def register_blueprints() -> None:
     from webhook import jawa_receiver
 
     app.register_blueprint(jawa_receiver.blueprint)
-    # Legacy views (deprecated — routes handled by automation_view)
-    # from views import jamf_webhook
-    # from views.okta_webhook import blueprint
-    # from views.cron_view import blueprint
     # Log view
     from views import log_view
 
@@ -152,9 +148,6 @@ def register_blueprints() -> None:
     from views import resource_view
 
     app.register_blueprint(resource_view.blueprint)
-    # Legacy views (deprecated — routes handled by automation_view)
-    # from views import custom_webhook
-    # from views import webhook_view
     # Template catalog, enable, and import view
     from views import template_view
 
diff --git a/bin/load_home.py b/bin/load_home.py
deleted file mode 100644
index c35db75..0000000
--- a/bin/load_home.py
+++ /dev/null
@@ -1,79 +0,0 @@
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-#
-# Copyright (c) 2022 Jamf.  All rights reserved.
-#
-#       Redistribution and use in source and binary forms, with or without
-#       modification, are permitted provided that the following conditions are met:
-#               * Redistributions of source code must retain the above copyright
-#                 notice, this list of conditions and the following disclaimer.
-#               * Redistributions in binary form must reproduce the above copyright
-#                 notice, this list of conditions and the following disclaimer in the
-#                 documentation and/or other materials provided with the distribution.
-#               * Neither the name of the Jamf nor the names of its contributors may be
-#                 used to endorse or promote products derived from this software without
-#                 specific prior written permission.
-#
-#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
-#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
-#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-from flask import Response, render_template, session, redirect, url_for
-from glob import escape
-import json
-import os
-from typing import Union
-
-from bin import logger
-
-logthis = logger.setup_child_logger("jawa", __name__)
-
-server_json_file = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), "..", "data", "server.json")
-)
-
-
-def load_home() -> Union[Response, str]:
-    if "username" in session:
-        return redirect(url_for("dashboard"))
-    with open(server_json_file, "r") as fin:
-        server_json = json.load(fin)
-    if not server_json:
-        return render_template("home.html")
-    brand = server_json.get("brand")
-
-    if "jps_url" not in server_json:
-        return render_template("home.html", app_name=brand)
-    elif server_json["jps_url"] is None:
-        return render_template("home.html", app_name=brand)
-    elif len(server_json["jps_url"]) == 0:
-        return render_template("home.html", app_name=brand)
-    else:
-        if "alternate_jps" not in server_json:
-            return render_template("home.html", app_name=brand)
-
-        if server_json["alternate_jps"] != "":
-            return render_template(
-                "home.html",
-                jps_url=server_json["jps_url"],
-                jps_url2=server_json["alternate_jps"],
-                welcome="true",
-                jsslock="true",
-                app_name=brand,
-            )
-
-        session["url"] = server_json["jps_url"]
-        return render_template(
-            "home.html",
-            jps_url=str(escape(session["url"])),
-            welcome="true",
-            jsslock="true",
-            app_name=brand,
-        )
diff --git a/bin/okta_verification.py b/bin/okta_verification.py
index f4c29af..7a27614 100755
--- a/bin/okta_verification.py
+++ b/bin/okta_verification.py
@@ -30,11 +30,3 @@
 
 def verify_new_webhook(challenge: Optional[str]) -> Dict[str, str]:
     return {"verification": f"{challenge}"}
-
-
-def main() -> None:
-    pass
-
-
-if __name__ == "__main__":
-    main()
diff --git a/requirements.txt b/requirements.txt
index f6b117d..87d9d72 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,7 +7,6 @@ jinja2>=3.1.2
 idna
 itsdangerous
 MarkupSafe~=2.1.5
-mongoengine~=0.27.0
 python-crontab~=3.0.0
 python-dateutil
 requests~=2.31.0

From 7f0f5f8ff8c8fcd7ddbfdd568def719ebd6a5242 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Fri, 10 Jul 2026 21:47:55 -0500
Subject: [PATCH 26/84] =?UTF-8?q?fix:=20J10=20paper-cuts=20=E2=80=94=20upl?=
 =?UTF-8?q?oad=20cap,=20setup=20slash,=20shebang,=20copy,=20auth=20guard,?=
 =?UTF-8?q?=20error=20swap=20(#69)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: cap upload size at 16MB (Flask MAX_CONTENT_LENGTH + JAWA nginx vhost)

* fix: strip trailing slashes from setup URLs (prevents double-slash webhook URLs)

* fix: reject script uploads without a shebang (fails clearly at upload, not trigger time)

* fix: setup submit button reads 'Save' when editing an existing config

* test: lock in that login fails against a non-Jamf URL (3.0.2 auth regression guard)

* fix: /error route no longer swaps title and message

The error() view passed render_template kwargs crossed
(error_message=error_title, error=error_message), so the branded page
showed the title as the body and the message as the h1. Now aligned
with how error.html and _error_page use them: error = title, error_message
= body. Test asserts each lands in its correct element (has teeth: fails
if the swap returns).
---
 app.py                       | 13 +++----
 bin/data_store.py            | 10 ++++++
 bin/installer.sh             |  2 ++
 templates/setup/setup.html   |  4 +--
 tests/test_error_handlers.py | 22 ++++++++++++
 tests/test_login.py          | 39 +++++++++++++++++++++
 tests/test_setup_required.py | 59 +++++++++++++++++++++++++++++++
 tests/test_uploads.py        | 68 ++++++++++++++++++++++++++++++++++++
 views/automation_view.py     |  6 ++++
 9 files changed, 215 insertions(+), 8 deletions(-)
 create mode 100644 tests/test_uploads.py

diff --git a/app.py b/app.py
index fb73160..8e08aa2 100644
--- a/app.py
+++ b/app.py
@@ -48,7 +48,7 @@
 from bin import logger
 from bin.context_processors import inject_common_vars, register_static_cache_bust
 from bin.view_modifiers import response
-from views.home_view import load_home
+from views.home_view import _strip_trailing_slash, load_home
 
 # Flask logging
 logthis = logger.setup_child_logger("jawa", "app")
@@ -79,6 +79,7 @@ def _resolve_session_timeout(config: dict) -> int:
     SESSION_COOKIE_SECURE=_secure_cookies,
     SESSION_COOKIE_HTTPONLY=True,
     SESSION_COOKIE_SAMESITE="Lax",
+    MAX_CONTENT_LENGTH=16 * 1024 * 1024,
 )
 
 
@@ -269,12 +270,12 @@ def setup() -> Union[Response, str]:
         logthis.debug(
             f"[{session.get('url')}] {session.get('username')} /setup - POST"
         )
-        server_url = request.form.get("address")
+        server_url = _strip_trailing_slash(request.form.get("address") or "")
         if not server_url:
             return redirect(url_for("setup"))
-        jps_url = request.form.get("jss-lock")
+        jps_url = _strip_trailing_slash(request.form.get("jss-lock") or "")
         jps2_check = request.form.get("alternate-jamf")
-        jps_url2 = request.form.get("alternate")
+        jps_url2 = _strip_trailing_slash(request.form.get("alternate") or "")
         timeout_raw = request.form.get("session_timeout_minutes", "")
         try:
             timeout_val = int(timeout_raw)
@@ -449,8 +450,8 @@ def error() -> Union[Response, str]:
     return render_template(
         "error.html",
         username=session.get("username"),
-        error_message=error_title,
-        error=error_message,
+        error=error_title,
+        error_message=error_message,
     )
 
 
diff --git a/bin/data_store.py b/bin/data_store.py
index fb77f9d..396d74e 100644
--- a/bin/data_store.py
+++ b/bin/data_store.py
@@ -196,6 +196,16 @@ def save_script(
 
     Returns the absolute path to the saved file.
     """
+    # A JAWA automation script is executed directly by the receiver
+    # (Popen, argv form). Without a shebang the OS cannot pick an
+    # interpreter, so it would fail cryptically at trigger time. Reject
+    # it here so the upload fails clearly instead.
+    head = file_storage.read(2)
+    file_storage.seek(0)
+    if head != b"#!":
+        raise ValueError(
+            "Script must start with a shebang (e.g. #!/bin/bash)."
+        )
     if not os.path.isdir(SCRIPTS_DIR):
         os.mkdir(SCRIPTS_DIR)
     filename = file_storage.filename
diff --git a/bin/installer.sh b/bin/installer.sh
index ae9566e..95b69a2 100644
--- a/bin/installer.sh
+++ b/bin/installer.sh
@@ -838,6 +838,7 @@ server {
 
         server_name localhost;
         server_name_in_redirect off;
+        client_max_body_size 16m;
         location / {
                 # First attempt to serve request as file, then
                 proxy_pass http://jawa;
@@ -879,6 +880,7 @@ configure_nginx_ubuntu() {
 
           server_name localhost;
           server_name_in_redirect off;
+          client_max_body_size 16m;
           location / {
                   # First attempt to serve request as file, then
                   proxy_pass http://localhost:8000;
diff --git a/templates/setup/setup.html b/templates/setup/setup.html
index 0b1a1b2..6f0f608 100644
--- a/templates/setup/setup.html
+++ b/templates/setup/setup.html
@@ -92,8 +92,8 @@ <h2>Server Setup</h2>
                     </div>
 
                     <div class="d-flex justify-content-center container-fluid">
-                        <button type="submit" value="Setup" class="btn btn-jawa btn-padded">
-                            Setup
+                        <button type="submit" value="{{ "Save" if jawa_url else "Setup" }}" class="btn btn-jawa btn-padded">
+                            {{ "Save" if jawa_url else "Setup" }}
                         </button>
                     </div>
 
diff --git a/tests/test_error_handlers.py b/tests/test_error_handlers.py
index b22d4ab..61c5b3c 100644
--- a/tests/test_error_handlers.py
+++ b/tests/test_error_handlers.py
@@ -29,3 +29,25 @@ def test_405_renders_branded_page(logged_in_client):
     body = resp.data.decode()
     assert "error-card" in body
     assert "Method not allowed" in body
+
+
+def test_error_route_does_not_swap_title_and_message(logged_in_client):
+    # /error reads ?error=<title>&error_message=<body>. error.html renders
+    # `error` as the h1 title and `error_message` as the body. Assert each
+    # lands in the correct element so a future arg-swap regresses the test.
+    import re
+
+    resp = logged_in_client.get(
+        "/error?error=SwapTitleXYZ&error_message=SwapBodyXYZ"
+    )
+    body = resp.data.decode()
+    # Title belongs in the error-title heading, not the body.
+    title_match = re.search(
+        r'class="error-title"[^>]*>(.*?)</h1>', body, re.DOTALL
+    )
+    assert title_match and "SwapTitleXYZ" in title_match.group(1)
+    # Message belongs in the error-message block.
+    msg_match = re.search(
+        r'class="error-message"[^>]*>(.*?)</div>', body, re.DOTALL
+    )
+    assert msg_match and "SwapBodyXYZ" in msg_match.group(1)
diff --git a/tests/test_login.py b/tests/test_login.py
index f6e468a..69a8318 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -95,6 +95,45 @@ def test_prev_url_not_reflected_via_logout_error_param(client, jawa_env):
     assert 'value="admin"' not in body
 
 
+def test_login_fails_against_non_jamf_url(client, jawa_env, monkeypatch):
+    # Regression guard for the 3.0.2 report where server.json pointing
+    # at JAWA's own URL let any creds log in. A URL that does not answer
+    # Jamf's token endpoint like Jamf Pro (returns non-JSON) must not
+    # log in. Invert the conftest fake_jamf fixture: the token endpoint
+    # returns a 200 whose .json() raises, so get_token() swallows the
+    # error and never sets session["token"] -> _validate_credentials
+    # bounces to /logout.
+    import requests
+
+    class NotJamfResponse:
+        """A non-Jamf endpoint: HTTP 200 but the body is not JSON."""
+
+        status_code = 200
+
+        def json(self):
+            raise ValueError("not JSON")
+
+        def raise_for_status(self):
+            pass
+
+    monkeypatch.setattr(requests, "post", lambda *a, **k: NotJamfResponse())
+    monkeypatch.setattr(requests, "get", lambda *a, **k: NotJamfResponse())
+
+    resp = client.post(
+        "/login",
+        data={
+            "url": "https://not-jamf.example",
+            "username": "u",
+            "password": "p",  # non-blank, so the blank-password gate passes
+        },
+    )
+    # Must NOT reach the dashboard; token fetch failed, so login bounces
+    # to /logout with the "Could not fetch token" error.
+    assert resp.status_code == 302
+    assert "/dashboard" not in resp.headers.get("Location", "")
+    assert "/logout" in resp.headers.get("Location", "")
+
+
 def test_failed_login_does_not_reflect_script_injection(
     client, jawa_env, fake_jamf
 ):
diff --git a/tests/test_setup_required.py b/tests/test_setup_required.py
index 623857a..023330b 100644
--- a/tests/test_setup_required.py
+++ b/tests/test_setup_required.py
@@ -6,6 +6,23 @@
 """
 
 import json
+import re
+
+
+def _submit_button_label(body):
+    """Return the visible label of the setup form's submit button.
+
+    The nav bar and sibling pages also render the word "Setup", so a
+    bare substring check can't distinguish first-time setup from an edit.
+    Extract the submit button's inner text specifically.
+    """
+    match = re.search(
+        r'<button[^>]*type="submit"[^>]*>(.*?)</button>',
+        body,
+        re.DOTALL,
+    )
+    assert match, "setup form should have a submit button"
+    return match.group(1).strip()
 
 
 def _unconfigure_jawa(jawa_env):
@@ -40,3 +57,45 @@ def test_okta_new_without_jawa_links_to_setup(logged_in_client, jawa_env):
     assert "Setup Required" in body
     assert 'href="/setup"' in body
     assert "Go to Setup" in body
+
+
+def test_setup_strips_trailing_slashes(logged_in_client, jawa_env):
+    logged_in_client.post(
+        "/setup",
+        data={
+            "address": "https://jawa.example.com/",
+            "jss-lock": "https://jamf.example.com/",
+            "alternate": "https://alt.example.com/",
+            "session_timeout_minutes": "15",
+        },
+    )
+    cfg = json.loads(jawa_env.server_file.read_text())
+    assert cfg["jawa_address"] == "https://jawa.example.com"
+    assert cfg["jps_url"] == "https://jamf.example.com"
+    assert cfg["alternate_jps"] == "https://alt.example.com"
+
+
+def test_setup_button_says_save_when_editing(logged_in_client, jawa_env):
+    jawa_env.server_file.write_text(
+        json.dumps(
+            {
+                "jawa_address": "https://jawa.example.com",
+                "jps_url": "x",
+                "alternate_jps": "",
+            }
+        )
+    )
+    resp = logged_in_client.get("/setup")
+    body = resp.data.decode()
+    # An existing config is being edited -> the button reads "Save".
+    assert _submit_button_label(body) == "Save"
+
+
+def test_setup_button_says_setup_when_unconfigured(logged_in_client, jawa_env):
+    jawa_env.server_file.write_text(
+        json.dumps({"jawa_address": "", "jps_url": "", "alternate_jps": ""})
+    )
+    resp = logged_in_client.get("/setup")
+    body = resp.data.decode()
+    # First-time setup keeps the "Setup" affordance on the button itself.
+    assert _submit_button_label(body) == "Setup"
diff --git a/tests/test_uploads.py b/tests/test_uploads.py
new file mode 100644
index 0000000..4336472
--- /dev/null
+++ b/tests/test_uploads.py
@@ -0,0 +1,68 @@
+"""Upload size cap (J10). Flask MAX_CONTENT_LENGTH rejects oversized bodies.
+
+Also covers shebang validation on automation script uploads (J10): a script
+without a ``#!`` first line must be rejected AT UPLOAD, not cryptically at
+trigger time when the receiver ``Popen``-execs it directly.
+"""
+
+import io
+import os
+
+import pytest
+
+import app as jawa_app
+
+
+def test_max_content_length_is_set_to_16mb():
+    assert jawa_app.app.config.get("MAX_CONTENT_LENGTH") == 16 * 1024 * 1024
+
+
+def test_oversized_upload_is_rejected(logged_in_client, jawa_env):
+    # A body over 16 MB must be rejected (413), not silently accepted.
+    big = b"x" * (16 * 1024 * 1024 + 1024)
+    resp = logged_in_client.post(
+        "/resources/files",
+        data={"upload": (io.BytesIO(big), "big.txt")},
+        content_type="multipart/form-data",
+    )
+    assert resp.status_code == 413
+
+
+class _FakeFile:
+    """Minimal werkzeug FileStorage stand-in backed by bytes."""
+
+    def __init__(self, filename, content):
+        self.filename = filename
+        self._stream = io.BytesIO(content)
+
+    def read(self, n=-1):
+        return self._stream.read(n)
+
+    def seek(self, pos, whence=0):
+        return self._stream.seek(pos, whence)
+
+    def save(self, path):
+        self._stream.seek(0)
+        with open(path, "wb") as f:
+            f.write(self._stream.read())
+
+
+def test_save_script_rejects_missing_shebang(jawa_env):
+    from bin import data_store
+
+    bad = _FakeFile("noshebang.sh", b"echo hello\n")
+    with pytest.raises(ValueError):
+        data_store.save_script(bad, "test")
+    # Nothing should have been written for a rejected upload.
+    assert os.listdir(data_store.SCRIPTS_DIR) == []
+
+
+def test_save_script_accepts_shebang(jawa_env):
+    from bin import data_store
+
+    good = _FakeFile("good.sh", b"#!/bin/bash\necho hi\n")
+    path = data_store.save_script(good, "test")
+    assert os.path.exists(path)
+    # The rewind must let save() write the FULL file, not just the tail.
+    with open(path, "rb") as f:
+        assert f.read() == b"#!/bin/bash\necho hi\n"
diff --git a/views/automation_view.py b/views/automation_view.py
index d62e9eb..08bb139 100644
--- a/views/automation_view.py
+++ b/views/automation_view.py
@@ -179,6 +179,9 @@ def create(auto_type: str) -> Union[Response, str]:
         )
     except AutomationError as err:
         return _error_page(err.title, err.message, err.link, err.link_text)
+    except ValueError as err:
+        # e.g. save_script rejecting an upload with no shebang.
+        return _error_page("Invalid script", str(err))
 
     # Persist the entry
     entry = result.get("entry")
@@ -292,6 +295,9 @@ def edit(auto_type: str, name: str) -> Union[Response, str]:
         )
     except AutomationError as err:
         return _error_page(err.title, err.message, err.link, err.link_text)
+    except ValueError as err:
+        # e.g. save_script rejecting an upload with no shebang.
+        return _error_page("Invalid script", str(err))
 
     return render_template(
         SUCCESS_TEMPLATE,

From e02ab88b56cbebfcc538e2aaf870bb58258400a6 Mon Sep 17 00:00:00 2001
From: Chris Ball <47579551+ball42@users.noreply.github.com>
Date: Sat, 11 Jul 2026 10:04:19 -0500
Subject: [PATCH 27/84] fix: guard legacy redirect routes against open-redirect
 (B8) (#70)

The legacy /webhooks/* and /cron/* compatibility routes interpolate a
user-controlled value (name/target_job/target_webhook) straight into a
301 redirect path. A value like //evil.com or /\evil.com makes the
result protocol-relative, so the browser resolves it off-site (open
redirect / phishing; CodeQL py/url-redirection).

Add bin/url_safety.safe_path_segment (no third-party imports, no cycle
risk) that strips slashes/backslashes from single-segment names, and
apply it to all five app.py interpolated redirects. The template_view
/workflows/<path:rest> catch-all guards against backslash/'//'/scheme
tails, falling back to the catalog. Tests cover off-site payloads per
route plus the normal-value happy paths.
---
 app.py                        |  27 ++++++--
 bin/url_safety.py             |  57 ++++++++++++++++
 tests/test_redirect_safety.py | 119 ++++++++++++++++++++++++++++++++++
 views/template_view.py        |   7 ++
 4 files changed, 204 insertions(+), 6 deletions(-)
 create mode 100644 bin/url_safety.py
 create mode 100644 tests/test_redirect_safety.py

diff --git a/app.py b/app.py
index 8e08aa2..75da6a7 100644
--- a/app.py
+++ b/app.py
@@ -47,6 +47,7 @@
 
 from bin import logger
 from bin.context_processors import inject_common_vars, register_static_cache_bust
+from bin.url_safety import safe_path_segment
 from bin.view_modifiers import response
 from views.home_view import _strip_trailing_slash, load_home
 
@@ -192,7 +193,9 @@ def _redir_jamf_new():
 
 @app.route("/webhooks/jamf/edit")
 def _redir_jamf_edit():
-    name = request.args.get("name", "")
+    name = safe_path_segment(request.args.get("name", ""))
+    if not name:
+        return redirect("/automations/jamfpro", code=301)
     return redirect(f"/automations/jamfpro/{name}/edit", code=301)
 
 
@@ -218,7 +221,9 @@ def _redir_custom_new():
 
 @app.route("/webhooks/custom/edit")
 def _redir_custom_edit():
-    name = request.args.get("name", "")
+    name = safe_path_segment(request.args.get("name", ""))
+    if not name:
+        return redirect("/automations/custom", code=301)
     return redirect(f"/automations/custom/{name}/edit", code=301)
 
 
@@ -234,24 +239,34 @@ def _redir_cron_new():
 
 @app.route("/cron/edit")
 def _redir_cron_edit():
-    name = request.args.get("name", "")
+    name = safe_path_segment(request.args.get("name", ""))
+    if not name:
+        return redirect("/automations/cron", code=301)
     return redirect(f"/automations/cron/{name}/edit", code=301)
 
 
 @app.route("/cron/delete")
 def _redir_cron_delete():
-    name = request.args.get("target_job", "")
+    name = safe_path_segment(request.args.get("target_job", ""))
+    if not name:
+        return redirect("/automations/cron", code=301)
     return redirect(f"/automations/cron/{name}/delete", code=301)
 
 
 @app.route("/webhooks/delete")
 def _redir_webhook_delete():
-    name = request.args.get("target_webhook", "")
+    name = safe_path_segment(request.args.get("target_webhook", ""))
+    if not name:
+        return redirect("/automations", code=301)
     # Need to look up the tag to route properly
     from bin.data_store import get_webhook_by_name
 
     webhook = get_webhook_by_name(name)
-    tag = webhook.get("tag", "custom") if webhook else "custom"
+    tag = (
+        safe_path_segment(webhook.get("tag", "custom"))
+        if webhook
+        else "custom"
+    )
     return redirect(f"/automations/{tag}/{name}/delete", code=301)
 
 
diff --git a/bin/url_safety.py b/bin/url_safety.py
new file mode 100644
index 0000000..e977d80
--- /dev/null
+++ b/bin/url_safety.py
@@ -0,0 +1,57 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+"""URL-safety helpers for building local redirect targets (bug B8).
+
+Several legacy compatibility routes build a redirect ``Location`` by
+interpolating a user-controlled value straight into a path string
+(``f"/automations/{name}/edit"``). A value such as ``//evil.com`` or
+``/\\evil.com`` turns the result into a protocol-relative URL that the
+browser resolves off-site (open redirect / phishing; CodeQL
+``py/url-redirection``).
+
+This module has no third-party imports, so it is safe to import from
+``app.py`` and any blueprint without creating an import cycle.
+"""
+
+
+def safe_path_segment(value: str) -> str:
+    """Sanitize a user value that will be interpolated as a *single*
+    path segment in a local redirect target.
+
+    The interpolated value is an automation name and must never contain
+    a path separator. Stripping every slash and backslash guarantees the
+    result cannot introduce an extra segment, a ``//`` run, or a
+    ``/\\`` sequence -- the three ways an interpolated value can make the
+    final path protocol-relative or otherwise escape its intended slot.
+
+    Returns a bare segment safe to embed in an f-string path.
+    """
+    if not value:
+        return ""
+    return value.replace("/", "").replace("\\", "")
diff --git a/tests/test_redirect_safety.py b/tests/test_redirect_safety.py
new file mode 100644
index 0000000..a18ee04
--- /dev/null
+++ b/tests/test_redirect_safety.py
@@ -0,0 +1,119 @@
+"""Open-redirect guard tests for legacy redirect routes (bug B8).
+
+The legacy compatibility routes in ``app.py`` and
+``views/template_view.py`` interpolate user-controlled values straight
+into a redirect path. A value like ``//evil.com`` or ``/\\evil.com``
+turns the resulting path into a protocol-relative URL, which the
+browser resolves off-site (open redirect / phishing, CodeQL
+``py/url-redirection``).
+
+These routes are anonymous-reachable (they are pure 301 shims), so no
+authenticated session is required to exercise them.
+"""
+
+import pytest
+
+# Payloads that, before the fix, escape the intended local path.
+OFF_SITE_PAYLOADS = [
+    "//evil.com",
+    "/\\evil.com",
+    "\\\\evil.com",
+    "https://evil.com",
+    "//evil.com/edit",
+    # All-separator input sanitizes to empty -> must not leave a
+    # dangling "//" segment in the local path (defense-in-depth).
+    "////",
+    "/",
+]
+
+
+def _assert_local_redirect(resp, prefix):
+    """A safe redirect stays on this origin under the given prefix."""
+    assert resp.status_code == 301
+    loc = resp.headers["Location"]
+    # Never protocol-relative and never absolute off-site.
+    assert not loc.startswith("//"), f"protocol-relative Location: {loc!r}"
+    assert not loc.startswith("http"), f"absolute Location: {loc!r}"
+    assert "\\" not in loc, f"backslash in Location: {loc!r}"
+    # No embedded "//" either: an interpolated separator run can be
+    # re-parsed as protocol-relative by intermediaries.
+    assert "//" not in loc, f"embedded '//' in Location: {loc!r}"
+    assert loc.startswith(prefix), f"Location {loc!r} escaped prefix {prefix!r}"
+
+
+# ---- app.py single-segment name routes ----
+
+# (path, query-param, resulting prefix)
+NAME_ROUTES = [
+    ("/webhooks/jamf/edit", "name", "/automations/jamfpro/"),
+    ("/webhooks/custom/edit", "name", "/automations/custom/"),
+    ("/cron/edit", "name", "/automations/cron/"),
+    ("/cron/delete", "target_job", "/automations/cron/"),
+]
+
+
+@pytest.mark.parametrize("path,param,prefix", NAME_ROUTES)
+@pytest.mark.parametrize("payload", OFF_SITE_PAYLOADS)
+def test_name_route_rejects_off_site(client, path, param, prefix, payload):
+    resp = client.get(path, query_string={param: payload})
+    _assert_local_redirect(resp, "/automations")
+
+
+@pytest.mark.parametrize("path,param,prefix", NAME_ROUTES)
+def test_name_route_normal_value_redirects(client, path, param, prefix):
+    resp = client.get(path, query_string={param: "myhook"})
+    _assert_local_redirect(resp, prefix)
+    assert resp.headers["Location"].endswith("myhook/edit") or resp.headers[
+        "Location"
+    ].endswith("myhook/delete")
+
+
+# ---- app.py webhook delete (target_webhook -> tag lookup) ----
+
+
+@pytest.mark.parametrize("payload", OFF_SITE_PAYLOADS)
+def test_webhook_delete_rejects_off_site(client, jawa_env, payload):
+    resp = client.get(
+        "/webhooks/delete", query_string={"target_webhook": payload}
+    )
+    _assert_local_redirect(resp, "/automations")
+
+
+def test_webhook_delete_normal_value_redirects(client, jawa_env):
+    jawa_env.add_webhook({"name": "myhook", "tag": "custom"})
+    resp = client.get(
+        "/webhooks/delete", query_string={"target_webhook": "myhook"}
+    )
+    _assert_local_redirect(resp, "/automations/custom/")
+    assert resp.headers["Location"].endswith("myhook/delete")
+
+
+# ---- template_view /workflows/<path:rest> catch-all ----
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/workflows///evil.com",
+        "/workflows/\\evil.com",
+    ],
+)
+def test_workflows_rest_rejects_off_site(client, path):
+    resp = client.get(path)
+    # The invariant is simply: this route never emits an OFF-SITE
+    # redirect. A 301 must point at a safe local /templates path; any
+    # non-redirect response (e.g. Werkzeug merges "///" and the URL map
+    # matches a real page -> 200, or a 404) carries no Location and so
+    # cannot redirect off-origin.
+    loc = resp.headers.get("Location")
+    if loc is not None:
+        assert not loc.startswith("//"), f"protocol-relative: {loc!r}"
+        assert not loc.startswith("http"), f"absolute off-site: {loc!r}"
+        assert "\\" not in loc, f"backslash in Location: {loc!r}"
+        assert loc.startswith("/templates"), f"escaped prefix: {loc!r}"
+
+
+def test_workflows_rest_normal_value_redirects(client):
+    resp = client.get("/workflows/device-naming/script")
+    assert resp.status_code == 301
+    assert resp.headers["Location"].endswith("/templates/device-naming/script")
diff --git a/views/template_view.py b/views/template_view.py
index 199f516..71d5d2a 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -221,6 +221,13 @@ def workflows_redirect() -> Response:
 
 @blueprint.route("/workflows/<path:rest>")
 def workflows_rest_redirect(rest: str) -> Response:
+    # `rest` is a user-controlled path tail interpolated into the
+    # redirect target. A value containing a backslash, a "//" run, or a
+    # scheme colon could make the result protocol-relative / off-site
+    # (open redirect, bug B8). Anything suspicious falls back to the
+    # catalog rather than redirecting off-origin.
+    if "\\" in rest or "//" in rest or ":" in rest:
+        return redirect(url_for(CATALOG_ENDPOINT), code=301)
     return redirect(f"/templates/{rest}", code=301)
 
 

From a4876ba6be43465602804e6cd720be7d67100b74 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 22 Jul 2026 23:28:19 -0500
Subject: [PATCH 28/84] docs: add Jamf Routines comparison, bump to v3.2, add
 release notes

---
 README.md | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4e1042c..b5461f1 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,12 @@
-# Jamf Automation and Webhook Assistant ("JAWA") Version 3.1.1
+# Jamf Automation and Webhook Assistant ("JAWA") Version 3.2
 
 <p align="center"> <img src="https://github.com/jamf/JAWA/blob/main/static/img/jawa_icon.png" width="384"/> </p>
 
 
 JAWA allows an IT Administrator to focus on providing the best end user experience through automation.
 
+> **Prefer a hosted option?** JAWA is self-hosted — you run and maintain the server yourself. If you'd rather not operate infrastructure, **[Jamf Routines](https://learn.jamf.com/r/en-US/jamf-routines-documentation/jamf_workflow_automation)** is a Jamf-hosted, Jamf-supported automation service. You can run both — see [JAWA vs. Jamf Routines](#jawa-vs-jamf-routines) below.
+
 ***[!]** NOTE: Always test automations in a dev/eval environment before deploying to production.*
 
 ## What is JAWA?
@@ -16,6 +18,20 @@ JAWA, the Jamf Automation and Webhook Assistant, is a web server designed to str
 
 *Read the [JAWA Admin Guide](https://github.com/jamf/JAWA/wiki) too!*
 
+## JAWA vs. Jamf Routines
+
+JAWA and [Jamf Routines](https://learn.jamf.com/r/en-US/jamf-routines-documentation/jamf_workflow_automation) both automate Jamf Pro workflows, in different ways.
+
+| | **JAWA** | **Jamf Routines** |
+|---|---|---|
+| **Hosting** | Self-hosted (your server) | Jamf-hosted |
+| **Maintenance** | You own the OS, TLS, updates, and uptime | Managed by Jamf |
+| **Support** | Community / open source | Jamf-supported |
+| **Automation model** | Your own scripts, triggered by webhooks or a schedule | Template-based workflows that connect tools to Jamf Pro |
+| **Setup effort** | Provision a server, certificate, and DNS | Sign in and go |
+
+**Choose JAWA** if you want full control, custom scripting, and don't mind running a server. **Choose Jamf Routines** if you'd rather not manage infrastructure and want a Jamf-supported, hosted experience. You can run both — they complement each other. For Jamf Routines availability and pricing, see the [Jamf Routines documentation](https://learn.jamf.com/r/en-US/jamf-routines-documentation/jamf_workflow_automation).
+
 ## Server Requirements
 
 ### General Server Requirements:
@@ -84,6 +100,20 @@ When scripting for webhooks, verify JSON structure sent from source:
 
 Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)
 
+### JAWA v3.2 release
+- New features
+    - smoke-test harness + CI (ruff + pytest) for safer releases
+    - admin-configurable session timeout with hardened session cookies
+    - in-app documentation for writing automation scripts
+- Bugfixes
+    - template webhooks now fire correctly
+    - rejected path traversal in template import
+    - fixed resource deletion, error pages, and receiver edge cases
+    - session-timeout warning now survives sleep/idle
+    - "Setup Required" error page links directly to Setup
+- Repository maintenance
+    - removed dead code (legacy MongoEngine, stale stubs)
+
 ### JAWA v3.1.1 release
 - Bugfix
  - Resolved #49

From 68ad3d995f015a1effc74083b31090c583aef7e6 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 22 Jul 2026 23:32:41 -0500
Subject: [PATCH 29/84] docs: document the JAWA automation script contract

Add a "Writing Automation Scripts" section to the README, between
"How to Use JAWA" and "Releases", describing JAWA's script-calling
contract so an LLM (or human) can write a working automation:

- Webhook payload arrives as a single JSON string in sys.argv[1]
  (no stdin, env, or file).
- stdout/stderr are logged line-by-line; non-zero exit = failure.
- Scripts hold their own credentials; JAWA injects none.
- Timed automations run with no payload (sys.argv[1] absent) - guard for it.
- Complete example faithful to the bundled smart_group_slack.py.

Fulfills the Task 1 release-notes bullet.
---
 README.md | 101 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)

diff --git a/README.md b/README.md
index b5461f1..ae9554f 100644
--- a/README.md
+++ b/README.md
@@ -96,6 +96,107 @@ When scripting for webhooks, verify JSON structure sent from source:
 1. [Jamf Pro Webhook Event Info](https://developer.jamf.com/developer-guide/docs/webhooks)
 2. [Okta Webhook Event Info](https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible)
 
+## Writing Automation Scripts
+
+JAWA runs **your** scripts in response to Jamf Pro (or Okta/custom) webhooks and on a schedule. A script can be written in any language JAWA's host can execute; the examples here are Python. This section describes the contract JAWA uses to call your script.
+
+### How JAWA calls a webhook script
+
+When a webhook fires, JAWA executes your script and passes the **entire event payload as a single JSON string in the first command-line argument** (`sys.argv[1]`). It does not use stdin, environment variables, or a file. Your script's first job is to parse it:
+
+```python
+import json
+import sys
+
+event_data = json.loads(sys.argv[1])   # the whole webhook payload
+```
+
+A Jamf Pro webhook payload has two top-level keys:
+
+- `event_data["webhook"]` — event metadata (`webhookEvent`, `eventTimestamp`, `id`)
+- `event_data["event"]` — the event's own fields (for example `groupAddedDevicesIds`, `name`)
+
+### Output and status
+
+- Anything your script prints (stdout and stderr) is captured line-by-line into the JAWA log under the automation's name. Use `print()` for progress and diagnostics.
+- Exit `0` for success. A **non-zero exit code is recorded as a failure** in the log.
+
+### Credentials
+
+JAWA does not inject Jamf Pro or third-party credentials into your script. A script that calls the Jamf Pro API authenticates itself (for example, requesting its own OAuth token). Store secrets in your script's own configuration, not in JAWA.
+
+### Scheduled (timed) automations
+
+A timed automation runs your script on a schedule with **no webhook payload** — `sys.argv[1]` is not present. If one script serves both paths, guard for it:
+
+```python
+import json
+import sys
+
+event_data = json.loads(sys.argv[1]) if len(sys.argv) > 1 else {}
+```
+
+### Complete example
+
+This bundled script (`data/workflows/scripts/smart_group_slack.py`) posts to Slack when devices join a smart group:
+
+```python
+#!/usr/bin/env python3
+"""Send Slack notification on smart group membership change.
+
+Webhook event: SmartGroupComputerMembershipChange
+"""
+
+import json
+import requests
+import sys
+from datetime import datetime
+
+SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+
+
+def main():
+    event_data = json.loads(sys.argv[1])
+    event = event_data["event"]
+
+    id_list = event.get("groupAddedDevicesIds", [])
+    if not id_list:
+        print("No devices entered the group.")
+        sys.exit(12)
+
+    group_name = event.get("name", "Unknown Group")
+
+    slack_data = {
+        "attachments": [
+            {
+                "title": f"Smart Group Update: {group_name}",
+                "text": f"{len(id_list)} device(s) added to {group_name}",
+                "footer": "JAWA Webhook Automation",
+                "ts": datetime.timestamp(datetime.now()),
+            }
+        ]
+    }
+
+    resp = requests.post(
+        SLACK_WEBHOOK_URL,
+        data=json.dumps(slack_data),
+        headers={"Content-Type": "application/json"},
+    )
+    print(f"Slack notification: {resp.status_code}")
+
+
+if __name__ == "__main__":
+    main()
+```
+
+### Common mistakes
+
+- **The payload is `sys.argv[1]`, not stdin, not an environment variable, and not a file.**
+- **It is a JSON *string*** — you must `json.loads()` it before use.
+- **The event fields are nested** under `event_data["event"]`, not at the top level.
+- **Don't assume JAWA provides a Jamf Pro token** — your script authenticates itself.
+- **On the timed path there is no `sys.argv[1]`** — guard for it if a script serves both.
+
 ## Releases
 
 Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)

From a53087792869d5730c7199ff72d3d98bf99dbfc8 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 22 Jul 2026 23:36:12 -0500
Subject: [PATCH 30/84] feat: note Jamf Routines as a hosted alternative on the
 setup page

---
 templates/setup/setup.html | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/templates/setup/setup.html b/templates/setup/setup.html
index 6f0f608..ab07860 100644
--- a/templates/setup/setup.html
+++ b/templates/setup/setup.html
@@ -48,6 +48,11 @@ <h2>Server Setup</h2>
                     Please read the <a href="https://github.com/jamf/JAWA/blob/main/README.md"
                                        target="_blank">documentation</a> prior to using JAWA.
                 </p>
+                <p class="text-center text-muted">
+                    Finding self-hosting a lot to manage?
+                    <a href="https://learn.jamf.com/r/en-US/jamf-routines-documentation/jamf_workflow_automation"
+                       target="_blank">Jamf Routines</a> is a Jamf-hosted alternative.
+                </p>
                 <form method="post" action="/setup" enctype="multipart/form-data">
 
                     <label for="jawa-address" class="visually-hidden">JAWA Server Address FQDN</label>

From 36662ee1c82ce8c20ef2084e8d65900ca88cdb1f Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 22 Jul 2026 23:42:57 -0500
Subject: [PATCH 31/84] docs: scope script output/exit behavior to the webhook
 path

The Output and status subsection overclaimed: stdout/stderr capture and
non-zero-exit-as-failure are webhook-path behaviors only. Timed automations
run under the system's cron, which owns their output and exit status.

- Retitle the subsection to "Output and status (webhook automations)".
- Note in the timed subsection that cron handles output/exit, not JAWA.
- Release note: drop "in-app" (docs live in the README, not the app UI).
---
 README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index ae9554f..6916152 100644
--- a/README.md
+++ b/README.md
@@ -116,7 +116,7 @@ A Jamf Pro webhook payload has two top-level keys:
 - `event_data["webhook"]` — event metadata (`webhookEvent`, `eventTimestamp`, `id`)
 - `event_data["event"]` — the event's own fields (for example `groupAddedDevicesIds`, `name`)
 
-### Output and status
+### Output and status (webhook automations)
 
 - Anything your script prints (stdout and stderr) is captured line-by-line into the JAWA log under the automation's name. Use `print()` for progress and diagnostics.
 - Exit `0` for success. A **non-zero exit code is recorded as a failure** in the log.
@@ -136,6 +136,8 @@ import sys
 event_data = json.loads(sys.argv[1]) if len(sys.argv) > 1 else {}
 ```
 
+Timed automations run under the system's cron, so a script's output and exit status are handled by cron (for example, in the host's mail/syslog), not captured in the JAWA log.
+
 ### Complete example
 
 This bundled script (`data/workflows/scripts/smart_group_slack.py`) posts to Slack when devices join a smart group:
@@ -205,7 +207,7 @@ Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)
 - New features
     - smoke-test harness + CI (ruff + pytest) for safer releases
     - admin-configurable session timeout with hardened session cookies
-    - in-app documentation for writing automation scripts
+    - documentation for writing automation scripts
 - Bugfixes
     - template webhooks now fire correctly
     - rejected path traversal in template import

From b9371c78e5aebb838f1c5c8ee4a9a26dab18d745 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 23 Jul 2026 09:46:20 -0500
Subject: [PATCH 32/84] fix: harden installer.sh and guard it in CI

Remove the stray argument-executor line and the invisible zero-width unicode
in the arg-parsing block, drop dead functions (addToLog, timestamp, cancel),
add clone-failure detection with a clear error and non-zero exit, fix a broken
-o file test in favor of ||, and default the branch to main for the production
install path. Add an installer-hygiene CI job: bash -n syntax check plus a
stray-non-ASCII guard so paste corruption cannot regress.
---
 .github/workflows/ci.yml | 22 +++++++++++++++++
 bin/installer.sh         | 53 ++++++++++++++--------------------------
 2 files changed, 40 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 59f447a..105ca03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,3 +30,25 @@ jobs:
 
       - name: Test (pytest)
         run: python -m pytest -v
+
+  installer-hygiene:
+    # Guards bin/installer.sh (curled off main, run as root) against invisible-unicode
+    # paste corruption. The only legitimate non-ASCII lives in the spinner charsets
+    # (`local spin=` assignments); anything else is a stray ZWSP/NBSP/BOM and fails.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Bash syntax check
+        run: bash -n bin/installer.sh
+
+      - name: Reject stray non-ASCII (paste corruption)
+        run: |
+          stray=$(grep -nP '[^\x00-\x7F]' bin/installer.sh | grep -vE 'local spin=' || true)
+          if [ -n "$stray" ]; then
+            echo "::error::Non-ASCII characters found outside the spinner charsets in bin/installer.sh:"
+            echo "$stray"
+            echo "These are almost certainly invisible paste corruption (zero-width space, NBSP, BOM)."
+            exit 1
+          fi
+          echo "OK: no stray non-ASCII in bin/installer.sh"
diff --git a/bin/installer.sh b/bin/installer.sh
index 95b69a2..6a09d9e 100644
--- a/bin/installer.sh
+++ b/bin/installer.sh
@@ -207,22 +207,6 @@ configure_firewall() {
     esac
 }
 
-addToLog(){
-    ## Usage
-    ## addToLog <Text> <Log File>
-    logFile="${$1}"
-    fillerText="${$2}"
-
-    echo "$(date -j)" "$2" >> "$1"
-
-}
-
-timestamp() {
-  /bin/echo ""
-  /bin/echo -n $(date +"%D %T -")
-  /bin/echo -n " "
-}
-
 readme() {
 
   /usr/bin/clear
@@ -253,11 +237,6 @@ Please make sure you:
 "
 }
 
-cancel() {
-  /bin/echo "Canceling..."
-  exit 0
-}
-
 install() {
   /usr/bin/clear
   # Variables
@@ -306,10 +285,8 @@ install() {
     *) echo "Please answer yes or no." ;;
     esac
   fi
-  if [ "$upgradeOption" == "yes" ]; then
-    continue
-  else
-    # prompting for install directory
+  if [ "$upgradeOption" != "yes" ]; then
+    # prompting for install directory (upgrades reuse the detected installDir)
     read -r -p "Where would you like to install JAWA? [Press RETURN for $installDir]:  " new_dir
     while true; do
       if [ "$new_dir" != "" ]; then
@@ -413,12 +390,22 @@ install() {
   /bin/echo '[############            ](60%) Cloning the JAWA project from GitHub... ' >>/var/log/jawaInstall.log 2>&1
 
   git clone --branch "$branch" https://github.com/jamf/JAWA.git jawa >>/var/log/jawaInstall.log 2>&1 & spinner $! ""
+  cloneStatus=$?
+  # spinner propagates the background job's exit code; also confirm the clone actually landed
+  if [ "$cloneStatus" -ne 0 ] || [ ! -d "$installDir/jawa/.git" ]; then
+    /usr/bin/clear
+    /bin/echo "Unable to clone the JAWA project (branch '$branch') from GitHub."
+    /bin/echo "Check your network connection and that the branch exists, then see /var/log/jawaInstall.log for details."
+    /bin/echo "Unable to clone the JAWA project (branch '$branch') from GitHub." >>/var/log/jawaInstall.log 2>&1
+    exit 2
+  fi
   # Restore backup?
   /usr/bin/clear
   /bin/echo -ne '[#############           ](64%) Checking for backups... '
   /bin/echo '[#############           ](64%) Checking for backups... ' >>/var/log/jawaInstall.log 2>&1
   /bin/sleep 1  & spinner $! ""
 if [ -d "$currentDir/jawabackup-$timenow" ]; then
+    backupJAWA="$currentDir/jawabackup-$timenow"
     while true; do
       /bin/echo ""
       if [ "$upgradeOption" == "yes" ]; then
@@ -713,10 +700,6 @@ function spinner() {
   return $?
 }
 
-("$@") &
-
-
-
 displayMenu() {
   while true; do
     read -r -p "Please select from the following options:
@@ -805,7 +788,7 @@ restoreBackup() {
               /bin/echo "Migrating cron..."
               /bin/cp "$currentDir/jawabackup-$timenow/v2/cron.json" "$currentDir/jawabackup-$timenow/data/"
             fi
-            if [ -e "$currentDir/jawabackup-$timenow/v2/webhook.conf" -o "$currentDir/jawabackup-$timenow/v2/jp_webhooks.json" ]; then
+            if [ -e "$currentDir/jawabackup-$timenow/v2/webhook.conf" ] || [ -e "$currentDir/jawabackup-$timenow/v2/jp_webhooks.json" ]; then
               /bin/echo "Migrating webhooks..."
               /usr/bin/python3 "$installDir/jawa/bin/v2_upgrade.py" "$currentDir/jawabackup-$timenow" >>/var/log/jawaInstall.log 2>&1 & spinner $! ""
             fi
@@ -928,10 +911,10 @@ installDir=/usr/local
 timenow=$(date +%m-%d-%y_%T)
 
 #branch="main"  # Default branch name if no arguments are provided
-​
+
 while [[ $# -gt 0 ]]; do
   key="$1"
-​
+
   case $key in
     b|branch)
       branch="$2"
@@ -944,12 +927,12 @@ while [[ $# -gt 0 ]]; do
       ;;
   esac
 done
-​
-# If no branch argument was provided, default to "develop"
+
+# If no branch argument was provided, default to "main" (production install path)
 if [ -z "$branch" ]; then
   branch="main"
 fi
-​
+
 
 
 # Checking for sudo

From 52f052095e5cb50622d5e4091d0199c68f6be8d1 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 23 Jul 2026 09:46:44 -0500
Subject: [PATCH 33/84] chore: stop tracking runtime webhooks.json, ignore
 scripts/

data/webhooks.json was listed in .gitignore but still tracked, so the ignore
rule was inert and local runtime state showed as diffs. Untrack it
(data_store recreates it lazily) and add scripts/ to .gitignore since it is
created at runtime.
---
 .gitignore         | 1 +
 data/webhooks.json | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)
 delete mode 100644 data/webhooks.json

diff --git a/.gitignore b/.gitignore
index 62e1d12..52157c2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -162,3 +162,4 @@ data/credentials.json
 data/cron.json
 data/webhooks.json
 resources/files/
+scripts/
diff --git a/data/webhooks.json b/data/webhooks.json
deleted file mode 100644
index 0637a08..0000000
--- a/data/webhooks.json
+++ /dev/null
@@ -1 +0,0 @@
-[]
\ No newline at end of file

From 6187199ed628b01362a107ba9684e9ccf827aa70 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 22 Jul 2026 23:25:57 -0500
Subject: [PATCH 34/84] refactor: clean up the setup form layout

Wrap each field in a standard mb-3 group with visible form-labels and
example-URL placeholders, drop the ad-hoc text-center/visually-hidden
styling, and simplify the session-timeout control. Update the timeout test
to assert all tiers are offered rather than the removed help-text note.
---
 templates/setup/setup.html | 51 ++++++++++++++++++--------------------
 tests/test_session.py      |  5 ++--
 2 files changed, 27 insertions(+), 29 deletions(-)

diff --git a/templates/setup/setup.html b/templates/setup/setup.html
index ab07860..5467707 100644
--- a/templates/setup/setup.html
+++ b/templates/setup/setup.html
@@ -55,45 +55,42 @@ <h2>Server Setup</h2>
                 </p>
                 <form method="post" action="/setup" enctype="multipart/form-data">
 
-                    <label for="jawa-address" class="visually-hidden">JAWA Server Address FQDN</label>
-                    <input id="jawa-address" type="text" class="form-control text-center" name="address" pattern="https?://.+" title="Use https://"
-                           value="{{ jawa_url if jawa_url }}" placeholder="JAWA Server Address FQDN" required autofocus>
-
-                    <div class="mb-3 form-check text-center">
-                        <input type="checkbox" class="form-check-input text-center" name="jss-lock" id="jss-lock"
-                               value={{ jps_url }} checked>
-                        <label class="form-check-label text-center" for="jss-lock"> Lock your JAWA to {{ jps_url }}</label>
+                    <div class="mb-3">
+                        <label for="jawa-address" class="form-label">JAWA server address</label>
+                        <input id="jawa-address" type="text" class="form-control" name="address" pattern="https?://.+" title="Use https://"
+                               value="{{ jawa_url if jawa_url }}" placeholder="https://jawa.example.com" required autofocus>
                     </div>
 
+                    <div class="mb-3 form-check">
+                        <input type="checkbox" class="form-check-input" name="jss-lock" id="jss-lock"
+                               value="{{ jps_url }}" checked>
+                        <label class="form-check-label" for="jss-lock">Lock your JAWA to {{ jps_url }}</label>
+                    </div>
 
-                    <div class="mb-3 form-check text-center">
+                    <div class="mb-3 form-check">
                         <input type="checkbox" class="form-check-input" name="alternate-jps" id="alternate-jps"
                                value="enabled" {% if jps_url2 %}checked{% endif %}>
-                        <label class="form-check-label" for="alternate-jps">Add an alternate Jamf Pro Server:</label>
+                        <label class="form-check-label" for="alternate-jps">Add an alternate Jamf Pro Server</label>
                     </div>
 
-                    <label for="alternate-jps-url" class="visually-hidden">Alternate Jamf Pro Server URL</label>
-                    <input id="alternate-jps-url" type="text" class="form-control text-center"
-                           placeholder="Alternate Jamf Pro Server URL"
-                           name="alternate"
-                           pattern="https?://.+"
-                           title="Use https://"
-                           value="{{ jps_url2 if jps_url2 }}">
+                    <div class="mb-3">
+                        <label for="alternate-jps-url" class="form-label">Alternate Jamf Pro Server URL</label>
+                        <input id="alternate-jps-url" type="text" class="form-control"
+                               placeholder="https://alternate.jamfcloud.com"
+                               name="alternate"
+                               pattern="https?://.+"
+                               title="Use https://"
+                               value="{{ jps_url2 if jps_url2 }}">
+                    </div>
 
-                    <div class="mb-3 text-start">
+                    <div class="mb-3">
                         <label for="session-timeout" class="form-label">Session timeout</label>
-                        <select id="session-timeout" name="session_timeout_minutes" class="form-select" aria-describedby="session-timeout-help">
+                        <select id="session-timeout" name="session_timeout_minutes" class="form-select">
                             <option value="15" {% if session_timeout == 15 %}selected{% endif %}>15 minutes (default)</option>
                             <option value="60" {% if session_timeout == 60 %}selected{% endif %}>1 hour</option>
-                            <option value="240" {% if session_timeout == 240 %}selected{% endif %}>4 hours (Extended)</option>
-                            <option value="480" {% if session_timeout == 480 %}selected{% endif %}>8 hours (Extended)</option>
+                            <option value="240" {% if session_timeout == 240 %}selected{% endif %}>4 hours</option>
+                            <option value="480" {% if session_timeout == 480 %}selected{% endif %}>8 hours</option>
                         </select>
-                        <small id="session-timeout-help" class="form-text text-muted">
-                            Longer sessions are convenient for workflow testing but increase risk:
-                            a signed-in console left unattended could be misused on-site. Extended
-                            tiers (4h/8h) are a deliberate trade-off; the 15-minute default is the
-                            most secure.
-                        </small>
                     </div>
 
                     <div class="d-flex justify-content-center container-fluid">
diff --git a/tests/test_session.py b/tests/test_session.py
index c4cf859..4cd418e 100644
--- a/tests/test_session.py
+++ b/tests/test_session.py
@@ -118,8 +118,9 @@ def test_setup_form_shows_timeout_control(logged_in_client, jawa_env):
     assert 'name="session_timeout_minutes"' in body
     # Current value preselected.
     assert 'value="240" selected' in body
-    # Extended tiers carry a security-trade-off note.
-    assert "Extended" in body
+    # All tiers offered, including the extended ones.
+    for minutes in ("15", "60", "240", "480"):
+        assert f'value="{minutes}"' in body
 
 
 def test_layout_injects_effective_timeout(logged_in_client, jawa_env):

From b780e71a8f23049ecaad815d7f50025e617f8cbc Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 23 Jul 2026 16:45:33 -0500
Subject: [PATCH 35/84] fix: close bogus-credential login bypass via stale
 token (security)

A stale API token from a prior real login survived logout and a failed
token fetch, so bogus credentials against a non-Jamf URL could reach the
dashboard: _validate_credentials only checked that session["token"] was
truthy, and _verify_jamf_access trusted any HTTP 200.

Defense in depth, each layer independently blocks the bypass:
- get_token() clears token/expires before fetching, so a failed fetch
  cannot leave a stale token behind.
- login() honors get_token()'s failure redirect instead of discarding it.
- logout() always clears token/expires.
- _verify_jamf_access() requires the activationcode response to be valid
  Jamf-shaped JSON (activation_code key), rejecting non-Jamf 200s.

Adds regression tests for the stale-token bypass, logout token clearing,
and non-Jamf 200 rejection. The prior 3.0.2 guard test missed this
because it used a fresh session with no pre-existing token.
---
 bin/tokens.py       |   6 +++
 tests/conftest.py   |   7 +++
 tests/test_login.py | 103 ++++++++++++++++++++++++++++++++++++++++++++
 views/home_view.py  |  32 +++++++++++++-
 4 files changed, 147 insertions(+), 1 deletion(-)

diff --git a/bin/tokens.py b/bin/tokens.py
index e9f70a4..cd9441c 100644
--- a/bin/tokens.py
+++ b/bin/tokens.py
@@ -37,6 +37,12 @@
 
 
 def get_token() -> Optional[Response]:
+    # Clear any prior token up front so a failed fetch can never leave a
+    # stale token from an earlier (real) login behind — that stale token
+    # was the crux of the bogus-credential bypass: _validate_credentials
+    # only checks that session["token"] is truthy.
+    session.pop("token", None)
+    session.pop("expires", None)
     try:
         resp = requests.post(
             f"{session['url']}/api/v1/auth/token",
diff --git a/tests/conftest.py b/tests/conftest.py
index 09abcba..457d110 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -84,6 +84,13 @@ def _fake_jamf_post(url, **kwargs):
 
 
 def _fake_jamf_get(url, **kwargs):
+    # /JSSResource/activationcode is the endpoint login uses to confirm
+    # the host is really Jamf Pro; answer with the Jamf-shaped JSON so
+    # _verify_jamf_access accepts it. Other GETs get a benign payload.
+    if url.endswith("/JSSResource/activationcode"):
+        return FakeJamfResponse(
+            {"activation_code": {"organization_name": "Test Org"}}
+        )
     return FakeJamfResponse({})
 
 
diff --git a/tests/test_login.py b/tests/test_login.py
index 69a8318..b0e0ef2 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -134,6 +134,109 @@ def raise_for_status(self):
     assert "/logout" in resp.headers.get("Location", "")
 
 
+class NotJamfResponse:
+    """A reachable non-Jamf endpoint: HTTP 200 whose body is not JSON.
+
+    Any random website answers /JSSResource/activationcode with a 200
+    HTML page and its token endpoint with non-JSON, so this stands in
+    for `fiddlefaddle.com` and friends.
+    """
+
+    status_code = 200
+
+    def json(self):
+        raise ValueError("not JSON")
+
+    def raise_for_status(self):
+        pass
+
+
+def test_logout_clears_token(logged_in_client):
+    # A stale token surviving logout is the core of the bypass: a later
+    # bogus login sees a truthy session["token"] and sails past the
+    # credential gate. Logout must clear it.
+    with logged_in_client.session_transaction() as sess:
+        assert sess.get("token"), "fixture should have logged in with a token"
+    logged_in_client.get("/logout")
+    with logged_in_client.session_transaction() as sess:
+        assert not sess.get("token"), "logout must clear the API token"
+
+
+def test_stale_token_blocks_bogus_login(logged_in_client, monkeypatch):
+    # THE BYPASS: reproduce a real prior Jamf login (logged_in_client has
+    # a valid session token), then attempt login with bogus creds against
+    # a non-Jamf URL that merely returns 200. Before the fix the stale
+    # token let this reach the dashboard.
+    import requests
+
+    # Plant a stale token as if a prior real login left one behind, even
+    # if logout were skipped.
+    with logged_in_client.session_transaction() as sess:
+        sess["token"] = "stale-token-from-prior-real-login"
+        sess["expires"] = "2099-01-01T00:00:00.000+0000"
+
+    monkeypatch.setattr(requests, "post", lambda *a, **k: NotJamfResponse())
+    monkeypatch.setattr(requests, "get", lambda *a, **k: NotJamfResponse())
+
+    resp = logged_in_client.post(
+        "/login",
+        data={
+            "url": "https://fiddlefaddle.com",
+            "username": "fjdsklj",
+            "password": "fjdklsjl",
+        },
+    )
+    assert resp.status_code == 302
+    assert "/dashboard" not in resp.headers.get("Location", "")
+    assert "/logout" in resp.headers.get("Location", "")
+
+
+def test_verify_jamf_access_rejects_non_jamf_200(client, jawa_env, monkeypatch):
+    # Defense in depth: even if a token were present, a 200 from a
+    # non-Jamf site (body not the activationcode JSON shape) must not
+    # count as Jamf access. Token endpoint returns a real-looking token
+    # so the only thing standing between bogus creds and the dashboard
+    # is the shape check in _verify_jamf_access.
+    import json as _json
+    import requests
+
+    jawa_env.server_file.write_text(_json.dumps({"brand": "JAWA"}))
+
+    class TokenButNotJamf:
+        status_code = 200
+
+        def __init__(self, kind):
+            self.kind = kind
+
+        def json(self):
+            if self.kind == "token":
+                return {"token": "looks-real", "expires":
+                        "2099-01-01T00:00:00.000+0000"}
+            raise ValueError("activationcode body is HTML, not JSON")
+
+        def raise_for_status(self):
+            pass
+
+    monkeypatch.setattr(
+        requests, "post", lambda *a, **k: TokenButNotJamf("token")
+    )
+    monkeypatch.setattr(
+        requests, "get", lambda *a, **k: TokenButNotJamf("activationcode")
+    )
+
+    resp = client.post(
+        "/login",
+        data={
+            "url": "https://fiddlefaddle.com",
+            "username": "fjdsklj",
+            "password": "fjdklsjl",
+        },
+    )
+    assert resp.status_code == 302
+    assert "/dashboard" not in resp.headers.get("Location", "")
+    assert "/logout" in resp.headers.get("Location", "")
+
+
 def test_failed_login_does_not_reflect_script_injection(
     client, jawa_env, fake_jamf
 ):
diff --git a/views/home_view.py b/views/home_view.py
index 457fef5..08e0443 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -132,6 +132,27 @@ def _verify_jamf_access() -> Union[Response, None]:
             verify=verify_ssl,
         )
         resp.raise_for_status()
+        # A reachable non-Jamf site also answers 200 here; confirm the
+        # body is the Jamf activationcode JSON shape before trusting it.
+        # Any random website returning an HTML 200 must NOT count as a
+        # successful Jamf login (defense in depth behind the token check).
+        body = resp.json()
+        if not isinstance(body, dict) or "activation_code" not in body:
+            logthis.error(
+                f"[{session.get('url')}] activationcode response was not "
+                "Jamf-shaped; refusing login."
+            )
+            return _login_error(
+                "Login error",
+                "that URL did not respond like a Jamf Pro server",
+            )
+    except ValueError as err:
+        # resp.json() raised: the endpoint returned non-JSON (e.g. an
+        # HTML page from a non-Jamf host).
+        logthis.error(f"Error occurred: {err}")
+        return _login_error(
+            "Login error", "that URL did not respond like a Jamf Pro server"
+        )
     except requests.exceptions.HTTPError as err:
         logthis.error(f"Error occurred: {err}")
         return _login_error(
@@ -163,7 +184,12 @@ def login() -> Response:
         session["b64_auth"] = base64.b64encode(
             str.encode(f"{session.get('username')}:{session.get('password')}")
         )
-        get_token()
+        # Honor a token-fetch failure: get_token() returns a redirect
+        # when the token endpoint is unreachable or answers with a
+        # non-Jamf body. Ignoring it let login proceed on a failed fetch.
+        token_error = get_token()
+        if token_error:
+            return token_error
         logthis.info(
             f"[{session.get('url')}] Attempting login for: "
             f"{session.get('username')}"
@@ -209,6 +235,10 @@ def logout() -> Union[Response, str]:
         invalidate_token()
         logthis.info("Logging Out: " + str(escape(session["username"])))
         session.pop("username", None)
+    # Always clear API token state on logout so a stale token can never
+    # outlive the session and satisfy a later login's credential check.
+    session.pop("token", None)
+    session.pop("expires", None)
     return load_home(error_title, error_message)
 
 

From 4e6cd8d99a8b5c3ea5172d4ce3117e5c632537b7 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 23 Jul 2026 16:45:49 -0500
Subject: [PATCH 36/84] fix: render a single autofocus on the login form

The login form set autofocus on both the Jamf URL and Username fields.
Duplicate autofocus is invalid HTML with browser-dependent focus
behavior. Make the username autofocus conditional on jsslock so exactly
one field carries it in every branch: the URL field when it renders,
the username field when the URL is locked and hidden.
---
 templates/home.html | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/templates/home.html b/templates/home.html
index ff3581d..9ee0c4d 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -62,7 +62,10 @@ <h1 class="d-flex justify-content-center">{% if app_name %}{{ app_name }}{% else
                    class="form-control text-center" autofocus>
         {% endif %}
         <label for="login-username" class="visually-hidden">Username</label>
-        <input id="login-username" name="username" type="text" placeholder="Username" required value="{{ prev_username if prev_username }}" class="form-control text-center" autofocus>
+        {# autofocus only when the URL field above isn't rendered (jsslock),
+           so exactly one field ever carries autofocus — duplicate autofocus
+           is invalid HTML with browser-dependent focus behavior. #}
+        <input id="login-username" name="username" type="text" placeholder="Username" required value="{{ prev_username if prev_username }}" class="form-control text-center"{% if jsslock %} autofocus{% endif %}>
         <label for="login-password" class="visually-hidden">Password</label>
         <input id="login-password" name="password" type="password" placeholder="Password" required class="form-control text-center">
 

From 47f58c3396faba23f57764cc8d10a4d60c005162 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 24 Jul 2026 10:22:00 -0500
Subject: [PATCH 37/84] feat: add success-context session flash + PRG on
 automation create (J13)

Add _flash_success() to stash the rich success context in a one-shot
session flash and redirect to /success, and have /success pop it. Convert
automation create to redirect-via-flash so browser-back can no longer
re-POST the create. Falls back to the existing success_msg query param
for other callers. Adds tests/test_automations.py.
---
 app.py                    |  8 ++++++++
 tests/test_automations.py | 39 +++++++++++++++++++++++++++++++++++++++
 views/automation_view.py  | 18 +++++++++++++-----
 3 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 tests/test_automations.py

diff --git a/app.py b/app.py
index 75da6a7..0b99f5c 100644
--- a/app.py
+++ b/app.py
@@ -438,6 +438,14 @@ def success(success_msg="") -> Union[Response, str]:
                 error_message="Please sign in again",
             )
         )
+    flashed = session.pop("success_ctx", None)
+    if flashed:
+        return render_template(
+            "success.html",
+            login="true",
+            username=str(escape(session["username"])),
+            **flashed,
+        )
     success_msg = request.args.get("success_msg")
     if success_msg:
         success_msg = escape(success_msg)
diff --git a/tests/test_automations.py b/tests/test_automations.py
new file mode 100644
index 0000000..b141f84
--- /dev/null
+++ b/tests/test_automations.py
@@ -0,0 +1,39 @@
+"""Automation create/edit/delete success flow: PRG + one-shot flash."""
+
+import io
+
+
+def _custom_create_data():
+    # custom_handler.process_create requires a name + an uploaded script.
+    return {
+        "custom_name": "prg-test-hook",
+        "description": "prg test",
+        "new_file": (io.BytesIO(b"#!/usr/bin/env python3\nprint('hi')\n"),
+                     "hook.py"),
+    }
+
+
+def test_create_redirects_to_success(logged_in_client, jawa_env):
+    resp = logged_in_client.post(
+        "/automations/custom/new",
+        data=_custom_create_data(),
+        content_type="multipart/form-data",
+    )
+    # PRG: the POST must 302 to /success, not render 200 inline.
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
+
+
+def test_success_flash_is_one_shot(logged_in_client, jawa_env):
+    logged_in_client.post(
+        "/automations/custom/new",
+        data=_custom_create_data(),
+        content_type="multipart/form-data",
+    )
+    # First GET renders the flashed context; second GET has no flash left.
+    first = logged_in_client.get("/success")
+    assert first.status_code == 200
+    assert b"New webhook created" in first.data
+    second = logged_in_client.get("/success")
+    # Flash popped: the create message must not persist on a re-load.
+    assert b"New webhook created" not in second.data
diff --git a/views/automation_view.py b/views/automation_view.py
index 08bb139..3328932 100644
--- a/views/automation_view.py
+++ b/views/automation_view.py
@@ -26,7 +26,7 @@
 #
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
-from typing import Union
+from typing import Any, Union
 
 from flask import (
     Blueprint,
@@ -77,6 +77,16 @@ def _get_session_data() -> dict:
     }
 
 
+def _flash_success(**ctx: Any) -> Response:
+    """Stash success context in a one-shot session flash and redirect to
+    /success (Post-Redirect-Get). Keeps the POST from being the terminal
+    history entry, so browser-back cannot re-issue it. Values must be
+    JSON-serializable (strings/None); this mirrors the login_retry flash
+    pattern in home_view."""
+    session["success_ctx"] = {k: v for k, v in ctx.items() if v is not None}
+    return redirect(url_for("success"))
+
+
 def _error_page(
     title: str, message: str, link: str = None, link_text: str = None
 ) -> str:
@@ -191,9 +201,8 @@ def create(auto_type: str) -> Union[Response, str]:
         else:
             add_webhook(entry)
 
-    return render_template(
-        SUCCESS_TEMPLATE,
-        webhooks="success",
+    return _flash_success(
+        auto_type=auto_type,
         success_msg=result.get("success_msg", "Created successfully."),
         new_link=result.get("new_link"),
         new_here=result.get("new_here"),
@@ -201,7 +210,6 @@ def create(auto_type: str) -> Union[Response, str]:
         smart_group_instructions=result.get("smart_group_instructions"),
         extra_notice=result.get("extra_notice"),
         custom_header=result.get("custom_header"),
-        username=session.get("username"),
     )
 
 

From dc906af1df8ae731bd59954ea2d9b50a3eaaa229 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 24 Jul 2026 10:26:36 -0500
Subject: [PATCH 38/84] feat: convert automation edit + delete to PRG (J13)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Route edit and delete success through _flash_success so their POSTs
redirect to /success instead of rendering inline — browser-back no longer
re-issues an edit or delete.
---
 tests/test_automations.py | 33 +++++++++++++++++++++++++++++++++
 views/automation_view.py  | 12 +++---------
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/tests/test_automations.py b/tests/test_automations.py
index b141f84..c953aff 100644
--- a/tests/test_automations.py
+++ b/tests/test_automations.py
@@ -37,3 +37,36 @@ def test_success_flash_is_one_shot(logged_in_client, jawa_env):
     second = logged_in_client.get("/success")
     # Flash popped: the create message must not persist on a re-load.
     assert b"New webhook created" not in second.data
+
+
+def test_edit_redirects_to_success(logged_in_client, jawa_env):
+    logged_in_client.post(
+        "/automations/custom/new",
+        data=_custom_create_data(),
+        content_type="multipart/form-data",
+    )
+    logged_in_client.get("/success")  # drain the create flash
+    resp = logged_in_client.post(
+        "/automations/custom/prg-test-hook/edit",
+        data={
+            "custom_name": "prg-test-hook",
+            "description": "edited",
+        },
+        content_type="multipart/form-data",
+    )
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
+
+
+def test_delete_redirects_to_success(logged_in_client, jawa_env):
+    logged_in_client.post(
+        "/automations/custom/new",
+        data=_custom_create_data(),
+        content_type="multipart/form-data",
+    )
+    logged_in_client.get("/success")
+    resp = logged_in_client.post(
+        "/automations/custom/prg-test-hook/delete",
+    )
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
diff --git a/views/automation_view.py b/views/automation_view.py
index 3328932..cb8279e 100644
--- a/views/automation_view.py
+++ b/views/automation_view.py
@@ -307,9 +307,8 @@ def edit(auto_type: str, name: str) -> Union[Response, str]:
         # e.g. save_script rejecting an upload with no shebang.
         return _error_page("Invalid script", str(err))
 
-    return render_template(
-        SUCCESS_TEMPLATE,
-        webhooks="success",
+    return _flash_success(
+        auto_type=auto_type,
         success_msg=result.get("success_msg", "Updated successfully."),
         new_link=result.get("new_link"),
         new_here=result.get("new_here"),
@@ -317,7 +316,6 @@ def edit(auto_type: str, name: str) -> Union[Response, str]:
         smart_group_instructions=result.get("smart_group_instructions"),
         extra_notice=result.get("extra_notice"),
         custom_header=result.get("custom_header"),
-        username=session.get("username"),
     )
 
 
@@ -370,11 +368,7 @@ def delete(auto_type: str, name: str) -> Union[Response, str]:
     success_msg = (
         f"Successfully deleted the {handler.display_name} automation: {name}."
     )
-    return render_template(
-        SUCCESS_TEMPLATE,
-        success_msg=success_msg,
-        username=session.get("username"),
-    )
+    return _flash_success(auto_type=auto_type, success_msg=success_msg)
 
 
 # --- Helpers ---

From 0420d55d794d2f93a47fef268801f36ce0393203 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 24 Jul 2026 10:30:11 -0500
Subject: [PATCH 39/84] feat: convert /setup success to PRG (J13)

The setup POST rendered success.html inline; redirect to /success instead
so it matches the automation flow and browser-back can't re-POST setup.
---
 app.py                |  7 ++-----
 tests/test_session.py | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/app.py b/app.py
index 0b99f5c..235f8e1 100644
--- a/app.py
+++ b/app.py
@@ -336,11 +336,8 @@ def setup() -> Union[Response, str]:
             with open(server_json_file, "w+") as outfile:
                 json.dump(data, outfile)
 
-        return render_template(
-            "success.html",
-            webhooks="success",
-            success_msg="JAWA Setup Complete!",
-            username=str(escape(session["username"])),
+        return redirect(
+            url_for("success", success_msg="JAWA Setup Complete!")
         )
     else:
         logthis.debug(
diff --git a/tests/test_session.py b/tests/test_session.py
index 4cd418e..8a3ff0f 100644
--- a/tests/test_session.py
+++ b/tests/test_session.py
@@ -108,6 +108,20 @@ def test_setup_rejects_off_ladder_timeout(logged_in_client, jawa_env):
     assert data["session_timeout_minutes"] == 15
 
 
+def test_setup_post_redirects_to_success(logged_in_client, jawa_env):
+    # PRG: a successful setup POST redirects to /success rather than
+    # rendering inline, so browser-back can't re-POST setup (J13).
+    resp = logged_in_client.post(
+        "/setup",
+        data={
+            "address": "https://jawa.example.test",
+            "session_timeout_minutes": "15",
+        },
+    )
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
+
+
 def test_setup_form_shows_timeout_control(logged_in_client, jawa_env):
     import json
     data = json.loads(jawa_env.server_file.read_text())

From ee7de28655e79cc01998728c3d9a5f3a7b0b6942 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 24 Jul 2026 10:33:26 -0500
Subject: [PATCH 40/84] feat: give the success page forward actions instead of
 history.back() (J13)

Replace the blind history.back() button (which walked into the now-spent
form) with forward actions: View it (when the automation exposes a link),
Create another (for the same type), and Dashboard.
---
 templates/success.html    | 13 ++++++++++---
 tests/test_automations.py | 17 +++++++++++++++++
 views/automation_view.py  |  1 -
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/templates/success.html b/templates/success.html
index c9dbaf9..00c5395 100644
--- a/templates/success.html
+++ b/templates/success.html
@@ -214,9 +214,16 @@ <h1 class="success-title">Success!</h1>
         {% endif %}
 
         <div class="success-actions">
-            <button type="button" onclick="history.back()" class="btn-success-secondary">
-                ← Back
-            </button>
+            {% if new_link and new_here %}
+            <a href="{{ new_link }}" target="_blank" class="btn-success-secondary">
+                View it →
+            </a>
+            {% endif %}
+            {% if auto_type %}
+            <a href="{{ url_for('automations.create', auto_type=auto_type) }}" class="btn-success-secondary">
+                Create another
+            </a>
+            {% endif %}
             <a href="/dashboard" class="btn-success-primary">
                 Dashboard →
             </a>
diff --git a/tests/test_automations.py b/tests/test_automations.py
index c953aff..a0bc449 100644
--- a/tests/test_automations.py
+++ b/tests/test_automations.py
@@ -70,3 +70,20 @@ def test_delete_redirects_to_success(logged_in_client, jawa_env):
     )
     assert resp.status_code == 302
     assert "/success" in resp.headers["Location"]
+
+
+def test_success_has_forward_actions_not_history_back(
+    logged_in_client, jawa_env
+):
+    logged_in_client.post(
+        "/automations/custom/new",
+        data=_custom_create_data(),
+        content_type="multipart/form-data",
+    )
+    resp = logged_in_client.get("/success")
+    body = resp.data.decode()
+    # No blind history.back() — it walks into a spent form.
+    assert "history.back()" not in body
+    # Forward actions present: Create another (for this type) + Dashboard.
+    assert "/automations/custom/new" in body   # Create another
+    assert "/dashboard" in body                # Dashboard
diff --git a/views/automation_view.py b/views/automation_view.py
index cb8279e..377d2b1 100644
--- a/views/automation_view.py
+++ b/views/automation_view.py
@@ -62,7 +62,6 @@
 
 blueprint = Blueprint("automations", __name__)
 
-SUCCESS_TEMPLATE = "success.html"
 LIST_TYPE_ENDPOINT = "automations.list_type"
 
 

From 21ccb6e84a99c512ed8a1d4897c66475f5b7b709 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 24 Jul 2026 10:43:54 -0500
Subject: [PATCH 41/84] test: assert smart-group notice survives the success
 flash (J13)

J13's PRG conversion stashes a rich success context in
session["success_ctx"] and 302-redirects to /success. The acceptance
criterion "smart-group notices still render after the redirect" was only
proven generically via success_msg, never for the smart-group context.

Add test_smart_group_notice_survives_flash: create a jamfpro automation
for SmartGroupComputerMembershipChange, assert the POST 302s to /success,
then GET /success and assert the real NOTICE string
("NOTICE!  This webhook is not yet enabled.") renders in the body -
proving the rich context survives the one-shot flash.
---
 tests/test_automations.py | 43 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/tests/test_automations.py b/tests/test_automations.py
index a0bc449..e6e1bd5 100644
--- a/tests/test_automations.py
+++ b/tests/test_automations.py
@@ -2,6 +2,8 @@
 
 import io
 
+import requests
+
 
 def _custom_create_data():
     # custom_handler.process_create requires a name + an uploaded script.
@@ -72,6 +74,47 @@ def test_delete_redirects_to_success(logged_in_client, jawa_env):
     assert "/success" in resp.headers["Location"]
 
 
+def test_smart_group_notice_survives_flash(
+    logged_in_client, jawa_env, monkeypatch
+):
+    # A smart-group event makes jamf_handler return a smart_group_notice.
+    # The Jamf create POST reads resp.text (for the <id> scrape + logging),
+    # which the shared fake_jamf post stub doesn't provide — so give this
+    # test a post fake that returns Jamf-shaped XML.
+    class _XmlResponse:
+        status_code = 201
+        text = "<webhook><id>42</id></webhook>"
+
+    monkeypatch.setattr(
+        requests, "post", lambda *a, **k: _XmlResponse()
+    )
+
+    resp = logged_in_client.post(
+        "/automations/jamfpro/new",
+        data={
+            "webhook_name": "sg-membership-hook",
+            "event": "SmartGroupComputerMembershipChange",
+            "description": "smart group prg test",
+            "choice": "none",
+            "new_file": (
+                io.BytesIO(b"#!/usr/bin/env python3\nprint('hi')\n"),
+                "hook.py",
+            ),
+        },
+        content_type="multipart/form-data",
+    )
+    # PRG: the POST must 302 to /success, stashing the rich context.
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
+
+    # The smart-group NOTICE must survive the one-shot flash and render
+    # on the redirected GET — proving the rich context, not just the
+    # generic success_msg, crosses the redirect.
+    page = logged_in_client.get("/success")
+    assert page.status_code == 200
+    assert b"NOTICE!  This webhook is not yet enabled." in page.data
+
+
 def test_success_has_forward_actions_not_history_back(
     logged_in_client, jawa_env
 ):

From 672493f52eefccd9b9154feed588939b8e501724 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 07:43:23 -0500
Subject: [PATCH 42/84] feat: add the Jamf webhook event catalog as static
 reference data (J15)

Ports a 23-event catalog (grouping, field schemas, sample payloads)
and reads it through a single data_store accessor. Reconciled to Jamf
Pro's real event set: DeviceRateLimited added, MobileDeviceUnenrolled
recased to MobileDeviceUnEnrolled -- the event string is stored on the
webhook and matched against Jamf's payload, so the casing mattered.

DeviceRateLimited ships marked pending: its field schema and sample
payload need confirmation against a live Jamf Pro instance rather
than invented values.
---
 bin/data_store.py             |   32 +
 data/webhook_schemas.json     | 1057 +++++++++++++++++++++++++++++++++
 tests/conftest.py             |   10 +
 tests/test_webhook_catalog.py |  105 ++++
 4 files changed, 1204 insertions(+)
 create mode 100644 data/webhook_schemas.json
 create mode 100644 tests/test_webhook_catalog.py

diff --git a/bin/data_store.py b/bin/data_store.py
index 396d74e..951d1f7 100644
--- a/bin/data_store.py
+++ b/bin/data_store.py
@@ -44,6 +44,9 @@
 CRON_FILE = os.path.abspath(os.path.join(_base_dir, "data", "cron.json"))
 SERVER_FILE = os.path.abspath(os.path.join(_base_dir, "data", "server.json"))
 TIME_FILE = os.path.abspath(os.path.join(_base_dir, "data", "time.json"))
+WEBHOOK_SCHEMAS_FILE = os.path.abspath(
+    os.path.join(_base_dir, "data", "webhook_schemas.json")
+)
 SCRIPTS_DIR = os.path.abspath(os.path.join(_base_dir, "scripts"))
 
 
@@ -186,6 +189,35 @@ def get_time_data() -> Dict:
         return json.load(f)
 
 
+def get_webhook_schemas() -> Dict[str, Any]:
+    """Read the static Jamf Pro webhook event catalog.
+
+    Hand-maintained reference data, not runtime state: the file ships
+    with JAWA and is edited directly when Jamf Pro's event set changes.
+    Read on every call (it is small, and no caching keeps a stale copy
+    alive after an edit). Degrades to empty structures instead of
+    raising, because the Jamf automation form's event dropdown reads
+    this too and must still render if the file is damaged.
+    """
+    empty: Dict[str, Any] = {
+        "categories": {},
+        "schemas": {},
+        "examples": {},
+    }
+    try:
+        with open(WEBHOOK_SCHEMAS_FILE, "r", encoding="utf-8") as f:
+            data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        logthis.warning(
+            f"Webhook event catalog unreadable: {WEBHOOK_SCHEMAS_FILE}"
+        )
+        return empty
+    if not isinstance(data, dict):
+        logthis.warning("Webhook event catalog is not a JSON object.")
+        return empty
+    return {key: data.get(key) or {} for key in empty}
+
+
 # --- Script Management ---
 
 
diff --git a/data/webhook_schemas.json b/data/webhook_schemas.json
new file mode 100644
index 0000000..3e46846
--- /dev/null
+++ b/data/webhook_schemas.json
@@ -0,0 +1,1057 @@
+{
+  "_comment": "Static reference catalog of Jamf Pro webhook events: display grouping, per-event field schemas, and sample payloads. Hand-maintained, like data/time.json - edit this file directly when Jamf Pro's event set changes. Read by the Webhook Reference pages and by the Jamf Pro automation form's event dropdown, so every event listed under 'categories' needs a matching 'schemas' entry. An entry with \"pending\": true renders as 'not yet confirmed' instead of showing fields.",
+  "categories": {
+    "Computer Events": [
+      "ComputerAdded",
+      "ComputerCheckIn",
+      "ComputerInventoryCompleted",
+      "ComputerPatchPolicyCompleted",
+      "ComputerPolicyFinished",
+      "ComputerPushCapabilityChanged",
+      "SmartGroupComputerMembershipChange"
+    ],
+    "Mobile Device Events": [
+      "MobileDeviceCheckIn",
+      "MobileDeviceCommandCompleted",
+      "MobileDeviceEnrolled",
+      "MobileDeviceInventoryCompleted",
+      "MobileDevicePushSent",
+      "MobileDeviceUnEnrolled",
+      "SmartGroupMobileDeviceMembershipChange"
+    ],
+    "System Events": [
+      "DeviceAddedToDEP",
+      "DeviceRateLimited",
+      "JSSShutdown",
+      "JSSStartup",
+      "PatchSoftwareTitleUpdated",
+      "PushSent",
+      "RestAPIOperation",
+      "SCEPChallenge",
+      "SmartGroupUserMembershipChange"
+    ]
+  },
+  "schemas": {
+    "ComputerAdded": {
+      "description": "Triggered when a new computer record is created in Jamf Pro",
+      "schema": {
+        "alternateMacAddress": "<string> Secondary MAC address (e.g., Ethernet)",
+        "building": "<string> Building name assigned to the computer",
+        "department": "<string> Department name assigned to the computer",
+        "deviceName": "<string> Computer name as reported by the device",
+        "emailAddress": "<string> Email address of the assigned user",
+        "ipAddress": "<string> Current IP address of the computer",
+        "jssID": "<integer> Unique Jamf Pro computer record ID",
+        "macAddress": "<string> Primary MAC address (usually Wi-Fi)",
+        "model": "<string> Hardware model identifier",
+        "osBuild": "<string> macOS build number",
+        "osVersion": "<string> macOS version string",
+        "phone": "<string> Phone number of the assigned user",
+        "position": "<string> Job title of the assigned user",
+        "realName": "<string> Full name of the assigned user",
+        "reportedIpAddress": "<string> IP address reported during last check-in",
+        "room": "<string> Room number/name assigned to the computer",
+        "serialNumber": "<string> Hardware serial number",
+        "udid": "<string> Unique Device Identifier",
+        "userDirectoryID": "<string> Directory service user ID (e.g., from AD/LDAP)",
+        "username": "<string> Username of the assigned user"
+      }
+    },
+    "ComputerCheckIn": {
+      "description": "Triggered when a computer checks in with Jamf Pro",
+      "schema": {
+        "alternateMacAddress": "<string> Secondary MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Computer name",
+        "emailAddress": "<string> Assigned user email",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro computer ID",
+        "macAddress": "<string> Primary MAC address",
+        "model": "<string> Hardware model",
+        "osBuild": "<string> macOS build number",
+        "osVersion": "<string> macOS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "realName": "<string> User full name",
+        "reportedIpAddress": "<string> Reported IP address",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username"
+      }
+    },
+    "ComputerInventoryCompleted": {
+      "description": "Triggered when a computer completes a full inventory update",
+      "schema": {
+        "alternateMacAddress": "<string> Secondary MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Computer name",
+        "emailAddress": "<string> Assigned user email",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro computer ID",
+        "macAddress": "<string> Primary MAC address",
+        "model": "<string> Hardware model",
+        "osBuild": "<string> macOS build number",
+        "osVersion": "<string> macOS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "realName": "<string> User full name",
+        "reportedIpAddress": "<string> Reported IP address",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username"
+      }
+    },
+    "ComputerPatchPolicyCompleted": {
+      "description": "Triggered when a patch policy completes on a computer",
+      "schema": {
+        "alternateMacAddress": "<string> Secondary MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Computer name",
+        "emailAddress": "<string> Assigned user email",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro computer ID",
+        "macAddress": "<string> Primary MAC address",
+        "model": "<string> Hardware model",
+        "osBuild": "<string> macOS build number",
+        "osVersion": "<string> macOS version",
+        "patchPolicyId": "<integer> ID of the patch policy that ran",
+        "patchPolicyName": "<string> Name of the patch policy",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "realName": "<string> User full name",
+        "reportedIpAddress": "<string> Reported IP address",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "softwareTitleId": "<integer> ID of the software title being patched",
+        "softwareTitleName": "<string> Name of the software title",
+        "successful": "<boolean> Whether the patch was successfully installed",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username"
+      }
+    },
+    "ComputerPolicyFinished": {
+      "description": "Triggered when a policy finishes executing on a computer",
+      "schema": {
+        "alternateMacAddress": "<string> Secondary MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Computer name",
+        "emailAddress": "<string> Assigned user email",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro computer ID",
+        "macAddress": "<string> Primary MAC address",
+        "model": "<string> Hardware model",
+        "osBuild": "<string> macOS build number",
+        "osVersion": "<string> macOS version",
+        "phone": "<string> User phone number",
+        "policyId": "<integer> ID of the policy that finished",
+        "position": "<string> User job title",
+        "realName": "<string> User full name",
+        "reportedIpAddress": "<string> Reported IP address",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "successful": "<boolean> Whether the policy completed successfully",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username"
+      }
+    },
+    "ComputerPushCapabilityChanged": {
+      "description": "Triggered when a computer's push notification capability changes",
+      "schema": {
+        "alternateMacAddress": "<string> Secondary MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Computer name",
+        "emailAddress": "<string> Assigned user email",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro computer ID",
+        "macAddress": "<string> Primary MAC address",
+        "model": "<string> Hardware model",
+        "osBuild": "<string> macOS build number",
+        "osVersion": "<string> macOS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "realName": "<string> User full name",
+        "reportedIpAddress": "<string> Reported IP address",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username"
+      }
+    },
+    "MobileDeviceCheckIn": {
+      "description": "Triggered when a mobile device checks in with Jamf Pro",
+      "schema": {
+        "bluetoothMacAddress": "<string> Bluetooth MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Device name",
+        "emailAddress": "<string> Assigned user email",
+        "icciID": "<string> Integrated Circuit Card ID for SIM",
+        "imei": "<string> International Mobile Equipment Identity",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro mobile device ID",
+        "model": "<string> Device model",
+        "modelDisplay": "<string> Human-readable model name",
+        "osBuild": "<string> iOS/iPadOS build number",
+        "osVersion": "<string> iOS/iPadOS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "product": "<string> Product identifier",
+        "realName": "<string> User full name",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username",
+        "version": "<string> Device version",
+        "wifiMacAddress": "<string> Wi-Fi MAC address"
+      }
+    },
+    "MobileDeviceCommandCompleted": {
+      "description": "Triggered when an MDM command completes on a mobile device",
+      "schema": {
+        "bluetoothMacAddress": "<string> Bluetooth MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Device name",
+        "emailAddress": "<string> Assigned user email",
+        "icciID": "<string> ICC ID",
+        "imei": "<string> IMEI",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro mobile device ID",
+        "model": "<string> Device model",
+        "modelDisplay": "<string> Model display name",
+        "osBuild": "<string> OS build number",
+        "osVersion": "<string> OS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "product": "<string> Product identifier",
+        "realName": "<string> User full name",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username",
+        "version": "<string> Device version",
+        "wifiMacAddress": "<string> Wi-Fi MAC address"
+      }
+    },
+    "MobileDeviceEnrolled": {
+      "description": "Triggered when a mobile device completes MDM enrollment",
+      "schema": {
+        "bluetoothMacAddress": "<string> Bluetooth MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Device name",
+        "emailAddress": "<string> Assigned user email",
+        "icciID": "<string> ICC ID",
+        "imei": "<string> IMEI",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro mobile device ID",
+        "model": "<string> Device model",
+        "modelDisplay": "<string> Model display name",
+        "osBuild": "<string> OS build number",
+        "osVersion": "<string> OS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "product": "<string> Product identifier",
+        "realName": "<string> User full name",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username",
+        "version": "<string> Device version",
+        "wifiMacAddress": "<string> Wi-Fi MAC address"
+      }
+    },
+    "MobileDeviceInventoryCompleted": {
+      "description": "Triggered when a mobile device completes a full inventory update",
+      "schema": {
+        "bluetoothMacAddress": "<string> Bluetooth MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Device name",
+        "emailAddress": "<string> Assigned user email",
+        "icciID": "<string> ICC ID",
+        "imei": "<string> IMEI",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro mobile device ID",
+        "model": "<string> Device model",
+        "modelDisplay": "<string> Model display name",
+        "osBuild": "<string> OS build number",
+        "osVersion": "<string> OS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "product": "<string> Product identifier",
+        "realName": "<string> User full name",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username",
+        "version": "<string> Device version",
+        "wifiMacAddress": "<string> Wi-Fi MAC address"
+      }
+    },
+    "MobileDevicePushSent": {
+      "description": "Triggered when a push notification is sent to a mobile device",
+      "schema": {
+        "bluetoothMacAddress": "<string> Bluetooth MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Device name",
+        "emailAddress": "<string> Assigned user email",
+        "icciID": "<string> ICC ID",
+        "imei": "<string> IMEI",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro mobile device ID",
+        "model": "<string> Device model",
+        "modelDisplay": "<string> Model display name",
+        "osBuild": "<string> OS build number",
+        "osVersion": "<string> OS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "product": "<string> Product identifier",
+        "realName": "<string> User full name",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username",
+        "version": "<string> Device version",
+        "wifiMacAddress": "<string> Wi-Fi MAC address"
+      }
+    },
+    "MobileDeviceUnEnrolled": {
+      "description": "Triggered when a mobile device is unenrolled from MDM",
+      "schema": {
+        "bluetoothMacAddress": "<string> Bluetooth MAC address",
+        "building": "<string> Building name",
+        "department": "<string> Department name",
+        "deviceName": "<string> Device name",
+        "emailAddress": "<string> Assigned user email",
+        "icciID": "<string> ICC ID",
+        "imei": "<string> IMEI",
+        "ipAddress": "<string> Current IP address",
+        "jssID": "<integer> Jamf Pro mobile device ID",
+        "model": "<string> Device model",
+        "modelDisplay": "<string> Model display name",
+        "osBuild": "<string> OS build number",
+        "osVersion": "<string> OS version",
+        "phone": "<string> User phone number",
+        "position": "<string> User job title",
+        "product": "<string> Product identifier",
+        "realName": "<string> User full name",
+        "room": "<string> Room assignment",
+        "serialNumber": "<string> Serial number",
+        "udid": "<string> UDID",
+        "userDirectoryID": "<string> Directory user ID",
+        "username": "<string> Username",
+        "version": "<string> Device version",
+        "wifiMacAddress": "<string> Wi-Fi MAC address"
+      }
+    },
+    "JSSShutdown": {
+      "description": "Triggered when the Jamf Pro server shuts down",
+      "schema": {
+        "hostAddress": "<string> IP address or hostname of the Jamf Pro server",
+        "institution": "<string> Organization name configured in Jamf Pro",
+        "isClusterMaster": "<boolean> Whether this node is the cluster master",
+        "jssUrl": "<string> Full URL of the Jamf Pro server",
+        "webApplicationPath": "<string> File system path to the web application"
+      }
+    },
+    "JSSStartup": {
+      "description": "Triggered when the Jamf Pro server starts up",
+      "schema": {
+        "hostAddress": "<string> IP address or hostname of the Jamf Pro server",
+        "institution": "<string> Organization name configured in Jamf Pro",
+        "isClusterMaster": "<boolean> Whether this node is the cluster master",
+        "jssUrl": "<string> Full URL of the Jamf Pro server",
+        "webApplicationPath": "<string> File system path to the web application"
+      }
+    },
+    "DeviceAddedToDEP": {
+      "description": "Triggered when a device is added to Apple Business/School Manager (DEP)",
+      "schema": {
+        "assetTag": "<string> Asset tag assigned to the device",
+        "description": "<string> Device description from Apple",
+        "deviceAssignedDate": "<integer> Epoch timestamp when device was assigned",
+        "deviceEnrollmentProgramInstanceId": "<integer> DEP instance ID in Jamf Pro",
+        "model": "<string> Device model",
+        "serialNumber": "<string> Device serial number"
+      }
+    },
+    "DeviceRateLimited": {
+      "description": "Triggered when Jamf Pro rate limits communication with a device. Field schema and sample payload are pending confirmation against a live Jamf Pro instance.",
+      "schema": {},
+      "pending": true
+    },
+    "PatchSoftwareTitleUpdated": {
+      "description": "Triggered when a patch software title definition is updated",
+      "schema": {
+        "jssID": "<integer> Jamf Pro patch software title ID",
+        "lastUpdate": "<integer> Epoch timestamp of last update",
+        "latestVersion": "<string> Latest available version",
+        "name": "<string> Software title name",
+        "reportUrl": "<string> URL to the patch report in Jamf Pro"
+      }
+    },
+    "PushSent": {
+      "description": "Triggered when a push notification is sent (generic)",
+      "schema": {
+        "type": "<string> Type of push notification sent",
+        "jssID": "<integer> ID of the device or object receiving the push"
+      }
+    },
+    "RestAPIOperation": {
+      "description": "Triggered when a REST API operation is performed",
+      "schema": {
+        "authorizedUsername": "<string> Username that authenticated the request",
+        "objectID": "<integer> ID of the object that was operated on",
+        "objectName": "<string> Name of the object",
+        "objectTypeName": "<string> Type of object (e.g., Computer, Policy)",
+        "operationSuccessful": "<boolean> Whether the operation succeeded",
+        "restAPIOperationType": "<string> Type of operation (GET, POST, PUT, DELETE)"
+      }
+    },
+    "SCEPChallenge": {
+      "description": "Triggered when a SCEP challenge is requested",
+      "schema": {
+        "challenge": "<string> The SCEP challenge password",
+        "deviceName": "<string> Name of the device requesting SCEP",
+        "jssID": "<integer> Jamf Pro device ID",
+        "product": "<string> Device product type",
+        "serialNumber": "<string> Device serial number",
+        "udid": "<string> Device UDID"
+      }
+    },
+    "SmartGroupComputerMembershipChange": {
+      "description": "Triggered when a computer's smart group membership changes",
+      "schema": {
+        "computer": "<boolean> Indicates this is a computer group",
+        "groupAddedDevices": "<array> List of device IDs added to the group",
+        "groupAddedDevicesIds": "<array> List of Jamf Pro IDs for added devices",
+        "groupRemovedDevices": "<array> List of device IDs removed from the group",
+        "groupRemovedDevicesIds": "<array> List of Jamf Pro IDs for removed devices",
+        "jssID": "<integer> Smart group ID",
+        "name": "<string> Smart group name",
+        "smartGroup": "<boolean> Indicates this is a smart group"
+      }
+    },
+    "SmartGroupMobileDeviceMembershipChange": {
+      "description": "Triggered when a mobile device's smart group membership changes",
+      "schema": {
+        "computer": "<boolean> Indicates this is a computer group (false for mobile)",
+        "groupAddedDevices": "<array> List of device IDs added to the group",
+        "groupAddedDevicesIds": "<array> List of Jamf Pro IDs for added devices",
+        "groupRemovedDevices": "<array> List of device IDs removed from the group",
+        "groupRemovedDevicesIds": "<array> List of Jamf Pro IDs for removed devices",
+        "jssID": "<integer> Smart group ID",
+        "name": "<string> Smart group name",
+        "smartGroup": "<boolean> Indicates this is a smart group"
+      }
+    },
+    "SmartGroupUserMembershipChange": {
+      "description": "Triggered when a user's smart group membership changes",
+      "schema": {
+        "groupAddedUserIds": "<array> List of user IDs added to the group",
+        "groupAddedUsers": "<array> List of usernames added to the group",
+        "groupRemovedUserIds": "<array> List of user IDs removed from the group",
+        "groupRemovedUsers": "<array> List of usernames removed from the group",
+        "jssID": "<integer> Smart group ID",
+        "name": "<string> Smart group name",
+        "smartGroup": "<boolean> Indicates this is a smart group"
+      }
+    }
+  },
+  "examples": {
+    "ComputerAdded": {
+      "event": {
+        "alternateMacAddress": "3C:22:FB:7A:B2:45",
+        "building": "Corporate HQ",
+        "department": "Marketing",
+        "deviceName": "MARKETING-MBP-001",
+        "emailAddress": "sarah.johnson@acmecorp.com",
+        "ipAddress": "10.0.50.142",
+        "jssID": 1547,
+        "macAddress": "F0:18:98:3C:D5:21",
+        "model": "MacBookPro18,3",
+        "osBuild": "23F79",
+        "osVersion": "14.5",
+        "phone": "+1 (555) 234-5678",
+        "position": "Marketing Manager",
+        "realName": "Sarah Johnson",
+        "reportedIpAddress": "10.0.50.142",
+        "room": "4th Floor - 412A",
+        "serialNumber": "C02ZN1YZLVDL",
+        "udid": "5A4E3D2C-1B0A-9F8E-7D6C-5B4A3E2D1C0B",
+        "userDirectoryID": "-1",
+        "username": "sjohnson"
+      },
+      "webhook": {
+        "eventTimestamp": 1706745623000,
+        "id": 3,
+        "name": "Computer Events Webhook",
+        "webhookEvent": "ComputerAdded"
+      }
+    },
+    "ComputerCheckIn": {
+      "event": {
+        "alternateMacAddress": "A4:83:E7:2D:9F:1B",
+        "building": "Engineering Center",
+        "department": "Software Development",
+        "deviceName": "DEV-MBP-042",
+        "emailAddress": "mike.chen@acmecorp.com",
+        "ipAddress": "10.0.100.87",
+        "jssID": 892,
+        "macAddress": "88:66:5A:3E:2C:1A",
+        "model": "MacBookPro18,1",
+        "osBuild": "23F79",
+        "osVersion": "14.5",
+        "phone": "+1 (555) 345-6789",
+        "position": "Senior Software Engineer",
+        "realName": "Michael Chen",
+        "reportedIpAddress": "10.0.100.87",
+        "room": "Building B - Lab 3",
+        "serialNumber": "C02FM2ABMD6T",
+        "udid": "8B7C6D5E-4F3A-2B1C-0D9E-8F7A6B5C4D3E",
+        "userDirectoryID": "12847",
+        "username": "mchen"
+      },
+      "webhook": {
+        "eventTimestamp": 1706746234000,
+        "id": 3,
+        "name": "Computer Events Webhook",
+        "webhookEvent": "ComputerCheckIn"
+      }
+    },
+    "ComputerInventoryCompleted": {
+      "event": {
+        "alternateMacAddress": "DC:A6:32:7F:E5:94",
+        "building": "Finance Tower",
+        "department": "Accounting",
+        "deviceName": "FINANCE-iMac-007",
+        "emailAddress": "jennifer.williams@acmecorp.com",
+        "ipAddress": "10.0.75.201",
+        "jssID": 2341,
+        "macAddress": "14:98:77:5B:3A:C2",
+        "model": "iMac21,1",
+        "osBuild": "23F79",
+        "osVersion": "14.5",
+        "phone": "+1 (555) 456-7890",
+        "position": "Senior Accountant",
+        "realName": "Jennifer Williams",
+        "reportedIpAddress": "10.0.75.201",
+        "room": "Suite 500",
+        "serialNumber": "C02G1234HASH",
+        "udid": "A1B2C3D4-E5F6-7890-ABCD-EF1234567890",
+        "userDirectoryID": "15632",
+        "username": "jwilliams"
+      },
+      "webhook": {
+        "eventTimestamp": 1706747845000,
+        "id": 3,
+        "name": "Computer Events Webhook",
+        "webhookEvent": "ComputerInventoryCompleted"
+      }
+    },
+    "ComputerPatchPolicyCompleted": {
+      "event": {
+        "alternateMacAddress": "70:4D:7B:9A:2E:F3",
+        "building": "Corporate HQ",
+        "department": "Human Resources",
+        "deviceName": "HR-MBP-015",
+        "emailAddress": "david.martinez@acmecorp.com",
+        "ipAddress": "10.0.60.55",
+        "jssID": 1893,
+        "macAddress": "A8:5C:2E:9D:1B:74",
+        "model": "MacBookAir10,1",
+        "osBuild": "23F79",
+        "osVersion": "14.5",
+        "patchPolicyId": 47,
+        "patchPolicyName": "Google Chrome - Latest",
+        "phone": "+1 (555) 567-8901",
+        "position": "HR Specialist",
+        "realName": "David Martinez",
+        "reportedIpAddress": "10.0.60.55",
+        "room": "3rd Floor - 305",
+        "serialNumber": "FVFH52ABPXWT",
+        "softwareTitleId": 12,
+        "softwareTitleName": "Google Chrome",
+        "successful": true,
+        "udid": "2C3D4E5F-6A7B-8C9D-0E1F-234567890ABC",
+        "userDirectoryID": "18754",
+        "username": "dmartinez"
+      },
+      "webhook": {
+        "eventTimestamp": 1706748456000,
+        "id": 5,
+        "name": "Patch Management Webhook",
+        "webhookEvent": "ComputerPatchPolicyCompleted"
+      }
+    },
+    "ComputerPolicyFinished": {
+      "event": {
+        "alternateMacAddress": "2C:F0:EE:8B:3D:A7",
+        "building": "Data Center",
+        "department": "IT Operations",
+        "deviceName": "ITOPS-Mac-Studio-001",
+        "emailAddress": "emily.brown@acmecorp.com",
+        "ipAddress": "10.0.200.15",
+        "jssID": 567,
+        "macAddress": "9C:76:0E:4D:2A:B8",
+        "model": "Mac14,13",
+        "osBuild": "23F79",
+        "osVersion": "14.5",
+        "phone": "+1 (555) 678-9012",
+        "policyId": 234,
+        "position": "Systems Administrator",
+        "realName": "Emily Brown",
+        "reportedIpAddress": "10.0.200.15",
+        "room": "Server Room A",
+        "serialNumber": "H2YQ4ABCD1GH",
+        "successful": true,
+        "udid": "9E8D7C6B-5A4F-3E2D-1C0B-9A8F7E6D5C4B",
+        "userDirectoryID": "10234",
+        "username": "ebrown"
+      },
+      "webhook": {
+        "eventTimestamp": 1706749067000,
+        "id": 4,
+        "name": "Policy Execution Webhook",
+        "webhookEvent": "ComputerPolicyFinished"
+      }
+    },
+    "ComputerPushCapabilityChanged": {
+      "event": {
+        "alternateMacAddress": "68:FE:F7:1C:9B:42",
+        "building": "Research Lab",
+        "department": "R&D",
+        "deviceName": "RND-MBP-023",
+        "emailAddress": "alex.thompson@acmecorp.com",
+        "ipAddress": "10.0.150.78",
+        "jssID": 1456,
+        "macAddress": "B0:BE:83:5E:7D:2F",
+        "model": "MacBookPro18,2",
+        "osBuild": "23F79",
+        "osVersion": "14.5",
+        "phone": "+1 (555) 789-0123",
+        "position": "Research Scientist",
+        "realName": "Alex Thompson",
+        "reportedIpAddress": "10.0.150.78",
+        "room": "Lab 7B",
+        "serialNumber": "C02XL1YZTFVH",
+        "udid": "F1E2D3C4-B5A6-9780-1234-56789ABCDEF0",
+        "userDirectoryID": "22341",
+        "username": "athompson"
+      },
+      "webhook": {
+        "eventTimestamp": 1706749678000,
+        "id": 3,
+        "name": "Computer Events Webhook",
+        "webhookEvent": "ComputerPushCapabilityChanged"
+      }
+    },
+    "MobileDeviceCheckIn": {
+      "event": {
+        "bluetoothMacAddress": "5C:F7:E6:D5:C4:B3",
+        "building": "Sales Office",
+        "department": "Sales",
+        "deviceName": "SALES-iPhone-042",
+        "emailAddress": "robert.davis@acmecorp.com",
+        "icciID": "89014104279605312847",
+        "imei": "353879234567891",
+        "ipAddress": "10.0.80.134",
+        "jssID": 3421,
+        "model": "iPhone15,3",
+        "modelDisplay": "iPhone 15 Pro Max",
+        "osBuild": "21F90",
+        "osVersion": "17.5.1",
+        "phone": "+1 (555) 890-1234",
+        "position": "Regional Sales Manager",
+        "product": "iPhone15,3",
+        "realName": "Robert Davis",
+        "room": "Floor 2 - East Wing",
+        "serialNumber": "DNQT4ABCDEFG",
+        "udid": "00008120-001234567890ABCD",
+        "userDirectoryID": "14523",
+        "username": "rdavis",
+        "version": "17.5.1",
+        "wifiMacAddress": "A4:B3:C2:D1:E0:F9"
+      },
+      "webhook": {
+        "eventTimestamp": 1706750289000,
+        "id": 7,
+        "name": "Mobile Device Webhook",
+        "webhookEvent": "MobileDeviceCheckIn"
+      }
+    },
+    "MobileDeviceCommandCompleted": {
+      "event": {
+        "bluetoothMacAddress": "1A:2B:3C:4D:5E:6F",
+        "building": "Corporate HQ",
+        "department": "Executive",
+        "deviceName": "EXEC-iPad-001",
+        "emailAddress": "ceo@acmecorp.com",
+        "icciID": "",
+        "imei": "",
+        "ipAddress": "10.0.10.5",
+        "jssID": 4521,
+        "model": "iPad14,6",
+        "modelDisplay": "iPad Pro 12.9-inch (6th generation)",
+        "osBuild": "21F90",
+        "osVersion": "17.5.1",
+        "phone": "+1 (555) 100-0001",
+        "position": "Chief Executive Officer",
+        "product": "iPad14,6",
+        "realName": "James Wilson",
+        "room": "Executive Suite",
+        "serialNumber": "DMPXQ1234567",
+        "udid": "00008027-000A1B2C3D4E5F6A",
+        "userDirectoryID": "10001",
+        "username": "jwilson",
+        "version": "17.5.1",
+        "wifiMacAddress": "7E:8F:9A:0B:1C:2D"
+      },
+      "webhook": {
+        "eventTimestamp": 1706750900000,
+        "id": 7,
+        "name": "Mobile Device Webhook",
+        "webhookEvent": "MobileDeviceCommandCompleted"
+      }
+    },
+    "MobileDeviceEnrolled": {
+      "event": {
+        "bluetoothMacAddress": "9F:8E:7D:6C:5B:4A",
+        "building": "Distribution Center",
+        "department": "Logistics",
+        "deviceName": "LOGISTICS-iPhone-089",
+        "emailAddress": "maria.garcia@acmecorp.com",
+        "icciID": "89012345678901234567",
+        "imei": "358765432109876",
+        "ipAddress": "10.0.180.42",
+        "jssID": 5678,
+        "model": "iPhone14,7",
+        "modelDisplay": "iPhone 14 Plus",
+        "osBuild": "21F90",
+        "osVersion": "17.5.1",
+        "phone": "+1 (555) 901-2345",
+        "position": "Logistics Coordinator",
+        "product": "iPhone14,7",
+        "realName": "Maria Garcia",
+        "room": "Warehouse Office",
+        "serialNumber": "F2LXCABCD123",
+        "udid": "00008110-000F1E2D3C4B5A69",
+        "userDirectoryID": "28456",
+        "username": "mgarcia",
+        "version": "17.5.1",
+        "wifiMacAddress": "3D:4E:5F:6A:7B:8C"
+      },
+      "webhook": {
+        "eventTimestamp": 1706751511000,
+        "id": 7,
+        "name": "Mobile Device Webhook",
+        "webhookEvent": "MobileDeviceEnrolled"
+      }
+    },
+    "MobileDeviceInventoryCompleted": {
+      "event": {
+        "bluetoothMacAddress": "2B:3C:4D:5E:6F:7A",
+        "building": "Customer Service Center",
+        "department": "Customer Support",
+        "deviceName": "SUPPORT-iPad-034",
+        "emailAddress": "lisa.anderson@acmecorp.com",
+        "icciID": "",
+        "imei": "",
+        "ipAddress": "10.0.90.178",
+        "jssID": 6234,
+        "model": "iPad13,18",
+        "modelDisplay": "iPad (10th generation)",
+        "osBuild": "21F90",
+        "osVersion": "17.5.1",
+        "phone": "+1 (555) 012-3456",
+        "position": "Customer Service Representative",
+        "product": "iPad13,18",
+        "realName": "Lisa Anderson",
+        "room": "Call Center - Section B",
+        "serialNumber": "GH7YK2ABCDEF",
+        "udid": "00008103-0012345678901234",
+        "userDirectoryID": "31245",
+        "username": "landerson",
+        "version": "17.5.1",
+        "wifiMacAddress": "8C:9D:AE:BF:C0:D1"
+      },
+      "webhook": {
+        "eventTimestamp": 1706752122000,
+        "id": 7,
+        "name": "Mobile Device Webhook",
+        "webhookEvent": "MobileDeviceInventoryCompleted"
+      }
+    },
+    "MobileDevicePushSent": {
+      "event": {
+        "bluetoothMacAddress": "6F:7A:8B:9C:0D:1E",
+        "building": "Field Office - Chicago",
+        "department": "Field Services",
+        "deviceName": "FIELD-iPhone-156",
+        "emailAddress": "chris.taylor@acmecorp.com",
+        "icciID": "89014103278456123098",
+        "imei": "359876543210123",
+        "ipAddress": "172.16.45.89",
+        "jssID": 7845,
+        "model": "iPhone15,2",
+        "modelDisplay": "iPhone 15 Pro",
+        "osBuild": "21F90",
+        "osVersion": "17.5.1",
+        "phone": "+1 (555) 123-4567",
+        "position": "Field Technician",
+        "product": "iPhone15,2",
+        "realName": "Chris Taylor",
+        "room": "Mobile Unit",
+        "serialNumber": "JKL9MNOPQRST",
+        "udid": "00008120-00AABBCCDDEEFF00",
+        "userDirectoryID": "35612",
+        "username": "ctaylor",
+        "version": "17.5.1",
+        "wifiMacAddress": "E2:F3:04:15:26:37"
+      },
+      "webhook": {
+        "eventTimestamp": 1706752733000,
+        "id": 7,
+        "name": "Mobile Device Webhook",
+        "webhookEvent": "MobileDevicePushSent"
+      }
+    },
+    "MobileDeviceUnEnrolled": {
+      "event": {
+        "bluetoothMacAddress": "A1:B2:C3:D4:E5:F6",
+        "building": "Corporate HQ",
+        "department": "Former Employee",
+        "deviceName": "OLD-iPhone-892",
+        "emailAddress": "former.employee@acmecorp.com",
+        "icciID": "89014108765432109876",
+        "imei": "352345678901234",
+        "ipAddress": "",
+        "jssID": 2341,
+        "model": "iPhone13,4",
+        "modelDisplay": "iPhone 12 Pro Max",
+        "osBuild": "21F90",
+        "osVersion": "17.5.1",
+        "phone": "",
+        "position": "",
+        "product": "iPhone13,4",
+        "realName": "Former Employee",
+        "room": "",
+        "serialNumber": "DNP45ABCDEFG",
+        "udid": "00008101-00112233445566AA",
+        "userDirectoryID": "-1",
+        "username": "",
+        "version": "17.5.1",
+        "wifiMacAddress": "48:59:6A:7B:8C:9D"
+      },
+      "webhook": {
+        "eventTimestamp": 1706753344000,
+        "id": 7,
+        "name": "Mobile Device Webhook",
+        "webhookEvent": "MobileDeviceUnEnrolled"
+      }
+    },
+    "JSSShutdown": {
+      "event": {
+        "hostAddress": "jamfpro.acmecorp.com",
+        "institution": "ACME Corporation",
+        "isClusterMaster": true,
+        "jssUrl": "https://jamfpro.acmecorp.com:8443/",
+        "webApplicationPath": "/usr/local/jss/tomcat/webapps/ROOT"
+      },
+      "webhook": {
+        "eventTimestamp": 1706753955000,
+        "id": 1,
+        "name": "System Events Webhook",
+        "webhookEvent": "JSSShutdown"
+      }
+    },
+    "JSSStartup": {
+      "event": {
+        "hostAddress": "jamfpro.acmecorp.com",
+        "institution": "ACME Corporation",
+        "isClusterMaster": true,
+        "jssUrl": "https://jamfpro.acmecorp.com:8443/",
+        "webApplicationPath": "/usr/local/jss/tomcat/webapps/ROOT"
+      },
+      "webhook": {
+        "eventTimestamp": 1706754566000,
+        "id": 1,
+        "name": "System Events Webhook",
+        "webhookEvent": "JSSStartup"
+      }
+    },
+    "DeviceAddedToDEP": {
+      "event": {
+        "assetTag": "ACME-2024-00456",
+        "description": "MACBOOKPRO 14 M3 PRO",
+        "deviceAssignedDate": 1706700000000,
+        "deviceEnrollmentProgramInstanceId": 2,
+        "model": "MacBook Pro 14\"",
+        "serialNumber": "XYZ789ABCDEF"
+      },
+      "webhook": {
+        "eventTimestamp": 1706755177000,
+        "id": 2,
+        "name": "DEP Events Webhook",
+        "webhookEvent": "DeviceAddedToDEP"
+      }
+    },
+    "PatchSoftwareTitleUpdated": {
+      "event": {
+        "jssID": 12,
+        "lastUpdate": 1706755000000,
+        "latestVersion": "124.0.6367.91",
+        "name": "Google Chrome",
+        "reportUrl": "https://jamfpro.acmecorp.com:8443/patchReports.html?id=12&o=r"
+      },
+      "webhook": {
+        "eventTimestamp": 1706755788000,
+        "id": 6,
+        "name": "Patch Updates Webhook",
+        "webhookEvent": "PatchSoftwareTitleUpdated"
+      }
+    },
+    "PushSent": {
+      "event": {
+        "type": "MDM",
+        "jssID": 1547
+      },
+      "webhook": {
+        "eventTimestamp": 1706756399000,
+        "id": 8,
+        "name": "Push Notification Webhook",
+        "webhookEvent": "PushSent"
+      }
+    },
+    "RestAPIOperation": {
+      "event": {
+        "authorizedUsername": "api-service-account",
+        "objectID": 892,
+        "objectName": "DEV-MBP-042",
+        "objectTypeName": "Computer",
+        "operationSuccessful": true,
+        "restAPIOperationType": "PUT"
+      },
+      "webhook": {
+        "eventTimestamp": 1706757010000,
+        "id": 9,
+        "name": "API Audit Webhook",
+        "webhookEvent": "RestAPIOperation"
+      }
+    },
+    "SCEPChallenge": {
+      "event": {
+        "challenge": "A1B2C3D4E5F6789012345678901234567890ABCDEF",
+        "deviceName": "NEW-MBP-ENROLLMENT",
+        "jssID": 0,
+        "product": "MacBookPro18,3",
+        "serialNumber": "ABC123XYZ789",
+        "udid": "TEMP-UDID-00000000-0000-0000-0000-000000000000"
+      },
+      "webhook": {
+        "eventTimestamp": 1706757621000,
+        "id": 10,
+        "name": "SCEP Events Webhook",
+        "webhookEvent": "SCEPChallenge"
+      }
+    },
+    "SmartGroupComputerMembershipChange": {
+      "event": {
+        "computer": true,
+        "groupAddedDevices": [
+          "DEV-MBP-042",
+          "MARKETING-MBP-001"
+        ],
+        "groupAddedDevicesIds": [
+          892,
+          1547
+        ],
+        "groupRemovedDevices": [
+          "OLD-iMac-retired"
+        ],
+        "groupRemovedDevicesIds": [
+          234
+        ],
+        "jssID": 45,
+        "name": "macOS 14 - All Macs",
+        "smartGroup": true
+      },
+      "webhook": {
+        "eventTimestamp": 1706758232000,
+        "id": 11,
+        "name": "Smart Group Webhook",
+        "webhookEvent": "SmartGroupComputerMembershipChange"
+      }
+    },
+    "SmartGroupMobileDeviceMembershipChange": {
+      "event": {
+        "computer": false,
+        "groupAddedDevices": [
+          "SALES-iPhone-042",
+          "LOGISTICS-iPhone-089"
+        ],
+        "groupAddedDevicesIds": [
+          3421,
+          5678
+        ],
+        "groupRemovedDevices": [],
+        "groupRemovedDevicesIds": [],
+        "jssID": 67,
+        "name": "iOS 17 - Corporate iPhones",
+        "smartGroup": true
+      },
+      "webhook": {
+        "eventTimestamp": 1706758843000,
+        "id": 11,
+        "name": "Smart Group Webhook",
+        "webhookEvent": "SmartGroupMobileDeviceMembershipChange"
+      }
+    },
+    "SmartGroupUserMembershipChange": {
+      "event": {
+        "groupAddedUserIds": [
+          28456,
+          31245
+        ],
+        "groupAddedUsers": [
+          "mgarcia",
+          "landerson"
+        ],
+        "groupRemovedUserIds": [
+          15000
+        ],
+        "groupRemovedUsers": [
+          "former.user"
+        ],
+        "jssID": 89,
+        "name": "All Active Employees",
+        "smartGroup": true
+      },
+      "webhook": {
+        "eventTimestamp": 1706759454000,
+        "id": 11,
+        "name": "Smart Group Webhook",
+        "webhookEvent": "SmartGroupUserMembershipChange"
+      }
+    }
+  }
+}
diff --git a/tests/conftest.py b/tests/conftest.py
index 457d110..fbc5472 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -120,6 +120,7 @@ def __init__(self, root):
         self.server_file = self.data_dir / "server.json"
         self.credentials_file = self.data_dir / "credentials.json"
         self.log_file = self.data_dir / "jawa.log"
+        self.webhook_schemas_file = self.data_dir / "webhook_schemas.json"
 
     def add_webhook(self, entry):
         data = json.loads(self.webhooks_file.read_text())
@@ -152,6 +153,10 @@ def jawa_env(tmp_path, monkeypatch):
         os.path.join(REPO_ROOT, "data", "time.json"),
         env.data_dir / "time.json",
     )
+    shutil.copy(
+        os.path.join(REPO_ROOT, "data", "webhook_schemas.json"),
+        env.webhook_schemas_file,
+    )
 
     webhooks = str(env.webhooks_file)
     cron = str(env.cron_file)
@@ -166,6 +171,11 @@ def jawa_env(tmp_path, monkeypatch):
     monkeypatch.setattr(
         data_store, "TIME_FILE", str(env.data_dir / "time.json")
     )
+    monkeypatch.setattr(
+        data_store,
+        "WEBHOOK_SCHEMAS_FILE",
+        str(env.webhook_schemas_file),
+    )
     monkeypatch.setattr(data_store, "SCRIPTS_DIR", scripts)
 
     monkeypatch.setattr(home_view, "log_file", log_file)
diff --git a/tests/test_webhook_catalog.py b/tests/test_webhook_catalog.py
new file mode 100644
index 0000000..1ec6063
--- /dev/null
+++ b/tests/test_webhook_catalog.py
@@ -0,0 +1,105 @@
+"""The Jamf webhook event catalog is static reference data.
+
+It feeds two surfaces — the /reference/webhooks pages and the Jamf
+creation form's event dropdown — so its internal consistency is a
+correctness concern: an event value that drifts from Jamf Pro's real
+string is stored on the webhook and then never matches the inbound
+payload's webhookEvent.
+"""
+
+from bin.data_store import get_webhook_schemas
+
+# Jamf Pro's authoritative event set (maintainer-confirmed against the
+# Jamf Pro webhook creation UI, 2026-07-24).
+JAMF_EVENTS = {
+    "ComputerAdded",
+    "ComputerCheckIn",
+    "ComputerInventoryCompleted",
+    "ComputerPatchPolicyCompleted",
+    "ComputerPolicyFinished",
+    "ComputerPushCapabilityChanged",
+    "DeviceAddedToDEP",
+    "DeviceRateLimited",
+    "JSSShutdown",
+    "JSSStartup",
+    "MobileDeviceCheckIn",
+    "MobileDeviceCommandCompleted",
+    "MobileDeviceEnrolled",
+    "MobileDeviceInventoryCompleted",
+    "MobileDevicePushSent",
+    "MobileDeviceUnEnrolled",
+    "PatchSoftwareTitleUpdated",
+    "PushSent",
+    "RestAPIOperation",
+    "SCEPChallenge",
+    "SmartGroupComputerMembershipChange",
+    "SmartGroupMobileDeviceMembershipChange",
+    "SmartGroupUserMembershipChange",
+}
+
+
+def _flatten(categories):
+    return [e for events in categories.values() for e in events]
+
+
+def test_catalog_covers_exactly_the_jamf_event_set(jawa_env):
+    catalog = get_webhook_schemas()
+    assert set(_flatten(catalog["categories"])) == JAMF_EVENTS
+
+
+def test_catalog_lists_each_event_once(jawa_env):
+    flat = _flatten(get_webhook_schemas()["categories"])
+    assert len(flat) == len(set(flat)) == 23
+
+
+def test_every_categorized_event_has_a_schema(jawa_env):
+    catalog = get_webhook_schemas()
+    for event in _flatten(catalog["categories"]):
+        entry = catalog["schemas"].get(event)
+        assert entry, f"{event} is categorized but has no schema entry"
+        assert entry["description"]
+
+
+def test_every_example_matches_a_schema_and_its_own_key(jawa_env):
+    catalog = get_webhook_schemas()
+    for event, example in catalog["examples"].items():
+        assert event in catalog["schemas"]
+        # The stored webhookEvent must equal the key, or the reference
+        # page would show a payload labelled as a different event.
+        assert example["webhook"]["webhookEvent"] == event
+
+
+def test_mobile_device_unenrolled_uses_jamfs_capital_e(jawa_env):
+    catalog = get_webhook_schemas()
+    assert "MobileDeviceUnEnrolled" in catalog["schemas"]
+    assert "MobileDeviceUnEnrolled" in catalog["examples"]
+    # The lowercase-e spelling never matches Jamf's payload.
+    assert "MobileDeviceUnenrolled" not in catalog["schemas"]
+    assert "MobileDeviceUnenrolled" not in catalog["examples"]
+    assert "MobileDeviceUnenrolled" not in _flatten(catalog["categories"])
+
+
+def test_device_rate_limited_is_present_and_marked_pending(jawa_env):
+    catalog = get_webhook_schemas()
+    entry = catalog["schemas"]["DeviceRateLimited"]
+    # Field schema + payload are unconfirmed; the page must say so
+    # rather than show invented fields.
+    assert entry["pending"] is True
+    assert entry["schema"] == {}
+    assert "DeviceRateLimited" not in catalog["examples"]
+
+
+def test_events_without_a_pending_marker_have_fields_and_a_payload(jawa_env):
+    catalog = get_webhook_schemas()
+    for event, entry in catalog["schemas"].items():
+        if entry.get("pending"):
+            continue
+        assert entry["schema"], f"{event} has an empty field schema"
+        assert event in catalog["examples"], f"{event} has no example"
+
+
+def test_missing_catalog_degrades_to_empty_structures(jawa_env):
+    jawa_env.webhook_schemas_file.unlink()
+    catalog = get_webhook_schemas()
+    # Never raise: a broken catalog must not 500 the creation form.
+    assert catalog == {"categories": {}, "schemas": {}, "examples": {}}

From 012ffa5a32f2608d09b054284bc51729463f552f Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 08:07:47 -0500
Subject: [PATCH 43/84] fix: close two escape paths in the webhook catalog
 fail-soft guard (J15)

The accessor promises it degrades to empty structures rather than
raising, because the Jamf event dropdown reads it and must still
render when the file is damaged. Two cases slipped past that promise
and would have surfaced as a 500 on a hand-edited catalog.

A file saved in a non-UTF-8 encoding raised UnicodeDecodeError, which
subclasses ValueError rather than OSError and so escaped the guard
entirely. The clause now catches ValueError, covering the malformed
JSON case and the bad-encoding case together.

A section hand-edited from an object into an array or a string was
passed through untouched: the top-level object check still passed,
and the wrong type then failed inside the template that iterates it
as a mapping. Each section is now type-checked individually.
---
 bin/data_store.py             | 14 ++++++++++++--
 tests/test_webhook_catalog.py | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/bin/data_store.py b/bin/data_store.py
index 951d1f7..4dc7922 100644
--- a/bin/data_store.py
+++ b/bin/data_store.py
@@ -207,7 +207,10 @@ def get_webhook_schemas() -> Dict[str, Any]:
     try:
         with open(WEBHOOK_SCHEMAS_FILE, "r", encoding="utf-8") as f:
             data = json.load(f)
-    except (OSError, json.JSONDecodeError):
+    except (OSError, ValueError):
+        # ValueError covers both a malformed JSON body
+        # (json.JSONDecodeError) and a file saved in a non-UTF-8
+        # encoding (UnicodeDecodeError) - neither is an OSError.
         logthis.warning(
             f"Webhook event catalog unreadable: {WEBHOOK_SCHEMAS_FILE}"
         )
@@ -215,7 +218,14 @@ def get_webhook_schemas() -> Dict[str, Any]:
     if not isinstance(data, dict):
         logthis.warning("Webhook event catalog is not a JSON object.")
         return empty
-    return {key: data.get(key) or {} for key in empty}
+    # Each section is iterated as a mapping by the reference pages and
+    # the event dropdown, so a hand edit that turns one into a list or
+    # a string degrades to empty here rather than failing in a template.
+    out: Dict[str, Any] = {}
+    for key in empty:
+        section = data.get(key)
+        out[key] = section if isinstance(section, dict) else {}
+    return out
 
 
 # --- Script Management ---
diff --git a/tests/test_webhook_catalog.py b/tests/test_webhook_catalog.py
index 1ec6063..3021d31 100644
--- a/tests/test_webhook_catalog.py
+++ b/tests/test_webhook_catalog.py
@@ -7,6 +7,8 @@
 payload's webhookEvent.
 """
 
+import json
+
 from bin.data_store import get_webhook_schemas
 
 # Jamf Pro's authoritative event set (maintainer-confirmed against the
@@ -103,3 +105,36 @@ def test_missing_catalog_degrades_to_empty_structures(jawa_env):
     catalog = get_webhook_schemas()
     # Never raise: a broken catalog must not 500 the creation form.
     assert catalog == {"categories": {}, "schemas": {}, "examples": {}}
+
+
+def test_undecodable_catalog_degrades_to_empty_structures(jawa_env):
+    # A hand edit saved in a non-UTF-8 encoding: 0x92 is a Latin-1
+    # curly apostrophe, which is not valid UTF-8. The resulting
+    # UnicodeDecodeError is a ValueError, not an OSError, so it has to
+    # be caught explicitly or it escapes the fail-soft guard.
+    jawa_env.webhook_schemas_file.write_bytes(
+        b'{"categories": {}, "schemas": {"X": {"description":'
+        b' "Jamf\x92s device"}}, "examples": {}}'
+    )
+    catalog = get_webhook_schemas()
+    assert catalog == {"categories": {}, "schemas": {}, "examples": {}}
+
+
+def test_wrong_typed_sections_degrade_to_empty_structures(jawa_env):
+    # A hand edit turns an object into an array. The top-level object
+    # check still passes, so without a per-section type check the list
+    # reaches the caller and .items() raises inside the template.
+    jawa_env.webhook_schemas_file.write_text(
+        json.dumps(
+            {
+                "categories": ["Computer Events"],
+                "schemas": "not a dict",
+                "examples": 17,
+            }
+        )
+    )
+    catalog = get_webhook_schemas()
+    assert catalog == {"categories": {}, "schemas": {}, "examples": {}}
+    # Callers iterate these as mappings; every value must be one.
+    for section in catalog.values():
+        assert section.items() is not None

From af300e1c802328f044dbd6ff9c8734382f9e7a7d Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 08:21:59 -0500
Subject: [PATCH 44/84] feat: serve the webhook event reference at
 /reference/webhooks (J15)

Read-only blueprint behind login_required, one template for the
overview and the per-event detail. Namespaced under /reference/
because /webhooks* still belongs to the legacy automation redirects.

The detail body shows the event description here; the field-schema
table and the sample payload land in the next commit.
---
 app.py                                 |  4 ++
 templates/reference/_event_detail.html |  3 ++
 templates/reference/webhooks.html      | 69 ++++++++++++++++++++++++++
 tests/test_smoke_routes.py             |  3 ++
 tests/test_webhook_reference.py        | 64 ++++++++++++++++++++++++
 views/reference_view.py                | 67 +++++++++++++++++++++++++
 6 files changed, 210 insertions(+)
 create mode 100644 templates/reference/_event_detail.html
 create mode 100644 templates/reference/webhooks.html
 create mode 100644 tests/test_webhook_reference.py
 create mode 100644 views/reference_view.py

diff --git a/app.py b/app.py
index 235f8e1..6b9d6cc 100644
--- a/app.py
+++ b/app.py
@@ -158,6 +158,10 @@ def register_blueprints() -> None:
     from views import search_view
 
     app.register_blueprint(search_view.blueprint)
+    # Webhook event reference (read-only docs)
+    from views import reference_view
+
+    app.register_blueprint(reference_view.blueprint)
     # Credential management view
     from views import credential_view
 
diff --git a/templates/reference/_event_detail.html b/templates/reference/_event_detail.html
new file mode 100644
index 0000000..0919027
--- /dev/null
+++ b/templates/reference/_event_detail.html
@@ -0,0 +1,3 @@
+<div class="schema-section">
+    <p class="event-description">{{ schemas[selected_event].description }}</p>
+</div>
diff --git a/templates/reference/webhooks.html b/templates/reference/webhooks.html
new file mode 100644
index 0000000..594a9b6
--- /dev/null
+++ b/templates/reference/webhooks.html
@@ -0,0 +1,69 @@
+{% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section %}
+
+{% block title %}
+{% if selected_event %}{{ selected_event }} | {% endif %}Webhook Reference | JAWA
+{% endblock %}
+
+{% block content %}
+{{ hero_section(
+    title=selected_event if selected_event else "Webhook Reference",
+    subtitle=(
+        "Jamf Pro webhook event"
+        if selected_event
+        else (schemas|length|string) ~ " Jamf Pro webhook events -- field schemas and sample payloads"
+    ),
+    secondary_url=url_for('reference.webhooks') if selected_event else "",
+    secondary_label="All events"
+) }}
+
+<div class="container">
+    <div class="row">
+        <div class="col-md-3 d-none d-md-block">
+            <nav class="event-sidebar" aria-label="Webhook events">
+                {% for category, events in categories.items() %}
+                <h6>{{ category }}</h6>
+                {% for event in events %}
+                <a class="event-link {% if event == selected_event %}active{% endif %}"
+                   href="{{ url_for('reference.webhook_detail', event_type=event) }}">{{ event }}</a>
+                {% endfor %}
+                {% endfor %}
+            </nav>
+        </div>
+
+        <div class="col-md-9">
+            {% if selected_event %}
+            {% include "reference/_event_detail.html" %}
+            {% else %}
+            {% for category, events in categories.items() %}
+            <div class="schema-section">
+                <div class="section-header">
+                    <h3>{{ category }}</h3>
+                </div>
+                <div class="table-responsive">
+                    <table class="hippocrates">
+                        <thead>
+                            <tr>
+                                <th>Event</th>
+                                <th>Description</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {% for event in events %}
+                            <tr>
+                                <td>
+                                    <a href="{{ url_for('reference.webhook_detail', event_type=event) }}"><code>{{ event }}</code></a>
+                                </td>
+                                <td>{{ schemas[event].description }}</td>
+                            </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+            {% endfor %}
+            {% endif %}
+        </div>
+    </div>
+</div>
+{% endblock %}
diff --git a/tests/test_smoke_routes.py b/tests/test_smoke_routes.py
index 9efd2ce..bbe11eb 100644
--- a/tests/test_smoke_routes.py
+++ b/tests/test_smoke_routes.py
@@ -32,6 +32,8 @@
     "/templates/device-naming",
     "/templates/device-naming/script",
     "/templates/import",
+    "/reference/webhooks",
+    "/reference/webhooks/ComputerAdded",
     "/setup/credentials",
     "/resources/files",
     "/branding",
@@ -61,6 +63,7 @@
     "/automations",
     "/automations/jamfpro",
     "/templates",
+    "/reference/webhooks",
     "/setup/credentials",
     "/resources/files",
     "/branding",
diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
new file mode 100644
index 0000000..9e21341
--- /dev/null
+++ b/tests/test_webhook_reference.py
@@ -0,0 +1,64 @@
+"""The Webhook Reference pages are read-only docs behind auth.
+
+Namespaced under /reference/ on purpose: /webhooks* is already taken by
+the legacy automation redirects in app.py.
+"""
+
+
+def test_overview_renders(logged_in_client, jawa_env):
+    resp = logged_in_client.get("/reference/webhooks")
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert "Webhook Reference" in body
+    # Every category heading and a representative event are listed.
+    assert "Computer Events" in body
+    assert "Mobile Device Events" in body
+    assert "System Events" in body
+    assert "ComputerAdded" in body
+
+
+def test_overview_lists_all_23_events(logged_in_client, jawa_env):
+    from bin.data_store import get_webhook_schemas
+
+    body = logged_in_client.get("/reference/webhooks").data.decode()
+    events = [
+        e
+        for evs in get_webhook_schemas()["categories"].values()
+        for e in evs
+    ]
+    assert len(events) == 23
+    for event in events:
+        assert f"/reference/webhooks/{event}" in body
+
+
+def test_detail_renders_for_a_known_event(logged_in_client, jawa_env):
+    resp = logged_in_client.get("/reference/webhooks/ComputerAdded")
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert "ComputerAdded" in body
+    # The event's description is shown. The field-schema table and the
+    # sample payload arrive with the full detail view, asserted there.
+    assert "computer record is created" in body
+
+
+def test_unknown_event_is_handled(logged_in_client, jawa_env):
+    # abort(404) -> the branded handler sends signed-in users home.
+    resp = logged_in_client.get("/reference/webhooks/NotAnEvent")
+    assert resp.status_code in (301, 302)
+    assert "/dashboard" in resp.headers["Location"]
+
+
+def test_reference_requires_a_session(client, jawa_env):
+    for path in (
+        "/reference/webhooks",
+        "/reference/webhooks/ComputerAdded",
+    ):
+        resp = client.get(path)
+        assert resp.status_code in (301, 302)
+
+
+def test_legacy_webhooks_redirect_is_untouched(logged_in_client, jawa_env):
+    # The new namespace must not shadow the legacy automation redirect.
+    resp = logged_in_client.get("/webhooks")
+    assert resp.status_code == 301
+    assert "/automations" in resp.headers["Location"]
diff --git a/views/reference_view.py b/views/reference_view.py
new file mode 100644
index 0000000..b4e9474
--- /dev/null
+++ b/views/reference_view.py
@@ -0,0 +1,67 @@
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+#
+# Copyright (c) 2026 Jamf.  All rights reserved.
+#
+#       Redistribution and use in source and binary forms, with or without
+#       modification, are permitted provided that the following conditions are met:
+#               * Redistributions of source code must retain the above copyright
+#                 notice, this list of conditions and the following disclaimer.
+#               * Redistributions in binary form must reproduce the above copyright
+#                 notice, this list of conditions and the following disclaimer in the
+#                 documentation and/or other materials provided with the distribution.
+#               * Neither the name of the Jamf nor the names of its contributors may be
+#                 used to endorse or promote products derived from this software without
+#                 specific prior written permission.
+#
+#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
+#       EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
+#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
+
+from typing import Union
+
+from flask import Blueprint, Response, abort, render_template
+
+from bin import logger
+from bin.auth import login_required
+from bin.data_store import get_webhook_schemas
+
+logthis = logger.setup_child_logger("jawa", "reference_view")
+
+blueprint = Blueprint("reference", __name__)
+
+
+def _context(selected_event: Union[str, None]) -> dict:
+    catalog = get_webhook_schemas()
+    return {
+        "categories": catalog["categories"],
+        "schemas": catalog["schemas"],
+        "examples": catalog["examples"],
+        "selected_event": selected_event,
+    }
+
+
+@blueprint.route("/reference/webhooks")
+@login_required
+def webhooks() -> Union[Response, str]:
+    """Overview of every Jamf Pro webhook event, grouped by category."""
+    return render_template("reference/webhooks.html", **_context(None))
+
+
+@blueprint.route("/reference/webhooks/<event_type>")
+@login_required
+def webhook_detail(event_type: str) -> Union[Response, str]:
+    """Field schema and sample payload for one Jamf Pro event."""
+    context = _context(event_type)
+    if event_type not in context["schemas"]:
+        logthis.info(f"Unknown webhook event requested: {event_type}")
+        abort(404)
+    return render_template("reference/webhooks.html", **context)

From 3b9c551da2a4c277e6acc718a9a96e49938097a7 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 09:58:29 -0500
Subject: [PATCH 45/84] fix: degrade the webhook reference when only part of
 the catalog loads

The catalog accessor validates each section independently, so a hand
edit that damages only "schemas" leaves "categories" fully populated.
The overview then looked up a description per event and hit an
undefined attribute, so the page raised instead of degrading -
exactly the failure the accessor guard was meant to prevent.

Look up descriptions defensively at both access sites. Output is
byte-identical for an intact catalog; a damaged one now renders the
event names it does know with blank descriptions.
---
 templates/reference/_event_detail.html |  2 +-
 templates/reference/webhooks.html      |  2 +-
 tests/test_webhook_reference.py        | 23 +++++++++++++++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/templates/reference/_event_detail.html b/templates/reference/_event_detail.html
index 0919027..b176ff0 100644
--- a/templates/reference/_event_detail.html
+++ b/templates/reference/_event_detail.html
@@ -1,3 +1,3 @@
 <div class="schema-section">
-    <p class="event-description">{{ schemas[selected_event].description }}</p>
+    <p class="event-description">{{ schemas.get(selected_event, {}).get('description', '') }}</p>
 </div>
diff --git a/templates/reference/webhooks.html b/templates/reference/webhooks.html
index 594a9b6..dd1b2ce 100644
--- a/templates/reference/webhooks.html
+++ b/templates/reference/webhooks.html
@@ -54,7 +54,7 @@ <h3>{{ category }}</h3>
                                 <td>
                                     <a href="{{ url_for('reference.webhook_detail', event_type=event) }}"><code>{{ event }}</code></a>
                                 </td>
-                                <td>{{ schemas[event].description }}</td>
+                                <td>{{ schemas.get(event, {}).get('description', '') }}</td>
                             </tr>
                             {% endfor %}
                         </tbody>
diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index 9e21341..29de273 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -57,6 +57,29 @@ def test_reference_requires_a_session(client, jawa_env):
         assert resp.status_code in (301, 302)
 
 
+def test_overview_survives_a_catalog_missing_its_schemas(
+    logged_in_client, jawa_env
+):
+    """A half-damaged catalog degrades, it does not blow up.
+
+    The accessor validates each section independently, so a hand edit
+    that turns "schemas" into an array leaves the category lists fully
+    populated while every description lookup comes back undefined. The
+    overview must still render the event names it does know about.
+    """
+    import json
+
+    catalog = json.loads(jawa_env.webhook_schemas_file.read_text())
+    catalog["schemas"] = []
+    jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
+
+    resp = logged_in_client.get("/reference/webhooks")
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert "Computer Events" in body
+    assert "ComputerAdded" in body
+
+
 def test_legacy_webhooks_redirect_is_untouched(logged_in_client, jawa_env):
     # The new namespace must not shadow the legacy automation redirect.
     resp = logged_in_client.get("/webhooks")

From 977ded963b4d9d302761c271b34e841c428b0587 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 10:21:16 -0500
Subject: [PATCH 46/84] feat: render event schemas and sample payloads on the
 reference page (J15)

Field schemas use the standard .hippocrates table; payloads reuse the
existing .script-preview dark code treatment plus a copy button. The
payload crosses into JS via tojson and is written with textContent,
so event data is never interpolated as markup.

Two layout facts drive the JS: highlightAll() runs before the
additional_js block (so the page highlights the element itself), and
the layout ships only the python language pack (so this page loads
the json one).

Every catalog lookup is guarded, so a hand-damaged catalog whose
examples section or whose entry for one event is the wrong shape
degrades to a page without that block instead of a 500.
---
 static/css/main.css                    | 122 +++++++++++++++++++++++++
 templates/reference/_event_detail.html |  58 +++++++++++-
 templates/reference/webhooks.html      |  44 +++++++++
 tests/test_webhook_reference.py        |  90 ++++++++++++++++++
 4 files changed, 313 insertions(+), 1 deletion(-)

diff --git a/static/css/main.css b/static/css/main.css
index 5d537dd..7b84edc 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -1295,3 +1295,125 @@ a.btn-hero-secondary:visited {
     border: 1px solid var(--color-border);
     box-shadow: var(--shadow-lg);
 }
+
+/* ===== Webhook Reference ===== */
+.event-sidebar {
+    position: sticky;
+    top: 70px;
+    max-height: calc(100vh - 90px);
+    overflow-y: auto;
+    padding: 0.75rem 1rem 2rem 0.5rem;
+    background-color: var(--color-surface);
+    border-right: 1px solid var(--color-border);
+    border-radius: var(--radius-md);
+    scrollbar-width: thin;
+    scrollbar-color: var(--color-border) transparent;
+}
+
+.event-sidebar::-webkit-scrollbar {
+    width: 4px;
+}
+
+.event-sidebar::-webkit-scrollbar-track {
+    background: transparent;
+}
+
+.event-sidebar::-webkit-scrollbar-thumb {
+    background: var(--color-border);
+    border-radius: var(--radius-sm);
+}
+
+.event-sidebar h6 {
+    font-size: 0.7rem;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    color: var(--color-text-secondary);
+    margin: 1.25rem 0 0.5rem;
+    padding-left: 12px;
+}
+
+.event-sidebar h6:first-child {
+    margin-top: 0;
+}
+
+.event-link,
+.event-link:visited {
+    display: block;
+    padding: 6px 12px;
+    font-family: var(--font-mono);
+    font-size: 0.78rem;
+    color: var(--color-text-secondary);
+    text-decoration: none;
+    border-left: 3px solid transparent;
+    border-radius: 0 var(--radius-sm) var(--radius-sm) 0;
+    transition: background-color 0.15s ease, color 0.15s ease;
+}
+
+.event-link:hover {
+    color: var(--color-primary);
+    background: var(--color-surface-hover);
+    text-decoration: none;
+}
+
+.event-link.active {
+    color: var(--color-primary);
+    font-weight: 600;
+    border-left-color: var(--color-primary);
+    background: var(--color-primary-light);
+}
+
+.schema-section {
+    margin-bottom: 2rem;
+}
+
+.schema-caption {
+    font-size: 0.85rem;
+    color: var(--color-text-secondary);
+    margin-bottom: 0.75rem;
+}
+
+.event-description {
+    color: var(--color-text-secondary);
+    font-style: italic;
+    margin-bottom: 1.5rem;
+}
+
+.code-wrapper {
+    position: relative;
+}
+
+.copy-btn {
+    position: absolute;
+    top: 8px;
+    right: 8px;
+    padding: 3px 12px;
+    font-size: 0.7rem;
+    color: rgba(255, 255, 255, 0.6);
+    background: rgba(255, 255, 255, 0.08);
+    border: 1px solid rgba(255, 255, 255, 0.15);
+    border-radius: var(--radius-sm);
+    cursor: pointer;
+    opacity: 0;
+    transition: opacity 0.2s ease, background-color 0.15s ease;
+}
+
+.code-wrapper:hover .copy-btn,
+.copy-btn:focus-visible {
+    opacity: 1;
+}
+
+.copy-btn:hover {
+    color: rgba(255, 255, 255, 0.9);
+    background: rgba(255, 255, 255, 0.15);
+}
+
+.copy-btn.copied {
+    color: var(--color-accent);
+    border-color: var(--color-accent);
+}
+
+.copy-btn:focus-visible {
+    outline: none;
+    box-shadow: 0 0 0 3px rgba(60, 106, 167, 0.35);
+}
diff --git a/templates/reference/_event_detail.html b/templates/reference/_event_detail.html
index b176ff0..6eb35a3 100644
--- a/templates/reference/_event_detail.html
+++ b/templates/reference/_event_detail.html
@@ -1,3 +1,59 @@
+{% set entry = schemas.get(selected_event, {}) %}
+<p class="event-description">{{ entry.description }}</p>
+
+{% if entry.pending %}
 <div class="schema-section">
-    <p class="event-description">{{ schemas.get(selected_event, {}).get('description', '') }}</p>
+    <div class="section-header">
+        <h3>Event schema</h3>
+    </div>
+    <p class="schema-caption">
+        The field schema and sample payload for
+        <code>{{ selected_event }}</code> are pending confirmation
+        against a live Jamf Pro instance. Jamf Pro can send this event
+        today &mdash; it is selectable when you create a Jamf Pro
+        automation.
+    </p>
 </div>
+{% else %}
+<div class="schema-section">
+    <div class="section-header">
+        <h3>Event schema</h3>
+    </div>
+    <p class="schema-caption">
+        Structure of the <code>event</code> object in the webhook payload.
+    </p>
+    <div class="table-responsive">
+        <table class="hippocrates">
+            <thead>
+                <tr>
+                    <th>Field</th>
+                    <th>Type and description</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for field, description in (entry.schema or {}).items() | sort %}
+                <tr>
+                    <td><code>{{ field }}</code></td>
+                    <td>{{ description }}</td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </div>
+</div>
+
+{% if examples.get(selected_event) %}
+<div class="schema-section">
+    <div class="section-header">
+        <h3>Sample payload</h3>
+    </div>
+    <p class="schema-caption">
+        A complete webhook payload with representative sample data.
+    </p>
+    <div class="script-preview code-wrapper">
+        <button type="button" class="copy-btn" title="Copy this payload">Copy</button>
+        <pre><code class="language-json" id="example-json"></code></pre>
+    </div>
+</div>
+{% endif %}
+{% endif %}
diff --git a/templates/reference/webhooks.html b/templates/reference/webhooks.html
index dd1b2ce..e573f7f 100644
--- a/templates/reference/webhooks.html
+++ b/templates/reference/webhooks.html
@@ -67,3 +67,47 @@ <h3>{{ category }}</h3>
     </div>
 </div>
 {% endblock %}
+
+{% block additional_js %}
+{% if examples.get(selected_event) %}
+<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/languages/json.min.js"></script>
+{% endif %}
+<script>
+(function () {
+    var COPIED_RESET_MS = 2000;
+
+    {% if examples.get(selected_event) %}
+    // The payload crosses into JS as data (tojson) and is written with
+    // textContent, so it is never parsed as markup. The layout already
+    // ran hljs.highlightAll() while this element was empty, so
+    // highlight it explicitly now that it has content.
+    var payload = {{ examples.get(selected_event) | tojson }};
+    var codeEl = document.getElementById('example-json');
+    // A pending event renders no payload block even when the catalog
+    // carries an example for it, so the element may be absent.
+    if (codeEl) {
+        codeEl.textContent = JSON.stringify(payload, null, 2);
+        if (window.hljs) {
+            hljs.highlightElement(codeEl);
+        }
+    }
+    {% endif %}
+
+    document.querySelectorAll('.copy-btn').forEach(function (btn) {
+        btn.addEventListener('click', function () {
+            var code = btn.closest('.code-wrapper').querySelector('code');
+            navigator.clipboard.writeText(code.textContent).then(
+                function () {
+                    btn.textContent = 'Copied!';
+                    btn.classList.add('copied');
+                    setTimeout(function () {
+                        btn.textContent = 'Copy';
+                        btn.classList.remove('copied');
+                    }, COPIED_RESET_MS);
+                }
+            );
+        });
+    });
+})();
+</script>
+{% endblock %}
diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index 29de273..2625226 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -4,6 +4,8 @@
 the legacy automation redirects in app.py.
 """
 
+import re
+
 
 def test_overview_renders(logged_in_client, jawa_env):
     resp = logged_in_client.get("/reference/webhooks")
@@ -85,3 +87,91 @@ def test_legacy_webhooks_redirect_is_untouched(logged_in_client, jawa_env):
     resp = logged_in_client.get("/webhooks")
     assert resp.status_code == 301
     assert "/automations" in resp.headers["Location"]
+
+
+def test_detail_shows_the_field_schema_table(logged_in_client, jawa_env):
+    body = logged_in_client.get(
+        "/reference/webhooks/ComputerAdded"
+    ).data.decode()
+    assert "Event schema" in body
+    # Fields render in the standard table treatment, not a bare table.
+    assert 'class="hippocrates"' in body
+    assert "jssID" in body
+    assert "Unique Jamf Pro computer record ID" in body
+
+
+def test_detail_embeds_the_payload_as_json_not_markup(
+    logged_in_client, jawa_env
+):
+    body = logged_in_client.get(
+        "/reference/webhooks/ComputerAdded"
+    ).data.decode()
+    # Payload goes into JS via tojson and is written with textContent;
+    # it is never interpolated into markup with |safe.
+    assert 'id="example-json"' in body
+    assert '"webhookEvent": "ComputerAdded"' in body
+    assert "JSON.stringify" in body
+    # The json language pack is not in the layout; this page loads it.
+    assert "languages/json.min.js" in body
+    # The layout's highlightAll() has already run by then.
+    assert "hljs.highlightElement" in body
+
+
+def test_detail_offers_a_copy_button(logged_in_client, jawa_env):
+    body = logged_in_client.get(
+        "/reference/webhooks/ComputerAdded"
+    ).data.decode()
+    assert 'class="copy-btn"' in body
+    assert "clipboard.writeText" in body
+
+
+def test_pending_event_says_so_instead_of_showing_empty_fields(
+    logged_in_client, jawa_env
+):
+    body = logged_in_client.get(
+        "/reference/webhooks/DeviceRateLimited"
+    ).data.decode()
+    assert "pending confirmation" in body
+    # No empty schema table and no payload block for a pending event.
+    assert 'class="hippocrates"' not in body
+    assert 'id="example-json"' not in body
+
+
+def test_detail_survives_a_catalog_missing_its_examples(
+    logged_in_client, jawa_env
+):
+    """A detail page must degrade the same way the overview does.
+
+    Each catalog section is validated independently, so a hand edit that
+    turns "examples" into an array leaves the field schema intact while
+    every payload lookup comes back missing. The page must drop the
+    sample-payload block and still render the schema table rather than
+    raising while the template evaluates the payload.
+    """
+    import json
+
+    catalog = json.loads(jawa_env.webhook_schemas_file.read_text())
+    catalog["examples"] = []
+    jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
+
+    resp = logged_in_client.get("/reference/webhooks/ComputerAdded")
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert "jssID" in body
+    assert 'id="example-json"' not in body
+
+
+def test_reference_pages_carry_no_inline_styles(logged_in_client, jawa_env):
+    # The design system forbids inline style= and <style> blocks. The
+    # only inline style the shared layout itself renders is on the
+    # session-timeout modal's "seconds" caption; the reference pages
+    # must add nothing to that set.
+    layout_styles = {'style="font-size: 0.85rem;"'}
+    for path in (
+        "/reference/webhooks",
+        "/reference/webhooks/ComputerAdded",
+    ):
+        body = logged_in_client.get(path).data.decode()
+        found = set(re.findall(r"""style=["'][^"']*["']""", body))
+        assert found <= layout_styles, found - layout_styles
+        assert "<style" not in body

From ec39677547293bcf117703173e4c4c0a73b73b44 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 10:27:13 -0500
Subject: [PATCH 47/84] test: pin the reference page against a damaged event
 entry (J15)

Two of the detail-view tests did not discriminate. The degradation
case emptied the examples section, which the template already guards
with a membership check, so it passed whether or not the schema
lookups were defensive. It now damages one event entry to a scalar --
the key survives, so the event is not treated as unknown and the page
is asked to iterate a field mapping that is not there. That is the
case that actually 500s without the guard.

The pending-event test asserted a phrase that also appears in the
catalog description, so it passed before the pending branch existed.
It now asserts copy only that branch emits, plus the absence of the
field table and payload block a documented event renders.
---
 tests/test_webhook_reference.py | 37 +++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index 2625226..97111ee 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -131,34 +131,45 @@ def test_pending_event_says_so_instead_of_showing_empty_fields(
     body = logged_in_client.get(
         "/reference/webhooks/DeviceRateLimited"
     ).data.decode()
-    assert "pending confirmation" in body
-    # No empty schema table and no payload block for a pending event.
+    # Copy unique to the pending branch. The catalog description also
+    # contains "pending confirmation", so asserting that phrase alone
+    # would pass without the branch; this sentence exists only here, and
+    # is what tells the reader the event is usable regardless.
+    assert "it is selectable when you create a Jamf Pro" in body
+    # A pending event still gets the section heading a normal event
+    # gets, so the page does not look truncated...
+    assert "Event schema" in body
+    # ...but none of the machinery a documented event renders.
     assert 'class="hippocrates"' not in body
     assert 'id="example-json"' not in body
+    assert "Sample payload" not in body
 
 
-def test_detail_survives_a_catalog_missing_its_examples(
+def test_detail_still_answers_when_one_events_entry_is_damaged(
     logged_in_client, jawa_env
 ):
-    """A detail page must degrade the same way the overview does.
-
-    Each catalog section is validated independently, so a hand edit that
-    turns "examples" into an array leaves the field schema intact while
-    every payload lookup comes back missing. The page must drop the
-    sample-payload block and still render the schema table rather than
-    raising while the template evaluates the payload.
+    """A single malformed entry degrades that event, not the page.
+
+    The accessor validates each catalog section as a whole, so a hand
+    edit that replaces one event's entry with a scalar leaves the key in
+    place: the view does not treat the event as unknown, and the page is
+    then asked to render an entry with no description, no pending flag
+    and no field mapping to iterate. It must answer with an empty field
+    list rather than failing.
     """
     import json
 
     catalog = json.loads(jawa_env.webhook_schemas_file.read_text())
-    catalog["examples"] = []
+    catalog["schemas"]["ComputerAdded"] = "not an object"
     jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
 
     resp = logged_in_client.get("/reference/webhooks/ComputerAdded")
     assert resp.status_code == 200
+    # The rest of the catalog is undamaged, so the sidebar still lists
+    # the events and the heading still renders.
     body = resp.data.decode()
-    assert "jssID" in body
-    assert 'id="example-json"' not in body
+    assert "Event schema" in body
+    assert "/reference/webhooks/ComputerCheckIn" in body
 
 
 def test_reference_pages_carry_no_inline_styles(logged_in_client, jawa_env):

From 499998f36e6d4b78240e9cf9030f8ed396b9ba13 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 11:11:19 -0500
Subject: [PATCH 48/84] fix: guard the reference page against wrong-typed
 catalog entries (J15)

The field-list guard only rescued falsy damage. A hand edit that
writes "schema": "TBD" or a list of field names leaves a truthy value
that is not a mapping, so the lookup failed and the page 500ed. The
overview had the same exposure one level up: a whole entry replaced by
a string got a .get() call it cannot answer.

Both now test the shape rather than the truthiness, which is what the
catalog accessor promises callers -- it validates each section as a
whole and cannot see inside one, so the templates are the only place
a damaged entry can be caught.

Rendered output for an intact catalog is byte-identical.
---
 templates/reference/_event_detail.html |  2 +-
 templates/reference/webhooks.html      |  2 +-
 tests/test_webhook_reference.py        | 57 ++++++++++++++++++--------
 3 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/templates/reference/_event_detail.html b/templates/reference/_event_detail.html
index 6eb35a3..6081e70 100644
--- a/templates/reference/_event_detail.html
+++ b/templates/reference/_event_detail.html
@@ -31,7 +31,7 @@ <h3>Event schema</h3>
                 </tr>
             </thead>
             <tbody>
-                {% for field, description in (entry.schema or {}).items() | sort %}
+                {% for field, description in (entry.schema if entry.schema is mapping else {}).items() | sort %}
                 <tr>
                     <td><code>{{ field }}</code></td>
                     <td>{{ description }}</td>
diff --git a/templates/reference/webhooks.html b/templates/reference/webhooks.html
index e573f7f..f871638 100644
--- a/templates/reference/webhooks.html
+++ b/templates/reference/webhooks.html
@@ -54,7 +54,7 @@ <h3>{{ category }}</h3>
                                 <td>
                                     <a href="{{ url_for('reference.webhook_detail', event_type=event) }}"><code>{{ event }}</code></a>
                                 </td>
-                                <td>{{ schemas.get(event, {}).get('description', '') }}</td>
+                                <td>{{ (schemas.get(event) if schemas.get(event) is mapping else {}).get('description', '') }}</td>
                             </tr>
                             {% endfor %}
                         </tbody>
diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index 97111ee..2a5b64e 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -150,26 +150,49 @@ def test_detail_still_answers_when_one_events_entry_is_damaged(
 ):
     """A single malformed entry degrades that event, not the page.
 
-    The accessor validates each catalog section as a whole, so a hand
-    edit that replaces one event's entry with a scalar leaves the key in
-    place: the view does not treat the event as unknown, and the page is
-    then asked to render an entry with no description, no pending flag
-    and no field mapping to iterate. It must answer with an empty field
-    list rather than failing.
+    The accessor validates each catalog section as a whole and cannot
+    see inside it, so a hand edit that damages one event leaves the key
+    in place: the view does not treat the event as unknown, and the page
+    is asked to render an entry whose field mapping may be missing or
+    may not be a mapping at all. Every shape must render an empty field
+    list rather than failing, because this file is hand-maintained.
+
+    The wrong-typed mappings matter most: unlike an empty one they are
+    truthy, so a guard that only tests falsiness lets them through to a
+    lookup that fails.
     """
     import json
 
-    catalog = json.loads(jawa_env.webhook_schemas_file.read_text())
-    catalog["schemas"]["ComputerAdded"] = "not an object"
-    jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
-
-    resp = logged_in_client.get("/reference/webhooks/ComputerAdded")
-    assert resp.status_code == 200
-    # The rest of the catalog is undamaged, so the sidebar still lists
-    # the events and the heading still renders.
-    body = resp.data.decode()
-    assert "Event schema" in body
-    assert "/reference/webhooks/ComputerCheckIn" in body
+    pristine = jawa_env.webhook_schemas_file.read_text()
+    shapes = (
+        # The whole entry replaced by a scalar.
+        "not an object",
+        # Truthy, wrong-typed field mappings -- the plausible slips in a
+        # hand-maintained mapping.
+        {"description": "d", "schema": "TBD"},
+        {"description": "d", "schema": ["jssID", "udid"]},
+        {"description": "d", "schema": 5},
+        # Falsy shapes, for completeness.
+        {"description": "d", "schema": {}},
+        {"description": "d"},
+    )
+    for shape in shapes:
+        catalog = json.loads(pristine)
+        catalog["schemas"]["ComputerAdded"] = shape
+        jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
+
+        resp = logged_in_client.get("/reference/webhooks/ComputerAdded")
+        assert resp.status_code == 200, shape
+        # The rest of the catalog is undamaged, so the sidebar still
+        # lists the events and the heading still renders.
+        body = resp.data.decode()
+        assert "Event schema" in body, shape
+        assert "/reference/webhooks/ComputerCheckIn" in body, shape
+        # No field row survives the damage, whatever its shape. Scoped
+        # to the table-row markup: the sample payload is a separate
+        # catalog section, so it is undamaged and still names its
+        # fields.
+        assert "<td><code>jssID</code></td>" not in body, shape
 
 
 def test_reference_pages_carry_no_inline_styles(logged_in_client, jawa_env):

From dce70617bb1d756aad32798343182f9f4a5560ee Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 11:14:05 -0500
Subject: [PATCH 49/84] test: pin the reference index against a wrong-typed
 entry (J15)

The index looks up a description for every event it lists, so a single
damaged entry is reachable there without anyone opening that events
page -- the more likely way to meet it. The shape guard was verified by
hand when it went in; this pins it, so a later refactor cannot drop it
with the suite still green.

Covers the truthy non-mapping shapes a hand edit produces: a string, a
list of field names, and a number.
---
 tests/test_webhook_reference.py | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index 2a5b64e..ba19b21 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -82,6 +82,36 @@ def test_overview_survives_a_catalog_missing_its_schemas(
     assert "ComputerAdded" in body
 
 
+def test_overview_still_answers_when_one_events_entry_is_damaged(
+    logged_in_client, jawa_env
+):
+    """One damaged entry must not take the whole index down.
+
+    The overview looks up a description for every event it lists, so a
+    single hand-edited entry is reachable here without anyone opening
+    that event's page. The entry is present but is not a mapping, so it
+    cannot answer the description lookup: the row must fall back to an
+    empty description and the page must still list the event.
+    """
+    import json
+
+    pristine = jawa_env.webhook_schemas_file.read_text()
+    for shape in ("TBD", ["jssID", "udid"], 5):
+        catalog = json.loads(pristine)
+        catalog["schemas"]["ComputerAdded"] = shape
+        jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
+
+        resp = logged_in_client.get("/reference/webhooks")
+        assert resp.status_code == 200, shape
+        body = resp.data.decode()
+        # The categories are a separate section and undamaged, so the
+        # event is still listed and still linked.
+        assert "Computer Events" in body, shape
+        assert "/reference/webhooks/ComputerAdded" in body, shape
+        # Undamaged siblings keep their descriptions.
+        assert "computer checks in" in body, shape
+
+
 def test_legacy_webhooks_redirect_is_untouched(logged_in_client, jawa_env):
     # The new namespace must not shadow the legacy automation redirect.
     resp = logged_in_client.get("/webhooks")

From a5ba3d18150d79f8bfd388f304fdcbc5fd70a438 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 11:20:30 -0500
Subject: [PATCH 50/84] feat: make Extras > Webhook Reference live, drop
 Notebooks (J14/J15)

Both were greyed-out href="#" placeholders. Webhook Reference now
points at the real page; Notebooks is removed rather than left as a
dead link for a feature that is not coming.
---
 templates/shared/_layout.html |  3 +--
 tests/test_extras_menu.py     | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 tests/test_extras_menu.py

diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index 5c16912..8e1e4c8 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -79,8 +79,7 @@
                             <li><a class="dropdown-item" href="{{ url_for('log_view.log_home') }}">Log</a></li>
                             <li><a class="dropdown-item" href="{{ url_for('resources_view.files') }}">Files</a></li>
                             <li><hr class="dropdown-divider"></li>
-                            <li><a class="dropdown-item text-muted" href="#">Notebooks</a></li>
-                            <li><a class="dropdown-item text-muted" href="#">Webhook Reference</a></li>
+                            <li><a class="dropdown-item" href="{{ url_for('reference.webhooks') }}">Webhook Reference</a></li>
                         </ul>
                     </li>
                     <li class="nav-item"><a class="nav-link" href="/setup">Setup</a></li>
diff --git a/tests/test_extras_menu.py b/tests/test_extras_menu.py
new file mode 100644
index 0000000..8f32096
--- /dev/null
+++ b/tests/test_extras_menu.py
@@ -0,0 +1,30 @@
+"""The Extras dropdown ships no dead links.
+
+Two placeholders shipped disabled: Notebooks (no feature coming, so it
+is removed) and Webhook Reference (now a real page).
+"""
+
+
+def test_notebooks_item_is_gone(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert "Notebooks" not in body
+
+
+def test_webhook_reference_item_is_live(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert (
+        '<a class="dropdown-item" href="/reference/webhooks">'
+        "Webhook Reference</a>" in body
+    )
+
+
+def test_no_disabled_placeholder_items_remain(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    # The greyed-out placeholder pattern: a muted item pointing nowhere.
+    assert 'class="dropdown-item text-muted" href="#"' not in body
+
+
+def test_extras_still_links_log_and_files(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert "/log/home.html" in body
+    assert "/resources/files" in body

From 781dae0ee7216d20b67d3e77794fec9f12535b07 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 11:29:40 -0500
Subject: [PATCH 51/84] test: scope Extras menu tests to the dropdown, not the
 page

Two tests were asserting against the entire /dashboard body:
- test_notebooks_item_is_gone searched the full page for "Notebooks"
  rather than just the Extras dropdown
- test_no_disabled_placeholder_items_remain required specific
  attribute order (class before href) rather than checking for any
  dead placeholder link

Add _extras_menu() helper to extract just the dropdown markup and
update both tests to assert against the scoped subset. This prevents
spurious failures from unrelated page copy and makes the tests
independent of attribute order.
---
 tests/test_extras_menu.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tests/test_extras_menu.py b/tests/test_extras_menu.py
index 8f32096..505d2d5 100644
--- a/tests/test_extras_menu.py
+++ b/tests/test_extras_menu.py
@@ -5,9 +5,15 @@
 """
 
 
+def _extras_menu(body: str) -> str:
+    """The Extras dropdown markup only — the app renders exactly one."""
+    start = body.index('<ul class="dropdown-menu">')
+    return body[start : body.index("</ul>", start)]
+
+
 def test_notebooks_item_is_gone(logged_in_client, jawa_env):
     body = logged_in_client.get("/dashboard").data.decode()
-    assert "Notebooks" not in body
+    assert "Notebooks" not in _extras_menu(body)
 
 
 def test_webhook_reference_item_is_live(logged_in_client, jawa_env):
@@ -20,8 +26,9 @@ def test_webhook_reference_item_is_live(logged_in_client, jawa_env):
 
 def test_no_disabled_placeholder_items_remain(logged_in_client, jawa_env):
     body = logged_in_client.get("/dashboard").data.decode()
-    # The greyed-out placeholder pattern: a muted item pointing nowhere.
-    assert 'class="dropdown-item text-muted" href="#"' not in body
+    # Dead placeholder link: any menu item pointing nowhere, regardless
+    # of attribute order.
+    assert 'href="#"' not in _extras_menu(body)
 
 
 def test_extras_still_links_log_and_files(logged_in_client, jawa_env):

From 5a1b700bf94cadd996c83926ef3f3d949954783d Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 11:35:25 -0500
Subject: [PATCH 52/84] feat: give empty-state CTAs brand styling (J14)

The shared empty_state macro rendered a browser-default blue link
inside an inline-styled panel -- four of them stacked on a fresh
dashboard. Now a tokenized panel with a btn-jawa call to action;
fixing the macro fixes the automation list pages at the same time.
---
 static/css/main.css            | 17 +++++++++++++++++
 templates/shared/_macros.html  | 12 +++++-------
 tests/test_dashboard_polish.py | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 7 deletions(-)
 create mode 100644 tests/test_dashboard_polish.py

diff --git a/static/css/main.css b/static/css/main.css
index 7b84edc..d21ac6d 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -1417,3 +1417,20 @@ a.btn-hero-secondary:visited {
     outline: none;
     box-shadow: 0 0 0 3px rgba(60, 106, 167, 0.35);
 }
+
+/* ===== Empty States ===== */
+.empty-state {
+    max-width: 800px;
+    margin: 1rem auto;
+    padding: 2rem;
+    text-align: center;
+    background: var(--color-surface);
+    border: 1px dashed var(--color-border);
+    border-radius: var(--radius-lg);
+}
+
+.empty-state-message {
+    margin: 0 0 1rem;
+    font-size: 0.95rem;
+    color: var(--color-text-secondary);
+}
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
index 862e134..8f64367 100644
--- a/templates/shared/_macros.html
+++ b/templates/shared/_macros.html
@@ -42,13 +42,11 @@ <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
 {% endmacro %}
 
 {% macro empty_state(message, create_url="", create_label="Create one now") %}
-<div class="form-section" style="text-align: center; margin: 1rem auto;">
-    <div class="table-responsive">
-        {{ message }}
-        {% if create_url %}
-        <a href="{{ create_url }}">{{ create_label }}</a>
-        {% endif %}
-    </div>
+<div class="empty-state">
+    <p class="empty-state-message">{{ message }}</p>
+    {% if create_url %}
+    <a href="{{ create_url }}" class="btn btn-jawa btn-action">{{ create_label }}</a>
+    {% endif %}
 </div>
 {% endmacro %}
 
diff --git a/tests/test_dashboard_polish.py b/tests/test_dashboard_polish.py
new file mode 100644
index 0000000..f04caf8
--- /dev/null
+++ b/tests/test_dashboard_polish.py
@@ -0,0 +1,34 @@
+"""Dashboard polish: styled empty-state CTAs, no inline styles.
+
+The dashboard is the first screen after login, and with no automations
+yet it is four empty states -- so those CTAs carry the first impression.
+"""
+
+
+def test_empty_state_cta_uses_the_brand_button(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    # No automations exist in a fresh temp env, so all four render.
+    assert body.count('class="empty-state"') == 4
+    assert body.count('class="btn btn-jawa btn-action"') == 4
+    assert "Create one now" in body
+
+
+def test_empty_state_has_no_inline_style(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert 'style="text-align: center; margin: 1rem auto;"' not in body
+
+
+def test_empty_state_keeps_its_message_and_link(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert "No Jamf Pro webhooks to display." in body
+    assert 'href="/automations/jamfpro/new"' in body
+    assert 'href="/automations/cron/new"' in body
+
+
+def test_empty_state_renders_on_a_type_list_page(
+    logged_in_client, jawa_env
+):
+    # The macro is shared, so styling it fixes the list pages too.
+    body = logged_in_client.get("/automations/okta").data.decode()
+    assert 'class="empty-state"' in body
+    assert 'class="btn btn-jawa btn-action"' in body

From ea1ef0dddeee0c5a1e4b6d5fd9a5fee564535c66 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 11:51:01 -0500
Subject: [PATCH 53/84] test: scope empty-state assertions to the empty-state
 markup

The hero call to action links to /automations/jamfpro/new too, so
checking the whole document could not tell an empty-state link from
the hero one -- that assertion held even with the empty-state anchor
removed entirely. Slice the empty-state region first, the way the
dropdown tests scope to the menu. The inline-style check stays
page-wide on purpose: it asserts an absence.
---
 tests/test_dashboard_polish.py | 40 ++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/tests/test_dashboard_polish.py b/tests/test_dashboard_polish.py
index f04caf8..a4cec7c 100644
--- a/tests/test_dashboard_polish.py
+++ b/tests/test_dashboard_polish.py
@@ -5,12 +5,28 @@
 """
 
 
+def _empty_states(body: str) -> str:
+    """The empty-state markup only, hero section excluded.
+
+    The hero links to /automations/jamfpro/new as well, so a
+    whole-page assertion cannot tell an empty-state call to action
+    from the hero's. An empty state holds no nested div, so its
+    first closing tag ends it. Raises if the markup is absent
+    rather than returning an empty string that asserts true.
+    """
+    opening = '<div class="empty-state">'
+    start = body.index(opening)
+    closing = "</div>"
+    end = body.index(closing, body.rindex(opening)) + len(closing)
+    return body[start:end]
+
+
 def test_empty_state_cta_uses_the_brand_button(logged_in_client, jawa_env):
-    body = logged_in_client.get("/dashboard").data.decode()
+    states = _empty_states(logged_in_client.get("/dashboard").data.decode())
     # No automations exist in a fresh temp env, so all four render.
-    assert body.count('class="empty-state"') == 4
-    assert body.count('class="btn btn-jawa btn-action"') == 4
-    assert "Create one now" in body
+    assert states.count('class="empty-state"') == 4
+    assert states.count('class="btn btn-jawa btn-action"') == 4
+    assert "Create one now" in states
 
 
 def test_empty_state_has_no_inline_style(logged_in_client, jawa_env):
@@ -19,16 +35,18 @@ def test_empty_state_has_no_inline_style(logged_in_client, jawa_env):
 
 
 def test_empty_state_keeps_its_message_and_link(logged_in_client, jawa_env):
-    body = logged_in_client.get("/dashboard").data.decode()
-    assert "No Jamf Pro webhooks to display." in body
-    assert 'href="/automations/jamfpro/new"' in body
-    assert 'href="/automations/cron/new"' in body
+    states = _empty_states(logged_in_client.get("/dashboard").data.decode())
+    assert "No Jamf Pro webhooks to display." in states
+    assert 'href="/automations/jamfpro/new"' in states
+    assert 'href="/automations/cron/new"' in states
 
 
 def test_empty_state_renders_on_a_type_list_page(
     logged_in_client, jawa_env
 ):
     # The macro is shared, so styling it fixes the list pages too.
-    body = logged_in_client.get("/automations/okta").data.decode()
-    assert 'class="empty-state"' in body
-    assert 'class="btn btn-jawa btn-action"' in body
+    states = _empty_states(
+        logged_in_client.get("/automations/okta").data.decode()
+    )
+    assert 'class="empty-state"' in states
+    assert 'class="btn btn-jawa btn-action"' in states

From 089848f2cc092e8b9d4c00ae396c13f3881d770d Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 29 Jul 2026 12:00:57 -0500
Subject: [PATCH 54/84] feat: style the hero subtitle link with tokens, not an
 inline style (J14)

The dashboard hand-built an anchor tag inside the subtitle string
with an inline colour. The hero macro now takes the link as
structured arguments and the colour lives in main.css, scoped to
hero paragraphs. The URL becomes an autoescaped attribute instead of
part of the |safe subtitle -- same output, tighter handling. Adds
rel="noopener" to the new-tab link.
---
 static/css/main.css            | 10 ++++++++++
 templates/dashboard.html       |  3 ++-
 templates/shared/_macros.html  |  6 +++---
 tests/test_dashboard_polish.py | 26 ++++++++++++++++++++++++++
 4 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/static/css/main.css b/static/css/main.css
index d21ac6d..f3707bb 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -972,6 +972,16 @@ code {
     position: relative;
 }
 
+.hero-section p a,
+.hero-section p a:visited {
+    color: rgba(255, 255, 255, 0.9);
+    text-decoration: underline;
+}
+
+.hero-section p a:hover {
+    color: #fff;
+}
+
 .hero-cta {
     display: flex;
     justify-content: left;
diff --git a/templates/dashboard.html b/templates/dashboard.html
index f4c3c61..3a90f56 100644
--- a/templates/dashboard.html
+++ b/templates/dashboard.html
@@ -36,7 +36,8 @@
 {% block content %}
 {{ hero_section(
     title="JAWA Dashboard",
-    subtitle=(total_webhooks or '0')|string ~ " webhooks &middot; " ~ (total_cron or '0')|string ~ " timed automations &middot; <a href='" ~ session.get('url', '') ~ "' target='_blank' style='color: rgba(255,255,255,0.9);'>" ~ session.get('url', '') ~ "</a>",
+    subtitle=(total_webhooks or '0')|string ~ " webhooks &middot; " ~ (total_cron or '0')|string ~ " timed automations &middot; ",
+    subtitle_link_url=session.get('url', ''),
     create_url="/automations/jamfpro/new",
     create_label="Create Webhook",
     secondary_url="/templates",
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
index 8f64367..2f0cb04 100644
--- a/templates/shared/_macros.html
+++ b/templates/shared/_macros.html
@@ -1,11 +1,11 @@
 {# Shared Jinja2 macros for JAWA automation templates #}
 
-{% macro hero_section(title, subtitle="", create_url="", create_label="Create", secondary_url="", secondary_label="") %}
+{% macro hero_section(title, subtitle="", create_url="", create_label="Create", secondary_url="", secondary_label="", subtitle_link_url="", subtitle_link_text="") %}
 <div class="hero-section">
     <div class="container">
         <h2>{{ title }}</h2>
-        {% if subtitle %}
-        <p>{{ subtitle|safe }}</p>
+        {% if subtitle or subtitle_link_url %}
+        <p>{{ subtitle|safe }}{% if subtitle_link_url %}<a href="{{ subtitle_link_url }}" target="_blank" rel="noopener">{{ subtitle_link_text or subtitle_link_url }}</a>{% endif %}</p>
         {% endif %}
         {% if create_url or secondary_url %}
         <div class="hero-cta">
diff --git a/tests/test_dashboard_polish.py b/tests/test_dashboard_polish.py
index a4cec7c..d227b68 100644
--- a/tests/test_dashboard_polish.py
+++ b/tests/test_dashboard_polish.py
@@ -50,3 +50,29 @@ def test_empty_state_renders_on_a_type_list_page(
     )
     assert 'class="empty-state"' in states
     assert 'class="btn btn-jawa btn-action"' in states
+
+
+def test_hero_subtitle_has_no_inline_style(logged_in_client, jawa_env):
+    body = logged_in_client.get("/dashboard").data.decode()
+    # The JPS-URL link used to carry style='color: rgba(...)'.
+    assert "style='color: rgba(255,255,255,0.9);'" not in body
+    assert 'style="color: rgba(255,255,255,0.9);"' not in body
+
+
+def test_hero_subtitle_still_links_the_jamf_pro_url(
+    logged_in_client, jawa_env
+):
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert "webhooks" in body
+    assert "timed automations" in body
+    assert 'href="https://jamf.example.test"' in body
+    assert 'target="_blank"' in body
+    # New tab hygiene on an admin-supplied destination.
+    assert 'rel="noopener"' in body
+
+
+def test_hero_subtitle_link_is_attribute_escaped(logged_in_client, jawa_env):
+    # The URL is rendered as an autoescaped attribute now, not spliced
+    # into the |safe subtitle string.
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert "<a href='" not in body

From 004a9a66d6f8a609dbc6a8e1314cfabc7eb23b7e Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 31 Jul 2026 13:15:18 -0500
Subject: [PATCH 55/84] test: pin the hero subtitle link text and its escaping

The hero link rendered its own URL as the anchor text via a
fallback expression that no caller overrides, so that branch --
the whole visible payload of the link -- had nothing asserting
on it: emptying it kept the suite green while the dashboard
showed an invisible link. Pin the anchor text, and add a case
that feeds a hostile Jamf Pro URL through the session to assert
it comes back entity-encoded. The older case only checked the
anchor avoided single quotes, which a double-quoted regression
would have passed.
---
 tests/test_dashboard_polish.py | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/tests/test_dashboard_polish.py b/tests/test_dashboard_polish.py
index d227b68..93fc534 100644
--- a/tests/test_dashboard_polish.py
+++ b/tests/test_dashboard_polish.py
@@ -4,6 +4,13 @@
 yet it is four empty states -- so those CTAs carry the first impression.
 """
 
+# A Jamf Pro URL crafted to break out of the href attribute and open a
+# script tag, plus the entity-encoded form autoescaping must produce.
+HOSTILE_URL = 'https://x.test/"><script>alert(1)</script>'
+HOSTILE_URL_ENCODED = (
+    "https://x.test/&#34;&gt;&lt;script&gt;alert(1)&lt;/script&gt;"
+)
+
 
 def _empty_states(body: str) -> str:
     """The empty-state markup only, hero section excluded.
@@ -69,6 +76,10 @@ def test_hero_subtitle_still_links_the_jamf_pro_url(
     assert 'target="_blank"' in body
     # New tab hygiene on an admin-supplied destination.
     assert 'rel="noopener"' in body
+    # The anchor's visible text is the whole point of the link, and it
+    # is the only thing the fallback expression produces -- no caller
+    # passes explicit link text, so nothing else covers that branch.
+    assert ">https://jamf.example.test</a>" in body
 
 
 def test_hero_subtitle_link_is_attribute_escaped(logged_in_client, jawa_env):
@@ -76,3 +87,20 @@ def test_hero_subtitle_link_is_attribute_escaped(logged_in_client, jawa_env):
     # into the |safe subtitle string.
     body = logged_in_client.get("/dashboard").data.decode()
     assert "<a href='" not in body
+
+
+def test_hero_subtitle_escapes_a_hostile_jamf_pro_url(
+    logged_in_client, jawa_env
+):
+    # The Jamf Pro URL is admin-supplied and lands in both an attribute
+    # and the link text. A payload that closes the href and opens a tag
+    # must come back entity-encoded, not as live markup: asserting only
+    # that the anchor avoids single quotes would still pass if a future
+    # edit re-concatenated it into the |safe subtitle with double ones.
+    with logged_in_client.session_transaction() as sess:
+        sess["url"] = HOSTILE_URL
+    body = logged_in_client.get("/dashboard").data.decode()
+    assert HOSTILE_URL_ENCODED in body
+    assert HOSTILE_URL not in body
+    assert '"><script>' not in body
+    assert "<script>alert(1)</script>" not in body

From 2f2a1c1617061ee834ceb65fad01786f76fe71fd Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 31 Jul 2026 13:32:42 -0500
Subject: [PATCH 56/84] feat: group the Jamf event dropdown by category from
 the catalog (J15)

The form listed 23 events alphabetically in a hardcoded block.
It now renders optgroups from the same event catalog the Webhook
Reference pages read, so the two lists cannot drift, and computer,
mobile device and system events are visibly separated when picking
an event.

Values are unchanged Jamf event strings. A stored event the catalog
does not list is rendered in its own group, so opening and saving an
older automation cannot silently change its event.
---
 .../automations/_partials/_jamf_fields.html   |  41 +++----
 tests/test_jamf_event_dropdown.py             | 102 ++++++++++++++++++
 views/_type_handlers/jamf_handler.py          |   8 +-
 3 files changed, 126 insertions(+), 25 deletions(-)
 create mode 100644 tests/test_jamf_event_dropdown.py

diff --git a/templates/automations/_partials/_jamf_fields.html b/templates/automations/_partials/_jamf_fields.html
index 74fb1fe..9a6a043 100644
--- a/templates/automations/_partials/_jamf_fields.html
+++ b/templates/automations/_partials/_jamf_fields.html
@@ -12,38 +12,31 @@
 <div class="d-flex justify-content-center text-center">
     <b>Jamf Event:</b>
 </div>
+{% set catalog_events = (event_categories or {}).values() | sum(start=[]) %}
+{% set stored_event = webhook_info[0].event if webhook_info else '' %}
 <select class="form-control text-center" name="event"
         onchange="showSmartGroupNote(this.value)"
         {% if not edit_mode %}required{% endif %}>
     <option value="">{{ '-- Keep current --' if edit_mode else '' }}</option>
-    <option value="ComputerAdded" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerAdded' }}>ComputerAdded</option>
-    <option value="ComputerCheckIn" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerCheckIn' }}>ComputerCheckIn</option>
-    <option value="ComputerInventoryCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerInventoryCompleted' }}>ComputerInventoryCompleted</option>
-    <option value="ComputerPatchPolicyCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerPatchPolicyCompleted' }}>ComputerPatchPolicyCompleted</option>
-    <option value="ComputerPolicyFinished" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerPolicyFinished' }}>ComputerPolicyFinished</option>
-    <option value="ComputerPushCapabilityChanged" {{ 'selected' if webhook_info and webhook_info[0].event == 'ComputerPushCapabilityChanged' }}>ComputerPushCapabilityChanged</option>
-    <option value="DeviceAddedToDEP" {{ 'selected' if webhook_info and webhook_info[0].event == 'DeviceAddedToDEP' }}>DeviceAddedToDEP</option>
-    <option value="DeviceRateLimited" {{ 'selected' if webhook_info and webhook_info[0].event == 'DeviceRateLimited' }}>DeviceRateLimited</option>
-    <option value="JSSShutdown" {{ 'selected' if webhook_info and webhook_info[0].event == 'JSSShutdown' }}>JSSShutdown</option>
-    <option value="JSSStartup" {{ 'selected' if webhook_info and webhook_info[0].event == 'JSSStartup' }}>JSSStartup</option>
-    <option value="MobileDeviceCheckIn" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceCheckIn' }}>MobileDeviceCheckIn</option>
-    <option value="MobileDeviceCommandCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceCommandCompleted' }}>MobileDeviceCommandCompleted</option>
-    <option value="MobileDeviceEnrolled" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceEnrolled' }}>MobileDeviceEnrolled</option>
-    <option value="MobileDeviceInventoryCompleted" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceInventoryCompleted' }}>MobileDeviceInventoryCompleted</option>
-    <option value="MobileDevicePushSent" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDevicePushSent' }}>MobileDevicePushSent</option>
-    <option value="MobileDeviceUnEnrolled" {{ 'selected' if webhook_info and webhook_info[0].event == 'MobileDeviceUnEnrolled' }}>MobileDeviceUnEnrolled</option>
-    <option value="PatchSoftwareTitleUpdated" {{ 'selected' if webhook_info and webhook_info[0].event == 'PatchSoftwareTitleUpdated' }}>PatchSoftwareTitleUpdated</option>
-    <option value="PushSent" {{ 'selected' if webhook_info and webhook_info[0].event == 'PushSent' }}>PushSent</option>
-    <option value="RestAPIOperation" {{ 'selected' if webhook_info and webhook_info[0].event == 'RestAPIOperation' }}>RestAPIOperation</option>
-    <option value="SCEPChallenge" {{ 'selected' if webhook_info and webhook_info[0].event == 'SCEPChallenge' }}>SCEPChallenge</option>
-    <option value="SmartGroupComputerMembershipChange" {{ 'selected' if webhook_info and webhook_info[0].event == 'SmartGroupComputerMembershipChange' }}>SmartGroupComputerMembershipChange</option>
-    <option value="SmartGroupMobileDeviceMembershipChange" {{ 'selected' if webhook_info and webhook_info[0].event == 'SmartGroupMobileDeviceMembershipChange' }}>SmartGroupMobileDeviceMembershipChange</option>
-    <option value="SmartGroupUserMembershipChange" {{ 'selected' if webhook_info and webhook_info[0].event == 'SmartGroupUserMembershipChange' }}>SmartGroupUserMembershipChange</option>
+    {% if stored_event and stored_event not in catalog_events %}
+    {# An event Jamf sends that this catalog does not list yet: keep it
+       selectable so saving the form cannot silently change it. #}
+    <optgroup label="Stored event">
+        <option value="{{ stored_event }}" selected>{{ stored_event }}</option>
+    </optgroup>
+    {% endif %}
+    {% for category, events in (event_categories or {}).items() %}
+    <optgroup label="{{ category }}">
+        {% for event in events %}
+        <option value="{{ event }}" {{ 'selected' if event == stored_event }}>{{ event }}</option>
+        {% endfor %}
+    </optgroup>
+    {% endfor %}
 </select>
 
 <div id="smartGroupNote" class="text-center" style="display:none">
     * Note: If utilizing the event for Smart Group Membership Change, after submitting, navigate to the
-    <a href="{{ session_url }}/webhooks.html" style="color:#3c6aa7;" target="_blank">Webhooks</a> setting in Jamf Pro
+    <a href="{{ session_url }}/webhooks.html" target="_blank">Webhooks</a> setting in Jamf Pro
     and adjust the proper Smart Group for this Webhook.
 </div>
 
diff --git a/tests/test_jamf_event_dropdown.py b/tests/test_jamf_event_dropdown.py
new file mode 100644
index 0000000..1b93029
--- /dev/null
+++ b/tests/test_jamf_event_dropdown.py
@@ -0,0 +1,102 @@
+"""The Jamf event dropdown is generated from the shared catalog.
+
+One source of truth for the event list: the reference pages and this
+form read the same file, so they cannot drift. The rendered values are
+the exact Jamf event strings -- they are stored on the webhook and
+matched against the inbound payload's webhookEvent.
+"""
+
+from bin.data_store import get_webhook_schemas
+
+
+def _catalog_events():
+    return [
+        event
+        for events in get_webhook_schemas()["categories"].values()
+        for event in events
+    ]
+
+
+def test_create_form_groups_events_by_category(logged_in_client, jawa_env):
+    body = logged_in_client.get(
+        "/automations/jamfpro/new"
+    ).data.decode()
+    for category in get_webhook_schemas()["categories"]:
+        assert f'<optgroup label="{category}">' in body
+
+
+def test_create_form_lists_every_catalog_event(logged_in_client, jawa_env):
+    body = logged_in_client.get(
+        "/automations/jamfpro/new"
+    ).data.decode()
+    events = _catalog_events()
+    assert len(events) == 23
+    for event in events:
+        assert f'value="{event}"' in body
+
+
+def test_create_form_keeps_the_required_empty_placeholder(
+    logged_in_client, jawa_env
+):
+    body = logged_in_client.get(
+        "/automations/jamfpro/new"
+    ).data.decode()
+    assert '<option value=""></option>' in body
+    assert "-- Keep current --" not in body
+    assert 'name="event"' in body
+    assert "showSmartGroupNote(this.value)" in body
+
+
+def _stored_webhook(event):
+    return {
+        "name": "dropdown-hook",
+        "tag": "jamfpro",
+        "event": event,
+        "description": "dropdown test",
+        "script": "/tmp/dropdown-hook.py",
+        "jamf_id": "42",
+        "webhook_username": "null",
+        "webhook_password": "null",
+        "api_key": "null",
+    }
+
+
+def test_edit_form_preselects_the_stored_event(
+    logged_in_client, jawa_env
+):
+    jawa_env.add_webhook(_stored_webhook("ComputerCheckIn"))
+    body = logged_in_client.get(
+        "/automations/jamfpro/dropdown-hook/edit"
+    ).data.decode()
+    assert '<option value="ComputerCheckIn" selected>' in body
+    assert "-- Keep current --" in body
+
+
+def test_edit_form_preserves_an_event_missing_from_the_catalog(
+    logged_in_client, jawa_env
+):
+    # A webhook stored before the MobileDeviceUnEnrolled recasing must
+    # not be silently rewritten by opening and saving the edit form.
+    jawa_env.add_webhook(_stored_webhook("MobileDeviceUnenrolled"))
+    body = logged_in_client.get(
+        "/automations/jamfpro/dropdown-hook/edit"
+    ).data.decode()
+    assert '<optgroup label="Stored event">' in body
+    assert '<option value="MobileDeviceUnenrolled" selected>' in body
+
+
+def test_dropdown_has_no_raw_hex_inline_style(logged_in_client, jawa_env):
+    body = logged_in_client.get(
+        "/automations/jamfpro/new"
+    ).data.decode()
+    assert 'style="color:#3c6aa7;"' not in body
+
+
+def test_empty_catalog_leaves_the_form_renderable(
+    logged_in_client, jawa_env
+):
+    # A damaged catalog must degrade, not 500 the creation form.
+    jawa_env.webhook_schemas_file.write_text("{}")
+    resp = logged_in_client.get("/automations/jamfpro/new")
+    assert resp.status_code == 200
+    assert 'name="event"' in resp.data.decode()
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index f9565d2..d5d8adf 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -35,6 +35,7 @@
 from bin import logger
 from bin.data_store import (
     get_jawa_address,
+    get_webhook_schemas,
     save_script,
     save_all_webhooks,
     retire_script,
@@ -163,7 +164,12 @@ class JamfHandler(AutomationHandler):
     supports_auth = True
 
     def get_create_context(self, session_data: Dict) -> Dict[str, Any]:
-        return {"url": session_data.get("url")}
+        # The event dropdown is generated from the same catalog the
+        # Webhook Reference pages use, so the two cannot drift.
+        return {
+            "url": session_data.get("url"),
+            "event_categories": get_webhook_schemas()["categories"],
+        }
 
     def process_create(
         self,

From f51f5613c760c4ae65aac9e5f7c06d5fa02704b5 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 31 Jul 2026 13:47:18 -0500
Subject: [PATCH 57/84] fix: degrade one bad event category instead of the
 whole dropdown

Flattening the catalog with sum(start=[]) raised a TypeError if a
hand edit left a category holding a bare string or a mapping instead
of a list, which took out both the create and the edit form. The
Webhook Reference overview survives the same damage, and the catalog
reader degrades rather than raising for exactly this reason, so the
form should too.

Categories are now filtered to list-shaped values before they are
flattened and looped, so a single malformed group drops out and the
remaining events still render. Also records what the `or {}` fallback
actually guards: the partial being rendered without the context key,
not a damaged catalog file.
---
 .../automations/_partials/_jamf_fields.html   | 12 +++++++--
 tests/test_jamf_event_dropdown.py             | 27 +++++++++++++++++++
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/templates/automations/_partials/_jamf_fields.html b/templates/automations/_partials/_jamf_fields.html
index 9a6a043..96711a5 100644
--- a/templates/automations/_partials/_jamf_fields.html
+++ b/templates/automations/_partials/_jamf_fields.html
@@ -12,7 +12,15 @@
 <div class="d-flex justify-content-center text-center">
     <b>Jamf Event:</b>
 </div>
-{% set catalog_events = (event_categories or {}).values() | sum(start=[]) %}
+{# `or {}` covers this partial being rendered without the context key at
+   all (a caller that does not splat get_create_context) -- a damaged
+   catalog file is already normalised to empty by the data store. The
+   sequence tests drop a category a hand edit left holding a string or a
+   mapping instead of a list, so one bad group degrades on its own. #}
+{% set event_groups = (event_categories or {}).items()
+   | selectattr('1', 'sequence') | rejectattr('1', 'string')
+   | rejectattr('1', 'mapping') | list %}
+{% set catalog_events = event_groups | map(attribute='1') | sum(start=[]) %}
 {% set stored_event = webhook_info[0].event if webhook_info else '' %}
 <select class="form-control text-center" name="event"
         onchange="showSmartGroupNote(this.value)"
@@ -25,7 +33,7 @@
         <option value="{{ stored_event }}" selected>{{ stored_event }}</option>
     </optgroup>
     {% endif %}
-    {% for category, events in (event_categories or {}).items() %}
+    {% for category, events in event_groups %}
     <optgroup label="{{ category }}">
         {% for event in events %}
         <option value="{{ event }}" {{ 'selected' if event == stored_event }}>{{ event }}</option>
diff --git a/tests/test_jamf_event_dropdown.py b/tests/test_jamf_event_dropdown.py
index 1b93029..f0be40c 100644
--- a/tests/test_jamf_event_dropdown.py
+++ b/tests/test_jamf_event_dropdown.py
@@ -6,6 +6,8 @@
 matched against the inbound payload's webhookEvent.
 """
 
+import json
+
 from bin.data_store import get_webhook_schemas
 
 
@@ -100,3 +102,28 @@ def test_empty_catalog_leaves_the_form_renderable(
     resp = logged_in_client.get("/automations/jamfpro/new")
     assert resp.status_code == 200
     assert 'name="event"' in resp.data.decode()
+
+
+def test_a_miscategorised_event_list_degrades_that_group_only(
+    logged_in_client, jawa_env
+):
+    # A hand edit that leaves one category holding a bare string
+    # instead of a list must drop that group, not the whole form.
+    jawa_env.webhook_schemas_file.write_text(
+        json.dumps(
+            {
+                "categories": {
+                    "Computer Events": ["ComputerAdded"],
+                    "System Events": "JSSStartup",
+                },
+                "schemas": {},
+                "examples": {},
+            }
+        )
+    )
+    resp = logged_in_client.get("/automations/jamfpro/new")
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    assert '<optgroup label="Computer Events">' in body
+    assert 'value="ComputerAdded"' in body
+    assert '<optgroup label="System Events">' not in body

From 935654fbbf426a529fe91dde4feaf9a4ecc09d0b Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 31 Jul 2026 13:53:35 -0500
Subject: [PATCH 58/84] test: cover both mapping and string in
 miscategorised-event test

The degradation guard in _jamf_fields.html has two rejectattr filters
(one for strings, one for mappings) to avoid TypeError from the later
flatten. The existing test only verified the string case. Parametrizing
over both damage shapes ensures the mapping half is also exercised.
---
 tests/test_jamf_event_dropdown.py | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/tests/test_jamf_event_dropdown.py b/tests/test_jamf_event_dropdown.py
index f0be40c..b01ea16 100644
--- a/tests/test_jamf_event_dropdown.py
+++ b/tests/test_jamf_event_dropdown.py
@@ -8,6 +8,8 @@
 
 import json
 
+import pytest
+
 from bin.data_store import get_webhook_schemas
 
 
@@ -104,17 +106,26 @@ def test_empty_catalog_leaves_the_form_renderable(
     assert 'name="event"' in resp.data.decode()
 
 
+@pytest.mark.parametrize(
+    "bad_value",
+    [
+        "JSSStartup",  # string
+        {"JSSStartup": "x"},  # mapping
+    ],
+    ids=["string", "mapping"],
+)
 def test_a_miscategorised_event_list_degrades_that_group_only(
-    logged_in_client, jawa_env
+    logged_in_client, jawa_env, bad_value
 ):
-    # A hand edit that leaves one category holding a bare string
-    # instead of a list must drop that group, not the whole form.
+    # A hand edit that leaves one category holding a bare string or
+    # mapping object instead of a list must drop that group, not the
+    # whole form. Both damage shapes blow up the flatten with TypeError.
     jawa_env.webhook_schemas_file.write_text(
         json.dumps(
             {
                 "categories": {
                     "Computer Events": ["ComputerAdded"],
-                    "System Events": "JSSStartup",
+                    "System Events": bad_value,
                 },
                 "schemas": {},
                 "examples": {},

From 3a504fcdadcf512e84ee82c2a5839416d0e63b55 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 31 Jul 2026 14:34:18 -0500
Subject: [PATCH 59/84] test: make the catalog-driven render assertions able to
 fail

Three assertions in the webhook reference and event dropdown tests
could not detect the defect they named.

The overview tests asserted only strings the sidebar also emits --
category headings, event names, and detail links -- so both passed with
the entire overview table deleted. They now also assert an event
description and the standard table class, neither of which the sidebar
renders.

Two tests counted events in the catalog rather than on the page:
len(events) == 23 reads the file the fixture just copied, so no
rendering defect can move it, and a 24th Jamf event would fail it
spuriously. Both now compare the rendered event list against the
catalog, so a dropped, duplicated, or spurious entry fails and growing
the catalog does not.

The required-placeholder test never asserted required. A bare
containment check cannot discriminate -- the upload macro and the name
field emit it too -- so the assertion is scoped to the event select's
own opening tag. Without it the create form accepts a webhook with no
event, which then matches no inbound webhookEvent: a webhook that
exists and never fires. Its absence in edit mode is asserted alongside
the "keep current" placeholder that depends on it.
---
 tests/test_jamf_event_dropdown.py | 34 ++++++++++++++++++++++++-
 tests/test_webhook_reference.py   | 42 ++++++++++++++++++++-----------
 2 files changed, 60 insertions(+), 16 deletions(-)

diff --git a/tests/test_jamf_event_dropdown.py b/tests/test_jamf_event_dropdown.py
index b01ea16..c2fbf35 100644
--- a/tests/test_jamf_event_dropdown.py
+++ b/tests/test_jamf_event_dropdown.py
@@ -7,6 +7,7 @@
 """
 
 import json
+import re
 
 import pytest
 
@@ -21,6 +22,26 @@ def _catalog_events():
     ]
 
 
+def _event_select_tag(body):
+    """The <select name="event"> opening tag on its own.
+
+    Other fields on the form carry `required` too, so an attribute
+    assertion has to be scoped to this tag or it cannot discriminate.
+    """
+    match = re.search(r'<select[^>]*name="event"[^>]*>', body)
+    assert match, "the event select is missing entirely"
+    return match.group(0)
+
+
+def _option_values(body):
+    """Every non-empty option value in document order.
+
+    The placeholder renders as value="" and is excluded, so this is the
+    catalog options plus a "Stored event" option when one is rendered.
+    """
+    return re.findall(r'<option value="([^"]+)"', body)
+
+
 def test_create_form_groups_events_by_category(logged_in_client, jawa_env):
     body = logged_in_client.get(
         "/automations/jamfpro/new"
@@ -34,7 +55,11 @@ def test_create_form_lists_every_catalog_event(logged_in_client, jawa_env):
         "/automations/jamfpro/new"
     ).data.decode()
     events = _catalog_events()
-    assert len(events) == 23
+    # An option per catalog event and no more. No stored event exists on
+    # the create form, so the only other option is the value=""
+    # placeholder, which _option_values excludes. A count read off the
+    # page, not a literal that has to be bumped when Jamf adds an event.
+    assert _option_values(body) == events
     for event in events:
         assert f'value="{event}"' in body
 
@@ -49,6 +74,10 @@ def test_create_form_keeps_the_required_empty_placeholder(
     assert "-- Keep current --" not in body
     assert 'name="event"' in body
     assert "showSmartGroupNote(this.value)" in body
+    # The placeholder is only a placeholder if the browser refuses the
+    # submission: a webhook saved with no event never matches an inbound
+    # webhookEvent, so it exists and never fires.
+    assert "required" in _event_select_tag(body)
 
 
 def _stored_webhook(event):
@@ -74,6 +103,9 @@ def test_edit_form_preselects_the_stored_event(
     ).data.decode()
     assert '<option value="ComputerCheckIn" selected>' in body
     assert "-- Keep current --" in body
+    # "Keep current" only works if the empty option is submittable, so
+    # the attribute the create form carries must be absent here.
+    assert "required" not in _event_select_tag(body)
 
 
 def test_edit_form_preserves_an_event_missing_from_the_catalog(
diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index ba19b21..a55d898 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -4,8 +4,25 @@
 the legacy automation redirects in app.py.
 """
 
+import json
 import re
 
+from bin.data_store import get_webhook_schemas
+
+# The overview table is the only place an event link is wrapped in
+# <code>; the sidebar renders bare anchors. Counting this shape keeps
+# the assertions below pinned to the table rather than to the sidebar,
+# which emits the same category headings and event names.
+TABLE_EVENT_LINK = re.compile(r'<a href="/reference/webhooks/([^"]+)"><code>')
+
+
+def _catalog_events():
+    return [
+        event
+        for events in get_webhook_schemas()["categories"].values()
+        for event in events
+    ]
+
 
 def test_overview_renders(logged_in_client, jawa_env):
     resp = logged_in_client.get("/reference/webhooks")
@@ -17,18 +34,19 @@ def test_overview_renders(logged_in_client, jawa_env):
     assert "Mobile Device Events" in body
     assert "System Events" in body
     assert "ComputerAdded" in body
+    # The headings and names above are also emitted by the sidebar, so
+    # they cannot see the table at all. Descriptions and the standard
+    # table treatment come only from the table.
+    assert "new computer record is created" in body
+    assert 'class="hippocrates"' in body
 
 
-def test_overview_lists_all_23_events(logged_in_client, jawa_env):
-    from bin.data_store import get_webhook_schemas
-
+def test_overview_lists_every_catalog_event(logged_in_client, jawa_env):
     body = logged_in_client.get("/reference/webhooks").data.decode()
-    events = [
-        e
-        for evs in get_webhook_schemas()["categories"].values()
-        for e in evs
-    ]
-    assert len(events) == 23
+    events = _catalog_events()
+    # A row per catalog event and no more: a count read off the page,
+    # not a literal that has to be bumped when Jamf adds an event.
+    assert TABLE_EVENT_LINK.findall(body) == events
     for event in events:
         assert f"/reference/webhooks/{event}" in body
 
@@ -69,8 +87,6 @@ def test_overview_survives_a_catalog_missing_its_schemas(
     populated while every description lookup comes back undefined. The
     overview must still render the event names it does know about.
     """
-    import json
-
     catalog = json.loads(jawa_env.webhook_schemas_file.read_text())
     catalog["schemas"] = []
     jawa_env.webhook_schemas_file.write_text(json.dumps(catalog))
@@ -93,8 +109,6 @@ def test_overview_still_answers_when_one_events_entry_is_damaged(
     cannot answer the description lookup: the row must fall back to an
     empty description and the page must still list the event.
     """
-    import json
-
     pristine = jawa_env.webhook_schemas_file.read_text()
     for shape in ("TBD", ["jssID", "udid"], 5):
         catalog = json.loads(pristine)
@@ -191,8 +205,6 @@ def test_detail_still_answers_when_one_events_entry_is_damaged(
     truthy, so a guard that only tests falsiness lets them through to a
     lookup that fails.
     """
-    import json
-
     pristine = jawa_env.webhook_schemas_file.read_text()
     shapes = (
         # The whole entry replaced by a scalar.

From 35ad0d3480523817a9795956763813a71803482c Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 31 Jul 2026 14:34:38 -0500
Subject: [PATCH 60/84] fix: apply the catalog shape rule to the reference
 pages too

The event dropdown already drops a category a hand edit left holding a
bare string or a mapping instead of a list of event names. The webhook
reference read the same catalog with no such guard.

Neither shape crashes the page, which is why it went unnoticed: Jinja
iterates a string character by character and a mapping over its keys,
so a miscategorised entry renders a table row and a sidebar link per
character or per key, each linking to an event that does not exist and
answering 404. Filtering once at the top of the template and looping
the filtered groups in both the sidebar and the overview table puts all
three consumers of the catalog under one shape rule.

The guard belongs in the template rather than the accessor: three
consumers read that dict, and coercing it centrally would silently
reshape hand-maintained reference data.

Also merges the duplicated .copy-btn:focus-visible rule, which
declared opacity in one block and the focus ring fourteen lines later.
---
 static/css/main.css               |  6 ++--
 templates/reference/webhooks.html | 15 ++++++++--
 tests/test_webhook_reference.py   | 50 +++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/static/css/main.css b/static/css/main.css
index f3707bb..1d04052 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -1408,8 +1408,7 @@ a.btn-hero-secondary:visited {
     transition: opacity 0.2s ease, background-color 0.15s ease;
 }
 
-.code-wrapper:hover .copy-btn,
-.copy-btn:focus-visible {
+.code-wrapper:hover .copy-btn {
     opacity: 1;
 }
 
@@ -1423,7 +1422,10 @@ a.btn-hero-secondary:visited {
     border-color: var(--color-accent);
 }
 
+/* Keyboard focus both reveals the button (it is opacity 0 until the
+   wrapper is hovered) and rings it. */
 .copy-btn:focus-visible {
+    opacity: 1;
     outline: none;
     box-shadow: 0 0 0 3px rgba(60, 106, 167, 0.35);
 }
diff --git a/templates/reference/webhooks.html b/templates/reference/webhooks.html
index f871638..4efad9c 100644
--- a/templates/reference/webhooks.html
+++ b/templates/reference/webhooks.html
@@ -17,11 +17,22 @@
     secondary_label="All events"
 ) }}
 
+{# One shape rule for every consumer of the catalog: the event dropdown
+   applies the same filter. `or {}` covers the context key being absent
+   altogether -- a damaged catalog file is already normalised to empty by
+   the data store. Both rejectattr tests are load-bearing: Jinja's
+   sequence test admits strings and mappings, and a category a hand edit
+   left holding either would otherwise render one row per character or
+   one row per key -- links to events that do not exist. #}
+{% set event_groups = (categories or {}).items()
+   | selectattr('1', 'sequence') | rejectattr('1', 'string')
+   | rejectattr('1', 'mapping') | list %}
+
 <div class="container">
     <div class="row">
         <div class="col-md-3 d-none d-md-block">
             <nav class="event-sidebar" aria-label="Webhook events">
-                {% for category, events in categories.items() %}
+                {% for category, events in event_groups %}
                 <h6>{{ category }}</h6>
                 {% for event in events %}
                 <a class="event-link {% if event == selected_event %}active{% endif %}"
@@ -35,7 +46,7 @@ <h6>{{ category }}</h6>
             {% if selected_event %}
             {% include "reference/_event_detail.html" %}
             {% else %}
-            {% for category, events in categories.items() %}
+            {% for category, events in event_groups %}
             <div class="schema-section">
                 <div class="section-header">
                     <h3>{{ category }}</h3>
diff --git a/tests/test_webhook_reference.py b/tests/test_webhook_reference.py
index a55d898..1fec706 100644
--- a/tests/test_webhook_reference.py
+++ b/tests/test_webhook_reference.py
@@ -7,6 +7,8 @@
 import json
 import re
 
+import pytest
+
 from bin.data_store import get_webhook_schemas
 
 # The overview table is the only place an event link is wrapped in
@@ -237,6 +239,54 @@ def test_detail_still_answers_when_one_events_entry_is_damaged(
         assert "<td><code>jssID</code></td>" not in body, shape
 
 
+@pytest.mark.parametrize(
+    "bad_value",
+    [
+        "JSSStartup",  # string
+        {"JSSStartup": "x"},  # mapping
+    ],
+    ids=["string", "mapping"],
+)
+def test_a_miscategorised_event_list_degrades_that_group_only(
+    logged_in_client, jawa_env, bad_value
+):
+    """The overview applies the same shape rule as the event dropdown.
+
+    A hand edit that leaves one category holding a bare string or a
+    mapping instead of a list is iterable, so the page does not fail --
+    it renders a row and a sidebar link per character or per key, every
+    one of them linking to an event that does not exist. That group must
+    be dropped instead.
+    """
+    jawa_env.webhook_schemas_file.write_text(
+        json.dumps(
+            {
+                "categories": {
+                    "Computer Events": ["ComputerAdded"],
+                    "System Events": bad_value,
+                },
+                "schemas": {},
+                "examples": {},
+            }
+        )
+    )
+    resp = logged_in_client.get("/reference/webhooks")
+    assert resp.status_code == 200
+    body = resp.data.decode()
+    # The undamaged group still renders its table row.
+    assert TABLE_EVENT_LINK.findall(body) == ["ComputerAdded"]
+    # ...and the damaged one contributes nothing anywhere on the page:
+    # no table row, no heading, and no per-character sidebar link. Kept
+    # at document scope so a guard applied to only one of the two loops
+    # cannot satisfy it.
+    assert "System Events" not in body
+    assert not [
+        event
+        for event in re.findall(r'/reference/webhooks/([^"]+)"', body)
+        if len(event) == 1
+    ]
+
+
 def test_reference_pages_carry_no_inline_styles(logged_in_client, jawa_env):
     # The design system forbids inline style= and <style> blocks. The
     # only inline style the shared layout itself renders is on the

From 6896531b81bc683ef151b74b3b3b0bcffcef8ad9 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Tue, 4 Aug 2026 10:26:18 -0500
Subject: [PATCH 61/84] chore: bump version strings to 3.2.0 (J9)

The README already announced 3.2, but four runtime sites still reported
3.1.1. The two User-Agent headers are the ones that mattered: they are
what a JAWA instance reports to Jamf Pro, so a shipped 3.2 would have
identified itself as 3.1.1 in customer Jamf logs.

- views/_type_handlers/jamf_handler.py: USER_AGENT_STRING (3 call sites)
- views/home_view.py: the activationcode probe's User-Agent
- templates/shared/_layout.html: console footer
- bin/installer.sh: install banner (same-length swap, art alignment kept)

The README v3.1.1 heading stays: it is that release's historical notes.

Version is still hardcoded in four places and the User-Agent literal is
duplicated across two files; consolidating onto one constant is left as
a follow-up rather than folded into a release-prep bump.
---
 bin/installer.sh                     | 2 +-
 templates/shared/_layout.html        | 2 +-
 views/_type_handlers/jamf_handler.py | 2 +-
 views/home_view.py                   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/installer.sh b/bin/installer.sh
index 6a09d9e..8e600b9 100644
--- a/bin/installer.sh
+++ b/bin/installer.sh
@@ -223,7 +223,7 @@ readme() {
 |  \`--'  |  /  _____  \  \    /\    / /  _____  \  
  \______/  /__/     \__\  \__/  \__/ /__/     \__\  
 
-                        v3.1.1
+                        v3.2.0
 
 
 Welcome to the Jamf Automation and Webhook Assistant, we hope it provides the solution you are looking for.
diff --git a/templates/shared/_layout.html b/templates/shared/_layout.html
index 8e1e4c8..75733a5 100644
--- a/templates/shared/_layout.html
+++ b/templates/shared/_layout.html
@@ -100,7 +100,7 @@
 </div>
 <footer>
     <div class="text-center">
-        Jamf Automation + Webhook Assistant &mdash; v3.1.1<br>
+        Jamf Automation + Webhook Assistant &mdash; v3.2.0<br>
         Discover what's possible with Jamf
     </div>
 </footer>
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index d5d8adf..a625f85 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -43,7 +43,7 @@
 from bin.tokens import validate_token, get_token
 from views._type_handlers.base import AutomationError, AutomationHandler
 
-USER_AGENT_STRING = "JAWA%20v3.1.1"
+USER_AGENT_STRING = "JAWA%20v3.2.0"
 
 XML = "application/xml"
 
diff --git a/views/home_view.py b/views/home_view.py
index 08e0443..945222f 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -127,7 +127,7 @@ def _verify_jamf_access() -> Union[Response, None]:
             headers={
                 "Accept": "application/json",
                 "Authorization": f"Bearer {session.get('token')}",
-                "User-Agent": "JAWA%20v3.1.1",
+                "User-Agent": "JAWA%20v3.2.0",
             },
             verify=verify_ssl,
         )

From ba2843070f12bac00015699072b5d0d5b827760e Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Tue, 4 Aug 2026 10:27:01 -0500
Subject: [PATCH 62/84] chore: stop tracking runtime data/cron.json

Same inert-ignore bug 52f0520 fixed for webhooks.json: data/cron.json was
listed in .gitignore but still tracked, so the rule never applied and local
timed-automation state showed up as a diff on every checkout. The committed
copy also meant a checkout could overwrite an operator's real cron
definitions with the empty seed.

data_store._read_json recreates it lazily as [] on first read, so a fresh
clone is unaffected. data/time.json stays tracked: it is static seed data
(day/hour/frequency lookup tables), not runtime state.
---
 data/cron.json | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 data/cron.json

diff --git a/data/cron.json b/data/cron.json
deleted file mode 100644
index 0637a08..0000000
--- a/data/cron.json
+++ /dev/null
@@ -1 +0,0 @@
-[]
\ No newline at end of file

From 8298d1f7a35f4f4bffd1837c6e6cfe0f539e99a2 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 5 Aug 2026 16:03:48 -0500
Subject: [PATCH 63/84] fix: make every bundled template script runnable (J16,
 B6)

enrollment_pipeline.py shipped as a 6-stage outline with 7 undefined
names and needed a device-assignment CSV contract that exists nowhere
in the repo; cut it rather than invent one. smart_group_appletv.py had
no Config and called an undefined perform_api_call.

All four Jamf-calling scripts now share one byte-identical canonical
API block. ruff.toml excludes this directory, so a new pytest guard
applies F821/F401 to the bundled scripts instead.
---
 data/workflows/scripts/device_naming.py       |  67 +++++-----
 data/workflows/scripts/ea_update.py           |  61 ++++++++--
 data/workflows/scripts/enrollment_pipeline.py |  76 ------------
 data/workflows/scripts/return_to_service.py   |  99 ++++++++++-----
 data/workflows/scripts/smart_group_appletv.py | 114 +++++++++++++++---
 tests/test_template_catalog.py                |  88 ++++++++++++++
 6 files changed, 342 insertions(+), 163 deletions(-)
 delete mode 100644 data/workflows/scripts/enrollment_pipeline.py
 create mode 100644 tests/test_template_catalog.py

diff --git a/data/workflows/scripts/device_naming.py b/data/workflows/scripts/device_naming.py
index 27f39bb..fb34609 100644
--- a/data/workflows/scripts/device_naming.py
+++ b/data/workflows/scripts/device_naming.py
@@ -6,27 +6,30 @@
 """
 
 import json
-import logging
-import requests
 import sys
 import time
 
+import requests
+
+# --- JAWA canonical Jamf API block (keep identical across templates) ---
+
 token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
 
 
 class Config:
     def __init__(self):
-        self.server_url = "https://example.jamfcloud.com"  # Your Jamf Pro URL
+        self.server_url = "__JAWA_SERVER_URL__"
         self.token_url = f"{self.server_url}/api/oauth/token"
-        self.client_id = "your_client_id"
-        self.client_secret = "your_client_secret"
-        self.scope = ""  # e.g., api-role:5
+        self.client_id = "__JAWA_CLIENT_ID__"
+        self.client_secret = "__JAWA_CLIENT_SECRET__"
+        self.scope = ""
 
 
 def get_oauth_token():
+    """Fetch (and cache) an OAuth access token from Jamf Pro."""
     global token_cache
-    current_time = time.time()
     config = Config()
+    current_time = time.time()
     if (
         token_cache["access_token"]
         and (current_time - token_cache["timestamp"])
@@ -44,7 +47,9 @@ def get_oauth_token():
         config.token_url,
         headers={"Content-Type": "application/x-www-form-urlencoded"},
         data=data,
+        timeout=30,
     )
+    response.raise_for_status()
     response_data = response.json()
     token_cache = {
         "access_token": response_data["access_token"],
@@ -54,32 +59,32 @@ def get_oauth_token():
     return token_cache["access_token"]
 
 
-def api_get(endpoint):
-    config = Config()
-    token = get_oauth_token()
-    headers = {
-        "Authorization": f"Bearer {token}",
-        "Accept": "application/json",
-    }
-    resp = requests.get(
-        f"{config.server_url}/JSSResource/{endpoint}", headers=headers
-    )
-    resp.raise_for_status()
-    return resp.json()
+def perform_api_call(endpoint, method="GET", data=None, api="classic"):
+    """Call the Jamf Pro API and return the parsed response.
 
-
-def api_post(endpoint):
+    endpoint: path with no leading slash, e.g. "mobiledevices/id/42".
+    api: "classic" for /JSSResource, "pro" for /api.
+    Returns parsed JSON, or the raw response when the body is not JSON.
+    """
     config = Config()
     token = get_oauth_token()
+    prefix = "JSSResource" if api == "classic" else "api"
+    url = f"{config.server_url}/{prefix}/{endpoint}"
     headers = {
         "Authorization": f"Bearer {token}",
         "Accept": "application/json",
+        "Content-Type": "application/json",
     }
-    resp = requests.post(
-        f"{config.server_url}/JSSResource/{endpoint}", headers=headers
+    response = requests.request(
+        method, url, headers=headers, json=data, timeout=30
     )
-    resp.raise_for_status()
-    return resp
+    response.raise_for_status()
+    try:
+        return response.json()
+    except ValueError:
+        return response
+
+# --- end canonical block ---
 
 
 def main():
@@ -104,7 +109,7 @@ def main():
     # 3. Wait for device record to populate, then look up asset tag
     time.sleep(30)
     try:
-        device_record = api_get(f"mobiledevices/id/{jss_id}")
+        device_record = perform_api_call(f"mobiledevices/id/{jss_id}")
         asset_tag = device_record["mobile_device"]["general"].get("asset_tag")
     except Exception as err:
         print(f"Could not GET device record for ID {jss_id}: {err}")
@@ -116,8 +121,9 @@ def main():
 
     # 4. Send DeviceName command
     try:
-        api_post(
-            f"mobiledevicecommands/command/DeviceName/{asset_tag}/id/{jss_id}"
+        perform_api_call(
+            f"mobiledevicecommands/command/DeviceName/{asset_tag}/id/{jss_id}",
+            method="POST",
         )
         print(
             f"Renamed {old_name} -> {asset_tag} (SN: {serial}, ID: {jss_id})"
@@ -128,7 +134,10 @@ def main():
 
     # 5. Send blank push to speed up command delivery
     try:
-        api_post(f"mobiledevicecommands/command/BlankPush/id/{jss_id}")
+        perform_api_call(
+            f"mobiledevicecommands/command/BlankPush/id/{jss_id}",
+            method="POST",
+        )
     except Exception:
         pass  # Non-critical
 
diff --git a/data/workflows/scripts/ea_update.py b/data/workflows/scripts/ea_update.py
index d1cb246..d314b2a 100644
--- a/data/workflows/scripts/ea_update.py
+++ b/data/workflows/scripts/ea_update.py
@@ -5,23 +5,27 @@
 """
 
 import json
-import requests
 import sys
 import time
 
+import requests
+
+# --- JAWA canonical Jamf API block (keep identical across templates) ---
+
 token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
 
 
 class Config:
     def __init__(self):
-        self.server_url = "https://example.jamfcloud.com"
+        self.server_url = "__JAWA_SERVER_URL__"
         self.token_url = f"{self.server_url}/api/oauth/token"
-        self.client_id = "your_client_id"
-        self.client_secret = "your_client_secret"
+        self.client_id = "__JAWA_CLIENT_ID__"
+        self.client_secret = "__JAWA_CLIENT_SECRET__"
         self.scope = ""
 
 
 def get_oauth_token():
+    """Fetch (and cache) an OAuth access token from Jamf Pro."""
     global token_cache
     config = Config()
     current_time = time.time()
@@ -31,24 +35,57 @@ def get_oauth_token():
         < token_cache["expires_in"]
     ):
         return token_cache["access_token"]
+    data = {
+        "client_id": config.client_id,
+        "grant_type": "client_credentials",
+        "client_secret": config.client_secret,
+    }
+    if config.scope:
+        data["scope"] = config.scope
     response = requests.post(
         config.token_url,
         headers={"Content-Type": "application/x-www-form-urlencoded"},
-        data={
-            "client_id": config.client_id,
-            "grant_type": "client_credentials",
-            "client_secret": config.client_secret,
-        },
+        data=data,
+        timeout=30,
     )
-    rd = response.json()
+    response.raise_for_status()
+    response_data = response.json()
     token_cache = {
-        "access_token": rd["access_token"],
-        "expires_in": rd["expires_in"],
+        "access_token": response_data["access_token"],
+        "expires_in": response_data["expires_in"],
         "timestamp": current_time,
     }
     return token_cache["access_token"]
 
 
+def perform_api_call(endpoint, method="GET", data=None, api="classic"):
+    """Call the Jamf Pro API and return the parsed response.
+
+    endpoint: path with no leading slash, e.g. "mobiledevices/id/42".
+    api: "classic" for /JSSResource, "pro" for /api.
+    Returns parsed JSON, or the raw response when the body is not JSON.
+    """
+    config = Config()
+    token = get_oauth_token()
+    prefix = "JSSResource" if api == "classic" else "api"
+    url = f"{config.server_url}/{prefix}/{endpoint}"
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/json",
+        "Content-Type": "application/json",
+    }
+    response = requests.request(
+        method, url, headers=headers, json=data, timeout=30
+    )
+    response.raise_for_status()
+    try:
+        return response.json()
+    except ValueError:
+        return response
+
+# --- end canonical block ---
+
+
 def build_ea_xml(ea_name, value):
     return (
         f"<mobile_device><extension_attributes><extension_attribute>"
diff --git a/data/workflows/scripts/enrollment_pipeline.py b/data/workflows/scripts/enrollment_pipeline.py
deleted file mode 100644
index be3a0ae..0000000
--- a/data/workflows/scripts/enrollment_pipeline.py
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/usr/bin/env python3
-"""Multi-step enrollment pipeline.
-
-Supports multiple webhook trigger events:
-  - MobileDeviceEnrolled (single device)
-  - ComputerAdded (single device)
-  - SmartGroupMobileDeviceMembershipChange (batch of devices)
-"""
-
-import csv, json, logging, requests, sys, time
-
-# ... (Config, OAuth, perform_api_call from foundations) ...
-
-CSV_FILE = "/usr/local/JAWA/resources/files/DeviceAssignments.csv"
-
-
-def extract_device_ids(event_data):
-    """Extract device ID(s) from any supported webhook event type."""
-    event = event_data.get("event", {})
-    webhook_event = event_data.get("webhook", {}).get("webhookEvent", "")
-
-    # Smart group events provide a list of added device IDs
-    if "SmartGroup" in webhook_event:
-        ids = event.get("groupAddedDevicesIds", [])
-        return [int(i) for i in ids] if ids else []
-
-    # Enrollment and add events provide a single device ID
-    jss_id = event.get("jssID")
-    if jss_id:
-        return [int(jss_id)]
-
-    return []
-
-
-def main():
-    # Stage 1-2: Parse event
-    event_data = json.loads(sys.argv[1])
-    id_list = extract_device_ids(event_data)
-    if not id_list:
-        sys.exit(12)
-
-    for jss_id in id_list:
-        # Stage 3: Get device serial, match to CSV
-        time.sleep(30)
-        device = api_get(f"api/v2/mobile-devices/{jss_id}/detail")
-        serial = device.get("serialNumber")
-        model = device.get("model", "")
-
-        # Apple TV fork
-        if "appletv" in model.lower():
-            handle_apple_tv(jss_id, serial)
-            continue
-
-        assignment = lookup_csv(serial, CSV_FILE)
-        if not assignment:
-            print(f"{serial} not in spreadsheet.")
-            continue
-
-        # Stage 4: Update device record
-        update_record(jss_id, assignment)
-
-        # Stage 5: Queue commands
-        set_device_name(jss_id, assignment["name"])
-
-        # Stage 6: Poll for DeviceConfigured
-        completed = poll_command(jss_id, "DeviceConfigured")
-
-        if completed:
-            print(f"ID {jss_id} ({serial}) completed setup.")
-        else:
-            print(f"ID {jss_id} ({serial}) failed - erasing.")
-            send_erase(jss_id)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/data/workflows/scripts/return_to_service.py b/data/workflows/scripts/return_to_service.py
index 7a1038e..2c15d46 100644
--- a/data/workflows/scripts/return_to_service.py
+++ b/data/workflows/scripts/return_to_service.py
@@ -11,69 +11,104 @@
 
 import base64
 import json
-import logging
-import requests
 import sys
 import time
 
+import requests
+
+# --- JAWA canonical Jamf API block (keep identical across templates) ---
+
 token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
 
 
 class Config:
     def __init__(self):
-        self.server_url = "https://example.jamfcloud.com"
+        self.server_url = "__JAWA_SERVER_URL__"
         self.token_url = f"{self.server_url}/api/oauth/token"
-        self.client_id = "your_client_id"
-        self.client_secret = "your_client_secret"
+        self.client_id = "__JAWA_CLIENT_ID__"
+        self.client_secret = "__JAWA_CLIENT_SECRET__"
         self.scope = ""
 
 
-# WiFi profile XML (base64 will be encoded at runtime)
-WIFI_PAYLOAD = b"""<?xml version="1.0" encoding="UTF-8"?>
-<plist version="1"><dict>
-  <key>PayloadUUID</key><string>RTS-UNIQUE-UUID</string>
-  <key>PayloadType</key><string>Configuration</string>
-  <key>PayloadIdentifier</key><string>RTS-UNIQUE-UUID</string>
-  <key>PayloadContent</key><array><dict>
-    <key>PayloadType</key><string>com.apple.wifi.managed</string>
-    <key>SSID_STR</key><string>Your-WiFi-SSID</string>
-    <key>AutoJoin</key><true/>
-    <key>CaptiveBypass</key><true/>
-  </dict></array>
-</dict></plist>"""
-
-EA_NAME = "RtS Status"
-
-
 def get_oauth_token():
+    """Fetch (and cache) an OAuth access token from Jamf Pro."""
     global token_cache
-    current_time = time.time()
     config = Config()
+    current_time = time.time()
     if (
         token_cache["access_token"]
         and (current_time - token_cache["timestamp"])
         < token_cache["expires_in"]
     ):
         return token_cache["access_token"]
+    data = {
+        "client_id": config.client_id,
+        "grant_type": "client_credentials",
+        "client_secret": config.client_secret,
+    }
+    if config.scope:
+        data["scope"] = config.scope
     response = requests.post(
         config.token_url,
         headers={"Content-Type": "application/x-www-form-urlencoded"},
-        data={
-            "client_id": config.client_id,
-            "grant_type": "client_credentials",
-            "client_secret": config.client_secret,
-            "scope": config.scope,
-        },
+        data=data,
+        timeout=30,
     )
-    rd = response.json()
+    response.raise_for_status()
+    response_data = response.json()
     token_cache = {
-        "access_token": rd["access_token"],
-        "expires_in": rd["expires_in"],
+        "access_token": response_data["access_token"],
+        "expires_in": response_data["expires_in"],
         "timestamp": current_time,
     }
     return token_cache["access_token"]
 
 
+def perform_api_call(endpoint, method="GET", data=None, api="classic"):
+    """Call the Jamf Pro API and return the parsed response.
+
+    endpoint: path with no leading slash, e.g. "mobiledevices/id/42".
+    api: "classic" for /JSSResource, "pro" for /api.
+    Returns parsed JSON, or the raw response when the body is not JSON.
+    """
+    config = Config()
+    token = get_oauth_token()
+    prefix = "JSSResource" if api == "classic" else "api"
+    url = f"{config.server_url}/{prefix}/{endpoint}"
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/json",
+        "Content-Type": "application/json",
+    }
+    response = requests.request(
+        method, url, headers=headers, json=data, timeout=30
+    )
+    response.raise_for_status()
+    try:
+        return response.json()
+    except ValueError:
+        return response
+
+# --- end canonical block ---
+
+
+# WiFi profile XML (base64 will be encoded at runtime)
+WIFI_PAYLOAD = b"""<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1"><dict>
+  <key>PayloadUUID</key><string>RTS-UNIQUE-UUID</string>
+  <key>PayloadType</key><string>Configuration</string>
+  <key>PayloadIdentifier</key><string>RTS-UNIQUE-UUID</string>
+  <key>PayloadContent</key><array><dict>
+    <key>PayloadType</key><string>com.apple.wifi.managed</string>
+    <key>SSID_STR</key><string>Your-WiFi-SSID</string>
+    <key>AutoJoin</key><true/>
+    <key>CaptiveBypass</key><true/>
+  </dict></array>
+</dict></plist>"""
+
+EA_NAME = "RtS Status"
+
+
 def get_headers(content_type="json"):
     token = get_oauth_token()
     return {
diff --git a/data/workflows/scripts/smart_group_appletv.py b/data/workflows/scripts/smart_group_appletv.py
index dae5584..10df0f5 100644
--- a/data/workflows/scripts/smart_group_appletv.py
+++ b/data/workflows/scripts/smart_group_appletv.py
@@ -2,36 +2,122 @@
 """Restart Apple TVs that join a smart group.
 
 Webhook event: SmartGroupMobileDeviceMembershipChange
+API privileges: Send Mobile Device Restart Device Command,
+                Send Mobile Device Update Inventory Command
 """
 
 import json
-import requests
 import sys
 import time
 
-# ... (Config, OAuth, perform_api_call from foundations) ...
+import requests
+
+# --- JAWA canonical Jamf API block (keep identical across templates) ---
+
+token_cache = {"access_token": None, "expires_in": 0, "timestamp": 0}
+
+
+class Config:
+    def __init__(self):
+        self.server_url = "__JAWA_SERVER_URL__"
+        self.token_url = f"{self.server_url}/api/oauth/token"
+        self.client_id = "__JAWA_CLIENT_ID__"
+        self.client_secret = "__JAWA_CLIENT_SECRET__"
+        self.scope = ""
+
+
+def get_oauth_token():
+    """Fetch (and cache) an OAuth access token from Jamf Pro."""
+    global token_cache
+    config = Config()
+    current_time = time.time()
+    if (
+        token_cache["access_token"]
+        and (current_time - token_cache["timestamp"])
+        < token_cache["expires_in"]
+    ):
+        return token_cache["access_token"]
+    data = {
+        "client_id": config.client_id,
+        "grant_type": "client_credentials",
+        "client_secret": config.client_secret,
+    }
+    if config.scope:
+        data["scope"] = config.scope
+    response = requests.post(
+        config.token_url,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        data=data,
+        timeout=30,
+    )
+    response.raise_for_status()
+    response_data = response.json()
+    token_cache = {
+        "access_token": response_data["access_token"],
+        "expires_in": response_data["expires_in"],
+        "timestamp": current_time,
+    }
+    return token_cache["access_token"]
+
+
+def perform_api_call(endpoint, method="GET", data=None, api="classic"):
+    """Call the Jamf Pro API and return the parsed response.
+
+    endpoint: path with no leading slash, e.g. "mobiledevices/id/42".
+    api: "classic" for /JSSResource, "pro" for /api.
+    Returns parsed JSON, or the raw response when the body is not JSON.
+    """
+    config = Config()
+    token = get_oauth_token()
+    prefix = "JSSResource" if api == "classic" else "api"
+    url = f"{config.server_url}/{prefix}/{endpoint}"
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/json",
+        "Content-Type": "application/json",
+    }
+    response = requests.request(
+        method, url, headers=headers, json=data, timeout=30
+    )
+    response.raise_for_status()
+    try:
+        return response.json()
+    except ValueError:
+        return response
+
+# --- end canonical block ---
 
 
 def main():
-    event_data = json.loads(sys.argv[1])
-    id_list = event_data["event"]["groupAddedDevicesIds"]
+    try:
+        event_data = json.loads(sys.argv[1])
+    except (json.JSONDecodeError, IndexError) as err:
+        print(f"Error parsing webhook JSON: {err}")
+        sys.exit(1)
 
+    id_list = event_data.get("event", {}).get("groupAddedDevicesIds", [])
     if not id_list:
         print("No devices entered the group.")
         sys.exit(12)
 
     for jss_id in id_list:
         print(f"Restarting device ID {jss_id}...")
-        time.sleep(200)  # Wait for Apple TV to be responsive
-        perform_api_call(
-            f"mobiledevicecommands/command/RestartDevice/id/{jss_id}",
-            method="POST",
-        )
-        time.sleep(10)
-        perform_api_call(
-            f"mobiledevicecommands/command/UpdateInventory/id/{jss_id}",
-            method="POST",
-        )
+        # Apple TVs need time to become responsive after joining.
+        time.sleep(200)
+        try:
+            perform_api_call(
+                f"mobiledevicecommands/command/RestartDevice/id/{jss_id}",
+                method="POST",
+            )
+            time.sleep(10)
+            perform_api_call(
+                f"mobiledevicecommands/command/UpdateInventory/id/{jss_id}",
+                method="POST",
+            )
+            print(f"Device {jss_id}: restart and inventory queued.")
+        except Exception as err:
+            print(f"Device {jss_id}: command failed: {err}")
+            sys.exit(4)
 
 
 if __name__ == "__main__":
diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
new file mode 100644
index 0000000..c12cd3b
--- /dev/null
+++ b/tests/test_template_catalog.py
@@ -0,0 +1,88 @@
+"""Guards on the bundled template catalog and its scripts.
+
+Catalog-driven: every check iterates workflow_config.json, so a new
+entry is covered automatically. ruff.toml excludes the bundled script
+dir from repo linting (it is shipped content, not app code); these
+tests apply the checks that actually matter there instead.
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+import pytest
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+CONFIG_PATH = os.path.join(
+    REPO_ROOT, "data", "workflows", "workflow_config.json"
+)
+SCRIPTS_DIR = os.path.join(REPO_ROOT, "data", "workflows", "scripts")
+
+
+def _catalog():
+    with open(CONFIG_PATH, "r", encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+CATALOG = _catalog()
+SLUGS = [wf["slug"] for wf in CATALOG]
+
+
+def _script_path(workflow):
+    return os.path.join(SCRIPTS_DIR, workflow["script_file"])
+
+
+def _script_source(workflow):
+    with open(_script_path(workflow), "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+@pytest.fixture(params=CATALOG, ids=SLUGS)
+def workflow(request):
+    return request.param
+
+
+def test_script_file_exists(workflow):
+    assert os.path.isfile(_script_path(workflow)), (
+        f"{workflow['slug']} names a script_file that does not exist: "
+        f"{workflow['script_file']}"
+    )
+
+
+def test_script_has_no_undefined_names(workflow):
+    """F821/F401-clean: a script calling a function it never defines
+    crashes with NameError on first trigger (bug B6). ruff.toml excludes
+    this directory, so CI cannot catch it -- this test does.
+    """
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "ruff",
+            "check",
+            "--isolated",
+            "--select",
+            "F821,F401",
+            "--output-format",
+            "concise",
+            _script_path(workflow),
+        ],
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, (
+        f"{workflow['slug']} has undefined or unused names:\n"
+        f"{result.stdout}{result.stderr}"
+    )
+
+
+def test_enrollment_pipeline_is_gone():
+    """It shipped as a 6-stage outline with 7 undefined names and needed
+    a CSV contract that exists nowhere in the repo. Cut in J16; this
+    pins the decision so it cannot be restored unfinished.
+    """
+    assert "enrollment-pipeline" not in SLUGS
+    assert not os.path.isfile(
+        os.path.join(SCRIPTS_DIR, "enrollment_pipeline.py")
+    )

From e2e0344186eca3fb7033cc24f074e6d3f96dcbab Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 5 Aug 2026 16:29:32 -0500
Subject: [PATCH 64/84] fix: correct template catalog metadata and the
 boolean-event crash (J16, B15)

ea-update targeted ComputerInventoryCompleted while its script PUTs to
a mobile-devices endpoint; teams-notification declared the non-event
"Any Event" (now null = any). Both smart-group schemas set
event.computer to a boolean, so the event.get("computer", {}).get()
fallback raised AttributeError -- replaced with a type-checking
_device_field helper.

config_params gain an explicit token, separating the replace-needle
from the UI hint (COOLDOWN_HOURS's old needle "12" matched twice in
its own script). Entries gain hook_name: a legal single-string Jamf
webhook name, required because Jamf rejects names with spaces and all
eight titles had them. Dead notebook_slug removed; exit codes
reconciled against the scripts.

A null trigger_event renders as the literal "None" in Jinja and would
be persisted as the webhook's event, so the three template surfaces
and the stored value now fall back to "Any Event" / "".
---
 .../workflows/scripts/event_tracker_sqlite.py |  30 +++-
 data/workflows/scripts/return_to_service.py   |   2 +-
 data/workflows/scripts/smart_group_slack.py   |   2 +-
 data/workflows/scripts/teams_notification.py  |  30 ++--
 data/workflows/workflow_config.json           | 119 ++++++--------
 templates/workflows/catalog.html              |   2 +-
 templates/workflows/detail.html               |   2 +-
 templates/workflows/enable.html               |   4 +-
 tests/test_template_catalog.py                | 146 ++++++++++++++++++
 views/search_view.py                          |   2 +-
 views/template_view.py                        |   4 +-
 11 files changed, 243 insertions(+), 100 deletions(-)

diff --git a/data/workflows/scripts/event_tracker_sqlite.py b/data/workflows/scripts/event_tracker_sqlite.py
index 850854b..09186fe 100644
--- a/data/workflows/scripts/event_tracker_sqlite.py
+++ b/data/workflows/scripts/event_tracker_sqlite.py
@@ -10,8 +10,26 @@
 import sqlite3
 import sys
 
-DB_PATH = "placeholder_value"  # Path to SQLite database file
-COOLDOWN_HOURS = 12  # Hours between recording repeat check-ins
+DB_PATH = "__JAWA_DB_PATH__"
+# Hours between recording repeat check-ins. Numeric token: substituted
+# bare (no quotes) so the installed script holds a real int literal.
+COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__  # noqa: F821
+
+
+def _device_field(event, key, default="Unknown"):
+    """Read a device field from a Jamf webhook event.
+
+    Some events (the smart-group ones) set event["computer"] to a
+    BOOLEAN rather than a nested object, so a bare
+    event.get("computer", {}).get(key) raises AttributeError. Only
+    descend when the value really is a mapping.
+    """
+    if key in event:
+        return event[key]
+    nested = event.get("computer")
+    if isinstance(nested, dict):
+        return nested.get(key, default)
+    return default
 
 
 def create_check_in_db(db_path):
@@ -90,11 +108,9 @@ def main():
         sys.exit(1)
 
     event = event_data.get("event", {})
-    jss_id = event.get("jssID") or event.get("computer", {}).get("jssID")
-    serial = event.get("serialNumber", "Unknown")
-    device_name = event.get("deviceName") or event.get("computer", {}).get(
-        "deviceName", "Unknown"
-    )
+    jss_id = _device_field(event, "jssID", None)
+    serial = _device_field(event, "serialNumber")
+    device_name = _device_field(event, "deviceName")
 
     if not jss_id:
         print("No device ID found in event data.")
diff --git a/data/workflows/scripts/return_to_service.py b/data/workflows/scripts/return_to_service.py
index 2c15d46..2a6abb1 100644
--- a/data/workflows/scripts/return_to_service.py
+++ b/data/workflows/scripts/return_to_service.py
@@ -100,7 +100,7 @@ def perform_api_call(endpoint, method="GET", data=None, api="classic"):
   <key>PayloadIdentifier</key><string>RTS-UNIQUE-UUID</string>
   <key>PayloadContent</key><array><dict>
     <key>PayloadType</key><string>com.apple.wifi.managed</string>
-    <key>SSID_STR</key><string>Your-WiFi-SSID</string>
+    <key>SSID_STR</key><string>__JAWA_WIFI_SSID__</string>
     <key>AutoJoin</key><true/>
     <key>CaptiveBypass</key><true/>
   </dict></array>
diff --git a/data/workflows/scripts/smart_group_slack.py b/data/workflows/scripts/smart_group_slack.py
index a6fe095..d3cdacf 100644
--- a/data/workflows/scripts/smart_group_slack.py
+++ b/data/workflows/scripts/smart_group_slack.py
@@ -9,7 +9,7 @@
 import sys
 from datetime import datetime
 
-SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+SLACK_WEBHOOK_URL = "__JAWA_SLACK_WEBHOOK_URL__"
 
 
 def main():
diff --git a/data/workflows/scripts/teams_notification.py b/data/workflows/scripts/teams_notification.py
index 86e6bea..4c744c2 100644
--- a/data/workflows/scripts/teams_notification.py
+++ b/data/workflows/scripts/teams_notification.py
@@ -9,7 +9,23 @@
 import requests
 import sys
 
-TEAMS_WEBHOOK_URL = "placeholder_value"  # Teams incoming webhook URL
+TEAMS_WEBHOOK_URL = "__JAWA_TEAMS_WEBHOOK_URL__"
+
+
+def _device_field(event, key, default="Unknown"):
+    """Read a device field from a Jamf webhook event.
+
+    Some events (the smart-group ones) set event["computer"] to a
+    BOOLEAN rather than a nested object, so a bare
+    event.get("computer", {}).get(key) raises AttributeError. Only
+    descend when the value really is a mapping.
+    """
+    if key in event:
+        return event[key]
+    nested = event.get("computer")
+    if isinstance(nested, dict):
+        return nested.get(key, default)
+    return default
 
 
 def send_teams_notification(webhook_url, title, message, facts=None):
@@ -74,15 +90,9 @@ def main():
     event = event_data.get("event", {})
 
     # 2. Build notification details
-    device_name = event.get("deviceName") or event.get("computer", {}).get(
-        "deviceName", "Unknown"
-    )
-    serial = event.get("serialNumber") or event.get("computer", {}).get(
-        "serialNumber", "Unknown"
-    )
-    jss_id = event.get("jssID") or event.get("computer", {}).get(
-        "jssID", "Unknown"
-    )
+    device_name = _device_field(event, "deviceName")
+    serial = _device_field(event, "serialNumber")
+    jss_id = _device_field(event, "jssID")
 
     title = f"Jamf Pro: {webhook_name}"
     message = f"Event received for device **{device_name}**."
diff --git a/data/workflows/workflow_config.json b/data/workflows/workflow_config.json
index 0991e6c..6ae90d1 100644
--- a/data/workflows/workflow_config.json
+++ b/data/workflows/workflow_config.json
@@ -7,7 +7,7 @@
         "trigger_type": "webhook",
         "trigger_event": "MobileDeviceEnrolled",
         "script_file": "device_naming.py",
-        "notebook_slug": "device-naming",
+        "hook_name": "Device-Naming-by-Asset-Tag",
         "api_privileges": [
             "Read Mobile Devices",
             "Send Mobile Device Set Device Name Command"
@@ -17,18 +17,21 @@
                 "key": "server_url",
                 "label": "Jamf Pro URL",
                 "placeholder": "https://example.jamfcloud.com",
+                "token": "\"__JAWA_SERVER_URL__\"",
                 "type": "text"
             },
             {
                 "key": "client_id",
                 "label": "OAuth Client ID",
-                "placeholder": "your_client_id",
+                "placeholder": "your-api-client-id",
+                "token": "\"__JAWA_CLIENT_ID__\"",
                 "type": "text"
             },
             {
                 "key": "client_secret",
                 "label": "OAuth Client Secret",
-                "placeholder": "your_client_secret",
+                "placeholder": "your-api-client-secret",
+                "token": "\"__JAWA_CLIENT_SECRET__\"",
                 "type": "password"
             }
         ],
@@ -51,13 +54,14 @@
         "trigger_type": "webhook",
         "trigger_event": "SmartGroupComputerMembershipChange",
         "script_file": "smart_group_slack.py",
-        "notebook_slug": "smart-group-actions",
+        "hook_name": "Smart-Group-Slack-Notification",
         "api_privileges": [],
         "config_params": [
             {
                 "key": "SLACK_WEBHOOK_URL",
                 "label": "Slack Webhook URL",
-                "placeholder": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL",
+                "placeholder": "https://hooks.slack.com/services/T00/B00/XXXX",
+                "token": "\"__JAWA_SLACK_WEBHOOK_URL__\"",
                 "type": "text"
             }
         ],
@@ -76,7 +80,7 @@
         "trigger_type": "webhook",
         "trigger_event": "SmartGroupMobileDeviceMembershipChange",
         "script_file": "smart_group_appletv.py",
-        "notebook_slug": "smart-group-actions",
+        "hook_name": "Apple-TV-Restart-on-Smart-Group",
         "api_privileges": [
             "Send Mobile Device Restart Device Command",
             "Send Mobile Device Update Inventory Command"
@@ -86,23 +90,28 @@
                 "key": "server_url",
                 "label": "Jamf Pro URL",
                 "placeholder": "https://example.jamfcloud.com",
+                "token": "\"__JAWA_SERVER_URL__\"",
                 "type": "text"
             },
             {
                 "key": "client_id",
                 "label": "OAuth Client ID",
-                "placeholder": "your_client_id",
+                "placeholder": "your-api-client-id",
+                "token": "\"__JAWA_CLIENT_ID__\"",
                 "type": "text"
             },
             {
                 "key": "client_secret",
                 "label": "OAuth Client Secret",
-                "placeholder": "your_client_secret",
+                "placeholder": "your-api-client-secret",
+                "token": "\"__JAWA_CLIENT_SECRET__\"",
                 "type": "password"
             }
         ],
         "exit_codes": [
             {"code": 0, "meaning": "Success — devices restarted"},
+            {"code": 1, "meaning": "Invalid webhook JSON"},
+            {"code": 4, "meaning": "Restart or inventory command failed"},
             {"code": 12, "meaning": "No devices entered the group"}
         ],
         "tags": ["smart-group", "apple-tv", "restart", "mobile"],
@@ -116,7 +125,7 @@
         "trigger_type": "webhook",
         "trigger_event": "SmartGroupMobileDeviceMembershipChange",
         "script_file": "return_to_service.py",
-        "notebook_slug": "return-to-service",
+        "hook_name": "Return-to-Service",
         "api_privileges": [
             "Read Mobile Devices",
             "Update Mobile Devices",
@@ -127,24 +136,29 @@
                 "key": "server_url",
                 "label": "Jamf Pro URL",
                 "placeholder": "https://example.jamfcloud.com",
+                "token": "\"__JAWA_SERVER_URL__\"",
                 "type": "text"
             },
             {
                 "key": "client_id",
                 "label": "OAuth Client ID",
-                "placeholder": "your_client_id",
+                "placeholder": "your-api-client-id",
+                "token": "\"__JAWA_CLIENT_ID__\"",
                 "type": "text"
             },
             {
                 "key": "client_secret",
                 "label": "OAuth Client Secret",
-                "placeholder": "your_client_secret",
+                "placeholder": "your-api-client-secret",
+                "token": "\"__JAWA_CLIENT_SECRET__\"",
                 "type": "password"
             },
             {
                 "key": "wifi_ssid",
                 "label": "WiFi SSID",
-                "placeholder": "Your-WiFi-SSID",
+                "placeholder": "Corporate-WiFi",
+                "token": "__JAWA_WIFI_SSID__",
+                "raw": true,
                 "type": "text"
             }
         ],
@@ -155,54 +169,6 @@
         "tags": ["smart-group", "mobile", "erase", "return-to-service", "wipe"],
         "order": 4
     },
-    {
-        "slug": "enrollment-pipeline",
-        "title": "Enrollment Pipeline",
-        "description": "Multi-stage enrollment workflow that matches devices to a CSV assignment list, updates records, and provisions automatically.",
-        "category": "provisioning",
-        "trigger_type": "webhook",
-        "trigger_event": "MobileDeviceEnrolled / ComputerAdded",
-        "script_file": "enrollment_pipeline.py",
-        "notebook_slug": "enrollment-pipeline",
-        "api_privileges": [
-            "Read Mobile Devices",
-            "Update Mobile Devices",
-            "Send Mobile Device Set Device Name Command",
-            "Send Mobile Device Erase Device Command"
-        ],
-        "config_params": [
-            {
-                "key": "server_url",
-                "label": "Jamf Pro URL",
-                "placeholder": "https://example.jamfcloud.com",
-                "type": "text"
-            },
-            {
-                "key": "client_id",
-                "label": "OAuth Client ID",
-                "placeholder": "your_client_id",
-                "type": "text"
-            },
-            {
-                "key": "client_secret",
-                "label": "OAuth Client Secret",
-                "placeholder": "your_client_secret",
-                "type": "password"
-            },
-            {
-                "key": "CSV_FILE",
-                "label": "CSV Assignment File Path",
-                "placeholder": "/usr/local/JAWA/resources/files/DeviceAssignments.csv",
-                "type": "text"
-            }
-        ],
-        "exit_codes": [
-            {"code": 0, "meaning": "Success — pipeline completed"},
-            {"code": 12, "meaning": "No devices entered the group"}
-        ],
-        "tags": ["enrollment", "mobile", "pipeline", "csv", "provisioning"],
-        "order": 5
-    },
     {
         "slug": "event-tracker-sqlite",
         "title": "Event Tracker (SQLite)",
@@ -211,19 +177,21 @@
         "trigger_type": "webhook",
         "trigger_event": "ComputerCheckIn",
         "script_file": "event_tracker_sqlite.py",
-        "notebook_slug": "event-tracking",
+        "hook_name": "Event-Tracker-SQLite",
         "api_privileges": [],
         "config_params": [
             {
                 "key": "DB_PATH",
                 "label": "SQLite Database Path",
-                "placeholder": "placeholder_value",
+                "placeholder": "/usr/local/JAWA/data/check_ins.db",
+                "token": "\"__JAWA_DB_PATH__\"",
                 "type": "text"
             },
             {
                 "key": "COOLDOWN_HOURS",
                 "label": "Cooldown Hours",
                 "placeholder": "12",
+                "token": "__JAWA_COOLDOWN_HOURS__",
                 "type": "number"
             }
         ],
@@ -233,7 +201,7 @@
             {"code": 2, "meaning": "No device ID found in event"}
         ],
         "tags": ["check-in", "logging", "sqlite", "cooldown"],
-        "order": 6
+        "order": 5
     },
     {
         "slug": "teams-notification",
@@ -241,15 +209,16 @@
         "description": "Send Microsoft Teams Adaptive Card notifications for any Jamf Pro webhook event.",
         "category": "observability",
         "trigger_type": "webhook",
-        "trigger_event": "Any Event",
+        "trigger_event": null,
         "script_file": "teams_notification.py",
-        "notebook_slug": "event-tracking",
+        "hook_name": "Teams-Notification",
         "api_privileges": [],
         "config_params": [
             {
                 "key": "TEAMS_WEBHOOK_URL",
                 "label": "Teams Webhook URL",
-                "placeholder": "placeholder_value",
+                "placeholder": "https://example.webhook.office.com/webhookb2/...",
+                "token": "\"__JAWA_TEAMS_WEBHOOK_URL__\"",
                 "type": "text"
             }
         ],
@@ -259,7 +228,7 @@
             {"code": 3, "meaning": "Failed to send notification"}
         ],
         "tags": ["teams", "notification", "adaptive-card"],
-        "order": 7
+        "order": 6
     },
     {
         "slug": "ea-update",
@@ -267,9 +236,9 @@
         "description": "Update a mobile device extension attribute from webhook events, supporting both standard Jamf Pro and custom JSON formats.",
         "category": "extensions",
         "trigger_type": "webhook",
-        "trigger_event": "ComputerInventoryCompleted",
+        "trigger_event": "MobileDeviceInventoryCompleted",
         "script_file": "ea_update.py",
-        "notebook_slug": "extension-attributes",
+        "hook_name": "Extension-Attribute-Update",
         "api_privileges": [
             "Read Mobile Devices",
             "Update Mobile Devices"
@@ -279,26 +248,28 @@
                 "key": "server_url",
                 "label": "Jamf Pro URL",
                 "placeholder": "https://example.jamfcloud.com",
+                "token": "\"__JAWA_SERVER_URL__\"",
                 "type": "text"
             },
             {
                 "key": "client_id",
                 "label": "OAuth Client ID",
-                "placeholder": "your_client_id",
+                "placeholder": "your-api-client-id",
+                "token": "\"__JAWA_CLIENT_ID__\"",
                 "type": "text"
             },
             {
                 "key": "client_secret",
                 "label": "OAuth Client Secret",
-                "placeholder": "your_client_secret",
+                "placeholder": "your-api-client-secret",
+                "token": "\"__JAWA_CLIENT_SECRET__\"",
                 "type": "password"
             }
         ],
         "exit_codes": [
-            {"code": 0, "meaning": "Success — EA updated"},
-            {"code": 1, "meaning": "Invalid webhook JSON"}
+            {"code": 0, "meaning": "Success — EA updated"}
         ],
         "tags": ["extension-attribute", "mobile", "classic-api"],
-        "order": 8
+        "order": 7
     }
 ]
diff --git a/templates/workflows/catalog.html b/templates/workflows/catalog.html
index dbbf147..c0357b9 100644
--- a/templates/workflows/catalog.html
+++ b/templates/workflows/catalog.html
@@ -28,7 +28,7 @@ <h2>Template Catalog</h2>
                     <h5 class="card-title">{{ wf.title }}</h5>
                     <p class="card-text">{{ wf.description }}</p>
                     <div style="font-size: 0.75rem; color: var(--color-text-muted);">
-                        {{ wf.trigger_event }}
+                        {{ wf.trigger_event or "Any Event" }}
                     </div>
                 </div>
             </a>
diff --git a/templates/workflows/detail.html b/templates/workflows/detail.html
index db1ef38..1e9e2a5 100644
--- a/templates/workflows/detail.html
+++ b/templates/workflows/detail.html
@@ -41,7 +41,7 @@ <h5 style="font-size: 1rem; font-weight: 600; margin-top: 2rem;">Script Preview<
             <div class="workflow-detail-sidebar">
                 <dl>
                     <dt>Trigger Event</dt>
-                    <dd>{{ workflow.trigger_event }}</dd>
+                    <dd>{{ workflow.trigger_event or "Any Event" }}</dd>
 
                     <dt>Script File</dt>
                     <dd><code>{{ workflow.script_file }}</code></dd>
diff --git a/templates/workflows/enable.html b/templates/workflows/enable.html
index c969e2c..61c2c2d 100644
--- a/templates/workflows/enable.html
+++ b/templates/workflows/enable.html
@@ -55,10 +55,8 @@ <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bott
         </form>
     </div>
 
-    {% if workflow.trigger_event %}
     <div class="mt-3 mb-5" style="font-size: 0.82rem; color: var(--color-text-muted); text-align: center;">
-        This template listens for: <strong>{{ workflow.trigger_event }}</strong>
+        This template listens for: <strong>{{ workflow.trigger_event or "Any Event" }}</strong>
     </div>
-    {% endif %}
 </div>
 {% endblock %}
diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
index c12cd3b..b0c6ad0 100644
--- a/tests/test_template_catalog.py
+++ b/tests/test_template_catalog.py
@@ -86,3 +86,149 @@ def test_enrollment_pipeline_is_gone():
     assert not os.path.isfile(
         os.path.join(SCRIPTS_DIR, "enrollment_pipeline.py")
     )
+
+
+SCHEMAS_PATH = os.path.join(REPO_ROOT, "data", "webhook_schemas.json")
+
+
+def _schemas():
+    with open(SCHEMAS_PATH, "r", encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def test_trigger_event_is_real_or_explicitly_any(workflow):
+    """A trigger_event that is not a Jamf event gets written verbatim
+    into webhooks.json. "Any Event" and "MobileDeviceEnrolled /
+    ComputerAdded" both shipped that way; null now means any-event.
+    """
+    event = workflow.get("trigger_event")
+    if event is None:
+        return
+    valid = _schemas()["schemas"].keys()
+    assert event in valid, (
+        f"{workflow['slug']} declares trigger_event {event!r}, which is "
+        f"not a key in webhook_schemas.json. Use null for any-event."
+    )
+
+
+def test_hook_name_is_legal_jamf_webhook_name(workflow):
+    """JamfHandler.process_create rejects names containing a space, and
+    the name is interpolated into the callback URL Jamf calls plus the
+    webhook XML body.
+    """
+    hook_name = workflow["hook_name"]
+    assert hook_name, f"{workflow['slug']} has an empty hook_name"
+    assert " " not in hook_name, (
+        f"{workflow['slug']} hook_name {hook_name!r} contains a space; "
+        f"Jamf webhook names must be a single string"
+    )
+    for char in ("&", "<", ">", '"', "'", "/", "\\"):
+        assert char not in hook_name, (
+            f"{workflow['slug']} hook_name {hook_name!r} contains "
+            f"{char!r}, which breaks the webhook XML or callback URL"
+        )
+
+
+def test_every_token_appears_exactly_once(workflow):
+    """placeholder used to double as the replace-needle, so
+    COOLDOWN_HOURS's needle "12" matched twice in its script. token is
+    now explicit and must be unambiguous.
+    """
+    source = _script_source(workflow)
+    for param in workflow.get("config_params", []):
+        token = param["token"]
+        count = source.count(token)
+        assert count == 1, (
+            f"{workflow['slug']} param {param['key']} token {token!r} "
+            f"appears {count} times in {workflow['script_file']}; "
+            f"expected exactly 1"
+        )
+
+
+def test_declared_exit_codes_match_the_script(workflow):
+    import re
+
+    source = _script_source(workflow)
+    declared = {code["code"] for code in workflow.get("exit_codes", [])}
+    actual = {
+        int(match) for match in re.findall(r"sys\.exit\((\d+)\)", source)
+    }
+    actual.add(0)
+    assert declared == actual, (
+        f"{workflow['slug']} declares exit codes {sorted(declared)} but "
+        f"the script uses {sorted(actual)}"
+    )
+
+
+def test_notebook_slug_is_gone(workflow):
+    """Notebooks was removed from Extras in J14; the field had no
+    consumers anywhere in the codebase.
+    """
+    assert "notebook_slug" not in workflow
+
+
+def test_any_event_template_never_renders_the_word_none(
+    logged_in_client, jawa_env
+):
+    """trigger_event is null for any-event templates. Jinja renders a
+    bare None as the string "None", so every surface that shows the
+    trigger must fall back to a real label instead.
+    """
+    slug = next(
+        wf["slug"] for wf in CATALOG if wf.get("trigger_event") is None
+    )
+    for path in (
+        "/templates",
+        f"/templates/{slug}",
+        f"/templates/{slug}/enable",
+    ):
+        body = logged_in_client.get(path).get_data(as_text=True)
+        assert ">None<" not in body and "None\n" not in body, (
+            f"{path} renders a literal None for a null trigger_event"
+        )
+        assert "Any Event" in body, (
+            f"{path} does not label the null trigger_event as Any Event"
+        )
+
+
+def test_enabling_an_any_event_template_stores_no_none_event(
+    logged_in_client, jawa_env
+):
+    """The stored event is compared against the inbound payload's
+    webhookEvent, so persisting the string "None" would never match.
+    """
+    from bin import data_store
+
+    slug = next(
+        wf["slug"] for wf in CATALOG if wf.get("trigger_event") is None
+    )
+    logged_in_client.post(
+        f"/templates/{slug}/enable", data={"webhook_name": "any-hook"}
+    )
+    entry = data_store.get_webhook_by_name("any-hook")
+    assert entry is not None
+    assert entry["event"] == ""
+
+
+def test_script_survives_every_example_payload(workflow):
+    """Both smart-group schemas set event.computer to a BOOLEAN, so the
+    event.get("computer", {}).get(...) fallback pattern raised
+    AttributeError (bug B15). Replay the catalog's own examples.
+    """
+    event = workflow.get("trigger_event")
+    examples = _schemas()["examples"]
+    payloads = list(examples.values()) if event is None else [examples[event]]
+    source = _script_source(workflow)
+    # Numeric tokens are written bare (no quotes) so the substituted
+    # value is a real int; swap in a placeholder to make it parseable.
+    for param in workflow.get("config_params", []):
+        if param.get("type") == "number":
+            source = source.replace(param["token"], "0")
+    namespace = {}
+    exec(compile(source, workflow["script_file"], "exec"), namespace)
+    extract = namespace.get("_device_field")
+    if extract is None:
+        pytest.skip(f"{workflow['slug']} defines no _device_field")
+    for payload in payloads:
+        for key in ("deviceName", "serialNumber", "jssID"):
+            extract(payload.get("event", {}), key, "Unknown")
diff --git a/views/search_view.py b/views/search_view.py
index 53224d4..d8375bf 100644
--- a/views/search_view.py
+++ b/views/search_view.py
@@ -202,7 +202,7 @@ def _index_templates() -> List[Dict[str, Any]]:
         title = tmpl.get("title", "")
         desc = tmpl.get("description", "")
         tags = " ".join(tmpl.get("tags", []))
-        event = tmpl.get("trigger_event", "")
+        event = tmpl.get("trigger_event") or ""
         slug = tmpl.get("slug", "")
         results.append(
             {
diff --git a/views/template_view.py b/views/template_view.py
index 71d5d2a..23dd1ab 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -386,7 +386,9 @@ def enable_template(slug: str) -> Union[Response, str]:
             "name": webhook_name,
             "tag": "custom",
             "url": session.get("url", ""),
-            "event": workflow.get("trigger_event", ""),
+            # null trigger_event means any-event; store "" rather than
+            # the string "None", which no payload would ever match.
+            "event": workflow.get("trigger_event") or "",
             "script": dest_path,
             "description": workflow.get("description", ""),
             "enabled": True,

From fa07f68cf1fdc2c9951a8c030612fb9ae1a008f6 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 5 Aug 2026 17:14:04 -0500
Subject: [PATCH 65/84] fix: stop corrupting template config values on enable
 (J16, B13)

_apply_form_params ran markupsafe.escape() over form input and then
string-replaced it into PYTHON SOURCE, so any value containing & " ' <
> was baked in mangled -- Power Automate and Logic Apps webhook URLs
are entirely & runs. _apply_credentials did not escape, so a quote in
a saved secret produced invalid Python instead. Two paths, opposite
bugs, one feature.

Both are replaced by one substitute_params that injects real Python
literals via repr(), validates numerics, and fails loud on any
unfilled field rather than baking the placeholder into the deployed
script.
---
 tests/conftest.py              |  40 ++++
 tests/test_template_catalog.py | 340 ++++++++++++++++++++++++++++++++-
 tests/test_templates.py        |  56 +++++-
 views/template_view.py         | 127 +++++++++---
 4 files changed, 526 insertions(+), 37 deletions(-)

diff --git a/tests/conftest.py b/tests/conftest.py
index fbc5472..2580e64 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -237,3 +237,43 @@ def logged_in_client(client, fake_jamf):
     assert resp.status_code == 302, "login should redirect on success"
     assert "/dashboard" in resp.headers["Location"]
     return client
+
+
+_WORKFLOW_CONFIG = os.path.join(
+    REPO_ROOT, "data", "workflows", "workflow_config.json"
+)
+
+
+def _build_enable_form(slug, **overrides):
+    """Build a complete enable-form payload for a bundled template.
+
+    Enabling now refuses to write a script with any config field left
+    unfilled, so a POST carrying only webhook_name is rejected by
+    design. Derive the fields from the catalog so adding a config_param
+    does not silently reintroduce a half-configured POST.
+    """
+    with open(_WORKFLOW_CONFIG, "r", encoding="utf-8") as handle:
+        catalog = json.load(handle)
+    workflow = next(wf for wf in catalog if wf["slug"] == slug)
+
+    form = {"webhook_name": slug}
+    for param in workflow.get("config_params", []):
+        if param.get("type") == "number":
+            value = "12"
+        elif param.get("raw"):
+            # Goes into an XML payload unquoted; keep it plain ASCII.
+            value = "Corporate-WiFi"
+        elif param["key"] == "server_url":
+            value = JAMF_URL
+        else:
+            value = f"test-{param['key']}"
+        form[param["key"]] = value
+
+    form.update(overrides)
+    return form
+
+
+@pytest.fixture()
+def enable_form():
+    """Callable building a fully populated enable-form payload."""
+    return _build_enable_form
diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
index b0c6ad0..89da109 100644
--- a/tests/test_template_catalog.py
+++ b/tests/test_template_catalog.py
@@ -192,7 +192,7 @@ def test_any_event_template_never_renders_the_word_none(
 
 
 def test_enabling_an_any_event_template_stores_no_none_event(
-    logged_in_client, jawa_env
+    logged_in_client, jawa_env, enable_form
 ):
     """The stored event is compared against the inbound payload's
     webhookEvent, so persisting the string "None" would never match.
@@ -203,7 +203,8 @@ def test_enabling_an_any_event_template_stores_no_none_event(
         wf["slug"] for wf in CATALOG if wf.get("trigger_event") is None
     )
     logged_in_client.post(
-        f"/templates/{slug}/enable", data={"webhook_name": "any-hook"}
+        f"/templates/{slug}/enable",
+        data=enable_form(slug, webhook_name="any-hook"),
     )
     entry = data_store.get_webhook_by_name("any-hook")
     assert entry is not None
@@ -232,3 +233,338 @@ def test_script_survives_every_example_payload(workflow):
     for payload in payloads:
         for key in ("deviceName", "serialNumber", "jssID"):
             extract(payload.get("event", {}), key, "Unknown")
+
+
+ADVERSARIAL_VALUES = [
+    # Power Automate / Logic Apps URL: the & runs got HTML-escaped to
+    # &amp; and baked in corrupted (bug B13).
+    "https://x.logic.azure.com:443/workflows/a/triggers/manual/paths/"
+    "invoke?api-version=2016-06-01&sp=%2Ftriggers%2Frun&sig=AbC123",
+    'secret"with"double-quotes',
+    "secret'with'single-quotes",
+    "trailing-backslash\\",
+    "<script>alert(1)</script>",
+    "amp & ersand",
+    "new\nline",
+]
+
+
+@pytest.mark.parametrize("value", ADVERSARIAL_VALUES)
+def test_substituted_value_survives_byte_exact(value):
+    """The old engine ran HTML escape() over values before replacing
+    them into PYTHON SOURCE, so any & " ' < > was corrupted. The
+    generated script must still compile AND hold the exact input.
+    """
+    from views import template_view
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "TEAMS_WEBHOOK_URL",
+                "token": '"__JAWA_TEAMS_WEBHOOK_URL__"',
+                "type": "text",
+            }
+        ]
+    }
+    source = 'TEAMS_WEBHOOK_URL = "__JAWA_TEAMS_WEBHOOK_URL__"\n'
+    result = template_view.substitute_params(
+        source, workflow, {"TEAMS_WEBHOOK_URL": value}, [], ""
+    )
+    namespace = {}
+    exec(compile(result, "generated.py", "exec"), namespace)
+    assert namespace["TEAMS_WEBHOOK_URL"] == value
+
+
+def test_numeric_param_substitutes_a_real_int():
+    from views import template_view
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    result = template_view.substitute_params(
+        "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__\n",
+        workflow,
+        {"COOLDOWN_HOURS": "24"},
+        [],
+        "",
+    )
+    namespace = {}
+    exec(compile(result, "generated.py", "exec"), namespace)
+    assert namespace["COOLDOWN_HOURS"] == 24
+
+
+def test_non_numeric_value_for_numeric_param_is_rejected():
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__\n",
+            workflow,
+            {"COOLDOWN_HOURS": "not-a-number"},
+            [],
+            "",
+        )
+
+
+def test_unfilled_param_fails_loud():
+    """An unfilled field used to leave the placeholder baked in, so the
+    automation misbehaved at trigger time instead of failing at enable.
+    """
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "DB_PATH",
+                "label": "SQLite Database Path",
+                "token": '"__JAWA_DB_PATH__"',
+                "type": "text",
+            }
+        ]
+    }
+    with pytest.raises(AutomationError) as excinfo:
+        template_view.substitute_params(
+            'DB_PATH = "__JAWA_DB_PATH__"\n', workflow, {}, [], ""
+        )
+    assert "SQLite Database Path" in excinfo.value.message
+
+
+def test_credential_set_fills_the_standard_three():
+    from views import template_view
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "server_url",
+                "token": '"__JAWA_SERVER_URL__"',
+                "type": "text",
+            },
+            {
+                "key": "client_id",
+                "token": '"__JAWA_CLIENT_ID__"',
+                "type": "text",
+            },
+            {
+                "key": "client_secret",
+                "token": '"__JAWA_CLIENT_SECRET__"',
+                "type": "password",
+            },
+        ]
+    }
+    source = (
+        'server_url = "__JAWA_SERVER_URL__"\n'
+        'client_id = "__JAWA_CLIENT_ID__"\n'
+        'client_secret = "__JAWA_CLIENT_SECRET__"\n'
+    )
+    credentials = [
+        {
+            "name": "prod",
+            "server_url": "https://prod.jamfcloud.com",
+            "client_id": "abc",
+            # A quote in a saved secret used to break the generated
+            # Python: the credential path did NOT escape.
+            "client_secret": 'sh"h',
+        }
+    ]
+    result = template_view.substitute_params(
+        source, workflow, {}, credentials, "0"
+    )
+    namespace = {}
+    exec(compile(result, "generated.py", "exec"), namespace)
+    assert namespace["client_secret"] == 'sh"h'
+    assert namespace["server_url"] == "https://prod.jamfcloud.com"
+
+
+def _raw_workflow():
+    return {
+        "config_params": [
+            {
+                "key": "wifi_ssid",
+                "label": "WiFi SSID",
+                "token": "__JAWA_WIFI_SSID__",
+                "raw": True,
+                "type": "text",
+            }
+        ]
+    }
+
+
+# The one raw token in the catalog sits inside an XML <string> element
+# held in a b"""...""" bytes literal, so it is neither quoted Python nor
+# escaped XML. Each of these would produce a script that fails to
+# compile or an Apple profile that is not well-formed XML.
+RAW_REJECTED_VALUES = [
+    'quote"breaks-the-bytes-literal',
+    "apostrophe'in-xml",
+    "angle<bracket",
+    "angle>bracket",
+    "back\\slash",
+    "new\nline",
+    # A bare & is not well-formed XML: the profile is rejected at
+    # runtime, long after enable succeeded.
+    "Corp & Guest",
+    # A bytes literal cannot hold a non-ASCII character at all.
+    "Café-WiFi",
+]
+
+
+@pytest.mark.parametrize("value", RAW_REJECTED_VALUES)
+def test_raw_param_rejects_values_that_break_its_context(value):
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            "<key>SSID_STR</key><string>__JAWA_WIFI_SSID__</string>",
+            _raw_workflow(),
+            {"wifi_ssid": value},
+            [],
+            "",
+        )
+
+
+def test_raw_param_accepts_a_normal_ssid_and_stays_well_formed_xml():
+    import xml.etree.ElementTree as ET
+
+    from views import template_view
+
+    result = template_view.substitute_params(
+        "<string>__JAWA_WIFI_SSID__</string>",
+        _raw_workflow(),
+        {"wifi_ssid": "Corporate-WiFi 5GHz"},
+        [],
+        "",
+    )
+    assert ET.fromstring(result).text == "Corporate-WiFi 5GHz"
+
+
+def test_raw_substitution_keeps_the_real_script_compiling():
+    """The raw token lives in return_to_service.py inside a bytes
+    literal, so a substituted value has to leave the whole module
+    compilable -- not just the one line.
+    """
+    import xml.etree.ElementTree as ET
+
+    from views import template_view
+
+    workflow = next(
+        wf
+        for wf in CATALOG
+        if any(param.get("raw") for param in wf.get("config_params", []))
+    )
+    form = {
+        param["key"]: (
+            "12"
+            if param.get("type") == "number"
+            else "Corporate-WiFi"
+            if param.get("raw")
+            else f"value-for-{param['key']}"
+        )
+        for param in workflow["config_params"]
+    }
+    result = template_view.substitute_params(
+        _script_source(workflow), workflow, form, [], ""
+    )
+    assert "__JAWA_" not in result
+    namespace = {}
+    exec(compile(result, workflow["script_file"], "exec"), namespace)
+    assert ET.fromstring(namespace["WIFI_PAYLOAD"]) is not None
+
+
+def test_numeric_param_cannot_smuggle_code_into_a_bare_token():
+    """markupsafe.escape() never protected this position: a payload with
+    no quote or angle characters passed through it untouched, and the
+    numeric token is written bare, so it landed in an expression
+    position. Validation, not escaping, is what closes it.
+    """
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "label": "Cooldown Hours",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    payload = "0 or exec(chr(112)+chr(97)+chr(115)+chr(115))"
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__  # noqa: F821\n",
+            workflow,
+            {"COOLDOWN_HOURS": payload},
+            [],
+            "",
+        )
+
+
+def test_numeric_substitution_preserves_the_trailing_noqa_comment():
+    """The noqa sits outside the token, so a plain string replace keeps
+    it. Stripping or relocating it would reintroduce the F821 that
+    test_script_has_no_undefined_names guards.
+    """
+    from views import template_view
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    result = template_view.substitute_params(
+        "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__  # noqa: F821\n",
+        workflow,
+        {"COOLDOWN_HOURS": "12"},
+        [],
+        "",
+    )
+    assert result == "COOLDOWN_HOURS = 12  # noqa: F821\n"
+
+
+def test_no_html_escaping_survives_in_the_substitution_path():
+    """markupsafe.escape() belongs to the HTML surfaces (escape(slug)),
+    never to Python source generation. Pin that separation so the
+    corrupting call cannot be reintroduced into the engine.
+    """
+    import ast
+    import inspect
+
+    from views import template_view
+
+    for func in (
+        template_view.substitute_params,
+        template_view._python_literal,
+    ):
+        tree = ast.parse(inspect.getsource(func))
+        called = {
+            node.func.id
+            for node in ast.walk(tree)
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+        }
+        assert "escape" not in called, (
+            f"{func.__name__} HTML-escapes a value on its way into "
+            f"Python source (bug B13)"
+        )
diff --git a/tests/test_templates.py b/tests/test_templates.py
index 6ac4173..4f3e653 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -29,11 +29,11 @@ def fake_popen(monkeypatch):
 
 
 def test_enabled_template_writes_canonical_auth_shape(
-    logged_in_client, jawa_env
+    logged_in_client, jawa_env, enable_form
 ):
     resp = logged_in_client.post(
         "/templates/device-naming/enable",
-        data={"webhook_name": "dn-hook"},
+        data=enable_form("device-naming", webhook_name="dn-hook"),
     )
     assert resp.status_code in (200, 302)
     entry = data_store.get_webhook_by_name("dn-hook")
@@ -45,11 +45,11 @@ def test_enabled_template_writes_canonical_auth_shape(
 
 
 def test_enabled_template_webhook_fires(
-    logged_in_client, jawa_env, fake_popen
+    logged_in_client, jawa_env, fake_popen, enable_form
 ):
     logged_in_client.post(
         "/templates/device-naming/enable",
-        data={"webhook_name": "dn-hook"},
+        data=enable_form("device-naming", webhook_name="dn-hook"),
     )
     resp = logged_in_client.post(
         "/hooks/dn-hook",
@@ -65,6 +65,54 @@ def test_enabled_template_webhook_fires(
     assert os.path.exists(argv[0])
 
 
+def test_enable_deploys_a_script_with_every_token_filled(
+    logged_in_client, jawa_env, enable_form
+):
+    """End-to-end through the route: the deployed copy on disk must hold
+    the submitted values as real Python and carry no leftover token. The
+    old engine matched on placeholder, not token, so every token stayed
+    baked in and the script ran against literal "__JAWA_..." strings.
+    """
+    url = "https://logic.example.test/invoke?a=1&b=2&sig=Ab%2FCd"
+    logged_in_client.post(
+        "/templates/teams-notification/enable",
+        data=enable_form(
+            "teams-notification",
+            webhook_name="teams-hook",
+            TEAMS_WEBHOOK_URL=url,
+        ),
+    )
+    entry = data_store.get_webhook_by_name("teams-hook")
+    assert entry is not None
+    with open(entry["script"], "r", encoding="utf-8") as handle:
+        deployed = handle.read()
+    assert "__JAWA_" not in deployed
+    namespace = {}
+    exec(compile(deployed, entry["script"], "exec"), namespace)
+    assert namespace["TEAMS_WEBHOOK_URL"] == url
+
+
+def test_enable_with_a_field_left_blank_deploys_nothing(
+    logged_in_client, jawa_env, enable_form
+):
+    """Failing loud is the point: a half-filled form used to yield a
+    registered webhook pointing at a script still holding tokens.
+    """
+    form = enable_form("teams-notification", webhook_name="blank-hook")
+    form["TEAMS_WEBHOOK_URL"] = ""
+    try:
+        logged_in_client.post(
+            "/templates/teams-notification/enable", data=form
+        )
+    except Exception:
+        # Task 5 adds the try/except that renders the error page; until
+        # then the AutomationError propagates. Either way nothing must
+        # be written.
+        pass
+    assert data_store.get_webhook_by_name("blank-hook") is None
+    assert not os.listdir(str(jawa_env.scripts_dir))
+
+
 def _traversal_package():
     return {
         "name": "evil",
diff --git a/views/template_view.py b/views/template_view.py
index 23dd1ab..861626c 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -45,6 +45,7 @@
 
 from bin import data_store, logger
 from bin.view_modifiers import response
+from views._type_handlers.base import AutomationError
 
 blueprint = Blueprint(
     "template_view",
@@ -130,40 +131,104 @@ def _install_package(package: dict) -> None:
     )
 
 
-def _apply_credentials(
+CREDENTIAL_KEYS = ("server_url", "client_id", "client_secret")
+
+
+def _python_literal(value: str, param: Dict[str, Any]) -> str:
+    """Render a config value as Python source text.
+
+    The value is going into a .py file, not into HTML, so it must be a
+    Python literal -- never HTML-escaped. The old engine ran
+    markupsafe.escape() over form values before string-replacing them
+    into script source, which turned every & in a Power Automate URL
+    into &amp; (bug B13); the credential path did not escape at all, so
+    a quote in a secret produced invalid Python. One function now
+    serves both paths so they cannot diverge again.
+    """
+    if param.get("type") == "number":
+        try:
+            number = int(value)
+        except ValueError:
+            try:
+                number = float(value)
+            except ValueError:
+                raise AutomationError(
+                    "Invalid Configuration",
+                    f"{param.get('label', param['key'])} must be a "
+                    f"number. Got: {value}",
+                )
+        return repr(number)
+    if param.get("raw"):
+        # Substituted into a non-Python context inside the script (for
+        # example an XML payload literal), so no quoting is applied.
+        # Reject characters that would break out of that literal. "&"
+        # is in the list because the only raw token ships inside an XML
+        # <string> element: a bare & is not well-formed XML, so the
+        # generated profile would be rejected at runtime.
+        for char in ("<", ">", "&", '"', "'", "\\", "\n"):
+            if char in value:
+                raise AutomationError(
+                    "Invalid Configuration",
+                    f"{param.get('label', param['key'])} may not "
+                    f"contain {char!r}.",
+                )
+        # That XML lives in a b"""...""" bytes literal, which cannot
+        # hold a non-ASCII character at all -- substituting one makes
+        # the deployed script fail to compile. Refuse at enable time
+        # rather than shipping a script that cannot start.
+        if not value.isascii():
+            raise AutomationError(
+                "Invalid Configuration",
+                f"{param.get('label', param['key'])} must be ASCII "
+                f"only. Got: {value}",
+            )
+        return value
+    return repr(value)
+
+
+def substitute_params(
     script_content: str,
-    workflow: dict,
+    workflow: Dict[str, Any],
+    form: Any,
+    credentials: List[Dict[str, Any]],
     credential_index: str,
-    credentials: list,
 ) -> str:
-    """Substitute credential placeholders in script content."""
-    if not credential_index or not credentials:
-        return script_content
-    try:
-        cred = credentials[int(credential_index)]
-    except (ValueError, IndexError):
-        return script_content
-
-    cred_keys = ("server_url", "client_id", "client_secret")
+    """Fill every token in a template script.
+
+    Values come from the selected credential set first, then the form.
+    Every declared token must end up filled: an unfilled token used to
+    leave the placeholder baked into the deployed script, so the
+    automation failed at trigger time instead of at enable time.
+    """
+    cred: Dict[str, Any] = {}
+    if credential_index and credentials:
+        try:
+            cred = credentials[int(credential_index)]
+        except (ValueError, IndexError):
+            cred = {}
+
+    missing = []
     for param in workflow.get("config_params", []):
-        key = param.get("key", "")
-        if key in cred_keys and cred.get(key):
-            script_content = script_content.replace(
-                param["placeholder"], cred[key]
-            )
-    return script_content
+        key = param["key"]
+        value = ""
+        if key in CREDENTIAL_KEYS and cred.get(key):
+            value = cred[key]
+        if not value:
+            value = form.get(key, "")
+        if not value:
+            missing.append(param.get("label", key))
+            continue
+        script_content = script_content.replace(
+            param["token"], _python_literal(str(value), param)
+        )
 
+    if missing:
+        raise AutomationError(
+            "Missing Configuration",
+            "Fill in every configuration field before enabling this "
+            "template. Missing: " + ", ".join(missing),
+        )
 
-def _apply_form_params(script_content: str, workflow: dict) -> str:
-    """Substitute remaining form-supplied placeholders."""
-    for param in workflow.get("config_params", []):
-        key = param.get("key", "")
-        form_value = request.form.get(key, "")
-        if form_value:
-            form_value = str(escape(form_value))
-            script_content = script_content.replace(
-                param["placeholder"], form_value
-            )
     return script_content
 
 
@@ -372,13 +437,13 @@ def enable_template(slug: str) -> Union[Response, str]:
     with open(src_path, "r", encoding="utf-8") as f:
         script_content = f.read()
 
-    script_content = _apply_credentials(
+    script_content = substitute_params(
         script_content,
         workflow,
-        request.form.get("credential_set", ""),
+        request.form,
         credentials,
+        request.form.get("credential_set", ""),
     )
-    script_content = _apply_form_params(script_content, workflow)
     dest_path = _write_script(webhook_name, script_content)
 
     data_store.add_webhook(

From 4fbf0a80e8d9e6ff8b10b532337287ca42a9ff03 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 5 Aug 2026 17:36:02 -0500
Subject: [PATCH 66/84] fix: substitute template tokens in one pass (J16, B13
 review round 1)

substitute_params applied one str.replace per param against a shared
accumulator, so text an earlier param had already substituted was
re-scanned by every later param's replace. A value carrying a later
param's needle was therefore rewritten from the inside, breaking out of
the Python string literal it was meant to be trapped in:

    server_url = x"__JAWA_CLIENT_ID__"y
    client_id  = +__import__("os").system("...")+
    ->  self.server_url = 'x'+__import__("os").system("...")+'y'

Enable returned 302, the webhook registered, and the payload ran when
the receiver instantiated Config() on the first fire. Affects every
multi-param workflow. Substitution is now a single re.sub over an
alternation of the tokens, so emitted text is never reconsidered, plus
a check rejecting any replacement that contains a __JAWA_ needle and
one refusing any token that survives.

Also tightened the two validators that let a script through to fail at
trigger time instead of at enable: the numeric branch accepted inf,
nan, 1e400 and past-limit integers, which repr() to bare words that are
not builtins (NameError on first fire), and unicode digits that mean a
different number than the glyphs typed; the raw branch was a character
blocklist that leaked NUL (deployed .py would not compile), CR (silently
rewritten to LF by the XML parser) and the other C0/C1 controls, now
rejected by range rather than by list.
---
 tests/test_template_catalog.py | 329 ++++++++++++++++++++++++++++++++-
 views/template_view.py         | 172 +++++++++++++----
 2 files changed, 456 insertions(+), 45 deletions(-)

diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
index 89da109..b9edf40 100644
--- a/tests/test_template_catalog.py
+++ b/tests/test_template_catalog.py
@@ -557,14 +557,331 @@ def test_no_html_escaping_survives_in_the_substitution_path():
     for func in (
         template_view.substitute_params,
         template_view._python_literal,
+        template_view._numeric_literal,
+        template_view._raw_literal,
     ):
         tree = ast.parse(inspect.getsource(func))
-        called = {
-            node.func.id
-            for node in ast.walk(tree)
-            if isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+        called = set()
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            # Bare escape(...) and dotted markupsafe.escape(...) both
+            # have to be caught; matching only ast.Name let the dotted
+            # form through.
+            if isinstance(node.func, ast.Name):
+                called.add(node.func.id)
+            elif isinstance(node.func, ast.Attribute):
+                prefix = getattr(node.func.value, "id", "")
+                called.add(
+                    f"{prefix}.{node.func.attr}" if prefix else node.func.attr
+                )
+        # re.escape is regex quoting of our OWN token needles, which is
+        # required and safe. Only HTML escaping of a value is the bug.
+        html_escapes = {
+            name
+            for name in called
+            if name.split(".")[-1] == "escape" and name != "re.escape"
         }
-        assert "escape" not in called, (
+        assert not html_escapes, (
             f"{func.__name__} HTML-escapes a value on its way into "
-            f"Python source (bug B13)"
+            f"Python source (bug B13): {sorted(html_escapes)}"
         )
+
+
+def _assign_nodes(source):
+    """Map every assigned name in `source` to its value AST node."""
+    import ast
+
+    found = {}
+    for node in ast.walk(ast.parse(source)):
+        if not isinstance(node, ast.Assign):
+            continue
+        target = node.targets[0]
+        if isinstance(target, ast.Name):
+            found[target.id] = node.value
+        elif isinstance(target, ast.Attribute):
+            found[target.attr] = node.value
+    return found
+
+
+def test_one_params_value_cannot_break_out_via_a_later_token():
+    """CRITICAL regression. Substitution used to apply one str.replace
+    per param against a shared accumulator, so text a previous param had
+    already substituted got re-scanned. A value carrying a LATER param's
+    needle was therefore rewritten from the inside, breaking out of the
+    Python string literal it was supposed to be trapped in and turning a
+    config field into arbitrary code in the deployed script:
+
+        self.server_url = 'x'+__import__("os").system(...)+'y'
+
+    Single-value round-trip tests cannot see this -- it needs two params
+    interacting -- which is why it shipped.
+    """
+    import ast
+
+    from views import template_view
+
+    # Synthetic tokens without the __JAWA_ prefix, so the belt-and-
+    # braces prefix check cannot fire: this pins the single-pass
+    # property itself, not the secondary guard.
+    workflow = {
+        "config_params": [
+            {"key": "FIRST", "token": '"@@FIRST@@"', "type": "text"},
+            {"key": "SECOND", "token": '"@@SECOND@@"', "type": "text"},
+        ]
+    }
+    first = 'x"@@SECOND@@"y'
+    second = '+__import__("os").system("echo PWNED")+'
+    result = template_view.substitute_params(
+        'FIRST = "@@FIRST@@"\nSECOND = "@@SECOND@@"\n',
+        workflow,
+        {"FIRST": first, "SECOND": second},
+        [],
+        "",
+    )
+
+    # Byte-exact survival...
+    namespace = {}
+    exec(compile(result, "generated.py", "exec"), namespace)
+    assert namespace["FIRST"] == first
+    assert namespace["SECOND"] == second
+    # ...and structurally a plain string constant, not an expression.
+    # Without this the value could still evaluate equal while having
+    # executed something on the way.
+    nodes = _assign_nodes(result)
+    assert isinstance(nodes["FIRST"], ast.Constant), (
+        f"FIRST became a {type(nodes['FIRST']).__name__}, not a string "
+        f"constant: the value broke out of its literal"
+    )
+    assert nodes["FIRST"].value == first
+
+
+def test_value_carrying_a_real_jawa_token_is_rejected(logged_in_client):
+    """Belt and braces over the single pass: a submitted value that
+    contains a real __JAWA_ needle is refused outright rather than
+    relying on pass ordering to stay harmless.
+    """
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = next(wf for wf in CATALOG if wf["slug"] == "device-naming")
+    form = {
+        "server_url": 'x"__JAWA_CLIENT_ID__"y',
+        "client_id": '+__import__("os").system("echo PWNED")+',
+        "client_secret": "s3cret",
+    }
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            _script_source(workflow), workflow, form, [], ""
+        )
+
+
+def test_the_reviewers_poc_does_not_execute_through_the_route(
+    logged_in_client, jawa_env, enable_form
+):
+    """End-to-end through the real HTTP route: the PoC POST must not
+    leave behind a deployed script that executes anything. Previously
+    this returned 302, registered the webhook, and ran the payload when
+    the receiver instantiated Config().
+    """
+    import ast
+
+    marker = os.path.join(str(jawa_env.root), "pwned.txt")
+    payload = f'+__import__("os").system("touch {marker}")+'
+    try:
+        logged_in_client.post(
+            "/templates/device-naming/enable",
+            data=enable_form(
+                "device-naming",
+                webhook_name="poc-hook",
+                server_url='x"__JAWA_CLIENT_ID__"y',
+                client_id=payload,
+            ),
+        )
+    except Exception:
+        # Task 5 adds the error-page wrapper; until then the rejection
+        # propagates as an AutomationError. Being rejected IS the pass
+        # condition here -- the assertions below hold either way.
+        pass
+    from bin import data_store
+
+    entry = data_store.get_webhook_by_name("poc-hook")
+    if entry is not None:
+        # If a script was deployed at all, nothing in it may be an
+        # expression in the value position.
+        with open(entry["script"], "r", encoding="utf-8") as handle:
+            nodes = _assign_nodes(handle.read())
+        for name in ("server_url", "client_id"):
+            assert isinstance(nodes[name], ast.Constant), (
+                f"{name} is a {type(nodes[name]).__name__} in the "
+                f"deployed script: the injection is still open"
+            )
+    # Either way the payload must never have run.
+    assert not os.path.exists(marker), "the injected payload executed"
+
+
+NON_FINITE_NUMERICS = ["inf", "-inf", "nan", "Infinity", "1e400", "-1e400"]
+
+
+@pytest.mark.parametrize("value", NON_FINITE_NUMERICS)
+def test_non_finite_numeric_is_rejected(value):
+    """repr(float("inf")) is the bare word `inf`, which is not a
+    builtin, so the numeric token (written bare) produced
+    `COOLDOWN_HOURS = inf` -- NameError on the first trigger. The F821
+    guard runs against the template, not the deployed copy, so only
+    enable-time validation catches this.
+    """
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "label": "Cooldown Hours",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__\n",
+            workflow,
+            {"COOLDOWN_HOURS": value},
+            [],
+            "",
+        )
+
+
+def test_huge_integer_is_rejected_rather_than_becoming_inf():
+    """An integer string past CPython's ~4300-digit limit fails int(),
+    then float()s to inf and shipped as the bare word `inf`.
+    """
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "label": "Cooldown Hours",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__\n",
+            workflow,
+            {"COOLDOWN_HOURS": "9" * 5000},
+            [],
+            "",
+        )
+
+
+def test_unicode_digit_numeric_is_rejected():
+    """int("٣") is 3 and int("１２") is 12, so a unicode digit silently
+    became a different number than the glyphs an admin typed. Numerics
+    are ASCII-only by deliberate choice.
+    """
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "label": "Cooldown Hours",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    for value in ("٣", "１２"):
+        with pytest.raises(AutomationError):
+            template_view.substitute_params(
+                "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__\n",
+                workflow,
+                {"COOLDOWN_HOURS": value},
+                [],
+                "",
+            )
+
+
+@pytest.mark.parametrize(
+    "value,expected",
+    [("24", 24), ("  7  ", 7), ("+5", 5), ("1e5", 100000.0), ("0.5", 0.5)],
+)
+def test_numeric_leniency_is_deliberate(value, expected):
+    """Documented, intentional leniency: whitespace, a leading +, and
+    exponent form are all things an admin plausibly types. Pinned so the
+    behaviour is a decision rather than an accident.
+    """
+    from views import template_view
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "COOLDOWN_HOURS",
+                "token": "__JAWA_COOLDOWN_HOURS__",
+                "type": "number",
+            }
+        ]
+    }
+    result = template_view.substitute_params(
+        "COOLDOWN_HOURS = __JAWA_COOLDOWN_HOURS__\n",
+        workflow,
+        {"COOLDOWN_HOURS": value},
+        [],
+        "",
+    )
+    namespace = {}
+    exec(compile(result, "generated.py", "exec"), namespace)
+    assert namespace["COOLDOWN_HOURS"] == expected
+
+
+# All ASCII, so isascii() passed, and none were in the structural
+# blocklist. NUL makes the deployed .py fail to compile outright; the
+# rest produce malformed XML or get silently rewritten by the parser.
+RAW_CONTROL_CHARS = ["\x00", "\r", "\x0c", "\x0b", "\x1b", "\t", "\x7f"]
+
+
+@pytest.mark.parametrize("char", RAW_CONTROL_CHARS)
+def test_raw_param_rejects_control_characters(char):
+    from views import template_view
+    from views._type_handlers.base import AutomationError
+
+    with pytest.raises(AutomationError):
+        template_view.substitute_params(
+            "<string>__JAWA_WIFI_SSID__</string>",
+            _raw_workflow(),
+            {"wifi_ssid": f"Corp{char}WiFi"},
+            [],
+            "",
+        )
+
+
+def test_raw_nul_byte_cannot_reach_a_deployed_script(
+    logged_in_client, jawa_env, enable_form
+):
+    """A NUL in the SSID used to be accepted, and `compile()` then
+    refused the deployed file ("source code string cannot contain null
+    bytes") on the first trigger -- the script never ran.
+    """
+    form = enable_form(
+        "return-to-service",
+        webhook_name="nul-hook",
+        wifi_ssid="Corp\x00WiFi",
+    )
+    try:
+        logged_in_client.post("/templates/return-to-service/enable", data=form)
+    except Exception:
+        # Task 5 adds the error-page wrapper; until then the
+        # AutomationError propagates. Nothing may be written either way.
+        pass
+    from bin import data_store
+
+    assert data_store.get_webhook_by_name("nul-hook") is None
+    assert not os.listdir(str(jawa_env.scripts_dir))
diff --git a/views/template_view.py b/views/template_view.py
index 861626c..a8a1d45 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -27,7 +27,9 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 import json
+import math
 import os
+import re
 from typing import Any, Dict, List, Union
 
 from flask import (
@@ -133,6 +135,95 @@ def _install_package(package: dict) -> None:
 
 CREDENTIAL_KEYS = ("server_url", "client_id", "client_secret")
 
+# Every template token starts with this. Used as a tripwire: no computed
+# replacement may reintroduce one, and none may survive substitution.
+TOKEN_PREFIX = "__JAWA_"
+
+
+def _numeric_literal(value: str, param: Dict[str, Any]) -> str:
+    """Validate a numeric config value and render it as a literal.
+
+    The one numeric token is written bare (no surrounding quotes), so
+    whatever comes back lands in an expression position. Validation --
+    not escaping -- is what keeps that safe.
+
+    Deliberately lenient: surrounding whitespace is stripped, and a
+    leading "+" or an exponent form ("1e5" -> 100000.0) is accepted,
+    because those are things an admin plausibly types into a form field.
+    Deliberately strict: the value must be ASCII, so a unicode digit
+    cannot silently become a different number, and it must be finite.
+    """
+    label = param.get("label", param["key"])
+    text = value.strip()
+    if not text.isascii():
+        raise AutomationError(
+            "Invalid Configuration",
+            f"{label} must be an ASCII number. Got: {value}",
+        )
+    try:
+        number = int(text)
+    except ValueError:
+        try:
+            number = float(text)
+        except ValueError:
+            raise AutomationError(
+                "Invalid Configuration",
+                f"{label} must be a number. Got: {value}",
+            )
+        # float() happily accepts "inf", "nan", "Infinity" and "1e400".
+        # repr(float("inf")) is the bare word inf, which is not a
+        # builtin, so the deployed script would raise NameError on its
+        # first trigger -- enable succeeds, the automation dies later.
+        if not math.isfinite(number):
+            raise AutomationError(
+                "Invalid Configuration",
+                f"{label} must be a finite number. Got: {value}",
+            )
+    return repr(number)
+
+
+def _raw_literal(value: str, param: Dict[str, Any]) -> str:
+    """Validate a raw (unquoted) config value and return it verbatim.
+
+    The only raw token sits inside an XML <string> element held in a
+    b\"\"\"...\"\"\" bytes literal, so the value is neither quoted Python
+    nor escaped XML and has to be safe in both at once.
+    """
+    label = param.get("label", param["key"])
+    # Structural characters: these would break out of the XML element or
+    # out of the enclosing Python literal. "&" is here because a bare
+    # ampersand is not well-formed XML, so the generated Apple profile
+    # would be rejected at runtime.
+    for char in ("<", ">", "&", '"', "'", "\\", "\n"):
+        if char in value:
+            raise AutomationError(
+                "Invalid Configuration",
+                f"{label} may not contain {char!r}.",
+            )
+    # A character blocklist alone is whack-a-mole, so this is a positive
+    # rule over the whole control range rather than another list of
+    # individual characters. NUL makes the deployed .py fail to
+    # compile; the other C0/C1 codes either produce malformed XML or get
+    # silently rewritten by the XML parser (CR becomes LF), which would
+    # change the SSID an admin typed without telling them.
+    for char in value:
+        code = ord(char)
+        if code < 0x20 or 0x7F <= code <= 0x9F:
+            raise AutomationError(
+                "Invalid Configuration",
+                f"{label} may not contain control characters. Got: {char!r}",
+            )
+    # That XML lives in a b\"\"\"...\"\"\" bytes literal, which cannot
+    # hold a non-ASCII character at all -- substituting one makes the
+    # deployed script fail to compile. Refuse at enable time rather
+    # than shipping a script that cannot start.
+    if not value.isascii():
+        raise AutomationError(
+            "Invalid Configuration",
+            f"{label} must be ASCII only. Got: {value}",
+        )
+    return value
+
 
 def _python_literal(value: str, param: Dict[str, Any]) -> str:
     """Render a config value as Python source text.
@@ -146,43 +237,9 @@ def _python_literal(value: str, param: Dict[str, Any]) -> str:
     serves both paths so they cannot diverge again.
     """
     if param.get("type") == "number":
-        try:
-            number = int(value)
-        except ValueError:
-            try:
-                number = float(value)
-            except ValueError:
-                raise AutomationError(
-                    "Invalid Configuration",
-                    f"{param.get('label', param['key'])} must be a "
-                    f"number. Got: {value}",
-                )
-        return repr(number)
+        return _numeric_literal(value, param)
     if param.get("raw"):
-        # Substituted into a non-Python context inside the script (for
-        # example an XML payload literal), so no quoting is applied.
-        # Reject characters that would break out of that literal. "&"
-        # is in the list because the only raw token ships inside an XML
-        # <string> element: a bare & is not well-formed XML, so the
-        # generated profile would be rejected at runtime.
-        for char in ("<", ">", "&", '"', "'", "\\", "\n"):
-            if char in value:
-                raise AutomationError(
-                    "Invalid Configuration",
-                    f"{param.get('label', param['key'])} may not "
-                    f"contain {char!r}.",
-                )
-        # That XML lives in a b"""...""" bytes literal, which cannot
-        # hold a non-ASCII character at all -- substituting one makes
-        # the deployed script fail to compile. Refuse at enable time
-        # rather than shipping a script that cannot start.
-        if not value.isascii():
-            raise AutomationError(
-                "Invalid Configuration",
-                f"{param.get('label', param['key'])} must be ASCII "
-                f"only. Got: {value}",
-            )
-        return value
+        return _raw_literal(value, param)
     return repr(value)
 
 
@@ -208,6 +265,7 @@ def substitute_params(
             cred = {}
 
     missing = []
+    replacements: Dict[str, str] = {}
     for param in workflow.get("config_params", []):
         key = param["key"]
         value = ""
@@ -218,9 +276,17 @@ def substitute_params(
         if not value:
             missing.append(param.get("label", key))
             continue
-        script_content = script_content.replace(
-            param["token"], _python_literal(str(value), param)
-        )
+        replacement = _python_literal(str(value), param)
+        # Belt and braces on top of the single pass below: a replacement
+        # that itself contains a token would be a needle for nothing
+        # now, but would come back the moment anyone reintroduces a
+        # second pass over this text.
+        if TOKEN_PREFIX in replacement:
+            raise AutomationError(
+                "Invalid Configuration",
+                f"{param.get('label', key)} may not contain {TOKEN_PREFIX}.",
+            )
+        replacements[param["token"]] = replacement
 
     if missing:
         raise AutomationError(
@@ -229,6 +295,34 @@ def substitute_params(
             "template. Missing: " + ", ".join(missing),
         )
 
+    if not replacements:
+        return script_content
+
+    # ONE pass over the source. Applying str.replace per param in a loop
+    # re-scanned text that earlier params had already substituted, so a
+    # value containing a later param's token got rewritten from the
+    # inside -- breaking out of the Python string literal it was
+    # supposed to be trapped in and turning a config field into
+    # arbitrary code in the deployed script. re.sub with a callback
+    # never reconsiders the text it has emitted, so a substituted value
+    # can no longer influence any later substitution.
+    pattern = "|".join(
+        re.escape(token)
+        for token in sorted(replacements, key=len, reverse=True)
+    )
+    script_content = re.sub(
+        pattern, lambda match: replacements[match.group(0)], script_content
+    )
+
+    # Nothing may survive: a leftover token means the deployed script
+    # would run against the literal string "__JAWA_...".
+    if TOKEN_PREFIX in script_content:
+        raise AutomationError(
+            "Invalid Configuration",
+            "The template script still contains unfilled placeholders "
+            "after configuration. Please report this template.",
+        )
+
     return script_content
 
 

From 14832ac1291f12fbe1f794687e10d49fd5eaa60c Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 5 Aug 2026 17:53:54 -0500
Subject: [PATCH 67/84] fix: reject imported template packages that cannot run
 (J16, B16)

_validate_package checked field presence and filename safety but never
that the script parses, so a truncated or malformed .jawa.json was
written, chmod 0755'd and registered as a live webhook -- failing later
inside Popen where the only signal is a logged non-zero exit code.

A compile() gate rejects it with the offending line number before
anything is written. Deliberately a parse gate only: undefined-name
analysis is right for bundled content, where the canonical API block is
the contract, but would wrongly reject a user script that relies on a
runtime global.

Also folds in a fix a reviewer found in the Task 3 substitution engine:
substitute_params returned early when a workflow declared no
config_params, skipping the TOKEN_PREFIX survivor check, so a template
carrying an undeclared __JAWA_* token shipped with the placeholder baked
into the deployed script -- exactly the drift that check exists to
catch. Latent only today (all seven bundled templates declare at least
one config_param), now guarded by a regression test.
---
 tests/test_templates.py | 72 +++++++++++++++++++++++++++++++++++++++++
 views/template_view.py  | 57 +++++++++++++++++++++-----------
 2 files changed, 111 insertions(+), 18 deletions(-)

diff --git a/tests/test_templates.py b/tests/test_templates.py
index 4f3e653..067ffb8 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -144,6 +144,78 @@ def test_import_rejects_traversal_filename(logged_in_client, jawa_env):
     assert not os.path.exists(os.path.join(scripts_dir, "evil.sh"))
 
 
+def _package(content, name="imported-hook"):
+    return {
+        "name": name,
+        "description": "test package",
+        "trigger": {"event": "ComputerCheckIn"},
+        "script": {"filename": "imported.py", "content": content},
+    }
+
+
+def _upload(client, package):
+    payload = json.dumps(package).encode()
+    return client.post(
+        "/templates/import",
+        data={
+            "package": (io.BytesIO(payload), "thing.jawa.json"),
+        },
+        content_type="multipart/form-data",
+    )
+
+
+def test_import_rejects_script_that_does_not_parse(
+    logged_in_client, jawa_env
+):
+    """A truncated or malformed upload used to be written, chmod 0755'd
+    and registered as a live webhook, then fail inside Popen where the
+    only signal is a logged non-zero exit code (bug B16).
+    """
+    broken = "#!/usr/bin/env python3\ndef main():\n    x = json.loads(\n"
+    resp = _upload(logged_in_client, _package(broken))
+
+    assert resp.status_code in (200, 302)
+    assert data_store.get_webhook_by_name("imported-hook") is None
+    assert not os.path.isfile(
+        os.path.join(str(jawa_env.scripts_dir), "imported.py")
+    )
+
+
+def test_import_accepts_script_using_a_runtime_global(
+    logged_in_client, jawa_env
+):
+    """The gate is compile() only, deliberately not undefined-name
+    analysis: a user's own script may legitimately rely on a runtime
+    global, and rejecting that would be a regression. Bundled content
+    is held to the stricter F821 bar in test_template_catalog.py.
+    """
+    uses_global = (
+        "#!/usr/bin/env python3\n"
+        "def main():\n"
+        "    return some_runtime_helper()\n"
+    )
+    resp = _upload(logged_in_client, _package(uses_global))
+
+    assert resp.status_code in (200, 302)
+    assert data_store.get_webhook_by_name("imported-hook") is not None
+
+
+def test_substitution_rejects_a_token_no_param_declares():
+    """The survivor check must run even when the workflow declares no
+    config_params. The early return for "nothing to substitute" used to
+    skip it, so a template carrying a token with no catalog entry --
+    exactly the drift the check exists to catch -- shipped with the
+    placeholder baked into the deployed script.
+    """
+    from views._type_handlers.base import AutomationError
+    from views.template_view import substitute_params
+
+    with pytest.raises(AutomationError):
+        substitute_params(
+            'X = "__JAWA_ORPHAN__"\n', {"config_params": []}, {}, [], ""
+        )
+
+
 def test_template_view_has_no_direct_webhook_io():
     import inspect
     from views import template_view
diff --git a/views/template_view.py b/views/template_view.py
index a8a1d45..fff2a61 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -295,24 +295,29 @@ def substitute_params(
             "template. Missing: " + ", ".join(missing),
         )
 
-    if not replacements:
-        return script_content
-
-    # ONE pass over the source. Applying str.replace per param in a loop
-    # re-scanned text that earlier params had already substituted, so a
-    # value containing a later param's token got rewritten from the
-    # inside -- breaking out of the Python string literal it was
-    # supposed to be trapped in and turning a config field into
-    # arbitrary code in the deployed script. re.sub with a callback
-    # never reconsiders the text it has emitted, so a substituted value
-    # can no longer influence any later substitution.
-    pattern = "|".join(
-        re.escape(token)
-        for token in sorted(replacements, key=len, reverse=True)
-    )
-    script_content = re.sub(
-        pattern, lambda match: replacements[match.group(0)], script_content
-    )
+    # Guarded rather than an early return: a workflow declaring no
+    # config_params must still reach the survivor check below, or a
+    # template carrying an undeclared token ships with the placeholder
+    # baked in -- exactly the drift that check exists to catch.
+    if replacements:
+        # ONE pass over the source. Applying str.replace per param in a
+        # loop re-scanned text that earlier params had already
+        # substituted, so a value containing a later param's token got
+        # rewritten from the inside -- breaking out of the Python string
+        # literal it was supposed to be trapped in and turning a config
+        # field into arbitrary code in the deployed script. re.sub with
+        # a callback never reconsiders the text it has emitted, so a
+        # substituted value can no longer influence any later
+        # substitution.
+        pattern = "|".join(
+            re.escape(token)
+            for token in sorted(replacements, key=len, reverse=True)
+        )
+        script_content = re.sub(
+            pattern,
+            lambda match: replacements[match.group(0)],
+            script_content,
+        )
 
     # Nothing may survive: a leftover token means the deployed script
     # would run against the literal string "__JAWA_...".
@@ -367,6 +372,22 @@ def _validate_package(package: dict) -> Union[str, None]:
         # outside SCRIPTS_DIR (bug B7). Reject loudly, write nothing.
         return f"Unsafe script filename: {filename}"
 
+    try:
+        compile(package["script"]["content"], filename, "exec")
+    except SyntaxError as err:
+        # Only a parse gate -- deliberately NOT undefined-name
+        # analysis. compile() catches truncated uploads and syntax
+        # errors with no false positives, while a user's own script may
+        # legitimately rely on a runtime global. Bundled scripts are
+        # held to the stricter F821 bar by the catalog tests.
+        return (
+            f"Script does not parse as Python "
+            f"(line {err.lineno}): {err.msg}"
+        )
+    except (ValueError, TypeError) as err:
+        # e.g. embedded NUL bytes in the uploaded content.
+        return f"Script content is not valid Python source: {err}"
+
     return None
 
 

From d5ba4bc96a9936d269c58958d26b47846af4d3f5 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Wed, 5 Aug 2026 18:23:33 -0500
Subject: [PATCH 68/84] feat: register templates as Jamf Pro automations and
 create them in Jamf (J16, B14)

Template enable wrote tag "custom" while carrying a Jamf event, so
every enabled template was misfiled under Custom and edited against
CustomHandler's form -- which has no event field, making the trigger
that drives the automation invisible and uneditable. Nothing was
created in Jamf Pro either, with no indication the user had to build
that side by hand.

Enable now creates the webhook in Jamf Pro first and only writes
locally once Jamf accepts, so a 409 or timeout leaves no orphaned
script. Entries carry tag "jamfpro", the real event, and jamf_id, so
they file correctly and "Open in Jamf Pro" works. The enable form
gains Basic/header auth and, for any-event templates, an event picker
sourced from the same catalog the create form uses.

Catalog entries carry an explicit hook_name because Jamf rejects
webhook names containing a space and all the template titles had them.
Also XML-escapes the interpolated name and event in _build_webhook_xml
-- pre-existing on the jamfpro path, but templates newly feed
user-supplied names through it.

Enable also reuses the create path's one-shot success flash rather
than a bare success_msg. Jamf creates a smart-group webhook DISABLED,
and three bundled templates use a smart-group event, so reporting a
plain "Enabled template" for those left the user believing the
automation was already live -- the same silent-extra-step failure this
bug is about.
---
 templates/workflows/enable.html      |  51 +++++-
 tests/conftest.py                    |  33 +++-
 tests/test_template_catalog.py       |  21 ++-
 tests/test_templates.py              | 118 ++++++++++++++
 views/_type_handlers/jamf_handler.py |  23 ++-
 views/template_view.py               | 230 +++++++++++++++++++++++----
 6 files changed, 431 insertions(+), 45 deletions(-)

diff --git a/templates/workflows/enable.html b/templates/workflows/enable.html
index 61c2c2d..0a1332e 100644
--- a/templates/workflows/enable.html
+++ b/templates/workflows/enable.html
@@ -1,4 +1,5 @@
 {% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import jamf_auth_fields %}
 {% block title %}Enable {{ workflow.title }} - JAWA{% endblock %}
 {% block content %}
 <div class="container" style="max-width: 750px; padding-top: 2rem;">
@@ -16,9 +17,37 @@ <h2 style="font-size: 1.6rem; text-align: left; letter-spacing: -0.5px; margin-t
             <div class="mb-3">
                 <label for="webhook-name" class="form-label" style="font-weight: 500;">Webhook Name</label>
                 <input type="text" name="webhook_name" id="webhook-name" class="form-control"
-                       value="{{ workflow.title }}" required>
+                       pattern="[^' ']+" title="No spaces, please."
+                       value="{{ workflow.hook_name }}" required>
+                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
+                    Single string, no spaces &mdash; this becomes part of the URL Jamf Pro calls.
+                </div>
             </div>
 
+            {% if not workflow.trigger_event %}
+            <div class="mb-3">
+                <label for="template-event" class="form-label" style="font-weight: 500;">Jamf Event</label>
+                {# Same catalog and the same degrade-one-bad-group filtering the create
+                   form and the Webhook Reference use, so the three cannot drift. #}
+                {% set event_groups = (event_categories or {}).items()
+                   | selectattr('1', 'sequence') | rejectattr('1', 'string')
+                   | rejectattr('1', 'mapping') | list %}
+                <select class="form-control" name="event" id="template-event" required>
+                    <option value="">-- Select an event --</option>
+                    {% for category, events in event_groups %}
+                    <optgroup label="{{ category }}">
+                        {% for event in events %}
+                        <option value="{{ event }}">{{ event }}</option>
+                        {% endfor %}
+                    </optgroup>
+                    {% endfor %}
+                </select>
+                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
+                    This template works with any event &mdash; pick the one Jamf Pro should send.
+                </div>
+            </div>
+            {% endif %}
+
             {% if credentials %}
             <div class="mb-4">
                 <label for="credential-set" class="form-label" style="font-weight: 500;">Credential Set</label>
@@ -44,11 +73,14 @@ <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bott
             <div class="mb-3">
                 <label for="param-{{ param.key }}" class="form-label" style="font-weight: 500; font-size: 0.88rem;">{{ param.label }}</label>
                 <input type="{{ param.type or 'text' }}" name="{{ param.key }}" id="param-{{ param.key }}"
-                       class="form-control" placeholder="{{ param.placeholder }}">
+                       class="form-control" placeholder="{{ param.placeholder }}" required>
             </div>
             {% endfor %}
             {% endif %}
 
+            <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bottom: 0.75rem;">Webhook Authentication (optional)</h6>
+            {{ jamf_auth_fields() }}
+
             <div class="d-flex justify-content-center mt-4">
                 <button type="submit" class="btn btn-jawa">Enable Template</button>
             </div>
@@ -60,3 +92,18 @@ <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bott
     </div>
 </div>
 {% endblock %}
+
+{% block additional_js %}
+<script>
+{# Copied verbatim from automations/create.html rather than written afresh:
+   the jamf_auth_fields macro's radios call this, and a third divergent
+   implementation is worse than an identical duplicate. Consolidating all
+   three copies into a static JS file is tracked separately. #}
+function toggleAuthField(divId) {
+    var el = document.getElementById(divId);
+    if (el) {
+        el.style.display = el.style.display === 'none' ? 'inline-block' : 'none';
+    }
+}
+</script>
+{% endblock %}
diff --git a/tests/conftest.py b/tests/conftest.py
index 2580e64..7065925 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -59,9 +59,10 @@
 class FakeJamfResponse:
     """Minimal stand-in for requests.Response."""
 
-    def __init__(self, payload=None, status_code=200):
+    def __init__(self, payload=None, status_code=200, text=""):
         self._payload = payload if payload is not None else {}
         self.status_code = status_code
+        self.text = text
 
     def json(self):
         return self._payload
@@ -80,6 +81,11 @@ def _fake_jamf_post(url, **kwargs):
         )
     if url.endswith("/api/v1/auth/invalidate-token"):
         return FakeJamfResponse({}, status_code=204)
+    if "/JSSResource/webhooks/id/0" in url:
+        # Jamf answers webhook creation with the new object's id.
+        return FakeJamfResponse(
+            {}, status_code=201, text="<webhook><id>77</id></webhook>"
+        )
     return FakeJamfResponse({})
 
 
@@ -107,6 +113,14 @@ def fake_jamf(monkeypatch):
     )
 
 
+@pytest.fixture()
+def jamf_fake_http():
+    """Hand a test the response class and the default POST handler so it
+    can override one endpoint without re-implementing the rest.
+    """
+    return FakeJamfResponse, _fake_jamf_post
+
+
 class JawaEnv:
     """Handles to the per-test temp data layout."""
 
@@ -251,12 +265,29 @@ def _build_enable_form(slug, **overrides):
     unfilled, so a POST carrying only webhook_name is rejected by
     design. Derive the fields from the catalog so adding a config_param
     does not silently reintroduce a half-configured POST.
+
+    An any-event template (null trigger_event) has no event to inherit
+    from the catalog, so enable makes the form supply one; mirror the
+    picker by sending the first catalog event.
     """
     with open(_WORKFLOW_CONFIG, "r", encoding="utf-8") as handle:
         catalog = json.load(handle)
     workflow = next(wf for wf in catalog if wf["slug"] == slug)
 
     form = {"webhook_name": slug}
+    if not workflow.get("trigger_event"):
+        with open(
+            os.path.join(REPO_ROOT, "data", "webhook_schemas.json"),
+            "r",
+            encoding="utf-8",
+        ) as handle:
+            categories = json.load(handle)["categories"]
+        form["event"] = next(
+            event
+            for events in categories.values()
+            if isinstance(events, list)
+            for event in events
+        )
     for param in workflow.get("config_params", []):
         if param.get("type") == "number":
             value = "12"
diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
index b9edf40..adfd866 100644
--- a/tests/test_template_catalog.py
+++ b/tests/test_template_catalog.py
@@ -194,21 +194,28 @@ def test_any_event_template_never_renders_the_word_none(
 def test_enabling_an_any_event_template_stores_no_none_event(
     logged_in_client, jawa_env, enable_form
 ):
-    """The stored event is compared against the inbound payload's
-    webhookEvent, so persisting the string "None" would never match.
+    """The stored event is what gets created in Jamf Pro, so persisting
+    the string "None" -- or the "Any Event" display label -- would
+    register a trigger Jamf never sends.
+
+    Task 2 stored "" here because nothing was created in Jamf at all.
+    Enabling now creates the webhook, and Jamf requires a real event, so
+    the form asks the user to pick one and that choice is what lands.
+    The invariant is unchanged: never the word "None".
     """
     from bin import data_store
 
     slug = next(
         wf["slug"] for wf in CATALOG if wf.get("trigger_event") is None
     )
-    logged_in_client.post(
-        f"/templates/{slug}/enable",
-        data=enable_form(slug, webhook_name="any-hook"),
-    )
+    form = enable_form(slug, webhook_name="any-hook")
+    logged_in_client.post(f"/templates/{slug}/enable", data=form)
     entry = data_store.get_webhook_by_name("any-hook")
     assert entry is not None
-    assert entry["event"] == ""
+    assert entry["event"] not in ("None", "Any Event", "")
+    # The picked event, verbatim -- and a real key in the schema catalog.
+    assert entry["event"] == form["event"]
+    assert entry["event"] in _schemas()["schemas"]
 
 
 def test_script_survives_every_example_payload(workflow):
diff --git a/tests/test_templates.py b/tests/test_templates.py
index 067ffb8..f43d472 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -39,6 +39,10 @@ def test_enabled_template_writes_canonical_auth_shape(
     entry = data_store.get_webhook_by_name("dn-hook")
     assert entry is not None
     # Canonical shape: all three auth keys present, defaulting to "null".
+    # The form now offers Basic/header auth, so "open" is the
+    # unauthenticated branch of an explicit choice rather than the only
+    # thing enable could write: with no "choice" field submitted,
+    # _extract_auth_fields returns "null" for all three.
     assert entry["webhook_username"] == "null"
     assert entry["webhook_password"] == "null"
     assert entry["api_key"] == "null"
@@ -216,6 +220,120 @@ def test_substitution_rejects_a_token_no_param_declares():
         )
 
 
+def test_enable_files_the_automation_under_jamfpro(
+    logged_in_client, jawa_env
+):
+    """Templates wrote tag "custom" while carrying a Jamf event, so they
+    were misfiled under Custom and edited against a form with no event
+    field -- their trigger was invisible and uneditable (bug B14).
+    """
+    resp = logged_in_client.post(
+        "/templates/device-naming/enable",
+        data={
+            "webhook_name": "Device-Naming-by-Asset-Tag",
+            "server_url": "https://prod.jamfcloud.com",
+            "client_id": "abc",
+            "client_secret": "shh",
+        },
+    )
+    assert resp.status_code in (200, 302)
+    entry = data_store.get_webhook_by_name("Device-Naming-by-Asset-Tag")
+    assert entry is not None
+    assert entry["tag"] == "jamfpro"
+    assert entry["event"] == "MobileDeviceEnrolled"
+    assert entry["jamf_id"] == "77"
+
+
+def test_enable_writes_nothing_when_jamf_rejects(
+    logged_in_client, jawa_env, monkeypatch, jamf_fake_http
+):
+    """Jamf-side creation happens BEFORE the local write, so a 409 or a
+    timeout leaves no orphaned script and no half-configured
+    automation.
+    """
+    import requests as requests_module
+
+    response_cls, default_post = jamf_fake_http
+
+    def _conflict(url, **kwargs):
+        if "/JSSResource/webhooks/id/0" in url:
+            return response_cls({}, status_code=409, text="duplicate")
+        return default_post(url, **kwargs)
+
+    monkeypatch.setattr(requests_module, "post", _conflict)
+
+    logged_in_client.post(
+        "/templates/device-naming/enable",
+        data={
+            "webhook_name": "Device-Naming-by-Asset-Tag",
+            "server_url": "https://prod.jamfcloud.com",
+            "client_id": "abc",
+            "client_secret": "shh",
+        },
+    )
+
+    assert (
+        data_store.get_webhook_by_name("Device-Naming-by-Asset-Tag") is None
+    )
+    written = os.listdir(str(jawa_env.scripts_dir))
+    assert written == [], f"orphaned script(s) left behind: {written}"
+
+
+def test_smart_group_template_warns_it_is_not_live_yet(
+    logged_in_client, jawa_env, enable_form
+):
+    """Jamf creates a smart-group webhook DISABLED (enablement "false"),
+    so it does not fire until the admin picks a smart group in Jamf Pro.
+    Three of the bundled templates use a smart-group event. Reporting a
+    bare "Enabled template" for those leaves the user believing the
+    automation is live -- the same "no indication the user must do more"
+    failure B14 exists to close.
+    """
+    resp = logged_in_client.post(
+        "/templates/smart-group-slack/enable",
+        data=enable_form("smart-group-slack", webhook_name="sg-hook"),
+    )
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
+
+    body = logged_in_client.get("/success").get_data(as_text=True)
+    assert "not yet enabled" in body, (
+        "the success page does not warn that Jamf created the webhook "
+        "disabled; the user thinks the automation is live"
+    )
+    assert "Smart Group" in body
+
+
+def test_enable_links_to_the_new_webhook_in_jamf(
+    logged_in_client, jawa_env, enable_form
+):
+    """jamf_id is captured, so the success page can deep-link the object
+    the way the create path does.
+    """
+    logged_in_client.post(
+        "/templates/device-naming/enable",
+        data=enable_form("device-naming", webhook_name="dn-link-hook"),
+    )
+    body = logged_in_client.get("/success").get_data(as_text=True)
+    assert "/webhooks.html?id=77" in body
+
+
+def test_enable_rejects_a_name_with_spaces(logged_in_client, jawa_env):
+    """The name goes into the callback URL Jamf calls; Jamf rejects
+    names containing a space.
+    """
+    logged_in_client.post(
+        "/templates/device-naming/enable",
+        data={
+            "webhook_name": "Device Naming by Asset Tag",
+            "server_url": "https://prod.jamfcloud.com",
+            "client_id": "abc",
+            "client_secret": "shh",
+        },
+    )
+    assert data_store.get_webhook_by_name("Device Naming by Asset Tag") is None
+
+
 def test_template_view_has_no_direct_webhook_io():
     import inspect
     from views import template_view
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index d5d8adf..7f9274b 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -70,6 +70,22 @@
 )
 
 
+def xml_escape(value: str) -> str:
+    """Escape a value interpolated into the webhook XML body.
+
+    The XML is hand-built with f-strings, so an unescaped & or < in a
+    webhook name produces a malformed body that Jamf rejects with an
+    opaque error.
+    """
+    return (
+        str(value)
+        .replace("&", "&amp;")
+        .replace("<", "&lt;")
+        .replace(">", "&gt;")
+        .replace('"', "&quot;")
+    )
+
+
 def _build_auth_xml(form: Any) -> str:
     auth_xml = "<authentication_type>NONE</authentication_type>"
     if form.get("choice") == "basic":
@@ -93,13 +109,14 @@ def _build_webhook_xml(
     auth_xml: str,
     extra_xml: str,
 ) -> str:
+    safe_name = xml_escape(name)
     return (
         f"<webhook>"
-        f"<name>{name}</name>"
+        f"<name>{safe_name}</name>"
         f"<enabled>{enabled}</enabled>"
-        f"<url>{server_address}/hooks/{name}</url>"
+        f"<url>{server_address}/hooks/{safe_name}</url>"
         f"<content_type>application/json</content_type>"
-        f"<event>{event}</event>"
+        f"<event>{xml_escape(event)}</event>"
         f"{auth_xml}"
         f"{extra_xml}"
         f"</webhook>"
diff --git a/views/template_view.py b/views/template_view.py
index fff2a61..cbea3d5 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -32,6 +32,7 @@
 import re
 from typing import Any, Dict, List, Union
 
+import requests
 from flask import (
     Blueprint,
     Response,
@@ -46,8 +47,19 @@
 from werkzeug.utils import secure_filename
 
 from bin import data_store, logger
+from bin.data_store import get_jawa_address, get_webhook_schemas
+from bin.tokens import get_token, validate_token
 from bin.view_modifiers import response
 from views._type_handlers.base import AutomationError
+from views._type_handlers.jamf_handler import (
+    USER_AGENT_STRING,
+    VERIFY_SSL,
+    XML,
+    _build_auth_xml,
+    _build_webhook_xml,
+    _extract_auth_fields,
+    _smart_group_info,
+)
 
 blueprint = Blueprint(
     "template_view",
@@ -349,6 +361,73 @@ def _write_script(name: str, content: str) -> str:
     return dest_path
 
 
+def _create_jamf_webhook(webhook_name: str, xml_data: str) -> str:
+    """Create the webhook in Jamf Pro and return its id.
+
+    Runs before any local write: if Jamf rejects the webhook there is
+    no orphaned script on disk and no half-configured automation.
+    """
+    full_url = session["url"] + "/JSSResource/webhooks/id/0"
+    try:
+        resp = requests.post(
+            full_url,
+            headers={
+                "Content-Type": XML,
+                "Authorization": f"Bearer {session['token']}",
+                "User-Agent": USER_AGENT_STRING,
+            },
+            data=xml_data,
+            verify=VERIFY_SSL,
+            timeout=30,
+        )
+    except requests.exceptions.Timeout as err:
+        logthis.error(
+            f"Timeout creating Jamf webhook {webhook_name}: {err}"
+        )
+        raise AutomationError(
+            "Connection Timeout",
+            f"Request to Jamf Pro timed out after 30 seconds. {err}",
+        )
+    except requests.exceptions.ConnectionError as err:
+        logthis.error(
+            f"Connection error creating Jamf webhook {webhook_name}: {err}"
+        )
+        raise AutomationError(
+            "Connection Error",
+            f"Could not connect to Jamf Pro. {err}",
+        )
+    except Exception as err:
+        logthis.error(
+            f"Unexpected error creating Jamf webhook {webhook_name}: {err}"
+        )
+        raise AutomationError(
+            "API Error", f"Failed to create the webhook in Jamf Pro. {err}"
+        )
+
+    if resp.status_code == 409:
+        logthis.error(
+            f"Duplicate webhook name {webhook_name} in Jamf Pro (409)"
+        )
+        raise AutomationError(
+            "Duplicate",
+            f'The webhook name "{webhook_name}" already exists in your '
+            f"Jamf Pro Server.",
+        )
+    if resp.status_code >= 400:
+        logthis.error(
+            f"Jamf API error creating webhook {webhook_name}: "
+            f"HTTP {resp.status_code} - {resp.text}"
+        )
+        raise AutomationError(
+            "API Error",
+            f"Jamf Pro returned HTTP {resp.status_code}. Check the "
+            f"API privileges on your account and try again.",
+        )
+
+    found = re.search("<id>(.*)</id>", resp.text)
+    return found.group(1) if found else ""
+
+
 def _validate_package(package: dict) -> Union[str, None]:
     """Validate a .jawa.json package. Returns error message or None."""
     for field in ("name", "trigger", "script"):
@@ -532,64 +611,151 @@ def enable_template(slug: str) -> Union[Response, str]:
             username=session.get("username"),
             workflow=workflow,
             credentials=credentials,
+            event_categories=get_webhook_schemas()["categories"],
         )
 
     # POST: enable the template
-    webhook_name = str(
-        escape(request.form.get("webhook_name", workflow["title"]))
-    )
+    try:
+        webhook_name = request.form.get(
+            "webhook_name", workflow["hook_name"]
+        ).strip()
+        if not webhook_name:
+            raise AutomationError("Error", "Webhook name is required.")
+        if " " in webhook_name:
+            raise AutomationError(
+                "Error",
+                "Single-string name only -- the name becomes part of "
+                "the URL Jamf Pro calls.",
+            )
+        # The name is interpolated into the webhook XML body and into
+        # the callback URL. xml_escape() covers the XML; these
+        # characters would still break the URL, so reject them here.
+        # Same rule the catalog test applies to hook_name, since a user
+        # can type anything into this field.
+        for bad in ("&", "<", ">", '"', "'", "/", "\\"):
+            if bad in webhook_name:
+                raise AutomationError(
+                    "Error",
+                    f"The webhook name may not contain {bad!r}.",
+                )
+        if data_store.get_webhook_by_name(webhook_name):
+            raise AutomationError(
+                "Error", f'The name "{webhook_name}" is already in use.'
+            )
 
-    src_path = os.path.join(TEMPLATE_SCRIPTS_DIR, workflow["script_file"])
-    if not os.path.isfile(src_path):
+        # trigger_event is null for any-event templates: the form asks.
+        event = workflow.get("trigger_event") or request.form.get(
+            "event", ""
+        )
+        if not event:
+            raise AutomationError(
+                "Error", "Choose the Jamf Pro event to listen for."
+            )
+
+        server_address = get_jawa_address()
+        if not server_address:
+            raise AutomationError(
+                "Setup Required",
+                "Configure your JAWA address and Jamf Pro server "
+                "before enabling a template.",
+                link="/setup",
+                link_text="Go to Setup",
+            )
+
+        src_path = os.path.join(
+            TEMPLATE_SCRIPTS_DIR, workflow["script_file"]
+        )
+        if not os.path.isfile(src_path):
+            raise AutomationError(
+                "Script not found",
+                f"Script {workflow['script_file']} not found.",
+            )
+        with open(src_path, "r", encoding="utf-8") as f:
+            script_content = f.read()
+
+        # Fill every token BEFORE touching Jamf, so a missing field
+        # fails before any remote state is created.
+        script_content = substitute_params(
+            script_content,
+            workflow,
+            request.form,
+            credentials,
+            request.form.get("credential_set", ""),
+        )
+
+        if not validate_token(session.get("expires")):
+            get_token()
+
+        notice, instructions, enablement, extra_xml = _smart_group_info(
+            event
+        )
+        auth_xml = _build_auth_xml(request.form)
+        (
+            webhook_user,
+            webhook_pass,
+            webhook_apikey,
+            extra_notice,
+            custom_header,
+        ) = _extract_auth_fields(request.form)
+
+        xml_data = _build_webhook_xml(
+            webhook_name,
+            enablement,
+            server_address,
+            event,
+            auth_xml,
+            extra_xml,
+        )
+        jamf_id = _create_jamf_webhook(webhook_name, xml_data)
+    except AutomationError as err:
         return redirect(
             url_for(
                 "error",
-                error="Script not found",
-                error_message=f"Script {workflow['script_file']} not found.",
+                error=err.title,
+                error_message=err.message,
             )
         )
 
-    with open(src_path, "r", encoding="utf-8") as f:
-        script_content = f.read()
-
-    script_content = substitute_params(
-        script_content,
-        workflow,
-        request.form,
-        credentials,
-        request.form.get("credential_set", ""),
-    )
+    # Jamf accepted it: only now write anything locally.
     dest_path = _write_script(webhook_name, script_content)
-
     data_store.add_webhook(
         {
             "name": webhook_name,
-            "tag": "custom",
+            "tag": "jamfpro",
             "url": session.get("url", ""),
-            # null trigger_event means any-event; store "" rather than
-            # the string "None", which no payload would ever match.
-            "event": workflow.get("trigger_event") or "",
+            "jawa_admin": session.get("username", ""),
+            "event": event,
             "script": dest_path,
             "description": workflow.get("description", ""),
             "enabled": True,
-            "webhook_username": "null",
-            "webhook_password": "null",
-            "api_key": "null",
+            "jamf_id": jamf_id,
+            "webhook_username": webhook_user,
+            "webhook_password": webhook_pass,
+            "api_key": webhook_apikey,
         }
     )
 
     logthis.info(
         f"[{session.get('url')}] {session.get('username')} "
         f"enabled template: {webhook_name} "
-        f"(script: {os.path.basename(dest_path)})"
+        f"(script: {os.path.basename(dest_path)}, jamf id: {jamf_id})"
     )
 
-    return redirect(
-        url_for(
-            "success",
-            success_msg=f"Enabled template: {webhook_name}",
-        )
-    )
+    # Same one-shot flash + PRG the create path uses, so the notices
+    # survive the redirect. A smart-group event is created DISABLED in
+    # Jamf Pro, so reporting a bare "Enabled" for those three templates
+    # would leave the user believing the automation is already live.
+    ctx = {
+        "success_msg": f"Enabled template: {webhook_name}",
+        "new_link": f"{session.get('url')}/webhooks.html?id={jamf_id}&o=r",
+        "new_here": webhook_name,
+        "smart_group_notice": notice,
+        "smart_group_instructions": instructions,
+        "extra_notice": extra_notice,
+        "custom_header": custom_header,
+    }
+    session["success_ctx"] = {k: v for k, v in ctx.items() if v}
+    return redirect(url_for("success"))
 
 
 @blueprint.route("/templates/import", methods=["GET", "POST"])

From e4587af5f2830002b8bace5ad1155cc63d48babf Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 6 Aug 2026 09:50:34 -0500
Subject: [PATCH 69/84] fix: stop enable writing auth values that lock the
 webhook out (J16, B14 review round 1)

Review fixes on top of d5ba4bc.

_extract_auth_fields used form.get(key, "null"), but a get() default only
fires when the key is ABSENT. The auth fields are labelled optional, so
picking Basic or Header auth and leaving the boxes blank posts "" -- which
was then stored verbatim while _build_auth_xml told Jamf NONE. The receiver
defaults an unauthenticated request to the string "null", so "null" != ""
made validate_webhook reject every inbound event, permanently, behind a
success page that said "Enabled". Reproduced as a 401 before the fix.

Also in this round:

- Template config params are now marked required only when a saved
  credential set cannot supply them. Selecting a credential set fills
  server_url/client_id/client_secret server-side and nothing populates
  them in the browser, so requiring them blocked submit until the admin
  retyped the client secret. CREDENTIAL_KEYS is passed into the template
  rather than duplicated in Jinja.
- Webhook-name validation is one shared rule (validate_webhook_name) used
  by both the create path and the template path, and is a positive
  character rule instead of a blocklist. xml_escape now makes "Dev&Prod"
  well-formed XML, so Jamf would accept it and then call /hooks/Dev&Prod
  -- which Flask routes to "Dev" with "Prod" as a query param, silently
  never firing. The old blocklist also missed "#", "?", "%" and tabs.
- The stored "enabled" flag mirrors what Jamf actually did: a smart-group
  event is created with enablement "false", so a flat True made the local
  record contradict the remote object.
- The success flash reuses automation_view._flash_success instead of a
  near-copy with a divergent filter.
- Four inline styles in enable.html moved to token-based CSS classes.

Tests: adds the anti-drift coverage for the event picker, the prefilled
hook_name, and the zero-POST ordering guarantee (a config JAWA refuses
must not leave an orphan webhook in the customer's Jamf Pro), plus the
blank-auth regression above and both sides of the enabled flag. Replaces
a try/except that would have let a 500 pass as success with an assertion
that the redirect lands on /error.
---
 static/css/main.css                  |  20 +++
 templates/workflows/enable.html      |  18 ++-
 tests/test_templates.py              | 213 +++++++++++++++++++++++++--
 views/_type_handlers/jamf_handler.py |  44 +++++-
 views/template_view.py               |  67 ++++-----
 5 files changed, 306 insertions(+), 56 deletions(-)

diff --git a/static/css/main.css b/static/css/main.css
index 1d04052..e362726 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -1152,6 +1152,26 @@ a.btn-hero-secondary:visited {
     color: #fff;
 }
 
+/* Template enable form: field labels, helper text and section headings.
+   The rest of enable.html still carries inline styles predating the
+   tokens-only rule; these classes cover the fields added with the Jamf
+   Pro registration work so no new inline styles ship. */
+.enable-field-label {
+    font-weight: 500;
+}
+
+.enable-field-hint {
+    color: var(--color-text-muted);
+    font-size: 0.82rem;
+}
+
+.enable-section-heading {
+    font-weight: 600;
+    font-size: 0.92rem;
+    margin-top: 1.5rem;
+    margin-bottom: 0.75rem;
+}
+
 .workflow-detail-sidebar {
     background: var(--color-surface);
     border: 1px solid var(--color-border);
diff --git a/templates/workflows/enable.html b/templates/workflows/enable.html
index 0a1332e..eb95c57 100644
--- a/templates/workflows/enable.html
+++ b/templates/workflows/enable.html
@@ -19,14 +19,14 @@ <h2 style="font-size: 1.6rem; text-align: left; letter-spacing: -0.5px; margin-t
                 <input type="text" name="webhook_name" id="webhook-name" class="form-control"
                        pattern="[^' ']+" title="No spaces, please."
                        value="{{ workflow.hook_name }}" required>
-                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
+                <div class="form-text enable-field-hint">
                     Single string, no spaces &mdash; this becomes part of the URL Jamf Pro calls.
                 </div>
             </div>
 
             {% if not workflow.trigger_event %}
             <div class="mb-3">
-                <label for="template-event" class="form-label" style="font-weight: 500;">Jamf Event</label>
+                <label for="template-event" class="form-label enable-field-label">Jamf Event</label>
                 {# Same catalog and the same degrade-one-bad-group filtering the create
                    form and the Webhook Reference use, so the three cannot drift. #}
                 {% set event_groups = (event_categories or {}).items()
@@ -42,7 +42,7 @@ <h2 style="font-size: 1.6rem; text-align: left; letter-spacing: -0.5px; margin-t
                     </optgroup>
                     {% endfor %}
                 </select>
-                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
+                <div class="form-text enable-field-hint">
                     This template works with any event &mdash; pick the one Jamf Pro should send.
                 </div>
             </div>
@@ -72,13 +72,21 @@ <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bott
             {% for param in workflow.config_params %}
             <div class="mb-3">
                 <label for="param-{{ param.key }}" class="form-label" style="font-weight: 500; font-size: 0.88rem;">{{ param.label }}</label>
+                {# Required only when a saved credential set cannot supply
+                   this field. The Credential Set dropdown above fills the
+                   credential keys and nothing populates them client-side,
+                   so requiring them would block submit until the admin
+                   retyped the client secret -- and the server already
+                   prefers the saved credential over anything typed. This
+                   mirrors that server-side rule. #}
                 <input type="{{ param.type or 'text' }}" name="{{ param.key }}" id="param-{{ param.key }}"
-                       class="form-control" placeholder="{{ param.placeholder }}" required>
+                       class="form-control" placeholder="{{ param.placeholder }}"
+                       {% if param.key not in (credential_keys or []) %}required{% endif %}>
             </div>
             {% endfor %}
             {% endif %}
 
-            <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bottom: 0.75rem;">Webhook Authentication (optional)</h6>
+            <h6 class="enable-section-heading">Webhook Authentication (optional)</h6>
             {{ jamf_auth_fields() }}
 
             <div class="d-flex justify-content-center mt-4">
diff --git a/tests/test_templates.py b/tests/test_templates.py
index f43d472..a60994f 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -48,6 +48,67 @@ def test_enabled_template_writes_canonical_auth_shape(
     assert entry["api_key"] == "null"
 
 
+# The auth fields are labelled optional, so picking a radio and leaving
+# the boxes blank is an expected action -- and the form makes that branch
+# reachable for the first time from the enable path.
+BLANK_AUTH_SUBMISSIONS = [
+    ({"choice": "basic", "basic_username": "", "basic_password": ""}),
+    ({"choice": "basic", "basic_username": "", "basic_password": "pw"}),
+    ({"choice": "custom", "api_key": ""}),
+]
+
+
+@pytest.mark.parametrize("auth_fields", BLANK_AUTH_SUBMISSIONS)
+def test_blank_auth_field_does_not_lock_the_webhook_out(
+    logged_in_client, jawa_env, enable_form, auth_fields
+):
+    """A submitted-but-empty auth input posts "", which the get()
+    default never replaced. _build_auth_xml then told Jamf NONE while
+    the stored value stayed "", and the receiver defaults an
+    unauthenticated request to "null" -- so "null" != "" made
+    validate_webhook reject EVERY inbound event, permanently, behind a
+    success page that said "Enabled".
+    """
+    from webhook import jawa_receiver
+
+    form = enable_form("device-naming", webhook_name="blank-auth-hook")
+    form.update(auth_fields)
+    logged_in_client.post("/templates/device-naming/enable", data=form)
+
+    entry = data_store.get_webhook_by_name("blank-auth-hook")
+    assert entry is not None
+    # No stored auth credential may ever be the empty string: the
+    # receiver's no-auth sentinel is the string "null".
+    for key in ("webhook_username", "webhook_password", "api_key"):
+        assert entry[key] != "", f"{key} stored as an empty string"
+
+    # The assertion with the teeth: an unauthenticated inbound request
+    # (the receiver's "null" x3 default) must still validate for any
+    # field the user left blank.
+    expected = {
+        "webhook_username": "null",
+        "webhook_password": "null",
+        "api_key": "null",
+    }
+    for key, value in expected.items():
+        if entry[key] != value:
+            # A field the user actually filled in: auth is genuinely on,
+            # so an unauthenticated request SHOULD be refused.
+            break
+    else:
+        assert jawa_receiver.validate_webhook(
+            "blank-auth-hook", "null", "null", "null"
+        ), "an all-blank auth choice locked the webhook out"
+        resp = logged_in_client.post(
+            "/hooks/blank-auth-hook",
+            json={"webhook": {"webhookEvent": "MobileDeviceEnrolled"}},
+        )
+        assert resp.status_code == 200, (
+            f"inbound event rejected {resp.status_code}; the webhook is "
+            f"permanently locked out"
+        )
+
+
 def test_enabled_template_webhook_fires(
     logged_in_client, jawa_env, fake_popen, enable_form
 ):
@@ -104,15 +165,15 @@ def test_enable_with_a_field_left_blank_deploys_nothing(
     """
     form = enable_form("teams-notification", webhook_name="blank-hook")
     form["TEAMS_WEBHOOK_URL"] = ""
-    try:
-        logged_in_client.post(
-            "/templates/teams-notification/enable", data=form
-        )
-    except Exception:
-        # Task 5 adds the try/except that renders the error page; until
-        # then the AutomationError propagates. Either way nothing must
-        # be written.
-        pass
+    resp = logged_in_client.post(
+        "/templates/teams-notification/enable", data=form
+    )
+    # The route now catches AutomationError and renders the error page.
+    # Asserting that explicitly, rather than swallowing whatever comes
+    # back: a 500 from an unrelated regression would otherwise satisfy
+    # "nothing was written" and pass silently.
+    assert resp.status_code == 302
+    assert "/error" in resp.headers["Location"]
     assert data_store.get_webhook_by_name("blank-hook") is None
     assert not os.listdir(str(jawa_env.scripts_dir))
 
@@ -303,6 +364,26 @@ def test_smart_group_template_warns_it_is_not_live_yet(
     )
     assert "Smart Group" in body
 
+    # And the stored record must agree with the remote object: Jamf
+    # created this one with enablement "false", so a flat True here
+    # would make any future "is it live?" read lie.
+    entry = data_store.get_webhook_by_name("sg-hook")
+    assert entry["enabled"] is False
+
+
+def test_non_smart_group_template_is_stored_enabled(
+    logged_in_client, jawa_env, enable_form
+):
+    """The other side of the same rule: a normal event is created
+    enabled, so the flag must not be blanket-false either.
+    """
+    logged_in_client.post(
+        "/templates/device-naming/enable",
+        data=enable_form("device-naming", webhook_name="live-hook"),
+    )
+    entry = data_store.get_webhook_by_name("live-hook")
+    assert entry["enabled"] is True
+
 
 def test_enable_links_to_the_new_webhook_in_jamf(
     logged_in_client, jawa_env, enable_form
@@ -334,6 +415,120 @@ def test_enable_rejects_a_name_with_spaces(logged_in_client, jawa_env):
     assert data_store.get_webhook_by_name("Device Naming by Asset Tag") is None
 
 
+def test_any_event_template_offers_a_real_event_to_pick(
+    logged_in_client, jawa_env
+):
+    """teams-notification declares trigger_event null, so the server
+    rejects the POST unless the form supplies an event. Without the
+    picker the page is a dead end: every submit hits "Choose the Jamf
+    Pro event to listen for." with no field to satisfy it.
+    """
+    with open(
+        os.path.join(
+            os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            "data",
+            "webhook_schemas.json",
+        ),
+        "r",
+        encoding="utf-8",
+    ) as handle:
+        schemas = json.load(handle)
+
+    body = logged_in_client.get(
+        "/templates/teams-notification/enable"
+    ).get_data(as_text=True)
+    assert 'name="event"' in body, "the any-event template has no picker"
+    # Real schema keys, not invented labels: the value is sent to Jamf.
+    assert any(f'value="{event}"' in body for event in schemas["schemas"])
+
+
+def test_fixed_event_template_does_not_offer_a_picker(
+    logged_in_client, jawa_env
+):
+    """The other six templates hard-declare their trigger. Offering a
+    picker there would let the admin choose an event the script cannot
+    parse, and the server ignores the field anyway.
+    """
+    body = logged_in_client.get(
+        "/templates/device-naming/enable"
+    ).get_data(as_text=True)
+    assert 'name="event"' not in body
+    assert "MobileDeviceEnrolled" in body
+
+
+def test_enable_form_prefills_a_name_jamf_will_accept(
+    logged_in_client, jawa_env
+):
+    """The field used to default to the human title, which contains
+    spaces -- so the prefilled value was one the server now rejects
+    outright. It must come from the catalog's hook_name (Task 2).
+    """
+    import re
+
+    catalog_path = os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+        "data",
+        "workflows",
+        "workflow_config.json",
+    )
+    with open(catalog_path, "r", encoding="utf-8") as handle:
+        catalog = json.load(handle)
+
+    for workflow in catalog:
+        body = logged_in_client.get(
+            f"/templates/{workflow['slug']}/enable"
+        ).get_data(as_text=True)
+        match = re.search(
+            r'name="webhook_name"[^>]*?value="([^"]*)"', body, re.S
+        )
+        assert match, f"{workflow['slug']}: no prefilled name field"
+        value = match.group(1)
+        assert value == workflow["hook_name"], (
+            f"{workflow['slug']}: form prefills {value!r}, catalog says "
+            f"{workflow['hook_name']!r}"
+        )
+        assert " " not in value
+
+
+def test_a_rejected_config_never_reaches_jamf(
+    logged_in_client, jawa_env, monkeypatch, jamf_fake_http, enable_form
+):
+    """Ordering is the whole point: substitution runs BEFORE the Jamf
+    POST, so a config substitute_params refuses cannot leave an orphan
+    webhook in the customer's Jamf Pro that JAWA has no record of and
+    the admin has to find and delete by hand.
+    """
+    import requests as requests_module
+
+    _, default_post = jamf_fake_http
+    creations = []
+
+    def _counting_post(url, **kwargs):
+        if "/JSSResource/webhooks/id/0" in url:
+            creations.append(url)
+        return default_post(url, **kwargs)
+
+    monkeypatch.setattr(requests_module, "post", _counting_post)
+
+    # COOLDOWN_HOURS is the one numeric token: it is written bare into
+    # an expression position, so _numeric_literal refuses a non-number
+    # instead of deploying a script that will not compile.
+    form = enable_form("event-tracker-sqlite", webhook_name="reject-hook")
+    form["COOLDOWN_HOURS"] = "twelve"
+    resp = logged_in_client.post(
+        "/templates/event-tracker-sqlite/enable", data=form
+    )
+
+    assert resp.status_code == 302
+    assert "/error" in resp.headers["Location"]
+    assert creations == [], (
+        f"{len(creations)} webhook(s) created in Jamf Pro for a config "
+        f"JAWA then refused -- each one is an orphan"
+    )
+    assert data_store.get_webhook_by_name("reject-hook") is None
+    assert not os.listdir(str(jawa_env.scripts_dir))
+
+
 def test_template_view_has_no_direct_webhook_io():
     import inspect
     from views import template_view
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index 7f9274b..ad1f7d3 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -86,6 +86,29 @@ def xml_escape(value: str) -> str:
     )
 
 
+# A webhook name is interpolated into the XML body AND into the callback
+# URL Jamf calls. A positive rule, not a blocklist: xml_escape() makes
+# "Dev&Prod" well-formed XML, so Jamf then calls /hooks/Dev&Prod, and
+# Flask's /hooks/<webhook_name> route matches "Dev" with "Prod" as a
+# query param -- the webhook silently never fires. A blocklist also
+# missed "#", "?", "%" and an interior tab (`" " in name` catches none of
+# those). Same argument _raw_literal makes in template_view.
+WEBHOOK_NAME_RE = re.compile(r"[A-Za-z0-9._-]+")
+
+WEBHOOK_NAME_RULE = (
+    "Use only letters, numbers, dots, underscores and hyphens -- the "
+    "name becomes part of the URL Jamf Pro calls."
+)
+
+
+def validate_webhook_name(name: str) -> None:
+    """Raise AutomationError unless the name is URL- and XML-safe."""
+    if not name:
+        raise AutomationError("Error", "Webhook name is required.")
+    if not WEBHOOK_NAME_RE.fullmatch(name):
+        raise AutomationError("Error", WEBHOOK_NAME_RULE)
+
+
 def _build_auth_xml(form: Any) -> str:
     auth_xml = "<authentication_type>NONE</authentication_type>"
     if form.get("choice") == "basic":
@@ -144,15 +167,22 @@ def _smart_group_info(event: str) -> Tuple[str, str, str, str]:
 
 def _extract_auth_fields(form: Any) -> Tuple[str, str, str, Any, Any]:
     """Extract auth fields from form. Returns (user, pass, apikey, extra_notice, custom_header)."""
+    # `or "null"`, not a get() default: the default only fires when the
+    # key is ABSENT, but a submitted-yet-empty input posts "". Since the
+    # auth fields are labelled optional, picking a radio and leaving the
+    # boxes blank is expected -- and storing "" there meant
+    # _build_auth_xml told Jamf NONE while validate_webhook compared the
+    # receiver's "null" default against "", so every inbound event was
+    # rejected 401 forever behind a success page saying "Enabled".
     if form.get("choice") == "basic":
-        webhook_user = form.get("basic_username", "null")
-        webhook_pass = form.get("basic_password", "null")
+        webhook_user = form.get("basic_username") or "null"
+        webhook_pass = form.get("basic_password") or "null"
     else:
         webhook_user = "null"
         webhook_pass = "null"
 
     if form.get("choice") == "custom":
-        webhook_apikey = form.get("api_key", "null")
+        webhook_apikey = form.get("api_key") or "null"
         extra_notice = (
             "Copy and paste the following into the Header "
             "Authentication section of Jamf Pro webhooks:"
@@ -198,10 +228,10 @@ def process_create(
         event = form.get("event", "")
         description = form.get("description", "")
 
-        if not webhook_name:
-            raise AutomationError("Error", "Webhook name is required.")
-        if " " in webhook_name:
-            raise AutomationError("Error", "Single-string name only.")
+        # Was `" " in webhook_name` only. xml_escape() now makes a name
+        # containing "&" or "<" well-formed XML, which turned a visible
+        # Jamf API error into a webhook Jamf creates but can never reach.
+        validate_webhook_name(webhook_name)
 
         server_address = get_jawa_address()
         if not server_address:
diff --git a/views/template_view.py b/views/template_view.py
index cbea3d5..887cb4e 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -59,8 +59,14 @@
     _build_webhook_xml,
     _extract_auth_fields,
     _smart_group_info,
+    validate_webhook_name,
 )
 
+# Reused, not re-implemented: the one-shot success flash has to behave
+# identically on the template path and the create path, or the two drift
+# on which context keys survive the redirect.
+from views.automation_view import _flash_success
+
 blueprint = Blueprint(
     "template_view",
     __name__,
@@ -612,6 +618,10 @@ def enable_template(slug: str) -> Union[Response, str]:
             workflow=workflow,
             credentials=credentials,
             event_categories=get_webhook_schemas()["categories"],
+            # Passed, not hardcoded in Jinja: the template marks a param
+            # required only when a credential set cannot supply it, and
+            # duplicating the three key names there would drift.
+            credential_keys=CREDENTIAL_KEYS,
         )
 
     # POST: enable the template
@@ -619,25 +629,9 @@ def enable_template(slug: str) -> Union[Response, str]:
         webhook_name = request.form.get(
             "webhook_name", workflow["hook_name"]
         ).strip()
-        if not webhook_name:
-            raise AutomationError("Error", "Webhook name is required.")
-        if " " in webhook_name:
-            raise AutomationError(
-                "Error",
-                "Single-string name only -- the name becomes part of "
-                "the URL Jamf Pro calls.",
-            )
-        # The name is interpolated into the webhook XML body and into
-        # the callback URL. xml_escape() covers the XML; these
-        # characters would still break the URL, so reject them here.
-        # Same rule the catalog test applies to hook_name, since a user
-        # can type anything into this field.
-        for bad in ("&", "<", ">", '"', "'", "/", "\\"):
-            if bad in webhook_name:
-                raise AutomationError(
-                    "Error",
-                    f"The webhook name may not contain {bad!r}.",
-                )
+        # Shared with the jamfpro create path so the two cannot diverge:
+        # the name goes into the XML body and into the callback URL.
+        validate_webhook_name(webhook_name)
         if data_store.get_webhook_by_name(webhook_name):
             raise AutomationError(
                 "Error", f'The name "{webhook_name}" is already in use.'
@@ -727,7 +721,12 @@ def enable_template(slug: str) -> Union[Response, str]:
             "event": event,
             "script": dest_path,
             "description": workflow.get("description", ""),
-            "enabled": True,
+            # Mirror what Jamf actually did, not what we asked for: a
+            # smart-group event is created with enablement "false" and
+            # does not fire until the admin picks a Smart Group. Writing
+            # a flat True would make the stored record disagree with the
+            # remote object the notice below warns about.
+            "enabled": enablement == "true",
             "jamf_id": jamf_id,
             "webhook_username": webhook_user,
             "webhook_password": webhook_pass,
@@ -741,21 +740,19 @@ def enable_template(slug: str) -> Union[Response, str]:
         f"(script: {os.path.basename(dest_path)}, jamf id: {jamf_id})"
     )
 
-    # Same one-shot flash + PRG the create path uses, so the notices
-    # survive the redirect. A smart-group event is created DISABLED in
-    # Jamf Pro, so reporting a bare "Enabled" for those three templates
-    # would leave the user believing the automation is already live.
-    ctx = {
-        "success_msg": f"Enabled template: {webhook_name}",
-        "new_link": f"{session.get('url')}/webhooks.html?id={jamf_id}&o=r",
-        "new_here": webhook_name,
-        "smart_group_notice": notice,
-        "smart_group_instructions": instructions,
-        "extra_notice": extra_notice,
-        "custom_header": custom_header,
-    }
-    session["success_ctx"] = {k: v for k, v in ctx.items() if v}
-    return redirect(url_for("success"))
+    # The create path's own one-shot flash + PRG, so the notices survive
+    # the redirect. A smart-group event is created DISABLED in Jamf Pro,
+    # so reporting a bare "Enabled" for those three templates would
+    # leave the user believing the automation is already live.
+    return _flash_success(
+        success_msg=f"Enabled template: {webhook_name}",
+        new_link=f"{session.get('url')}/webhooks.html?id={jamf_id}&o=r",
+        new_here=webhook_name,
+        smart_group_notice=notice,
+        smart_group_instructions=instructions,
+        extra_notice=extra_notice,
+        custom_header=custom_header,
+    )
 
 
 @blueprint.route("/templates/import", methods=["GET", "POST"])

From e7a0582d0d74b805311128af624bb3b94f365155 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Fri, 7 Aug 2026 09:54:39 -0500
Subject: [PATCH 70/84] test: guard the canonical API block against drift (J16)

The bundled scripts stay self-contained so a user can download one and
run it standalone, which means the Jamf API block is duplicated rather
than imported. That is only safe while the copies stay byte-identical,
so assert it.

Also pins the shebang and the executable bit, as two separate
invariants rather than one. The shebang is the load-bearing half: this
directory is the shipped template SOURCE, and enable copies its content
verbatim into the deployed scripts dir, which the receiver execs with a
bare Popen and no interpreter prefix -- so a template missing its
shebang yields a deployed script the kernel cannot start. The exec bit
on the source is not what the receiver depends on, since the deploy
step chmods its own output; it is asserted for the standalone-download
promise, and the receiver-facing invariant now has its own test that
the deployed copy really is 0o755.

The B15 payload replay was vacuous for the script that motivated it.
Pinned to its own trigger_event, event-tracker-sqlite only ever saw
ComputerCheckIn, whose example carries no "computer" key at all, so the
nested-dict branch never ran and the boolean case -- the actual bug --
went untested. The replay is now every example payload against every
script, which is also the honest contract: the trigger lives in Jamf
Pro, where an admin can point any event at any JAWA webhook. A
companion test asserts some example still sets event.computer to a
bool, so the replay cannot go quietly vacuous again.

_device_field additionally tolerates a non-dict event body in both
scripts that define it. Nothing Jamf sends looks like that and both
call sites already do event_data.get("event", {}), so this is hardening
rather than a fix -- but the body is JSON off the wire and these
scripts run unattended, where a TypeError is just a non-zero exit code
in a log rather than anything a user sees.

Finally, pytest.ini silences one environmental import-time warning from
requests about its urllib3/chardet version ranges, matched on the
message so resolving it does not require importing the module that
emits it, and so a different version mismatch still surfaces. The full
suite now runs clean with no warnings.
---
 data/workflows/scripts/device_naming.py       |   0
 data/workflows/scripts/ea_update.py           |   0
 .../workflows/scripts/event_tracker_sqlite.py |   9 +
 data/workflows/scripts/return_to_service.py   |   0
 data/workflows/scripts/smart_group_appletv.py |   0
 data/workflows/scripts/smart_group_slack.py   |   0
 data/workflows/scripts/teams_notification.py  |   9 +
 pytest.ini                                    |  20 +++
 tests/test_template_catalog.py                | 169 ++++++++++++++++--
 9 files changed, 196 insertions(+), 11 deletions(-)
 mode change 100644 => 100755 data/workflows/scripts/device_naming.py
 mode change 100644 => 100755 data/workflows/scripts/ea_update.py
 mode change 100644 => 100755 data/workflows/scripts/event_tracker_sqlite.py
 mode change 100644 => 100755 data/workflows/scripts/return_to_service.py
 mode change 100644 => 100755 data/workflows/scripts/smart_group_appletv.py
 mode change 100644 => 100755 data/workflows/scripts/smart_group_slack.py
 mode change 100644 => 100755 data/workflows/scripts/teams_notification.py

diff --git a/data/workflows/scripts/device_naming.py b/data/workflows/scripts/device_naming.py
old mode 100644
new mode 100755
diff --git a/data/workflows/scripts/ea_update.py b/data/workflows/scripts/ea_update.py
old mode 100644
new mode 100755
diff --git a/data/workflows/scripts/event_tracker_sqlite.py b/data/workflows/scripts/event_tracker_sqlite.py
old mode 100644
new mode 100755
index 09186fe..1d0a114
--- a/data/workflows/scripts/event_tracker_sqlite.py
+++ b/data/workflows/scripts/event_tracker_sqlite.py
@@ -23,7 +23,16 @@ def _device_field(event, key, default="Unknown"):
     BOOLEAN rather than a nested object, so a bare
     event.get("computer", {}).get(key) raises AttributeError. Only
     descend when the value really is a mapping.
+
+    The event body itself is guarded the same way. No Jamf event ships a
+    non-object body, so this is hardening rather than a fix -- but the
+    body comes off the wire, this runs unattended, and `key in event`
+    raises TypeError on a bool/int/None while `.get` raises
+    AttributeError on a str/list. Returning the default keeps a
+    malformed POST a logged "Unknown" instead of a traceback.
     """
+    if not isinstance(event, dict):
+        return default
     if key in event:
         return event[key]
     nested = event.get("computer")
diff --git a/data/workflows/scripts/return_to_service.py b/data/workflows/scripts/return_to_service.py
old mode 100644
new mode 100755
diff --git a/data/workflows/scripts/smart_group_appletv.py b/data/workflows/scripts/smart_group_appletv.py
old mode 100644
new mode 100755
diff --git a/data/workflows/scripts/smart_group_slack.py b/data/workflows/scripts/smart_group_slack.py
old mode 100644
new mode 100755
diff --git a/data/workflows/scripts/teams_notification.py b/data/workflows/scripts/teams_notification.py
old mode 100644
new mode 100755
index 4c744c2..2211d9f
--- a/data/workflows/scripts/teams_notification.py
+++ b/data/workflows/scripts/teams_notification.py
@@ -19,7 +19,16 @@ def _device_field(event, key, default="Unknown"):
     BOOLEAN rather than a nested object, so a bare
     event.get("computer", {}).get(key) raises AttributeError. Only
     descend when the value really is a mapping.
+
+    The event body itself is guarded the same way. No Jamf event ships a
+    non-object body, so this is hardening rather than a fix -- but the
+    body comes off the wire, this runs unattended, and `key in event`
+    raises TypeError on a bool/int/None while `.get` raises
+    AttributeError on a str/list. Returning the default keeps a
+    malformed POST a logged "Unknown" instead of a traceback.
     """
+    if not isinstance(event, dict):
+        return default
     if key in event:
         return event[key]
     nested = event.get("computer")
diff --git a/pytest.ini b/pytest.ini
index 5ee6477..b5eca83 100644
--- a/pytest.ini
+++ b/pytest.ini
@@ -1,2 +1,22 @@
 [pytest]
 testpaths = tests
+
+# One environmental warning, silenced narrowly. requests 2.31 declares
+# supported urllib3/chardet ranges and warns at IMPORT time when the
+# installed versions fall outside them; requirements.txt pins requests
+# but leaves chardet/urllib3 unpinned, so a fresh venv resolves a chardet
+# newer than requests knows about. Nothing in JAWA causes it and nothing
+# in JAWA is affected by it.
+#
+# Matched on the MESSAGE rather than the category on purpose. Naming
+# requests.exceptions.RequestsDependencyWarning would make pytest import
+# requests to resolve the class -- which is the very import that emits
+# the warning -- and it would also swallow any future version-mismatch
+# warning, including a real one. This pattern is specific enough that a
+# different mismatch still shows up.
+#
+# Deliberately NOT `error`: promoting every warning to a failure would
+# turn an unrelated upstream deprecation into a red build on the next
+# dependency bump. The gate is that `pytest -q` reports no warnings.
+filterwarnings =
+    ignore:urllib3 \(.*\) or chardet \(.*\)/charset_normalizer \(.*\) doesn't match a supported version:Warning
diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
index adfd866..6f0f471 100644
--- a/tests/test_template_catalog.py
+++ b/tests/test_template_catalog.py
@@ -218,14 +218,33 @@ def test_enabling_an_any_event_template_stores_no_none_event(
     assert entry["event"] in _schemas()["schemas"]
 
 
-def test_script_survives_every_example_payload(workflow):
-    """Both smart-group schemas set event.computer to a BOOLEAN, so the
-    event.get("computer", {}).get(...) fallback pattern raised
-    AttributeError (bug B15). Replay the catalog's own examples.
+EXAMPLE_EVENTS = sorted(_schemas()["examples"])
+
+# The payloads that carry the B15 shape: event["computer"] is a BOOLEAN,
+# not a nested object, so event.get("computer", {}).get(key) raises
+# AttributeError. Computed from the schema file rather than hardcoded, so
+# the coverage claim below tracks the catalog.
+BOOLEAN_COMPUTER_EVENTS = sorted(
+    name
+    for name, payload in _schemas()["examples"].items()
+    if isinstance(payload.get("event", {}).get("computer"), bool)
+)
+
+
+def test_the_b15_payload_shape_still_exists_to_be_tested():
+    """Guards the guard. The replay below is only meaningful while some
+    example really does set event.computer to a bool -- if the schema
+    file were reshaped, every replay case would pass vacuously and B15
+    could return unnoticed. This test fails loudly in that case instead.
     """
-    event = workflow.get("trigger_event")
-    examples = _schemas()["examples"]
-    payloads = list(examples.values()) if event is None else [examples[event]]
+    assert BOOLEAN_COMPUTER_EVENTS, (
+        "no example payload sets event.computer to a bool, so the B15 "
+        "replay no longer exercises the shape that caused the bug"
+    )
+
+
+def _extract_fn(workflow):
+    """Compile a bundled script and hand back its _device_field."""
     source = _script_source(workflow)
     # Numeric tokens are written bare (no quotes) so the substituted
     # value is a real int; swap in a placeholder to make it parseable.
@@ -234,12 +253,52 @@ def test_script_survives_every_example_payload(workflow):
             source = source.replace(param["token"], "0")
     namespace = {}
     exec(compile(source, workflow["script_file"], "exec"), namespace)
-    extract = namespace.get("_device_field")
+    return namespace.get("_device_field")
+
+
+@pytest.mark.parametrize("event_name", EXAMPLE_EVENTS)
+def test_script_survives_every_example_payload(workflow, event_name):
+    """Both smart-group schemas set event.computer to a BOOLEAN, so the
+    event.get("computer", {}).get(...) fallback pattern raised
+    AttributeError (bug B15). Replay the catalog's own examples.
+
+    Every payload against every script, deliberately NOT just the one
+    the entry's trigger_event names. Pinning the replay to trigger_event
+    made this vacuous for the script that motivated it:
+    event-tracker-sqlite declares ComputerCheckIn, whose example has no
+    "computer" key at all, so the nested-dict branch never ran and the
+    boolean case -- the actual bug -- went untested. A script also has to
+    survive a mis-pointed webhook: the trigger lives in Jamf Pro, where
+    an admin can point any event at any JAWA webhook.
+    """
+    extract = _extract_fn(workflow)
+    if extract is None:
+        pytest.skip(f"{workflow['slug']} defines no _device_field")
+    payload = _schemas()["examples"][event_name]
+    for key in ("deviceName", "serialNumber", "jssID"):
+        extract(payload.get("event", {}), key, "Unknown")
+
+
+# Nothing Jamf sends looks like this, so these are hardening, not a
+# fix. `key in event` raises TypeError on a bool/int/float/None; `.get`
+# raises AttributeError on a str/list.
+NON_DICT_EVENT_BODIES = [None, True, False, 42, 3.5, "string", ["list"]]
+
+
+@pytest.mark.parametrize("body", NON_DICT_EVENT_BODIES)
+def test_device_field_tolerates_a_non_dict_event_body(workflow, body):
+    """A malformed body must degrade to the default, not raise.
+
+    Both call sites already do event_data.get("event", {}), so no
+    shipped payload reaches here as a non-dict -- but the body is
+    attacker-influenced JSON off the wire and these scripts run
+    unattended under the receiver, where a traceback is just a non-zero
+    exit code in a log.
+    """
+    extract = _extract_fn(workflow)
     if extract is None:
         pytest.skip(f"{workflow['slug']} defines no _device_field")
-    for payload in payloads:
-        for key in ("deviceName", "serialNumber", "jssID"):
-            extract(payload.get("event", {}), key, "Unknown")
+    assert extract(body, "deviceName", "Unknown") == "Unknown"
 
 
 ADVERSARIAL_VALUES = [
@@ -892,3 +951,91 @@ def test_raw_nul_byte_cannot_reach_a_deployed_script(
 
     assert data_store.get_webhook_by_name("nul-hook") is None
     assert not os.listdir(str(jawa_env.scripts_dir))
+
+
+CANONICAL_START = "# --- JAWA canonical Jamf API block"
+CANONICAL_END = "# --- end canonical block ---"
+
+
+def _canonical_block(source):
+    if CANONICAL_START not in source:
+        return None
+    start = source.index(CANONICAL_START)
+    end = source.index(CANONICAL_END) + len(CANONICAL_END)
+    return source[start:end]
+
+
+def test_canonical_api_block_has_not_drifted():
+    """The scripts stay self-contained on purpose -- a user can download
+    one and run it alone -- so the Jamf API block is duplicated rather
+    than imported. Duplication is only safe if the copies stay
+    identical.
+    """
+    blocks = {}
+    for workflow in CATALOG:
+        block = _canonical_block(_script_source(workflow))
+        if block is not None:
+            blocks[workflow["script_file"]] = block
+
+    assert len(blocks) >= 2, (
+        "expected several scripts to carry the canonical block; found "
+        f"{sorted(blocks)}"
+    )
+    distinct = set(blocks.values())
+    assert len(distinct) == 1, (
+        "the canonical Jamf API block has drifted between scripts: "
+        f"{sorted(blocks)} yielded {len(distinct)} different versions"
+    )
+
+
+def test_every_script_is_executable_and_has_a_shebang():
+    """Two separate invariants, only one of which is receiver-facing.
+
+    The SHEBANG is load-bearing here. This directory is the shipped
+    TEMPLATE SOURCE; enabling copies its content verbatim into
+    SCRIPTS_DIR, and the receiver execs that copy with a bare
+    Popen([script_path, payload]) -- no interpreter prefix. A template
+    missing its shebang therefore produces a deployed script the kernel
+    cannot start.
+
+    The EXECUTABLE BIT on the template source is NOT what the receiver
+    relies on -- _write_script chmods the deployed copy itself (pinned by
+    test_deployed_script_is_executable). It is asserted for the
+    standalone-download promise the catalog makes: a user downloads one
+    of these and runs it directly, so the shipped file has to be
+    runnable as it stands.
+    """
+    for workflow in CATALOG:
+        path = _script_path(workflow)
+        with open(path, "r", encoding="utf-8") as handle:
+            first_line = handle.readline()
+        assert first_line.startswith("#!"), (
+            f"{workflow['script_file']} has no shebang; the receiver "
+            f"execs it directly"
+        )
+        assert os.access(path, os.X_OK), (
+            f"{workflow['script_file']} is not executable"
+        )
+
+
+def test_deployed_script_is_executable(jawa_env):
+    """The invariant the receiver's bare Popen actually depends on.
+
+    script_results() runs Popen([each_webhook["script"], payload]) with
+    no interpreter prefix, so the file _write_script leaves in
+    SCRIPTS_DIR has to carry the executable bit itself -- the mode of the
+    template source is irrelevant by then, because _write_script creates
+    a new file rather than copying one.
+    """
+    import stat
+
+    from views import template_view
+
+    dest = template_view._write_script(
+        "mode-check", "#!/usr/bin/env python3\nprint('hi')\n"
+    )
+    mode = stat.S_IMODE(os.stat(dest).st_mode)
+    assert mode == 0o755, (
+        f"_write_script left {oct(mode)} on {dest}; the receiver execs "
+        f"this path directly, so it must be 0o755"
+    )

From 5131f315e9e618a9a33ea4ec94cd428d837451be Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Mon, 10 Aug 2026 17:00:38 -0500
Subject: [PATCH 71/84] feat: offer Jamf Pro registration on the template
 import path (J16, B14)

Enable creates the webhook in Jamf Pro; import did not. Same catalog,
same kind of package, opposite behaviour -- and an imported package is
predicated on a Jamf Pro event just as much as a bundled one, so
leaving that side to be built by hand is the silent-extra-step failure
B14 exists to close.

The import form gains a "Create webhook in Jamf Pro?" checkbox,
checked by default, and reads it as absent-means-cleared since an
unchecked box posts nothing.

Checked reuses the enable path's machinery rather than reimplementing
it: the same name validation, the same duplicate check, the same
smart-group enablement, the same auth helpers, and the same
fail-closed order -- Jamf is asked first, so a 409 leaves no orphaned
script on disk and no half-configured automation. The entry lands with
tag "jamfpro", the real event, and jamf_id, and the success page deep
links the new object. Auth goes through _build_auth_xml and
_extract_auth_fields even though this form carries no auth fields yet:
both reduce to unauthenticated today, but deriving the XML JAWA sends
and the credentials JAWA stores from one place is what stops them
drifting into telling Jamf NONE while storing something the receiver
then rejects.

Cleared keeps today's behaviour exactly -- tag "custom", no jamf_id,
nothing created in the customer's Jamf Pro.

Name validation is re-framed on the way out because this form has no
name field. The name comes from the package, so the create form's
"rename it" advice is not something the admin can act on here; the
message names the package file and points at the checkbox instead.

Both paths now use the one-shot success flash, so import stops being
the last route that redirected with the message in the query string.

Tests cover both branches, the fail-closed ordering, the rejected
name, the smart-group not-yet-live warning, and -- the invariant this
module exists for -- that a Jamf-registered import actually fires
through the receiver. Each was mutation-tested: seven mutations, each
caught by the intended test.
---
 templates/workflows/import.html |  13 +++
 tests/test_templates.py         | 180 +++++++++++++++++++++++++++++++-
 views/template_view.py          | 171 +++++++++++++++++++++++++-----
 3 files changed, 335 insertions(+), 29 deletions(-)

diff --git a/templates/workflows/import.html b/templates/workflows/import.html
index ca97e33..dfcbeed 100644
--- a/templates/workflows/import.html
+++ b/templates/workflows/import.html
@@ -20,6 +20,19 @@ <h2 style="font-size: 1.8rem; letter-spacing: -1px;">Import Template</h2>
                     Select a <code>.jawa.json</code> file exported from the template documentation site.
                 </div>
             </div>
+            <div class="mb-3 form-check">
+                <input type="checkbox" class="form-check-input" name="create_in_jamf"
+                       id="create-in-jamf" value="yes" checked>
+                <label class="form-check-label" for="create-in-jamf">Create webhook in Jamf Pro?</label>
+                <div class="form-text enable-field-hint">
+                    JAWA creates the webhook in Jamf Pro for you, pointed at this
+                    server. Clear this to install the script locally only &mdash;
+                    you will have to create the Jamf Pro webhook by hand.
+                    The package name becomes part of the URL Jamf Pro calls, so it
+                    must contain only letters, numbers, dots, underscores and hyphens.
+                </div>
+            </div>
+
             <button type="submit" class="btn btn-jawa mt-2">Import</button>
         </form>
     </div>
diff --git a/tests/test_templates.py b/tests/test_templates.py
index a60994f..e189214 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -3,6 +3,7 @@
 import io
 import json
 import os
+import re
 import subprocess
 
 import pytest
@@ -218,13 +219,13 @@ def _package(content, name="imported-hook"):
     }
 
 
-def _upload(client, package):
+def _upload(client, package, **fields):
     payload = json.dumps(package).encode()
+    data = {"package": (io.BytesIO(payload), "thing.jawa.json")}
+    data.update(fields)
     return client.post(
         "/templates/import",
-        data={
-            "package": (io.BytesIO(payload), "thing.jawa.json"),
-        },
+        data=data,
         content_type="multipart/form-data",
     )
 
@@ -265,6 +266,177 @@ def test_import_accepts_script_using_a_runtime_global(
     assert data_store.get_webhook_by_name("imported-hook") is not None
 
 
+def _jamf_creations(monkeypatch, jamf_fake_http, response=None):
+    """Record every webhook-creation POST, optionally answering with a
+    canned response instead of the default success.
+    """
+    import requests as requests_module
+
+    _, default_post = jamf_fake_http
+    creations = []
+
+    def _post(url, **kwargs):
+        if "/JSSResource/webhooks/id/0" in url:
+            creations.append(url)
+            if response is not None:
+                return response
+        return default_post(url, **kwargs)
+
+    monkeypatch.setattr(requests_module, "post", _post)
+    return creations
+
+
+def test_import_form_offers_jamf_registration_by_default(logged_in_client):
+    """An imported package triggers on a Jamf Pro event, so the coupling
+    regular webhooks get -- JAWA creates the webhook in Jamf for you --
+    is the default, not an extra step the admin has to know about.
+    """
+    body = logged_in_client.get("/templates/import").get_data(as_text=True)
+    match = re.search(
+        r'<input[^>]*name="create_in_jamf"[^>]*>', body, re.S
+    )
+    assert match, "no create_in_jamf control on the import form"
+    assert "checked" in match.group(0), (
+        "the Jamf Pro registration box is not checked by default"
+    )
+
+
+def test_import_with_the_box_checked_creates_the_webhook_in_jamf(
+    logged_in_client, jawa_env
+):
+    """Checked is the same deal the enable path gives: JAWA creates the
+    webhook in Jamf Pro and files the automation under jamfpro, so its
+    trigger is visible and editable (the B14 rule).
+    """
+    resp = _upload(
+        logged_in_client,
+        _package("#!/usr/bin/env python3\nprint('hi')\n"),
+        create_in_jamf="yes",
+    )
+    assert resp.status_code == 302
+
+    entry = data_store.get_webhook_by_name("imported-hook")
+    assert entry is not None
+    assert entry["tag"] == "jamfpro"
+    assert entry["event"] == "ComputerCheckIn"
+    assert entry["jamf_id"] == "77"
+
+
+def test_a_jamf_registered_import_actually_fires(
+    logged_in_client, jawa_env, fake_popen
+):
+    """The whole point of this module (B1): registering in Jamf must not
+    change the stored shape in a way that stops the receiver validating
+    the inbound event or finding the script on disk.
+    """
+    _upload(
+        logged_in_client,
+        _package("#!/usr/bin/env python3\nprint('hi')\n"),
+        create_in_jamf="yes",
+    )
+    resp = logged_in_client.post(
+        "/hooks/imported-hook",
+        json={"webhook": {"webhookEvent": "ComputerCheckIn"}},
+    )
+    assert resp.status_code == 200
+    assert len(fake_popen.calls) == 1
+    argv = fake_popen.calls[0]
+    assert os.path.isabs(argv[0])
+    assert os.path.exists(argv[0])
+
+
+def test_import_with_the_box_cleared_stays_local(
+    logged_in_client, jawa_env, monkeypatch, jamf_fake_http
+):
+    """Clearing the box is the pre-existing behaviour: a JAWA-local
+    automation, nothing created in the customer's Jamf Pro.
+    """
+    creations = _jamf_creations(monkeypatch, jamf_fake_http)
+
+    resp = _upload(
+        logged_in_client, _package("#!/usr/bin/env python3\nprint('hi')\n")
+    )
+    assert resp.status_code == 302
+
+    entry = data_store.get_webhook_by_name("imported-hook")
+    assert entry is not None
+    assert entry["tag"] == "custom"
+    assert "jamf_id" not in entry
+    assert creations == [], (
+        "a webhook was created in Jamf Pro for an import the admin "
+        "asked to keep local"
+    )
+
+
+def test_import_writes_nothing_when_jamf_rejects(
+    logged_in_client, jawa_env, monkeypatch, jamf_fake_http
+):
+    """Same ordering guarantee the enable path makes: Jamf is asked
+    first, so a 409 leaves no orphaned script on disk and no
+    half-configured automation.
+    """
+    response_cls, _ = jamf_fake_http
+    _jamf_creations(
+        monkeypatch,
+        jamf_fake_http,
+        response=response_cls({}, status_code=409, text="duplicate"),
+    )
+
+    resp = _upload(
+        logged_in_client,
+        _package("#!/usr/bin/env python3\nprint('hi')\n"),
+        create_in_jamf="yes",
+    )
+    assert resp.status_code == 302
+    assert "/error" in resp.headers["Location"]
+    assert data_store.get_webhook_by_name("imported-hook") is None
+    written = os.listdir(str(jawa_env.scripts_dir))
+    assert written == [], f"orphaned script(s) left behind: {written}"
+
+
+def test_import_rejects_a_name_jamf_cannot_use(
+    logged_in_client, jawa_env, monkeypatch, jamf_fake_http
+):
+    """The package name becomes part of the URL Jamf Pro calls, so the
+    checked path holds it to the same rule as the create and enable
+    forms -- and rejects before anything is written either side.
+    """
+    creations = _jamf_creations(monkeypatch, jamf_fake_http)
+
+    resp = _upload(
+        logged_in_client,
+        _package(
+            "#!/usr/bin/env python3\nprint('hi')\n",
+            name="Imported Hook With Spaces",
+        ),
+        create_in_jamf="yes",
+    )
+    assert resp.status_code == 302
+    assert "/error" in resp.headers["Location"]
+    assert data_store.get_webhook_by_name("Imported Hook With Spaces") is None
+    assert creations == []
+    assert not os.listdir(str(jawa_env.scripts_dir))
+
+
+def test_import_of_a_smart_group_package_warns_it_is_not_live_yet(
+    logged_in_client, jawa_env
+):
+    """Jamf creates a smart-group webhook DISABLED, so the import path
+    owes the admin the same warning the enable path gives -- and must
+    store the flag Jamf actually applied, not a flat True.
+    """
+    package = _package("#!/usr/bin/env python3\nprint('hi')\n")
+    package["trigger"]["event"] = "SmartGroupComputerMembershipChange"
+    resp = _upload(logged_in_client, package, create_in_jamf="yes")
+    assert resp.status_code == 302
+    assert "/success" in resp.headers["Location"]
+
+    body = logged_in_client.get("/success").get_data(as_text=True)
+    assert "not yet enabled" in body
+    assert "Smart Group" in body
+    assert data_store.get_webhook_by_name("imported-hook")["enabled"] is False
+
+
 def test_substitution_rejects_a_token_no_param_declares():
     """The survivor check must run even when the workflow declares no
     config_params. The early return for "nothing to substitute" used to
diff --git a/views/template_view.py b/views/template_view.py
index 887cb4e..2b6fea0 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -30,7 +30,7 @@
 import math
 import os
 import re
-from typing import Any, Dict, List, Union
+from typing import Any, Dict, List, Optional, Union
 
 import requests
 from flask import (
@@ -121,8 +121,21 @@ def _load_credentials() -> List[Dict[str, Any]]:
         return []
 
 
-def _install_package(package: dict) -> None:
-    """Install a .jawa.json workflow package into JAWA."""
+def _install_package(
+    package: dict,
+    jamf_id: Optional[str] = None,
+    enabled: bool = True,
+    auth_fields: Optional[Dict[str, str]] = None,
+) -> None:
+    """Install a .jawa.json workflow package into JAWA.
+
+    ``jamf_id`` is the id of the webhook already created in Jamf Pro, or
+    None when the admin cleared the registration box and wants a
+    JAWA-local automation. Registered packages are filed under
+    "jamfpro" so the automation carries its trigger the way the enable
+    path's do -- filing an event-driven automation under "custom" is the
+    B14 mistake, where the trigger becomes invisible and uneditable.
+    """
     script = package["script"]
     safe_filename = secure_filename(script["filename"])
     script_path = os.path.join(SCRIPTS_DIR, safe_filename)
@@ -130,24 +143,33 @@ def _install_package(package: dict) -> None:
         f.write(script["content"])
     os.chmod(script_path, 0o755)
 
-    data_store.add_webhook(
-        {
-            "name": package["name"],
-            "tag": "custom",
-            "url": session.get("url", ""),
-            "event": package["trigger"]["event"],
-            "script": script_path,
-            "description": package.get("description", ""),
-            "enabled": True,
-            "webhook_username": "null",
-            "webhook_password": "null",
-            "api_key": "null",
-        }
-    )
+    auth = auth_fields or {
+        "webhook_username": "null",
+        "webhook_password": "null",
+        "api_key": "null",
+    }
+    entry = {
+        "name": package["name"],
+        "tag": "jamfpro" if jamf_id is not None else "custom",
+        "url": session.get("url", ""),
+        "jawa_admin": session.get("username", ""),
+        "event": package["trigger"]["event"],
+        "script": script_path,
+        "description": package.get("description", ""),
+        # Mirror what Jamf actually did: a smart-group event is created
+        # disabled and does not fire until the admin picks a Smart Group,
+        # so a flat True would make the stored record disagree with the
+        # remote object.
+        "enabled": enabled,
+        **auth,
+    }
+    if jamf_id is not None:
+        entry["jamf_id"] = jamf_id
+    data_store.add_webhook(entry)
 
     logthis.info(
         f"Installed workflow package: {package['name']} "
-        f"(script: {safe_filename})"
+        f"(script: {safe_filename}, jamf id: {jamf_id or 'not registered'})"
     )
 
 
@@ -802,14 +824,113 @@ def import_template() -> Union[Response, Dict[str, Any]]:
             )
         )
 
-    _install_package(package)
+    # Default-on, and read as "absent means cleared": an unchecked box
+    # posts nothing at all. These packages are predicated on Jamf Pro
+    # events, so registering the webhook in Jamf -- the coupling the
+    # regular create path gives -- is the expected outcome, not an extra
+    # step the admin has to discover.
+    if not request.form.get("create_in_jamf"):
+        _install_package(package)
+        logthis.info(
+            f"[{session.get('url')}] {session.get('username')} "
+            f"imported template: {package['name']} (JAWA-local)"
+        )
+        return _flash_success(
+            success_msg=f"Installed template: {package['name']}"
+        )
+
+    webhook_name = package["name"]
+    event = package["trigger"]["event"]
+    try:
+        # Shared with the create and enable paths so the three cannot
+        # diverge: the name goes into the XML body and into the callback
+        # URL Jamf Pro calls. Re-framed on the way out because this form
+        # has no name field -- the name comes from the package, so
+        # "rename it" is not advice the admin can act on here.
+        try:
+            validate_webhook_name(webhook_name)
+        except AutomationError as err:
+            raise AutomationError(
+                ERROR_INVALID_PKG,
+                f'The package name "{webhook_name}" cannot be used as a '
+                f"Jamf Pro webhook. {err.message} Fix the name in the "
+                f"package file, or clear the Jamf Pro box to install the "
+                f"script locally only.",
+            )
+        if data_store.get_webhook_by_name(webhook_name):
+            raise AutomationError(
+                "Error", f'The name "{webhook_name}" is already in use.'
+            )
+
+        server_address = get_jawa_address()
+        if not server_address:
+            raise AutomationError(
+                "Setup Required",
+                "Configure your JAWA address and Jamf Pro server "
+                "before importing a template into Jamf Pro.",
+                link="/setup",
+                link_text="Go to Setup",
+            )
+
+        if not validate_token(session.get("expires")):
+            get_token()
+
+        notice, instructions, enablement, extra_xml = _smart_group_info(
+            event
+        )
+        # The helpers rather than a hardcoded NONE + "null" x3: the
+        # import form carries no auth fields today, so both reduce to
+        # unauthenticated -- but going through them keeps the XML JAWA
+        # sends and the credentials JAWA stores derived from one place.
+        # Hardcoding the pair is how they drift into telling Jamf NONE
+        # while storing something the receiver then rejects (B14).
+        auth_xml = _build_auth_xml(request.form)
+        (
+            webhook_user,
+            webhook_pass,
+            webhook_apikey,
+            _extra_notice,
+            _custom_header,
+        ) = _extract_auth_fields(request.form)
+        xml_data = _build_webhook_xml(
+            webhook_name,
+            enablement,
+            server_address,
+            event,
+            auth_xml,
+            extra_xml,
+        )
+        jamf_id = _create_jamf_webhook(webhook_name, xml_data)
+    except AutomationError as err:
+        return redirect(
+            url_for(
+                "error",
+                error=err.title,
+                error_message=err.message,
+            )
+        )
+
+    # Jamf accepted it: only now write anything locally, so a rejection
+    # leaves no orphaned script on disk and no half-configured
+    # automation.
+    _install_package(
+        package,
+        jamf_id=jamf_id,
+        enabled=enablement == "true",
+        auth_fields={
+            "webhook_username": webhook_user,
+            "webhook_password": webhook_pass,
+            "api_key": webhook_apikey,
+        },
+    )
     logthis.info(
         f"[{session.get('url')}] {session.get('username')} "
-        f"imported template: {package['name']}"
+        f"imported template: {package['name']} (jamf id: {jamf_id})"
     )
-    return redirect(
-        url_for(
-            "success",
-            success_msg=f"Installed template: {package['name']}",
-        )
+    return _flash_success(
+        success_msg=f"Installed template: {package['name']}",
+        new_link=f"{session.get('url')}/webhooks.html?id={jamf_id}&o=r",
+        new_here=webhook_name,
+        smart_group_notice=notice,
+        smart_group_instructions=instructions,
     )

From 3b1f6ba2d3f937026930cf9232d6f4370a5925fb Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Tue, 11 Aug 2026 09:39:42 -0500
Subject: [PATCH 72/84] fix: make the Resource Files page safe and consistent
 with the design system

Two problems on one page, kept in one commit because the tests covering
them do not split cleanly.

Destructive-action safety: Download and Delete sat flush against each
other in one flex row, same size, so a misclick on a benign action
landed on a destructive one. Add a gap, and route Delete through the
shared delete_confirmation macro instead of the hand-rolled copy of that
card the page carried -- style block and all -- which is how the two
drift. The macro grows two optional arguments rather than this page
growing a second confirmation screen:

- cancel_url, because a blind history.back() walks to the spent list
  form (the same reason the success pages stopped using it).
- warning_detail, because the shared line promises to delete "all
  associated data", which describes an automation and not a file. The
  real consequence for a file is a script that starts failing.

Both default to today's behaviour, so the automations delete page is
unchanged.

Design system: the page predated the system pass and kept its own
table, headings and layout. Move the listing onto .hippocrates inside
an overflow wrapper, replace the centred h4s with section-headers,
demote the resources path from a navy+mono code block to a caption
(that treatment is for code and logs, and a directory path is neither),
make the whole row a hit target for its radio, and give the empty case
an empty_state that invites an upload instead of a bare "No files
uploaded".

Add Size and Type columns while the view is open: both are what an
admin needs to decide what to download or delete, and sizes are
formatted so a 412-byte script reads "412 B" rather than "0.0 KB".

Two bugs surfaced while listing the directory:

- Hidden files were filtered by removing from the list being iterated,
  which shifts the next element past the cursor -- so a dotfile
  immediately following another leaked into the page. Filter by
  comprehension, and sort, so the order is not left to the filesystem.
- listdir-then-stat is a race. A file deleted by a second admin
  mid-request took the whole listing down with a 500; skip it instead.
---
 static/css/main.css             |  32 +++-
 templates/resources/delete.html | 139 +-------------
 templates/resources/files.html  |  83 +++++----
 templates/shared/_macros.html   |  11 +-
 tests/test_files_page.py        | 318 ++++++++++++++++++++++++++++++++
 views/resource_view.py          |  61 +++++-
 6 files changed, 464 insertions(+), 180 deletions(-)
 create mode 100644 tests/test_files_page.py

diff --git a/static/css/main.css b/static/css/main.css
index e362726..7a02d3d 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -772,8 +772,6 @@ form.table-view {
 
 form.files-form {
     margin: auto;
-    max-height: 45vh;
-    max-width: 800px;
     background-color: var(--color-surface);
     color: var(--color-text);
     border: 1px solid var(--color-border);
@@ -781,6 +779,36 @@ form.files-form {
     padding: 1rem;
 }
 
+/* The overflow wrapper for .hippocrates: tables scroll sideways on a
+   phone instead of forcing the whole page wide. */
+.table-scroll {
+    overflow-x: auto;
+}
+
+/* The resources path is a caption, not code -- the navy+mono block it
+   used to sit in reads as output the admin should be looking at. */
+.files-directory-caption {
+    color: var(--color-text-secondary);
+    font-size: 0.88rem;
+    margin-bottom: 1rem;
+}
+
+.files-directory-path {
+    font-family: var(--font-mono);
+    word-break: break-all;
+}
+
+/* Whole-cell hit target: the radio used to be a bare control the
+   filename happened to sit beside. */
+.file-row-label {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin: 0;
+    cursor: pointer;
+    word-break: break-all;
+}
+
 .error-msg {
     color: #b30000;
     text-align: center;
diff --git a/templates/resources/delete.html b/templates/resources/delete.html
index 89d31c3..98147ce 100644
--- a/templates/resources/delete.html
+++ b/templates/resources/delete.html
@@ -27,114 +27,10 @@
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 
 {% extends "shared/_layout.html" %}
-{% from "shared/_macros.html" import hero_section %}
+{% from "shared/_macros.html" import hero_section, delete_confirmation %}
 
 {% block title %}Delete File | JAWA{% endblock %}
 
-{% block additional_css %}
-<style>
-    .delete-container {
-        min-height: calc(100vh - 300px);
-        display: flex;
-        align-items: center;
-        justify-content: center;
-        padding: 2rem 1rem;
-    }
-    .delete-card {
-        background: var(--color-surface-raised);
-        border: 1px solid var(--color-border);
-        border-radius: 12px;
-        padding: 2.5rem;
-        max-width: 550px;
-        width: 100%;
-        box-shadow: 0 4px 20px rgba(106, 47, 48, 0.08);
-    }
-    .delete-icon {
-        width: 64px;
-        height: 64px;
-        margin: 0 auto 1.5rem;
-        background: rgba(229, 192, 123, 0.12);
-        border: 2px solid rgba(229, 192, 123, 0.3);
-        border-radius: 50%;
-        display: flex;
-        align-items: center;
-        justify-content: center;
-        color: #c17d11;
-        font-size: 2rem;
-        font-weight: bold;
-    }
-    .delete-title {
-        color: var(--color-text);
-        font-size: 1.5rem;
-        font-weight: 600;
-        text-align: center;
-        margin-bottom: 1rem;
-    }
-    .delete-item-name {
-        background: var(--color-surface-hover);
-        border: 1px solid var(--color-border);
-        border-radius: 8px;
-        padding: 0.75rem 1rem;
-        margin: 1.5rem 0;
-        text-align: center;
-        font-family: var(--font-mono);
-        font-weight: 600;
-        color: var(--color-text);
-        word-break: break-word;
-    }
-    .delete-warning {
-        color: var(--color-text-secondary);
-        font-size: 0.95rem;
-        line-height: 1.5;
-        text-align: center;
-        margin-bottom: 2rem;
-    }
-    .delete-warning strong {
-        color: #c17d11;
-    }
-    .delete-actions {
-        display: flex;
-        gap: 0.75rem;
-        justify-content: center;
-        flex-wrap: wrap;
-    }
-    .btn-delete-cancel {
-        background: var(--color-surface);
-        border: 1px solid var(--color-border);
-        color: var(--color-text);
-        padding: 0.6rem 1.5rem;
-        border-radius: 8px;
-        font-weight: 500;
-        transition: all 0.2s ease;
-        text-decoration: none;
-        display: inline-block;
-    }
-    .btn-delete-cancel:hover {
-        background: var(--color-surface-hover);
-        border-color: var(--color-text-secondary);
-        color: var(--color-text);
-        transform: translateY(-1px);
-        text-decoration: none;
-    }
-    .btn-delete-confirm {
-        background: #d63447;
-        border: 1px solid #d63447;
-        color: white;
-        padding: 0.6rem 1.5rem;
-        border-radius: 8px;
-        font-weight: 500;
-        transition: all 0.2s ease;
-        cursor: pointer;
-    }
-    .btn-delete-confirm:hover {
-        background: #b8293a;
-        border-color: #b8293a;
-        transform: translateY(-1px);
-        box-shadow: 0 4px 12px rgba(214, 52, 71, 0.3);
-    }
-</style>
-{% endblock %}
-
 {% block content %}
 {{ hero_section(
     title="Delete Resource File",
@@ -143,30 +39,11 @@
     secondary_label="Back to Files"
 ) }}
 
-<div class="delete-container">
-    <div class="delete-card">
-        <div class="delete-icon">⚠</div>
-        <h1 class="delete-title">Delete File?</h1>
-
-        <div class="delete-item-name">
-            {{ target_file }}
-        </div>
-
-        <div class="delete-warning">
-            <strong>This action cannot be undone.</strong><br>
-            This will permanently delete this file from the resources directory.
-        </div>
-
-        <form action="#" method="POST" enctype="multipart/form-data">
-            <div class="delete-actions">
-                <a href="/resources/files" class="btn-delete-cancel">
-                    Cancel
-                </a>
-                <button type="submit" class="btn-delete-confirm">
-                    Delete File
-                </button>
-            </div>
-        </form>
-    </div>
-</div>
+{{ delete_confirmation(
+    target_file,
+    "File",
+    url_for('resources_view.delete_file', target_file=target_file),
+    cancel_url="/resources/files",
+    warning_detail="This will permanently delete this file from the resources directory. Any automation script that reads it will start failing."
+) }}
 {% endblock %}
diff --git a/templates/resources/files.html b/templates/resources/files.html
index d6cdbc3..185ccdc 100644
--- a/templates/resources/files.html
+++ b/templates/resources/files.html
@@ -26,65 +26,72 @@
 {###}
 {## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ##}
 {% extends "shared/_layout.html" %}
+{% from "shared/_macros.html" import hero_section, empty_state %}
 {% block title %}JAWA Resource Files{% endblock %}
 {% block content %}
-<div class="hero-section">
-    <div class="container">
-        <h2>Resource Files</h2>
-        <p>Upload, download, and manage script resources.</p>
-        <div class="hero-cta">
-            <a href="{{ url_for('log_view.log_home') }}" class="btn btn-hero-secondary">View Log</a>
-        </div>
-    </div>
-</div>
+{{ hero_section(
+    title="Resource Files",
+    subtitle="Upload, download, and manage script resources.",
+    secondary_url=url_for('log_view.log_home'),
+    secondary_label="View Log"
+) }}
 <div class="container">
-    <div class="form-container">
-        <div class="form-section">
-            <div class="overflow-auto pre-scrollable">
-            <h4 class="text-center mb-3">Upload a file</h4>
-            <p>Files directory:
-            <pre><code>{{ files_repo }}/</code></pre>
-            </p>
-            <form action="#" method="post" enctype="multipart/form-data">
-                <div class="mb-3">
-                    <input type="file" name="upload" class="form-control"
-                           formenctype="multipart/form-data" id="file-upload"/>
-                </div>
-                <div class="d-flex justify-content-center">
-                    <input type="submit" id="file-submit" class="btn btn-jawa btn-action" value="Upload" disabled/>
-                </div>
-            </form>
+    <div class="content-narrow">
+        <div class="section-header">
+            <h3>Upload a file</h3>
         </div>
+        <p class="files-directory-caption">
+            Files directory: <span class="files-directory-path">{{ files_repo }}/</span>
+        </p>
+        <form class="form-section" action="#" method="post" enctype="multipart/form-data">
+            <div class="mb-3">
+                <input type="file" name="upload" class="form-control"
+                       formenctype="multipart/form-data" id="file-upload"/>
+            </div>
+            <div class="button-align">
+                <input type="submit" id="file-submit" class="btn btn-jawa btn-action" value="Upload" disabled/>
+            </div>
+        </form>
     </div>
-</div>
-        {% if not files %}
 
-            <div class="d-flex justify-content-center font-weight-bolder"> No files uploaded</div>
-        {% endif %}
-    {% if files %}
-        <form class="files-form overflow-auto">
-            <h4 class="text-center mb-3">Uploaded files</h4>
-            <div class="btn-padded">
-                <table id="files_table" class="table">
+    <div class="section-header">
+        <h3>Uploaded files</h3>
+    </div>
+    {% if not files %}
+        {{ empty_state("No files uploaded yet. Upload one above to make it available to your scripts.") }}
+    {% else %}
+        <form class="files-form">
+            <div class="table-scroll">
+                <table id="files_table" class="hippocrates">
                     <tr>
                         <th>Name</th>
+                        <th>Size</th>
+                        <th>Type</th>
                         <th>Date Modified</th>
                     </tr>
                     {% for file in files %}
                         <tr>
-                            <td><input type="radio" id="{{ file.name }}" name="target_file"
-                                       value="{{ file.name }}"> {{ file.name }}</td>
+                            <td>
+                                <label class="file-row-label" for="file-{{ loop.index }}">
+                                    <input type="radio" id="file-{{ loop.index }}" name="target_file"
+                                           value="{{ file.name }}">
+                                    <span>{{ file.name }}</span>
+                                </label>
+                            </td>
+                            <td>{{ file.size }}</td>
+                            <td>{{ file.type }}</td>
                             <td>{{ file.mtime }}</td>
                         </tr>
                     {% endfor %}
                 </table>
             </div>
-            <div class="d-flex justify-content-center">
+            <div class="d-flex justify-content-center gap-3 btn-padded">
                 <button type="submit" name="button_choice" value="Download"
                         class="btn btn-jawa btn-action">
                     Download
                 </button>
-                <button name="button_choice" type="submit" value="Delete" class="btn btn-danger btn-action">
+                <button name="button_choice" type="submit" value="Delete"
+                        class="btn btn-danger btn-action">
                     Delete
                 </button>
             </div>
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
index 2f0cb04..774c84c 100644
--- a/templates/shared/_macros.html
+++ b/templates/shared/_macros.html
@@ -50,7 +50,12 @@ <h6 class="overflow-hidden card-title font-weight-bolder">{{ item.name }}</h6>
 </div>
 {% endmacro %}
 
-{% macro delete_confirmation(item_name, item_type, delete_url) %}
+{# cancel_url: where Cancel goes. Left empty it falls back to
+   history.back(), which walks to a spent form -- pass an explicit
+   destination on any page that knows where the admin came from.
+   warning_detail: overrides the consequence line. The default speaks of
+   "associated data", which is true of an automation but not of a file. #}
+{% macro delete_confirmation(item_name, item_type, delete_url, cancel_url="", warning_detail="") %}
 <style>
     .delete-container {
         min-height: calc(100vh - 300px);
@@ -163,12 +168,12 @@ <h1 class="delete-title">Delete {{ item_type }}?</h1>
 
         <div class="delete-warning">
             <strong>This action cannot be undone.</strong><br>
-            This will permanently delete this {{ item_type|lower }} and all associated data.
+            {% if warning_detail %}{{ warning_detail }}{% else %}This will permanently delete this {{ item_type|lower }} and all associated data.{% endif %}
         </div>
 
         <form method="POST" action="{{ delete_url }}">
             <div class="delete-actions">
-                <a href="javascript:history.back()" class="btn-delete-cancel">
+                <a href="{{ cancel_url if cancel_url else 'javascript:history.back()' }}" class="btn-delete-cancel">
                     Cancel
                 </a>
                 <button type="submit" class="btn-delete-confirm">
diff --git a/tests/test_files_page.py b/tests/test_files_page.py
new file mode 100644
index 0000000..b29a288
--- /dev/null
+++ b/tests/test_files_page.py
@@ -0,0 +1,318 @@
+"""Resource Files page: destructive-action safety + design-system pass.
+
+Two concerns, one page. The safety half is that Download (benign) and
+Delete (destructive) used to sit flush against each other, same size, so
+a misclick landed on the wrong one. The unification half is that this
+page predated the design system and kept its own table, headings and a
+duplicated confirmation card.
+"""
+
+import os
+import re
+
+
+def _row_for(body: str, filename: str) -> str:
+    """The table row holding ``filename``.
+
+    Row-scoped rather than page-scoped: the filename also appears in the
+    radio's id and value attributes, so a whole-page assertion on a size
+    or type string could pass while the cell that shows it is missing.
+    """
+    start = body.index(f'value="{filename}"')
+    row_start = body.rindex("<tr", 0, start)
+    row_end = body.index("</tr>", start) + len("</tr>")
+    return body[row_start:row_end]
+
+
+def _write(env, name: str, content: bytes = b"x") -> None:
+    (env.files_dir / name).write_bytes(content)
+
+
+def _page(body: str) -> str:
+    """This page's own markup, layout chrome excluded.
+
+    The shared layout carries a session-timeout modal with inline styles
+    and a script that reads ``document.hidden``, so whole-document
+    assertions about inline styling or hidden files answer questions
+    about the layout instead of about this page.
+    """
+    start = body.index('<div class="main-content')
+    return body[start : body.index("<footer>", start)]
+
+
+# ----------------------------------------------------------------- item A
+
+
+def test_download_and_delete_are_separated(logged_in_client, jawa_env):
+    _write(jawa_env, "thing.txt")
+    body = logged_in_client.get("/resources/files").data.decode()
+    # The two submits share one flex row; the gap utility is what keeps a
+    # destructive action from sitting flush against a benign one.
+    actions = body[body.index('value="Download"') - 400 :]
+    actions = actions[: actions.index("</form>")]
+    assert "gap-3" in actions
+
+
+def test_delete_asks_for_confirmation_through_the_shared_card(
+    logged_in_client, jawa_env
+):
+    _write(jawa_env, "thing.txt")
+    resp = logged_in_client.get(
+        "/resources/delete.html?target_file=thing.txt"
+    )
+    body = resp.data.decode()
+    # The shared delete_confirmation markup, not a hand-rolled copy.
+    assert 'class="delete-card"' in body
+    assert 'class="delete-item-name"' in body
+    assert "This action cannot be undone." in body
+    # Copy rule: the button names the noun, never "Confirm"/"OK".
+    assert "Delete File" in body
+    assert ">Confirm<" not in body
+    # The shared default speaks of "associated data", which means nothing
+    # for a file -- the real consequence is a script that breaks.
+    assert "all associated data" not in body
+    assert "Any automation script that reads it will start failing." in body
+
+
+def test_confirmation_names_the_file_it_will_delete(
+    logged_in_client, jawa_env
+):
+    _write(jawa_env, "payroll-export.csv")
+    body = logged_in_client.get(
+        "/resources/delete.html?target_file=payroll-export.csv"
+    ).data.decode()
+    named = body[body.index('class="delete-item-name"') :]
+    named = named[: named.index("</div>")]
+    assert "payroll-export.csv" in named
+
+
+def test_the_confirmation_card_is_not_a_second_copy_of_the_macro():
+    """The card markup exists twice today, style block and all.
+
+    Asserting on the rendered page cannot catch this: a duplicate that
+    renders identically passes every output assertion right up until
+    someone edits one copy. So this reads the template.
+    """
+    with open("templates/resources/delete.html", encoding="utf-8") as f:
+        source = f.read()
+    assert "delete_confirmation" in source
+    assert "<style>" not in source
+    assert ".delete-card {" not in source
+
+
+def test_confirmation_cancel_goes_to_the_files_list(
+    logged_in_client, jawa_env
+):
+    _write(jawa_env, "thing.txt")
+    body = logged_in_client.get(
+        "/resources/delete.html?target_file=thing.txt"
+    ).data.decode()
+    actions = body[body.index('class="delete-actions"') :]
+    actions = actions[: actions.index("</form>")]
+    # A blind history.back() walks to the spent list form (the J13
+    # lesson); this page knows where it came from, so it says so.
+    assert 'href="/resources/files"' in actions
+    assert "history.back()" not in actions
+
+
+def test_confirming_actually_deletes_the_file(logged_in_client, jawa_env):
+    _write(jawa_env, "doomed.txt")
+    resp = logged_in_client.post(
+        "/resources/delete.html?target_file=doomed.txt"
+    )
+    assert resp.status_code == 302
+    assert not (jawa_env.files_dir / "doomed.txt").exists()
+
+
+def test_the_confirmation_form_posts_to_the_delete_route(
+    logged_in_client, jawa_env
+):
+    """The macro takes an explicit action; a wrong one silently no-ops.
+
+    The delete route reads target_file from the query string, so the
+    action has to carry it. Rendering the card correctly but posting
+    somewhere that drops the filename would look identical and delete
+    nothing.
+    """
+    _write(jawa_env, "thing.txt")
+    body = logged_in_client.get(
+        "/resources/delete.html?target_file=thing.txt"
+    ).data.decode()
+    form = body[body.index('class="delete-card"') :]
+    action = re.search(r'<form method="POST" action="([^"]+)"', form)
+    assert action, "confirmation card renders no POST form"
+    assert "target_file=thing.txt" in action.group(1)
+    assert "/resources/delete.html" in action.group(1)
+
+
+# ----------------------------------------------------------------- item B
+
+
+def test_uploaded_files_use_the_standard_table(logged_in_client, jawa_env):
+    _write(jawa_env, "thing.txt")
+    body = logged_in_client.get("/resources/files").data.decode()
+    assert 'class="hippocrates"' in body
+    assert '<table id="files_table" class="table">' not in body
+
+
+def test_page_sections_use_section_headers(logged_in_client, jawa_env):
+    _write(jawa_env, "thing.txt")
+    body = logged_in_client.get("/resources/files").data.decode()
+    # One hero, then section-headers for everything below it.
+    assert body.count('class="section-header"') == 2
+    assert '<h4 class="text-center mb-3">' not in body
+    assert "Upload a file" in body
+    assert "Uploaded files" in body
+
+
+def test_files_directory_is_a_caption_not_a_code_block(
+    logged_in_client, jawa_env
+):
+    body = logged_in_client.get("/resources/files").data.decode()
+    # The path is a caption. The navy+mono treatment is for code and
+    # logs, and a directory path is neither.
+    assert "<pre><code>" not in body
+    assert str(jawa_env.files_dir) in body
+
+
+def test_file_rows_show_size_and_type(logged_in_client, jawa_env):
+    _write(jawa_env, "notes.txt", b"y" * 2048)
+    body = logged_in_client.get("/resources/files").data.decode()
+    assert "<th>Size</th>" in body
+    assert "<th>Type</th>" in body
+    row = _row_for(body, "notes.txt")
+    assert "2.0 KB" in row
+    assert "TXT" in row
+
+
+def test_a_file_with_no_extension_still_renders_a_type(
+    logged_in_client, jawa_env
+):
+    _write(jawa_env, "README", b"hi")
+    body = logged_in_client.get("/resources/files").data.decode()
+    row = _row_for(body, "README")
+    # A placeholder, not an empty cell: the Type column gets scanned
+    # down, and a blank reads as "failed to load" rather than "none".
+    assert "&#8212;" in row or "—" in row
+    # And whatever it shows, never a Python None leaked into the UI.
+    assert "None" not in row
+    assert "2 B" in row
+
+
+def test_files_are_listed_in_a_stable_order(
+    logged_in_client, jawa_env, monkeypatch
+):
+    """Sorted by name, not by whatever order the filesystem hands back.
+
+    The order is pinned to something unsorted on purpose -- APFS returns
+    a small directory alphabetically already, so leaving it to the
+    filesystem would let an unsorted implementation pass.
+    """
+    for name in ("charlie.txt", "alpha.txt", "bravo.txt"):
+        _write(jawa_env, name)
+    monkeypatch.setattr(
+        os, "listdir", lambda _: ["charlie.txt", "alpha.txt", "bravo.txt"]
+    )
+    body = logged_in_client.get("/resources/files").data.decode()
+    positions = [
+        body.index(f'value="{name}"')
+        for name in ("alpha.txt", "bravo.txt", "charlie.txt")
+    ]
+    assert positions == sorted(positions)
+
+
+def test_hidden_files_are_never_listed(
+    logged_in_client, jawa_env, monkeypatch
+):
+    """Two ADJACENT dotfiles: the list-mutating filter used to skip one.
+
+    Removing from a list while iterating it shifts the next element past
+    the cursor, so a dotfile immediately after another leaked into the
+    page. The order has to be pinned rather than left to the filesystem
+    -- APFS hands back creation order shuffled, so an unpatched version
+    of this test passes or fails by luck and proves nothing either way.
+    """
+    _write(jawa_env, ".DS_Store")
+    _write(jawa_env, ".hidden")
+    _write(jawa_env, "visible.txt")
+    monkeypatch.setattr(
+        os, "listdir", lambda _: [".DS_Store", ".hidden", "visible.txt"]
+    )
+    page = _page(logged_in_client.get("/resources/files").data.decode())
+    assert ".DS_Store" not in page
+    assert ".hidden" not in page
+    assert "visible.txt" in page
+
+
+def test_empty_state_invites_an_upload(logged_in_client, jawa_env):
+    body = logged_in_client.get("/resources/files").data.decode()
+    assert 'class="empty-state"' in body
+    # Never a bare "No items" -- and never a stale table header either.
+    assert "<th>Size</th>" not in body
+
+
+def test_the_page_carries_no_inline_styles(logged_in_client, jawa_env):
+    _write(jawa_env, "thing.txt")
+    page = _page(logged_in_client.get("/resources/files").data.decode())
+    assert "style=" not in page
+
+
+def test_a_hostile_filename_is_escaped_in_the_table(
+    logged_in_client, jawa_env
+):
+    """Filenames reach the page in a radio value, an id and a cell.
+
+    Uploads go through secure_filename, but anything already sitting in
+    the directory (dropped in over SSH, restored from a backup) does
+    not, so the template is the only thing standing between a crafted
+    name and the DOM.
+    """
+    hostile = '<img src=x onerror=alert(1)>.txt'
+    _write(jawa_env, hostile)
+    body = logged_in_client.get("/resources/files").data.decode()
+    assert "<img src=x onerror=alert(1)>" not in body
+    assert "&lt;img src=x onerror=alert(1)&gt;" in body
+
+
+# ------------------------------------------------------- size formatting
+
+
+def test_format_size_boundaries():
+    from views.resource_view import _format_size
+
+    # Whole bytes below 1 KB: a 40-byte script must not read "0.0 KB".
+    assert _format_size(0) == "0 B"
+    assert _format_size(40) == "40 B"
+    assert _format_size(1023) == "1023 B"
+    assert _format_size(1024) == "1.0 KB"
+    assert _format_size(1536) == "1.5 KB"
+    assert _format_size(1024 * 1024) == "1.0 MB"
+    assert _format_size(16 * 1024 * 1024) == "16.0 MB"
+    assert _format_size(1024**3) == "1.0 GB"
+
+
+def test_a_vanished_file_does_not_break_the_listing(
+    logged_in_client, jawa_env, monkeypatch
+):
+    """os.listdir then stat is a race: a file can go between the two.
+
+    Two admins, or an admin and a script, and the listing 500s on a
+    stat of something that no longer exists.
+    """
+    _write(jawa_env, "here.txt")
+    _write(jawa_env, "vanishing.txt")
+    real_getsize = os.path.getsize
+
+    def flaky_getsize(path):
+        if path.endswith("vanishing.txt"):
+            raise OSError("No such file or directory")
+        return real_getsize(path)
+
+    monkeypatch.setattr(os.path, "getsize", flaky_getsize)
+    resp = logged_in_client.get("/resources/files")
+    assert resp.status_code == 200
+    page = _page(resp.data.decode())
+    assert "here.txt" in page
+    # Dropped, not degraded into a phantom row: offering Download and
+    # Delete on a file that no longer exists is worse than omitting it.
+    assert "vanishing.txt" not in page
diff --git a/views/resource_view.py b/views/resource_view.py
index 48587de..ea7bc32 100644
--- a/views/resource_view.py
+++ b/views/resource_view.py
@@ -67,6 +67,36 @@
 
 blueprint = Blueprint("resources_view", __name__, template_folder="templates")
 
+_SIZE_UNITS = ("KB", "MB", "GB", "TB")
+
+
+def _format_size(num_bytes: int) -> str:
+    """Render a byte count the way an admin reads it.
+
+    Bytes stay whole below 1 KB so a 40-byte script does not read
+    "0.0 KB". Above that, one decimal place is enough to tell a 200 KB
+    plist from a 2 MB installer -- which is the decision this column
+    exists to support.
+    """
+    if num_bytes < 1024:
+        return f"{num_bytes} B"
+    size = float(num_bytes)
+    for unit in _SIZE_UNITS:
+        size /= 1024
+        if size < 1024 or unit == _SIZE_UNITS[-1]:
+            return f"{size:.1f} {unit}"
+    return f"{size:.1f} {_SIZE_UNITS[-1]}"
+
+
+def _format_type(filename: str) -> str:
+    """The extension as a short uppercase label, or a dash if there is none.
+
+    A dash rather than an empty cell or a Python None: the column is
+    scanned down, so every row needs something in it.
+    """
+    extension = os.path.splitext(filename)[1].lstrip(".")
+    return extension.upper() if extension else "—"
+
 
 @blueprint.route("/resources/files", methods=["GET", "POST"])
 def files() -> Union[Response, Tuple[str, int]]:
@@ -129,17 +159,36 @@ def files() -> Union[Response, Tuple[str, int]]:
     logthis.info(
         f"[{session.get('url')}] {session.get('username')} {request.path} {request.method}"
     )
-    file_list = os.listdir(files_dir)
-    for file in file_list:
-        if file[0] == ".":
-            file_list.remove(file)
+    # Sorted, and filtered by comprehension rather than by removing from
+    # the list being iterated -- that shifts the next element past the
+    # cursor, so two adjacent dotfiles leaked the second one into the page.
+    file_list = sorted(
+        each for each in os.listdir(files_dir) if not each.startswith(".")
+    )
     files_list = []
     for each_file in file_list:
-        mtime = os.path.getmtime(os.path.join(files_dir, each_file))
+        each_path = os.path.join(files_dir, each_file)
+        try:
+            mtime = os.path.getmtime(each_path)
+            size = os.path.getsize(each_path)
+        except OSError:
+            # listdir-then-stat is a race: a second admin deleting a file
+            # mid-request must not take the whole listing down with it.
+            logthis.debug(
+                f"Skipping {each_file}: vanished while listing resources."
+            )
+            continue
         pretty_mtime = datetime.fromtimestamp(mtime).strftime(
             "%Y-%m-%d %H:%M:%S"
         )
-        files_list.append({"name": each_file, "mtime": pretty_mtime})
+        files_list.append(
+            {
+                "name": each_file,
+                "mtime": pretty_mtime,
+                "size": _format_size(size),
+                "type": _format_type(each_file),
+            }
+        )
     return render_template(
         "resources/files.html",
         username=session.get("username"),

From 1781db4bd84f26ba6f8169e8af79dcf4b875def9 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 20:07:00 -0500
Subject: [PATCH 73/84] fix: stop reflecting the webhook name into the 401 body
 (J11)

The receiver's unauthorized branch interpolated webhook_name -- which
comes straight off the /hooks/<webhook_name> path -- into a bare-string
return. Flask serves a bare string as text/html, so a POST to
/hooks/<markup> with bad auth reflected unescaped markup back onto
JAWA's own origin. There is no CSP and no after_request escaping to
blunt it.

The two sibling returns in the same function were safe only by
accident: they return dicts, which Flask serializes as JSON.

Drop the interpolation rather than escaping it. The name is already on
the warning log line above, which is where an operator debugging a 401
looks, and a body carrying no request input cannot regress if the
content type ever changes. The escape() pattern used in app.py would
also have worked; not reflecting at all is the stronger guarantee.

Add a regression test asserting a markup payload in the hook name never
reaches the 401 body, verified failing against the previous code.

This is the one live-file CodeQL py/reflective-xss alert that is real
rather than a false positive; the others either sit in files this
release deletes or return JSON.
---
 tests/test_receiver.py   | 22 ++++++++++++++++++++++
 webhook/jawa_receiver.py |  7 ++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/tests/test_receiver.py b/tests/test_receiver.py
index 6dfb729..4962c5c 100644
--- a/tests/test_receiver.py
+++ b/tests/test_receiver.py
@@ -94,6 +94,28 @@ def test_unknown_webhook_is_rejected(client, jawa_env, fake_popen):
     assert fake_popen.calls == []
 
 
+def test_401_body_does_not_reflect_the_webhook_name(
+    client, jawa_env, fake_popen
+):
+    """A bare-string return is served as text/html, so the caller-supplied
+    webhook name must never reach the 401 body raw -- that was a reflected
+    XSS on JAWA's own origin. The payload carries no slash because the
+    route's default converter matches a single path segment.
+    """
+    marker = "<img src=x onerror=alert(1)>"
+    resp = client.post(
+        f"/hooks/{marker}",
+        json=PAYLOAD,
+        headers=_basic_auth("any", "any"),
+    )
+    assert resp.status_code == 401
+    body = resp.get_data(as_text=True)
+    assert marker not in body
+    assert "onerror" not in body
+    assert "<img" not in body
+    assert fake_popen.calls == []
+
+
 def test_api_key_auth_runs_script(client, jawa_env, fake_popen):
     _make_webhook(
         jawa_env,
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 08248c1..6a52cf3 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -197,7 +197,12 @@ def webhook_handler(
         logthis.warning(
             f"401 - Incorrect authentication provided for /hooks/{webhook_name}."
         )
+        # webhook_name is caller-controlled path input, and a bare-string
+        # return is served as text/html -- interpolating it here reflected
+        # unescaped markup back onto JAWA's own origin. The name is already
+        # on the log line above, which is where an operator debugging a 401
+        # actually looks.
         return (
-            f"Unauthorized - incorrect authentication provided for /hooks/{webhook_name}.",
+            "Unauthorized - incorrect authentication provided.",
             401,
         )

From f0ffe5d122320ac3a587a59951fe3d5a5f4e46c4 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 20:10:50 -0500
Subject: [PATCH 74/84] docs: rewrite the v3.2.0 release notes for the shipped
 payload (J9)

The existing v3.2 section was written before the UI sweep and the
templates work, so it described roughly half the release: it covered the
harness/CI, session timeout, script docs, template firing, path
traversal, resource deletion, error pages and dead-code removal, and
mentioned nothing from the success-page fix, the dashboard/Extras
polish, the Webhook Reference page, the Resource Files page, or the
bundled-template content work -- which is the flagship.

Adds an "Upgrade notes" block up front for the four things that change
behaviour on an existing install rather than merely fixing it:

- v3.2 is the last release carrying a v2 migration path. The v2 upgrade
  code is untouched here; this is the notice, not the removal.
- Previously-enabled template webhooks start firing on upgrade, and
  template webhooks are unauthenticated by default. An operator who
  enabled one months ago and saw nothing happen needs to know it is
  about to become a live open endpoint.
- Stricter webhook-name validation on create now refuses # and %.
- Anything shipped inside data/ is not upgraded in place, because the
  installer restores the operator's data/ over the shipped copy. That
  covers the bundled template scripts and the webhook event catalog, so
  an upgrading operator keeps the versions they first installed.

The rest is reorganised into New features / Bugfixes / Removed /
Repository maintenance, following the existing entries' shape. Notes
that DeviceRateLimited is listed with its sample payload pending rather
than inventing one, and that the Enrollment Pipeline template was
removed rather than shipped as an outline.

Heading is v3.2.0 to match the tag and the three-part style of the
v3.1.1 / v3.1.0 entries. The historical v3.1.1 heading stays as
changelog history.
---
 README.md | 84 ++++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 74 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 6916152..3725b82 100644
--- a/README.md
+++ b/README.md
@@ -203,19 +203,83 @@ if __name__ == "__main__":
 
 Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)
 
-### JAWA v3.2 release
+### JAWA v3.2.0 release
+
+**Upgrade notes — please read before upgrading**
+
+- **v3.2 is the last release that can migrate a JAWA v2 install.** The v2 upgrade path works in
+  this release and is unchanged. If you are still on v2, move to v3.2 before upgrading further.
+- **Template webhooks you previously enabled will begin firing.** A bug meant enabled and
+  imported template webhooks silently never triggered. Template webhooks run **without
+  authentication by default** — anyone who knows the hook name can trigger one. Review your
+  enabled templates and add webhook authentication in the automation's edit screen if an
+  endpoint should be protected. Authenticated-by-default templates are planned for a future
+  release.
+- **New webhook names are validated more strictly.** `#` and `%` are no longer accepted in a new
+  webhook name, because Jamf Pro cannot call a URL containing them. Existing automations are
+  unaffected.
+- **Content JAWA ships inside `data/` is not upgraded in place.** The installer preserves your
+  `data/` directory across an upgrade, which protects your automations and settings, but it also
+  means the bundled template scripts and the webhook event catalog stay at the version you first
+  installed. A fresh install gets the current copies.
+
 - New features
-    - smoke-test harness + CI (ruff + pytest) for safer releases
-    - admin-configurable session timeout with hardened session cookies
-    - documentation for writing automation scripts
+    - **Bundled templates now work as shipped.** Every bundled template runs when triggered; two
+      were incomplete sketches that failed immediately. Enabling a template also creates the
+      matching webhook in Jamf Pro for you and files the automation under Jamf Pro, so its
+      trigger event is visible and editable. Templates can be protected with Basic
+      authentication at enable time.
+    - **Importing a template package can create its webhook in Jamf Pro too** — a new *Create
+      webhook in Jamf Pro?* option, on by default. Clear it to install the script locally only.
+      Because the package name becomes part of the URL Jamf Pro calls, a name with spaces or
+      other URL-unsafe characters is refused on that path; fix the package file, or clear the box
+      to install locally under any name.
+    - **Webhook Reference page** documenting the Jamf Pro webhook events with sample payloads.
+      One event, `DeviceRateLimited`, is listed with its sample payload still pending.
+    - **Admin-configurable session timeout** in Setup: 15 minutes (default), 1 hour, 4 hours, or
+      8 hours, with hardened session cookies. The 15-minute default remains the most secure; the
+      longer options are convenient for workflow testing but leave an unattended signed-in
+      console exposed for longer. Choose deliberately.
+    - Smoke-test harness and CI (ruff + pytest) running on every push and pull request.
+    - Documentation for writing automation scripts.
+    - Script Preview and Download Script now show the real substitution tokens rather than
+      generic placeholder text, so a downloaded script is self-documenting.
+    - Resource Files listing gained Size and Type columns.
 - Bugfixes
-    - template webhooks now fire correctly
-    - rejected path traversal in template import
-    - fixed resource deletion, error pages, and receiver edge cases
-    - session-timeout warning now survives sleep/idle
-    - "Setup Required" error page links directly to Setup
+    - Template webhooks now fire (see upgrade notes).
+    - Configuration values containing `&`, quotes, or angle brackets — Microsoft Teams and Power
+      Automate URLs, and some secrets — are no longer corrupted when written into a generated
+      script.
+    - Enabling a template no longer stores authentication values that locked the webhook out.
+    - Imported template packages are validated before installation: a `.jawa.json` whose script
+      is truncated or has a syntax error is rejected with the offending line number, instead of
+      installing a webhook that fails silently when it fires.
+    - Fixed a crash on templates whose trigger event was a boolean.
+    - The 401 response from an inbound webhook no longer echoes the requested hook name back.
+    - Rejected path traversal in template package import, and guarded the legacy redirect routes
+      against open redirects.
+    - Resource Files page: Download and Delete are no longer adjacent, identical buttons, Delete
+      routes through the shared confirmation screen, and hidden files no longer leak into the
+      listing.
+    - The success-page Back button no longer re-submits the action it just completed.
+    - Corrected dashboard links and removed dead Extras links.
+    - Uploads between 1 MB and 16 MB no longer fail with an opaque error; the server upload cap
+      is now set explicitly.
+    - Setup strips trailing slashes from Jamf Pro URLs, so generated webhook URLs no longer
+      contain double slashes.
+    - Script uploads with no `#!` shebang are rejected with a clear message instead of failing
+      cryptically at trigger time.
+    - The session-timeout warning now survives laptop sleep and backgrounded tabs.
+    - Fixed resource file deletion, added 403/405/500 error pages, and hardened receiver edge
+      cases including malformed form payloads.
+    - The "Setup Required" error page links directly to Setup.
+- Removed
+    - The *Enrollment Pipeline* template, which shipped as an incomplete outline and needs a
+      device-assignment CSV contract that will be designed properly in a future release.
 - Repository maintenance
-    - removed dead code (legacy MongoEngine, stale stubs)
+    - Removed dead code (legacy MongoEngine, stale stubs).
+    - `data/cron.json` is no longer tracked in git, so a checkout can no longer overwrite real
+      cron definitions with an empty seed file.
 
 ### JAWA v3.1.1 release
 - Bugfix

From 52c4e3d46d0dad92fe49921509f72b455502c78b Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 20:15:41 -0500
Subject: [PATCH 75/84] fix: accept the activationcode shape a live Jamf Pro
 actually returns

Reported against a real instance: login failed with "activationcode
response was not Jamf-shaped; refusing login" for an account that has
working API access. Querying /JSSResource/activationcode directly on the
same instance with the same account returns

  {"license_information": {"organization_name": "...", "code": "..."}}

The guard required a top-level "activation_code" key, so it rejected
that. The result was a hard lockout of the console against a genuine
Jamf Pro server -- the product's core function -- with an error message
blaming the operator's URL.

Accept either wrapper key. A random website's JSON carries neither,
which is all this guard needs to distinguish; it is defense in depth
behind the token check, not the primary authentication.

The reason the harness did not catch this is the more important half:
tests/conftest.py mocked the activationcode response as
{"activation_code": {...}} -- a shape no instance sends. The fixture
invented the contract and every login test then verified the code
against that invention, so the guard looked covered while being wrong
about the one thing it inspects. The mock now returns the live shape,
which is why the old guard fails four fixture-based tests once reverted.

Adds three tests: the live "license_information" shape logs in, the
"activation_code" spelling logs in, and a 200 of valid JSON carrying
neither key is still refused. That last one is tighter than the
existing non-Jamf case, which only covered a body that fails to parse
as JSON at all. Mutation-tested: the license_information test fails
against the previous guard.
---
 tests/conftest.py   |  10 ++++-
 tests/test_login.py | 103 ++++++++++++++++++++++++++++++++++++++++++++
 views/home_view.py  |  12 +++++-
 3 files changed, 123 insertions(+), 2 deletions(-)

diff --git a/tests/conftest.py b/tests/conftest.py
index 7065925..ce93071 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -94,8 +94,16 @@ def _fake_jamf_get(url, **kwargs):
     # the host is really Jamf Pro; answer with the Jamf-shaped JSON so
     # _verify_jamf_access accepts it. Other GETs get a benign payload.
     if url.endswith("/JSSResource/activationcode"):
+        # This is the shape a live Jamf Pro returns. It previously mocked
+        # {"activation_code": ...}, which no instance sends, so the suite
+        # validated the login guard against a contract it had invented.
         return FakeJamfResponse(
-            {"activation_code": {"organization_name": "Test Org"}}
+            {
+                "license_information": {
+                    "organization_name": "Test Org",
+                    "code": "AAAA-BBBB-CCCC-DDDD",
+                }
+            }
         )
     return FakeJamfResponse({})
 
diff --git a/tests/test_login.py b/tests/test_login.py
index b0e0ef2..5d731d0 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -254,3 +254,106 @@ def test_failed_login_does_not_reflect_script_injection(
     body = resp.data.decode()
     # Autoescaped -- the raw tag must not appear unescaped in the body.
     assert "<script>alert(1)</script>" not in body
+
+
+# ---- activationcode shape acceptance (login regression) ----
+#
+# The guard in _verify_jamf_access exists to stop a reachable non-Jamf
+# host from counting as a successful login. It originally required a
+# top-level "activation_code" key, which no live instance sends -- real
+# Jamf Pro answers with "license_information" -- so it rejected genuine
+# logins against genuine servers. The suite did not catch it because the
+# fixture mocked the invented shape. These tests pin both real spellings
+# and keep the non-Jamf rejection honest.
+
+
+class _ShapedActivationCode:
+    """Token endpoint plus an activationcode body of a chosen shape."""
+
+    status_code = 200
+
+    def __init__(self, kind, body=None):
+        self.kind = kind
+        self.body = body
+
+    def json(self):
+        if self.kind == "token":
+            return {
+                "token": "looks-real",
+                "expires": "2099-01-01T00:00:00.000+0000",
+            }
+        return self.body
+
+    def raise_for_status(self):
+        pass
+
+
+def _login_with_activationcode_body(client, jawa_env, monkeypatch, body):
+    import json as _json
+
+    import requests
+
+    jawa_env.server_file.write_text(_json.dumps({"brand": "JAWA"}))
+    monkeypatch.setattr(
+        requests, "post", lambda *a, **k: _ShapedActivationCode("token")
+    )
+    monkeypatch.setattr(
+        requests,
+        "get",
+        lambda *a, **k: _ShapedActivationCode("activationcode", body),
+    )
+    return client.post(
+        "/login",
+        data={
+            "url": "https://jamf.example.test",
+            "username": "admin",
+            "password": "hunter2",
+        },
+    )
+
+
+def test_login_accepts_license_information_shape(
+    client, jawa_env, monkeypatch
+):
+    """The shape a live Jamf Pro actually returns must be accepted."""
+    resp = _login_with_activationcode_body(
+        client,
+        jawa_env,
+        monkeypatch,
+        {
+            "license_information": {
+                "organization_name": "Shinra Electric Power Company",
+                "code": "AAAA-BBBB-CCCC-DDDD",
+            }
+        },
+    )
+    assert resp.status_code == 302
+    assert "/dashboard" in resp.headers.get("Location", "")
+
+
+def test_login_accepts_activation_code_shape(client, jawa_env, monkeypatch):
+    """The other published spelling must be accepted too."""
+    resp = _login_with_activationcode_body(
+        client,
+        jawa_env,
+        monkeypatch,
+        {"activation_code": {"organization_name": "Test Org"}},
+    )
+    assert resp.status_code == 302
+    assert "/dashboard" in resp.headers.get("Location", "")
+
+
+def test_login_rejects_json_200_that_is_not_jamf(
+    client, jawa_env, monkeypatch
+):
+    """A non-Jamf host answering valid JSON still must not log in.
+
+    Tighter than the non-JSON case: this body parses fine and carries
+    neither wrapper key, which is the only thing the guard keys off.
+    """
+    resp = _login_with_activationcode_body(
+        client, jawa_env, monkeypatch, {"welcome": "to my blog"}
+    )
+    assert resp.status_code == 302
+    assert "/dashboard" not in resp.headers.get("Location", "")
+    assert "/logout" in resp.headers.get("Location", "")
diff --git a/views/home_view.py b/views/home_view.py
index 945222f..6e132cc 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -119,6 +119,14 @@ def _validate_credentials() -> Union[Response, None]:
     return None
 
 
+# Jamf Pro wraps /JSSResource/activationcode in a single top-level key.
+# Live instances answer with "license_information"; the resource is also
+# published as "activation_code". Accept either: a random website's JSON
+# carries neither, which is all this guard has to distinguish. Checking
+# for one spelling only locked real operators out of their own console.
+_JAMF_ACTIVATION_KEYS = ("license_information", "activation_code")
+
+
 def _verify_jamf_access() -> Union[Response, None]:
     """Verify Jamf Pro API access, returning a redirect on failure."""
     try:
@@ -137,7 +145,9 @@ def _verify_jamf_access() -> Union[Response, None]:
         # Any random website returning an HTML 200 must NOT count as a
         # successful Jamf login (defense in depth behind the token check).
         body = resp.json()
-        if not isinstance(body, dict) or "activation_code" not in body:
+        if not isinstance(body, dict) or not any(
+            key in body for key in _JAMF_ACTIVATION_KEYS
+        ):
             logthis.error(
                 f"[{session.get('url')}] activationcode response was not "
                 "Jamf-shaped; refusing login."

From 8af3fb2161e4d7eaafcfaffb4ba0b08886be4fa5 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 20:17:46 -0500
Subject: [PATCH 76/84] chore: bump requests and Werkzeug past their open
 advisories

Five open Dependabot advisories, all medium, and the compatible-release
pins were what blocked the fixes rather than merely lagging them:

  requests ~=2.31.0  allows <2.32.0, patched at 2.32.0 / 2.32.4 / 2.33.0
  Werkzeug ~=3.0.1   allows <3.1.0,  patched at 3.1.4 / 3.1.5

bin/installer.sh installs straight from requirements.txt, so shipping
3.2.0 unchanged would have put the vulnerable versions on every new
install. Bumped to ~=2.33.0 and ~=3.1.5, resolving to requests 2.33.1
and Werkzeug 3.1.8 against the existing Flask ~=3.0.2.

Werkzeug 3.1 changed one behaviour the suite depended on:
test_workflows_rest_rejects_off_site asserted the Location header does
not start with "http" as a stand-in for "not off-site". Werkzeug >= 3.1
emits an absolute Location for its own routing-layer canonicalization
redirect (merging a "///" run), so a same-origin hop now arrives as
"http://localhost/workflows/evil.com" and tripped a string-prefix check
while remaining entirely local -- evil.com is a path segment there, not
a host. The open-redirect protection itself never regressed.

Rather than special-case the string, the assertions now parse the
Location and compare its host against the request host, which is what
off-site actually means. That also covers a case the prefix check could
not: an absolute URL to a genuinely different host. Prefix and
embedded-"//" checks now run against the parsed path, so a legitimate
scheme's "//" no longer reads as a protocol-relative payload.

Under 3.1 the "///" payload is merged at the routing layer before
JAWA's view runs, so the test accepts either destination -- /templates
from JAWA's own shim, or /workflows from Werkzeug's canonicalization --
and asserts same-origin on both.

Verified on both generations: 415 passed under Werkzeug 3.0.6 with the
old pins and under 3.1.8 with the new ones. Mutation-tested by
neutering safe_path_segment, which fails 30 of the 43 redirect tests,
so the origin comparison still catches a real off-site redirect.
---
 requirements.txt              |  4 +--
 tests/test_redirect_safety.py | 63 +++++++++++++++++++++++++----------
 2 files changed, 48 insertions(+), 19 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index 87d9d72..ef87c74 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,9 +9,9 @@ itsdangerous
 MarkupSafe~=2.1.5
 python-crontab~=3.0.0
 python-dateutil
-requests~=2.31.0
+requests~=2.33.0
 setuptools
 six
 urllib3
 waitress~=3.0.0
-Werkzeug~=3.0.1
+Werkzeug~=3.1.5
diff --git a/tests/test_redirect_safety.py b/tests/test_redirect_safety.py
index a18ee04..179e5b8 100644
--- a/tests/test_redirect_safety.py
+++ b/tests/test_redirect_safety.py
@@ -11,6 +11,8 @@
 authenticated session is required to exercise them.
 """
 
+from urllib.parse import urlsplit
+
 import pytest
 
 # Payloads that, before the fix, escape the intended local path.
@@ -27,18 +29,39 @@
 ]
 
 
+def _assert_same_origin(loc, host="localhost"):
+    """Assert a Location header cannot leave this origin; return its path.
+
+    "Does not start with http" is NOT a usable proxy for "not off-site".
+    Werkzeug >= 3.1 emits an *absolute* Location for its own routing-layer
+    canonicalization redirects (merging a "///" run), so a perfectly safe
+    same-origin hop arrives as "http://localhost/...". Compare the parsed
+    host instead, which is what off-site actually means and which holds
+    across both Werkzeug generations.
+    """
+    # A protocol-relative "//host" has an empty scheme, so urlsplit reads
+    # it as a netloc -- reject it before parsing so the message is clear.
+    assert not loc.startswith("//"), f"protocol-relative Location: {loc!r}"
+    assert "\\" not in loc, f"backslash in Location: {loc!r}"
+    parts = urlsplit(loc)
+    if parts.netloc:
+        assert parts.netloc == host, f"off-site host in Location: {loc!r}"
+        assert parts.scheme in ("http", "https"), f"odd scheme: {loc!r}"
+    assert not parts.path.startswith("//"), f"embedded '//' in path: {loc!r}"
+    return parts.path
+
+
 def _assert_local_redirect(resp, prefix):
     """A safe redirect stays on this origin under the given prefix."""
     assert resp.status_code == 301
     loc = resp.headers["Location"]
-    # Never protocol-relative and never absolute off-site.
-    assert not loc.startswith("//"), f"protocol-relative Location: {loc!r}"
-    assert not loc.startswith("http"), f"absolute Location: {loc!r}"
-    assert "\\" not in loc, f"backslash in Location: {loc!r}"
-    # No embedded "//" either: an interpolated separator run can be
-    # re-parsed as protocol-relative by intermediaries.
-    assert "//" not in loc, f"embedded '//' in Location: {loc!r}"
-    assert loc.startswith(prefix), f"Location {loc!r} escaped prefix {prefix!r}"
+    path = _assert_same_origin(loc)
+    # Assert on the parsed path, not the raw header: an absolute
+    # same-origin Location legitimately contains "//" in its scheme.
+    # No embedded "//" in the path -- an interpolated separator run can
+    # be re-parsed as protocol-relative by intermediaries.
+    assert "//" not in path, f"embedded '//' in path: {loc!r}"
+    assert path.startswith(prefix), f"Location {loc!r} escaped prefix {prefix!r}"
 
 
 # ---- app.py single-segment name routes ----
@@ -101,16 +124,22 @@ def test_webhook_delete_normal_value_redirects(client, jawa_env):
 def test_workflows_rest_rejects_off_site(client, path):
     resp = client.get(path)
     # The invariant is simply: this route never emits an OFF-SITE
-    # redirect. A 301 must point at a safe local /templates path; any
-    # non-redirect response (e.g. Werkzeug merges "///" and the URL map
-    # matches a real page -> 200, or a 404) carries no Location and so
-    # cannot redirect off-origin.
+    # redirect. Any non-redirect response (a 200 or a 404) carries no
+    # Location and so cannot redirect off-origin.
     loc = resp.headers.get("Location")
-    if loc is not None:
-        assert not loc.startswith("//"), f"protocol-relative: {loc!r}"
-        assert not loc.startswith("http"), f"absolute off-site: {loc!r}"
-        assert "\\" not in loc, f"backslash in Location: {loc!r}"
-        assert loc.startswith("/templates"), f"escaped prefix: {loc!r}"
+    if loc is None:
+        return
+    path_out = _assert_same_origin(loc)
+    # Two safe destinations, depending on who handled the request:
+    #   /templates/... -- JAWA's own 301 shim ran and sanitized the value.
+    #   /workflows/... -- Werkzeug >= 3.1 merged the "///" run at the
+    #                     routing layer and redirected to the canonical
+    #                     path before JAWA's view was ever reached, which
+    #                     means the payload never hit the interpolation.
+    # Both stay on this origin, which is the property under test.
+    assert path_out.startswith(("/templates", "/workflows")), (
+        f"escaped prefix: {loc!r}"
+    )
 
 
 def test_workflows_rest_normal_value_redirects(client):

From 56615c71c7551bab683cb7078981619fa1bd8ea5 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 21:04:20 -0500
Subject: [PATCH 77/84] fix: hold requests at 2.32.x so Python 3.9 keeps
 resolving

CI caught what local testing could not: requests 2.33.x declares
Requires-Python >=3.10, so the 3.9 leg of the matrix could not resolve
requests~=2.33.0 at all and failed at dependency install. The 3.14 leg
passed, which is exactly why this needed the matrix.

Dropping 3.9 is a supported-platform decision about who can run JAWA,
not a side effect of clearing an advisory, so the pin moves to ~=2.32.4
(resolves to 2.32.5) and 3.9 stays supported. Werkzeug 3.1.5 is
unaffected -- it declares >=3.9.

That clears two of the three requests advisories, both the ones that
matter for how JAWA uses the library:

  GHSA-9wx4-h78v-vm56  Session does not verify later requests after a
                       first request with verify=False   (fixed 2.32.0)
  GHSA-9hjg-9r4m-mvj7  .netrc credential leak via malicious URLs
                                                         (fixed 2.32.4)

The third, GHSA-gc5v-m9x4-r6x2 (insecure temp file reuse in
extract_zipped_paths), needs 2.33.0 and therefore 3.10. It stays open
and is not reachable in JAWA's deployment shape: JAWA never calls that
function, and its only caller inside requests is adapters.py passing
DEFAULT_CA_BUNDLE_PATH, which returns immediately when the path exists.
installer.sh builds a venv and pip-installs certifi as a real file on
disk, so the zipped-egg branch that the advisory concerns is never
entered. Revisit if the Python floor moves to 3.10, which would let the
pin go to 2.33 and close it properly.

Verified: 415 passed with requests 2.32.5 and Werkzeug 3.1.8.
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index ef87c74..7100d84 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,7 +9,7 @@ itsdangerous
 MarkupSafe~=2.1.5
 python-crontab~=3.0.0
 python-dateutil
-requests~=2.33.0
+requests~=2.32.4
 setuptools
 six
 urllib3

From 5aedf02886452c49327a65c0ab29476580a96319 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 21:15:59 -0500
Subject: [PATCH 78/84] docs: state the platform floor JAWA's dependencies
 actually require

The stated requirements said Ubuntu 20.04+ / RHEL 8.x+ and Python 3.8+.
None of that has been true for a while, and the CI matrix disagreed with
it too -- CI's oldest leg is 3.9, so the documented 3.8 floor was never
tested.

The installer builds the venv from the distribution's *default* python3
(apt-get install python3-*, yum install -y python3, then python3 -m
venv), so the OS version decides the Python version. That gives:

  Ubuntu 20.04     3.8    fails: Werkzeug 3.1 requires >=3.9
  Ubuntu 22.04+    3.10+  ok
  RHEL/Rocky 8     3.6    fails, and has since JAWA moved to Flask 3
  RHEL/Rocky 9     3.9    ok

RHEL/Rocky 8 is the notable one: it stopped being able to run JAWA when
Flask 3 arrived, independent of this release, and the requirements never
caught up. Werkzeug 3.1 in this release is what rules out Ubuntu 20.04.

Requirements now read Ubuntu 22.04+ or RHEL/Rocky 9.x+ and Python 3.9+,
with a note explaining that the OS choice is what sets the Python
version -- the failure mode otherwise is an opaque pip resolution error
partway through an install as root.

Also added to the release notes' upgrade section, since an operator on
20.04 or RHEL 8 needs to know before running the installer rather than
after.

Deliberately not raising the floor to 3.10 to close the remaining
requests advisory: that would drop RHEL/Rocky 9 as well, and choosing
who can run JAWA is a product decision, not a consequence of patching a
dependency.
---
 README.md | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 3725b82..8f7d72a 100644
--- a/README.md
+++ b/README.md
@@ -36,11 +36,16 @@ JAWA and [Jamf Routines](https://learn.jamf.com/r/en-US/jamf-routines-documentat
 
 ### General Server Requirements:
 
-- Ubuntu 20.04+ or RHEL 8.x+
+- Ubuntu 22.04+ or RHEL / Rocky 9.x+
 - Minimum: 8GB RAM (16GB recommended)
 - Minimum: 128GB Storage (512GB recommended)
 - Minimum: 2 CPU Core (4 Cores recommended)
-- Python 3.8+ (with pip)
+- Python 3.9+ (with pip)
+
+> The installer uses the distribution's default `python3` to build JAWA's virtual environment, so
+> the OS version is what determines the Python version. Ubuntu 20.04 ships Python 3.8 and
+> RHEL/Rocky 8 ships Python 3.6, neither of which satisfies JAWA's dependencies — use Ubuntu 22.04
+> or later, or RHEL/Rocky 9 or later.
 
 ### Network Requirements:
 
@@ -218,6 +223,12 @@ Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)
 - **New webhook names are validated more strictly.** `#` and `%` are no longer accepted in a new
   webhook name, because Jamf Pro cannot call a URL containing them. Existing automations are
   unaffected.
+- **Minimum platform is now Ubuntu 22.04 or RHEL/Rocky 9, and Python 3.9.** The installer builds
+  JAWA's virtual environment from the distribution's default `python3`, and JAWA's dependencies no
+  longer support Python 3.8. Ubuntu 20.04 (Python 3.8) and RHEL/Rocky 8 (Python 3.6) can no longer
+  run JAWA — RHEL/Rocky 8 in fact stopped being able to when JAWA moved to Flask 3, which the
+  stated requirements had not caught up with. Check `python3 --version` on the host before
+  upgrading.
 - **Content JAWA ships inside `data/` is not upgraded in place.** The installer preserves your
   `data/` directory across an upgrade, which protects your automations and settings, but it also
   means the bundled template scripts and the webhook event catalog stay at the version you first

From 87b3e70ad5f07b85412d6616527394bd131c7e75 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 21:52:51 -0500
Subject: [PATCH 79/84] fix: hide the credential fields a selected credential
 set supplies

Reported by the maintainer: picking a credential set on the template
enable form still prompted for the OAuth client ID.

Two things were wrong. The form rendered every config_param
unconditionally, including the three credential keys, while the dropdown
hint promised it would "auto-fill server URL, client ID, and client
secret" -- and nothing populated them. The template's own comment said
as much. They were merely not marked required, so submit worked and the
server used the saved set anyway.

The worse half: substitute_params prefers the credential set over the
form unconditionally, so a value typed into one of those visible fields
was silently discarded. Nothing told the admin, and the only way to find
out was to read the generated script.

Fix hides exactly the fields the chosen set fills, and disables them so
the browser omits them from the submission -- a stale typed value cannot
reach the server to be dropped. Per-set, not blanket: only "name" is
required when saving a credential set, so a set may carry any subset of
the three. A field the set cannot supply stays visible and becomes
required, which converts what used to be a server-side missing-value
error at enable time into ordinary form validation.

Deliberately NOT auto-filling the inputs, which is the obvious reading
of the old hint. That would render the OAuth client secret into the DOM
and into view-source. The page carries key NAMES only, asserted by a
test that fails if anyone adds the values back -- verified by mutating
the template to emit them.

The hint now describes what actually happens, including that the saved
set wins over anything typed.

Also moves the param label off an inline style into a class, since new
CSS belongs in main.css rather than the markup.

419 passed, ruff clean.
---
 README.md                       |   5 ++
 static/css/main.css             |  13 +++
 templates/workflows/enable.html |  70 ++++++++++++++--
 tests/test_templates.py         | 139 ++++++++++++++++++++++++++++++++
 views/template_view.py          |  26 ++++++
 5 files changed, 246 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 8f7d72a..689008a 100644
--- a/README.md
+++ b/README.md
@@ -261,6 +261,11 @@ Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)
     - Configuration values containing `&`, quotes, or angle brackets — Microsoft Teams and Power
       Automate URLs, and some secrets — are no longer corrupted when written into a generated
       script.
+    - Selecting a saved credential set on the template enable form now hides the server URL,
+      client ID and client secret fields it supplies, instead of showing empty fields alongside a
+      hint that claimed they would be auto-filled. A value typed into one of those fields was
+      previously discarded without warning, because the saved set takes precedence. Fields a
+      partial credential set cannot supply stay visible.
     - Enabling a template no longer stores authentication values that locked the webhook out.
     - Imported template packages are validated before installation: a `.jawa.json` whose script
       is truncated or has a syntax error is rejected with the offending line number, instead of
diff --git a/static/css/main.css b/static/css/main.css
index 7a02d3d..6bca7f4 100644
--- a/static/css/main.css
+++ b/static/css/main.css
@@ -1494,3 +1494,16 @@ a.btn-hero-secondary:visited {
     font-size: 0.95rem;
     color: var(--color-text-secondary);
 }
+
+/* Field group whose value comes from the selected saved credential set.
+   Toggled by workflows/enable.html; the input is also disabled so the
+   browser omits it from the submission. */
+.is-hidden {
+    display: none;
+}
+
+/* Template Configuration param label. Replaces a per-field inline style. */
+.enable-param-label {
+    font-weight: 500;
+    font-size: 0.88rem;
+}
diff --git a/templates/workflows/enable.html b/templates/workflows/enable.html
index eb95c57..15ad59d 100644
--- a/templates/workflows/enable.html
+++ b/templates/workflows/enable.html
@@ -51,14 +51,21 @@ <h2 style="font-size: 1.6rem; text-align: left; letter-spacing: -0.5px; margin-t
             {% if credentials %}
             <div class="mb-4">
                 <label for="credential-set" class="form-label" style="font-weight: 500;">Credential Set</label>
-                <select name="credential_set" id="credential-set" class="form-control">
-                    <option value="">-- None (configure manually below) --</option>
+                <select name="credential_set" id="credential-set" class="form-control"
+                        data-cred-select>
+                    <option value="" data-supplies="">-- None (configure manually below) --</option>
                     {% for cred in credentials %}
-                    <option value="{{ loop.index0 }}">{{ cred.name }} ({{ cred.server_url }})</option>
+                    {# Key NAMES only. Rendering a client secret here would put it in
+                       the DOM and in view-source. #}
+                    <option value="{{ loop.index0 }}"
+                            data-supplies="{{ (credential_supplies[loop.index0] or []) | join(' ') }}">
+                        {{ cred.name }} ({{ cred.server_url }})</option>
                     {% endfor %}
                 </select>
-                <div class="form-text" style="color: var(--color-text-muted); font-size: 0.82rem;">
-                    Select a saved credential set to auto-fill server URL, client ID, and client secret.
+                <div class="form-text enable-field-hint">
+                    The selected set supplies its own server URL, client ID and client secret.
+                    Those fields disappear below, because the saved set is used in preference
+                    to anything typed here.
                 </div>
             </div>
             {% else %}
@@ -70,8 +77,8 @@ <h2 style="font-size: 1.6rem; text-align: left; letter-spacing: -0.5px; margin-t
             {% if workflow.config_params %}
             <h6 style="font-weight: 600; font-size: 0.92rem; margin-top: 1.5rem; margin-bottom: 0.75rem;">Template Configuration</h6>
             {% for param in workflow.config_params %}
-            <div class="mb-3">
-                <label for="param-{{ param.key }}" class="form-label" style="font-weight: 500; font-size: 0.88rem;">{{ param.label }}</label>
+            <div class="mb-3" {% if param.key in (credential_keys or []) %}data-cred-field="{{ param.key }}"{% endif %}>
+                <label for="param-{{ param.key }}" class="form-label enable-param-label">{{ param.label }}</label>
                 {# Required only when a saved credential set cannot supply
                    this field. The Credential Set dropdown above fills the
                    credential keys and nothing populates them client-side,
@@ -113,5 +120,54 @@ <h6 class="enable-section-heading">Webhook Authentication (optional)</h6>
         el.style.display = el.style.display === 'none' ? 'inline-block' : 'none';
     }
 }
+
+{# Credential-set fields.
+
+   The server prefers a selected credential set over anything typed into
+   these inputs (substitute_params), so leaving them visible both asked
+   for values that were already available and silently discarded what was
+   typed. Hide exactly the fields the chosen set fills, and disable them
+   so the browser does not submit them at all.
+
+   Per-set, not blanket: only "name" is required when saving a credential
+   set, so a set may supply any subset of the three. A field the set
+   cannot fill stays visible and becomes required, which turns what used
+   to be a server-side "missing value" error at enable time into ordinary
+   form validation.
+
+   No JS: every field stays visible and none is required -- the previous
+   behaviour, and still correct, because the server applies the same
+   precedence regardless. #}
+(function () {
+    var select = document.querySelector('[data-cred-select]');
+    if (!select) {
+        return;
+    }
+    var groups = document.querySelectorAll('[data-cred-field]');
+
+    function applyCredentialSet() {
+        var chosen = select.options[select.selectedIndex];
+        var supplied = ((chosen && chosen.dataset.supplies) || '')
+            .split(' ')
+            .filter(function (key) { return key !== ''; });
+
+        groups.forEach(function (group) {
+            var key = group.dataset.credField;
+            var input = group.querySelector('input');
+            var isSupplied = supplied.indexOf(key) !== -1;
+
+            group.classList.toggle('is-hidden', isSupplied);
+            if (input) {
+                // Disabled inputs are not submitted, so a stale typed
+                // value cannot reach the server and be silently dropped.
+                input.disabled = isSupplied;
+                input.required = !isSupplied;
+            }
+        });
+    }
+
+    select.addEventListener('change', applyCredentialSet);
+    applyCredentialSet();
+})();
 </script>
 {% endblock %}
diff --git a/tests/test_templates.py b/tests/test_templates.py
index e189214..2f4ce21 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -710,3 +710,142 @@ def test_template_view_has_no_direct_webhook_io():
     assert "_load_webhooks" not in src
     # No direct open() of the webhooks file remains.
     assert "open(WEBHOOKS_FILE" not in src
+
+
+# ---- credential-set fields on the enable form ----
+#
+# substitute_params prefers a selected credential set over anything typed
+# into the matching inputs. The form used to render those inputs anyway,
+# with a hint promising it would "auto-fill" them, and nothing populated
+# them. So the admin was asked for a client ID that was already
+# available, and anything typed there was silently discarded. The form
+# now hides exactly the fields the chosen set fills.
+
+
+def _write_credentials(jawa_env, sets):
+    jawa_env.credentials_file.write_text(json.dumps(sets))
+
+
+def test_credential_supplies_reports_only_keys_the_set_carries(jawa_env):
+    """Only "name" is required when saving a set, so sets can be partial."""
+    from views import template_view
+
+    supplies = template_view._credential_supplies(
+        [
+            {
+                "name": "full",
+                "server_url": "https://a.jamfcloud.com",
+                "client_id": "cid",
+                "client_secret": "sec",
+            },
+            # Partial: no secret. Its field must stay visible.
+            {
+                "name": "partial",
+                "server_url": "https://b.jamfcloud.com",
+                "client_id": "cid2",
+                "client_secret": "",
+            },
+            {"name": "name-only"},
+        ]
+    )
+    assert supplies == [
+        ["server_url", "client_id", "client_secret"],
+        ["server_url", "client_id"],
+        [],
+    ]
+
+
+def test_enable_form_marks_which_keys_each_set_supplies(
+    logged_in_client, jawa_env
+):
+    _write_credentials(
+        jawa_env,
+        [
+            {
+                "name": "full",
+                "server_url": "https://a.jamfcloud.com",
+                "client_id": "cid",
+                "client_secret": "sec",
+            },
+            {
+                "name": "partial",
+                "server_url": "https://b.jamfcloud.com",
+                "client_id": "",
+                "client_secret": "",
+            },
+        ],
+    )
+    body = logged_in_client.get(
+        "/templates/device-naming/enable"
+    ).get_data(as_text=True)
+
+    assert 'data-supplies="server_url client_id client_secret"' in body
+    assert 'data-supplies="server_url"' in body
+    # The credential-key field groups must be addressable by the toggle.
+    for key in ("server_url", "client_id", "client_secret"):
+        assert f'data-cred-field="{key}"' in body
+
+
+def test_enable_form_never_renders_credential_values(
+    logged_in_client, jawa_env
+):
+    """The page must carry key NAMES only.
+
+    Auto-filling the inputs would be the obvious fix and is the wrong
+    one: it puts the OAuth client secret in the DOM and in view-source.
+    """
+    secret = "sup3r-secret-value"
+    client_id = "sekrit-client-id"
+    _write_credentials(
+        jawa_env,
+        [
+            {
+                "name": "prod",
+                "server_url": "https://prod.jamfcloud.com",
+                "client_id": client_id,
+                "client_secret": secret,
+            }
+        ],
+    )
+    body = logged_in_client.get(
+        "/templates/device-naming/enable"
+    ).get_data(as_text=True)
+
+    assert secret not in body
+    assert client_id not in body
+    # The set's name and server URL are shown deliberately, to identify
+    # it in the dropdown.
+    assert "prod" in body
+
+
+def test_partial_credential_set_still_takes_typed_value(jawa_env):
+    """A key the set cannot supply falls through to the form."""
+    from views import template_view
+
+    workflow = {
+        "config_params": [
+            {
+                "key": "server_url",
+                "token": '"__JAWA_SERVER_URL__"',
+                "type": "text",
+            },
+            {
+                "key": "client_secret",
+                "token": '"__JAWA_CLIENT_SECRET__"',
+                "type": "password",
+            },
+        ]
+    }
+    out = template_view.substitute_params(
+        'u = "__JAWA_SERVER_URL__"\ns = "__JAWA_CLIENT_SECRET__"\n',
+        workflow,
+        {"server_url": "https://typed.example.com", "client_secret": "typed"},
+        [{"name": "partial", "server_url": "https://saved.jamfcloud.com"}],
+        "0",
+    )
+    # Saved set wins where it has a value...
+    assert "https://saved.jamfcloud.com" in out
+    assert "https://typed.example.com" not in out
+    # ...and the form fills the gap it cannot. Values are emitted via
+    # repr(), hence the single quotes.
+    assert "s = 'typed'" in out
diff --git a/views/template_view.py b/views/template_view.py
index 2b6fea0..4ef9329 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -175,6 +175,22 @@ def _install_package(
 
 CREDENTIAL_KEYS = ("server_url", "client_id", "client_secret")
 
+
+def _credential_supplies(
+    credentials: List[Dict[str, Any]],
+) -> List[List[str]]:
+    """For each saved credential set, the credential keys it can fill.
+
+    Key names only -- never the values. Mirrors the truth test in
+    substitute_params (``cred.get(key)`` must be non-empty) so the form
+    hides precisely the fields the server will override.
+    """
+    return [
+        [key for key in CREDENTIAL_KEYS if cred.get(key)]
+        for cred in credentials
+    ]
+
+
 # Every template token starts with this. Used as a tripwire: no computed
 # replacement may reintroduce one, and none may survive substitution.
 TOKEN_PREFIX = "__JAWA_"
@@ -644,6 +660,16 @@ def enable_template(slug: str) -> Union[Response, str]:
             # required only when a credential set cannot supply it, and
             # duplicating the three key names there would drift.
             credential_keys=CREDENTIAL_KEYS,
+            # Which credential keys each saved set can actually supply --
+            # names only, never values, because rendering a client secret
+            # into the page would expose it in the DOM and in view-source.
+            # Per-set rather than blanket, because only "name" is required
+            # when saving a credential set, so a set may carry any subset
+            # of the three. The form hides exactly the fields the chosen
+            # set fills, which is also what stops a typed value being
+            # silently discarded by substitute_params' credential-first
+            # precedence.
+            credential_supplies=_credential_supplies(credentials),
         )
 
     # POST: enable the template

From 9c3a68f904133cb34c2769fa72a1e1f93d7689eb Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Thu, 27 Aug 2026 21:55:53 -0500
Subject: [PATCH 80/84] test: assert the credential precedence by whole line,
 not URL substring

CodeQL flagged the assertion I added in 87b3e70 as
py/incomplete-url-substring-sanitization (high) -- the one new alert on
the release PR, and self-inflicted.

  assert "https://typed.example.com" not in out

It is a test assertion, not sanitization, so the finding is wrong about
intent. But the pattern it matches is a real bug class: checking a URL by
substring containment. Leaving it would mean asking the maintainer to
dismiss an alert on a public repo for something introduced during release
prep, which is a worse trade than rewriting two lines.

Now compares the whole generated output line by line. That is a stronger
assertion than containment -- it pins the exact emitted values including
repr() quoting, and would catch extra or reordered output that "in" would
not -- and it carries no URL substring check for the analyser to read as
a security control.

Behaviour under test is unchanged: the saved credential set wins for the
key it supplies, and the form fills the key a partial set cannot.
---
 tests/test_templates.py | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/tests/test_templates.py b/tests/test_templates.py
index 2f4ce21..26d28f9 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -843,9 +843,13 @@ def test_partial_credential_set_still_takes_typed_value(jawa_env):
         [{"name": "partial", "server_url": "https://saved.jamfcloud.com"}],
         "0",
     )
-    # Saved set wins where it has a value...
-    assert "https://saved.jamfcloud.com" in out
-    assert "https://typed.example.com" not in out
-    # ...and the form fills the gap it cannot. Values are emitted via
-    # repr(), hence the single quotes.
-    assert "s = 'typed'" in out
+    # Whole-line equality rather than substring containment: it pins the
+    # exact emitted value (repr(), hence single quotes), and a "URL not in
+    # output" assertion reads to static analysis like URL sanitization
+    # done by substring match, which is a real bug pattern -- just not
+    # this. Line 1 proves the saved set won; line 2 proves the form
+    # filled the key the partial set could not.
+    assert out.strip().split("\n") == [
+        "u = 'https://saved.jamfcloud.com'",
+        "s = 'typed'",
+    ]

From 888b74c2033b2ad49bdb91be0308d08f3d67af11 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Mon, 31 Aug 2026 12:00:41 -0500
Subject: [PATCH 81/84] fix: close five release blockers found reviewing the
 v3.2.0 PR (J23-J27)

A seven-lane specialist review of the develop -> main release PR, plus the
maintainer's manual gate on a real host, found five defects that would each
have shipped a broken or unsafe release. All five share one shape: something
reported success while doing nothing.

J24 - Six of seven bundled templates could not run on a real install.
The receiver spawns scripts bare, Popen([script_path, payload]), so the
shebang alone chooses the interpreter. Every bundled template shipped
"#!/usr/bin/env python3", which resolves to the SYSTEM python, while
installer.sh pip-installs requirements.txt into JAWA's venv only. Six of the
seven import requests, so they raised ModuleNotFoundError on first trigger -
and the receiver answered HTTP 200, so Jamf Pro recorded a successful
delivery. _write_script now retargets a python shebang to sys.executable,
the venv interpreter the service already runs under, which makes the
guarantee true by construction. A non-python shebang is left alone: an
uploaded script may legitimately be bash and its interpreter is the
operator's choice.

The three tests that were supposed to gate this all verified the wrong
interpreter. ruff --select F821,F401 does not resolve packages; the
exec(compile(...)) helper runs inside the pytest process, where requests is
importable by definition; and the shebang test only asserted a "#!" exists.
Added a deterministic assertion on the deployed shebang plus a test that
runs that shebang's own interpreter. The second cannot fail on a host whose
system python happens to have requests, CI included, so the first is the
real guard.

J23 - A fresh install could not enable ANY template. scripts/ is gitignored
with no tracked file and installer.sh installs by git clone, so the
directory does not exist; both writers opened a path inside it with no
makedirs anywhere in template_view. Worse, _create_jamf_webhook runs inside
the try/except while _write_script runs outside it, so the first template a
new operator enabled created the webhook in Jamf Pro, died with
FileNotFoundError, wrote no local record, and then hit HTTP 409 on every
retry with no in-product recovery. jamf_handler.process_create orders the
same two operations the opposite way, which is why the automation path
worked and the template path could not. CI cannot see this: pytest runs in a
tree that already has scripts/.

J25 - The receiver reported success for scripts that never ran. Proven by a
surviving mutation: inverting "if return_code != 0" left all 419 tests
passing, because both Popen stubs hard-code wait() -> 0 and neither can
raise. Three defects, one shape. The except branch returned str(err) as the
function's normal return type and the handler answered 200 "valid webhook
received" regardless, reachable via a retired script, a lost mode bit, or
any non-zero exit. decode("ascii") on the response path against
output.decode() on the log path turned a SUCCESSFUL run printing any
non-ASCII device name into a 500 that Jamf Pro then retried; fixing the
response path exposed the same bug in the log decode, so both are tolerant
now. And run_script had no fallback return, so a concurrent remove_webhook
between validate and run gave an AttributeError 500. Errors now raise
ScriptExecutionError; the handler answers 500 for a script that did not run
and 404 for a vanished entry. The mutation that survived now kills 12 tests.

J26 - Unauthenticated console access via an unvalidated active_url. Found
independently by two specialist lanes that could not see each other's work.
Pre-existing on main, so this is not a regression, but it is now known.
_resolve_url_from_server returned the POSTed value verbatim with no check
against the configured jps_url/alternate_jps, and every gate after that
point queries that same attacker-chosen host: get_token had no
raise_for_status, so any status with a JSON body carrying a truthy token
passed; _validate_credentials only checks that the token is truthy; and
_verify_jamf_access only checks the activationcode body's shape. A host
serving those two endpoints therefore reached the dashboard, and from there
a custom automation with an uploaded script plus POST /hooks/<name> is
arbitrary code execution as the jawa service user. The in-code comment "a
random website's JSON carries neither" named the wrong threat: it is not a
random website, it is an attacker-chosen one. Now allow-listed against the
configured URLs (slash-insensitive), with raise_for_status and a
token-less-2xx rejection in tokens.py. Unconfigured installs still accept a
typed URL for first-time setup, since there is nothing to check against.

J27 - The bundled Return-to-Service template was an unauthenticated
fleet-erase primitive. It took event["groupAddedDevicesIds"] straight from
the POST body and issued ERASE_DEVICE per id with no membership re-check and
no cap: a confused deputy holding OAuth credentials the caller does not.
Three things made it reachable. The hook name is published in this repo.
Both auth radios rendered unchecked, so no choice was posted and
validate_webhook returned True for a request carrying no credentials. And
grep -n enabled webhook/jawa_receiver.py returned nothing: template_view
stores "enabled": False for this trigger and the UI says "NOTICE! This
webhook is not yet enabled", but the receiver never read the field, so that
notice was false and the endpoint was live and open from that moment.

The receiver now honours enabled - only an explicit False rejects, because
the non-template handlers write no such key - and breaks at the first name
match, since two entries sharing a name let the last decide authentication
while run_script executed the first. return_to_service re-reads current
group membership from Jamf Pro by event["jssID"] and refuses any id the
group does not contain, so a forged payload can only name devices the
automation was meant to act on. New exit codes 13 and 14 are declared in the
catalog.

The compounding UI bug is fixed too: jamf_auth_fields are radios wired to
the shared toggleAuthField(), which flips one div. That is correct for the
checkboxes in auth_fields() but wrong for radios, whose change event fires
only on gaining selection - so Basic -> Custom -> Basic ended with Basic
selected and its fields hidden, and submitting wrote authentication_type
NONE while the screen showed Basic. Replaced with selectJamfAuthMode(),
hide-all-then-show-one, plus an explicit "No authentication" radio so the
documented default is visible and reversible. The edit form reflects stored
state.

Also in this change, smaller and independently worth it:

- _build_auth_xml interpolated the basic username and password raw into the
  webhook XML while _build_webhook_xml twelve lines above escapes name and
  event. A password closing its own element could inject a second <url>,
  pointing Jamf Pro's deliveries elsewhere while JAWA's record and success
  page both showed the JAWA callback. A benign "&" also produced a body Jamf
  rejects with an opaque error.
- Generated scripts were chmod 0o755 at three sites, and substitute_params
  bakes the credential set's client_secret into that source. The explicit
  chmod overrode a hardened umask, so an operator running umask 077 still
  handed the secret to every local account on a host whose whole point is an
  isolated jawa service user. Now 0o700; the receiver runs them as the same
  user that owns them, so nothing is lost.
- The last three outbound calls in bundled scripts had no timeout, which
  pins a Waitress worker until the kernel drops the socket - indefinitely
  for a peer that stops responding without closing. Added, with an AST-based
  guard test so it cannot regress.

Two test corrections, both cases where the test asserted the wrong thing:
test_blank_auth_field_does_not_lock_the_webhook_out asserted 200 as a proxy
for "not rejected", which held only because the receiver swallowed a
non-zero script exit; it now asserts the 401 lockout it exists to guard.
test_deployed_script_is_executable asserted mode == 0o755 on the reasoning
that the receiver execs the path directly, but the receiver runs as the
owner, so owner-execute is the whole requirement; it now asserts that and
that no group or other bit is set.

28 tests added. Teeth verified by mutation on the receiver exit-code check,
the shebang retarget and the active_url allow-list: each fails its new tests
when reverted. 452 passed, 146 skipped, ruff clean.
---
 bin/data_store.py                            |   7 +-
 bin/tokens.py                                |  15 +-
 data/workflows/scripts/ea_update.py          |   1 +
 data/workflows/scripts/return_to_service.py  |  49 ++++++-
 data/workflows/scripts/smart_group_slack.py  |   1 +
 data/workflows/scripts/teams_notification.py |   1 +
 data/workflows/workflow_config.json          |   4 +-
 templates/automations/create.html            |  10 ++
 templates/automations/edit.html              |  10 ++
 templates/shared/_macros.html                |  29 +++-
 templates/workflows/enable.html              |  10 ++
 tests/test_automations.py                    |  42 ++++++
 tests/test_login.py                          | 137 +++++++++++++++++
 tests/test_receiver.py                       | 147 +++++++++++++++++++
 tests/test_template_catalog.py               | 145 +++++++++++++++++-
 tests/test_templates.py                      |  11 +-
 views/_type_handlers/jamf_handler.py         |  14 +-
 views/home_view.py                           |  57 +++++--
 views/template_view.py                       |  61 +++++++-
 webhook/jawa_receiver.py                     |  58 +++++++-
 20 files changed, 775 insertions(+), 34 deletions(-)

diff --git a/bin/data_store.py b/bin/data_store.py
index 4dc7922..1aa8142 100644
--- a/bin/data_store.py
+++ b/bin/data_store.py
@@ -257,7 +257,12 @@ def save_script(
     safe_name = secure_filename(new_filename)
     filepath = os.path.join(SCRIPTS_DIR, safe_name)
     file_storage.save(filepath)
-    os.chmod(filepath, mode=0o0755)
+    # Owner-only. The receiver runs this as the same `jawa` user that
+    # owns it, so the group/other read bits only ever widened who could
+    # read a script that may hold credentials. The shebang is left as
+    # the operator wrote it -- an uploaded script may legitimately be
+    # bash, and choosing its interpreter is theirs.
+    os.chmod(filepath, mode=0o0700)
     return filepath
 
 
diff --git a/bin/tokens.py b/bin/tokens.py
index cd9441c..5d8fb96 100644
--- a/bin/tokens.py
+++ b/bin/tokens.py
@@ -48,9 +48,20 @@ def get_token() -> Optional[Response]:
             f"{session['url']}/api/v1/auth/token",
             headers={"Authorization": f"Basic {session['b64_auth'].decode()}"},
         )
+        # Without this, a non-2xx passes: Jamf Pro answers a JSON body on
+        # 401/503 too, so resp.json() succeeds and data.get("token")
+        # returns None -- which was then stored and returned exactly like
+        # a success, leaving _validate_credentials' truthiness check as
+        # the only thing standing between a failed fetch and a session.
+        resp.raise_for_status()
         data = resp.json()
-        session["token"] = data.get("token")
-        session["expires"] = data.get("expires")
+        token = data.get("token")
+        expires = data.get("expires")
+        if not token or not expires:
+            # A 2xx carrying no token is not a token.
+            raise ValueError("token response contained no token/expires")
+        session["token"] = token
+        session["expires"] = expires
     except Exception as err:
         logthis.error(
             f"[{session.get('url')}] Could not get a token using session credentials: {err}.  Logging out."
diff --git a/data/workflows/scripts/ea_update.py b/data/workflows/scripts/ea_update.py
index d314b2a..5ecaa2d 100755
--- a/data/workflows/scripts/ea_update.py
+++ b/data/workflows/scripts/ea_update.py
@@ -120,6 +120,7 @@ def main():
             "Authorization": f"Bearer {token}",
         },
         data=xml_data,
+        timeout=30,
     )
     resp.raise_for_status()
     print(f"Updated EA '{ea_name}' = '{value}' for device {device_id}")
diff --git a/data/workflows/scripts/return_to_service.py b/data/workflows/scripts/return_to_service.py
index 2a6abb1..b55125c 100755
--- a/data/workflows/scripts/return_to_service.py
+++ b/data/workflows/scripts/return_to_service.py
@@ -128,15 +128,59 @@ def build_ea_xml(ea_name, value):
     )
 
 
+def current_group_member_ids(config, group_id):
+    """Jamf Pro's own view of who is in the smart group, right now.
+
+    The webhook payload arrives on an endpoint that may be
+    unauthenticated, and this script issues ERASE_DEVICE for every id the
+    payload names -- so without this it is a confused deputy: it holds
+    OAuth credentials the caller does not and acts on the caller's target
+    list. Re-reading membership from Jamf Pro means a forged payload can
+    only name devices that are genuinely in the group, which is exactly
+    what the automation is meant to act on.
+    """
+    resp = requests.get(
+        f"{config.server_url}/JSSResource/mobiledevicegroups/id/{group_id}",
+        headers=get_headers(),
+        timeout=30,
+    )
+    resp.raise_for_status()
+    group = resp.json().get("mobile_device_group", {})
+    return {
+        int(device["id"])
+        for device in group.get("mobile_devices", [])
+        if str(device.get("id", "")).isdigit()
+    }
+
+
 def main():
     config = Config()
     # 1. Parse event
     event_data = json.loads(sys.argv[1])
-    id_list = event_data["event"]["groupAddedDevicesIds"]
+    event = event_data["event"]
+    id_list = event["groupAddedDevicesIds"]
     if not id_list:
         print("No devices entered the group.")
         sys.exit(12)
 
+    # Never erase on the payload's word alone.
+    group_id = event.get("jssID")
+    if not group_id:
+        print("Payload named no smart group (jssID); refusing to erase.")
+        sys.exit(13)
+    members = current_group_member_ids(config, group_id)
+    verified = [i for i in id_list if str(i).isdigit() and int(i) in members]
+    refused = [i for i in id_list if i not in verified]
+    if refused:
+        print(
+            f"Refusing {len(refused)} device(s) the payload named but smart "
+            f"group {group_id} does not currently contain: {refused}"
+        )
+    if not verified:
+        print("No payload device is a current group member; nothing to do.")
+        sys.exit(14)
+    id_list = verified
+
     # 2. Encode WiFi payload
     wifi_b64 = base64.b64encode(WIFI_PAYLOAD).decode("ascii")
 
@@ -149,6 +193,7 @@ def main():
             f"{config.server_url}/JSSResource/mobiledevices/id/{jss_id}",
             headers=headers,
             data=ea_xml,
+            timeout=30,
         )
 
         # Look up managementId
@@ -156,6 +201,7 @@ def main():
         resp = requests.get(
             f"{config.server_url}/api/v2/mobile-devices/{jss_id}",
             headers=headers,
+            timeout=30,
         )
         mgmt_id = resp.json().get("managementId")
 
@@ -176,6 +222,7 @@ def main():
             f"{config.server_url}/api/v2/mdm/commands",
             headers=get_headers(),
             json=erase_json,
+            timeout=30,
         )
         resp.raise_for_status()
         print(f"Device {jss_id}: RtS command sent.")
diff --git a/data/workflows/scripts/smart_group_slack.py b/data/workflows/scripts/smart_group_slack.py
index d3cdacf..84dffa3 100755
--- a/data/workflows/scripts/smart_group_slack.py
+++ b/data/workflows/scripts/smart_group_slack.py
@@ -40,6 +40,7 @@ def main():
         SLACK_WEBHOOK_URL,
         data=json.dumps(slack_data),
         headers={"Content-Type": "application/json"},
+        timeout=30,
     )
     print(f"Slack notification: {resp.status_code}")
 
diff --git a/data/workflows/scripts/teams_notification.py b/data/workflows/scripts/teams_notification.py
index 2211d9f..5f6496f 100755
--- a/data/workflows/scripts/teams_notification.py
+++ b/data/workflows/scripts/teams_notification.py
@@ -81,6 +81,7 @@ def send_teams_notification(webhook_url, title, message, facts=None):
         webhook_url,
         data=json.dumps(card),
         headers={"Content-Type": "application/json"},
+        timeout=30,
     )
     return response.status_code == 200
 
diff --git a/data/workflows/workflow_config.json b/data/workflows/workflow_config.json
index 6ae90d1..3e46e46 100644
--- a/data/workflows/workflow_config.json
+++ b/data/workflows/workflow_config.json
@@ -164,7 +164,9 @@
         ],
         "exit_codes": [
             {"code": 0, "meaning": "Success — erase with RtS sent"},
-            {"code": 12, "meaning": "No devices entered the group"}
+            {"code": 12, "meaning": "No devices entered the group"},
+            {"code": 13, "meaning": "Payload named no smart group (jssID) to verify against"},
+            {"code": 14, "meaning": "No payload device is a current member of the smart group"}
         ],
         "tags": ["smart-group", "mobile", "erase", "return-to-service", "wipe"],
         "order": 4
diff --git a/templates/automations/create.html b/templates/automations/create.html
index 4435283..e03589e 100644
--- a/templates/automations/create.html
+++ b/templates/automations/create.html
@@ -106,6 +106,16 @@ <h1>New {{ handler.display_name }}
     }
 }
 
+function selectJamfAuthMode(mode) {
+    // Radios, not checkboxes: show exactly one mode's fields and hide
+    // the rest. toggleAuthField() flips a single div, which cannot
+    // clear the mode a radio just lost.
+    ['basic', 'custom'].forEach(function (m) {
+        var el = document.getElementById('jamf-auth-' + m + '-fields');
+        if (el) { el.classList.toggle('is-hidden', m !== mode); }
+    });
+}
+
 function showSmartGroupNote(event) {
     var note = document.getElementById('smartGroupNote');
     if (note) {
diff --git a/templates/automations/edit.html b/templates/automations/edit.html
index 03d2800..7ded806 100644
--- a/templates/automations/edit.html
+++ b/templates/automations/edit.html
@@ -147,6 +147,16 @@ <h1>Edit {{ handler.display_name }}
     }
 }
 
+function selectJamfAuthMode(mode) {
+    // Radios, not checkboxes: show exactly one mode's fields and hide
+    // the rest. toggleAuthField() flips a single div, which cannot
+    // clear the mode a radio just lost.
+    ['basic', 'custom'].forEach(function (m) {
+        var el = document.getElementById('jamf-auth-' + m + '-fields');
+        if (el) { el.classList.toggle('is-hidden', m !== mode); }
+    });
+}
+
 function showSmartGroupNote(event) {
     var note = document.getElementById('smartGroupNote');
     if (note) {
diff --git a/templates/shared/_macros.html b/templates/shared/_macros.html
index 774c84c..d49b531 100644
--- a/templates/shared/_macros.html
+++ b/templates/shared/_macros.html
@@ -254,15 +254,35 @@ <h1 class="delete-title">Delete {{ item_type }}?</h1>
 {% endmacro %}
 
 {% macro jamf_auth_fields(webhook_info=none) %}
+{# These are RADIOS, so they need hide-all-then-show-one. The shared
+   toggleAuthField() FLIPS one div, which is right for the checkboxes in
+   auth_fields() above but wrong here: a radio's change event fires only
+   on gaining selection, never on losing it. Basic -> Custom -> Basic
+   therefore ended with Basic SELECTED and its fields HIDDEN, and
+   submitting that wrote authentication_type NONE while the screen said
+   Basic -- a silently unauthenticated webhook. An explicit "No
+   authentication" radio also makes the documented default visible and
+   gives the operator a way back, which two radios alone did not. #}
+{% set has_basic = webhook_info and webhook_info[0].webhook_username not in (none, '', 'null') %}
+{% set has_custom = webhook_info and webhook_info[0].api_key not in (none, '', 'null') %}
+<div class="d-flex justify-content-center">
+    <label>
+        <input type="radio" name="choice" value="none"
+               {% if not has_basic and not has_custom %}checked{% endif %}
+               onchange="selectJamfAuthMode('none')">
+        <b>&nbsp;No authentication</b>
+    </label>
+</div>
 <div class="d-flex justify-content-center">
     <label>
         <input type="radio" name="choice" value="basic"
-               onchange="toggleAuthField('jamf-auth-basic-fields')">
+               {% if has_basic %}checked{% endif %}
+               onchange="selectJamfAuthMode('basic')">
         <b>&nbsp;Basic Authentication (optional):</b>
     </label>
 </div>
 <div class="d-flex justify-content-center">
-    <div id="jamf-auth-basic-fields" style="display:none" class="center_box">
+    <div id="jamf-auth-basic-fields" class="center_box{% if not has_basic %} is-hidden{% endif %}">
         <div class="d-flex justify-content-center">
             <input class="form-control-sm" name="basic_username" title="Username (optional)"
                    autocomplete="off" placeholder="Username (optional)" style="padding: unset"
@@ -275,12 +295,13 @@ <h1 class="delete-title">Delete {{ item_type }}?</h1>
 <div class="d-flex justify-content-center">
     <label>
         <input type="radio" name="choice" value="custom"
-               onchange="toggleAuthField('jamf-auth-custom-fields')">
+               {% if has_custom %}checked{% endif %}
+               onchange="selectJamfAuthMode('custom')">
         <b>&nbsp;Custom Authentication (optional):</b>
     </label>
 </div>
 <div class="d-flex justify-content-center">
-    <div id="jamf-auth-custom-fields" style="display:none">
+    <div id="jamf-auth-custom-fields"{% if not has_custom %} class="is-hidden"{% endif %}>
         <input name="api_key" class="form-control-sm" title="x-api-key (optional)"
                placeholder="x-api-key value (optional)" autocomplete="off"
                {% if webhook_info and webhook_info[0].api_key != 'null' %}value="{{ webhook_info[0].api_key }}"{% endif %}>
diff --git a/templates/workflows/enable.html b/templates/workflows/enable.html
index 15ad59d..d73a5d8 100644
--- a/templates/workflows/enable.html
+++ b/templates/workflows/enable.html
@@ -121,6 +121,16 @@ <h6 class="enable-section-heading">Webhook Authentication (optional)</h6>
     }
 }
 
+function selectJamfAuthMode(mode) {
+    // Radios, not checkboxes: show exactly one mode's fields and hide
+    // the rest. toggleAuthField() flips a single div, which cannot
+    // clear the mode a radio just lost.
+    ['basic', 'custom'].forEach(function (m) {
+        var el = document.getElementById('jamf-auth-' + m + '-fields');
+        if (el) { el.classList.toggle('is-hidden', m !== mode); }
+    });
+}
+
 {# Credential-set fields.
 
    The server prefers a selected credential set over anything typed into
diff --git a/tests/test_automations.py b/tests/test_automations.py
index e6e1bd5..a2b56b7 100644
--- a/tests/test_automations.py
+++ b/tests/test_automations.py
@@ -130,3 +130,45 @@ def test_success_has_forward_actions_not_history_back(
     # Forward actions present: Create another (for this type) + Dashboard.
     assert "/automations/custom/new" in body   # Create another
     assert "/dashboard" in body                # Dashboard
+
+
+# --- Jamf Pro webhook XML: every interpolated value must be escaped ---
+
+
+def test_auth_xml_escapes_the_basic_credentials():
+    """A password that closes its own element must not inject siblings.
+
+    _build_webhook_xml already escapes name and event with a comment
+    explaining why hand-built f-string XML has to. _build_auth_xml, in
+    the same file, interpolated raw form values -- so a crafted password
+    could add a second <url> element to the <webhook> object, pointing
+    Jamf Pro's event deliveries at another host while JAWA's own record
+    and success page still showed the JAWA callback URL.
+    """
+    from views._type_handlers.jamf_handler import _build_auth_xml
+
+    hostile = (
+        "s3cret</password><url>https://attacker.example/hooks/x</url>"
+        "<password>s3cret"
+    )
+    xml = _build_auth_xml(
+        {"choice": "basic", "basic_username": "admin", "basic_password": hostile}
+    )
+    assert "<url>" not in xml, f"injected a <url> element: {xml}"
+    assert "attacker.example" not in xml or "&lt;url&gt;" in xml
+    assert xml.count("<password>") == 1, f"injected a second element: {xml}"
+
+
+def test_auth_xml_survives_an_ordinary_ampersand():
+    """The benign case needs no malice: & alone made Jamf reject the body."""
+    from views._type_handlers.jamf_handler import _build_auth_xml
+
+    xml = _build_auth_xml(
+        {
+            "choice": "basic",
+            "basic_username": "a&b",
+            "basic_password": "p<q>r",
+        }
+    )
+    assert "<username>a&amp;b</username>" in xml
+    assert "<password>p&lt;q&gt;r</password>" in xml
diff --git a/tests/test_login.py b/tests/test_login.py
index 5d731d0..3138eff 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -1,5 +1,7 @@
 """Console login flow against a fully faked Jamf Pro."""
 
+import pytest
+
 
 def test_successful_login_reaches_dashboard(logged_in_client):
     resp = logged_in_client.get("/dashboard")
@@ -357,3 +359,138 @@ def test_login_rejects_json_200_that_is_not_jamf(
     assert resp.status_code == 302
     assert "/dashboard" not in resp.headers.get("Location", "")
     assert "/logout" in resp.headers.get("Location", "")
+
+
+# --- active_url must be one of the URLs this JAWA is configured for ---
+#
+# Both login gates query whatever host session["url"] names, so a host
+# the caller chooses answers both of them: get_token() had no
+# raise_for_status (any status with a JSON "token" passed) and
+# _verify_jamf_access only checks the activationcode body's shape. The
+# login page renders active_url as a two-option <select> over the
+# configured URLs, so the UI presents the server as pinned -- but the
+# resolver honoured any POSTed value. An allow-list here is what makes
+# the downstream gates mean anything.
+
+
+def _login_against(client, jawa_env, monkeypatch, active_url, configured):
+    """POST /login with a chosen active_url against a Jamf-shaped host."""
+    import json as _json
+
+    import requests
+
+    jawa_env.server_file.write_text(_json.dumps(configured))
+    monkeypatch.setattr(
+        requests, "post", lambda *a, **k: _ShapedActivationCode("token")
+    )
+    monkeypatch.setattr(
+        requests,
+        "get",
+        lambda *a, **k: _ShapedActivationCode(
+            "activationcode",
+            {"license_information": {"organization_name": "Test Org"}},
+        ),
+    )
+    return client.post(
+        "/login",
+        data={
+            "active_url": active_url,
+            "username": "admin",
+            "password": "hunter2",
+        },
+    )
+
+
+CONFIGURED = {
+    "brand": "JAWA",
+    "jps_url": "https://primary.jamfcloud.test",
+    "alternate_jps": "https://alternate.jamfcloud.test",
+}
+
+
+@pytest.mark.parametrize(
+    "hostile",
+    [
+        pytest.param("https://attacker.example", id="off-list-host"),
+        pytest.param("http://127.0.0.1:8000", id="loopback"),
+        pytest.param(
+            "https://primary.jamfcloud.test.attacker.example",
+            id="suffix-lookalike",
+        ),
+        pytest.param(
+            "https://attacker.example#https://primary.jamfcloud.test",
+            id="fragment-smuggle",
+        ),
+    ],
+)
+def test_login_refuses_an_unconfigured_active_url(
+    client, jawa_env, monkeypatch, hostile
+):
+    """The attacker's host answers both gates Jamf-shaped and still fails.
+
+    Both mocks here are deliberately cooperative -- they return exactly
+    what a real Jamf Pro returns. That is the point: the shape checks
+    cannot distinguish an attacker-chosen host, so only the allow-list
+    can.
+    """
+    resp = _login_against(client, jawa_env, monkeypatch, hostile, CONFIGURED)
+    with client.session_transaction() as sess:
+        assert "username" not in sess, (
+            f"logged in against {hostile!r}, which is not a configured "
+            f"Jamf Pro URL"
+        )
+    location = resp.headers.get("Location", "")
+    assert resp.status_code == 302
+    assert "/dashboard" not in location
+    assert "/logout" in location
+    assert "Unrecognized+server" in location or "Unrecognized%20server" in location
+
+
+@pytest.mark.parametrize(
+    "allowed",
+    [
+        pytest.param("https://primary.jamfcloud.test", id="primary"),
+        pytest.param("https://alternate.jamfcloud.test", id="alternate"),
+        pytest.param("https://primary.jamfcloud.test/", id="trailing-slash"),
+    ],
+)
+def test_login_still_accepts_a_configured_active_url(
+    client, jawa_env, monkeypatch, allowed
+):
+    """The alternate-JPS feature must keep working, slash-insensitively."""
+    resp = _login_against(client, jawa_env, monkeypatch, allowed, CONFIGURED)
+    with client.session_transaction() as sess:
+        assert sess.get("username") == "admin", (
+            f"a configured URL ({allowed!r}) was refused"
+        )
+    assert "/dashboard" in resp.headers.get("Location", "")
+
+
+def test_unconfigured_install_still_accepts_a_typed_url(
+    client, jawa_env, monkeypatch
+):
+    """First-time setup has nothing to check against, so free text stands."""
+    import json as _json
+
+    import requests
+
+    jawa_env.server_file.write_text(_json.dumps({"brand": "JAWA"}))
+    monkeypatch.setattr(
+        requests, "post", lambda *a, **k: _ShapedActivationCode("token")
+    )
+    monkeypatch.setattr(
+        requests,
+        "get",
+        lambda *a, **k: _ShapedActivationCode(
+            "activationcode", {"activation_code": {"code": "AAAA"}}
+        ),
+    )
+    resp = client.post(
+        "/login",
+        data={
+            "url": "https://fresh.jamfcloud.test",
+            "username": "admin",
+            "password": "hunter2",
+        },
+    )
+    assert "/dashboard" in resp.headers.get("Location", "")
diff --git a/tests/test_receiver.py b/tests/test_receiver.py
index 4962c5c..b69edc3 100644
--- a/tests/test_receiver.py
+++ b/tests/test_receiver.py
@@ -210,3 +210,150 @@ def test_get_method_returns_405(client, jawa_env, fake_popen):
     resp = client.get("/hooks/testhook")
     assert resp.status_code == 405
     assert fake_popen.calls == []
+
+
+class ConfigurablePopen:
+    """A Popen stub whose failure dimensions are actually variable.
+
+    RecordingPopen hard-codes ASCII stdout and `wait() -> 0`, so the two
+    dimensions the receiver narrows -- the decode and the exit code --
+    could not fail in the suite. Inverting `if return_code != 0:` in
+    jawa_receiver used to leave all 419 tests passing.
+    """
+
+    def __init__(self, stdout=b"", returncode=0, raises=None):
+        self._stdout = stdout
+        self._returncode = returncode
+        self._raises = raises
+
+    def __call__(self, args, stdout=None, stderr=None):
+        if self._raises is not None:
+            raise self._raises
+        self.stdout = io.BytesIO(self._stdout)
+        return self
+
+    def wait(self):
+        return self._returncode
+
+
+def _post_hook(client, jawa_env, monkeypatch, popen, **overrides):
+    _make_webhook(jawa_env, **overrides)
+    monkeypatch.setattr(subprocess, "Popen", popen)
+    return client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers=_basic_auth("hookuser", "hookpass"),
+    )
+
+
+@pytest.mark.parametrize(
+    "stdout",
+    [
+        pytest.param("Renamed café-MacBook\n".encode(), id="utf8-accent"),
+        pytest.param("記録しました\n".encode(), id="utf8-cjk"),
+        pytest.param(b"latin-1 caf\xe9\n", id="invalid-utf8"),
+    ],
+)
+def test_non_ascii_script_output_does_not_fail_the_request(
+    client, jawa_env, monkeypatch, stdout
+):
+    """A device name with an accent is not an error.
+
+    The response path decoded ascii while the log path decoded utf-8, so
+    a script that exited 0 and printed a non-ASCII device name raised
+    UnicodeDecodeError -> HTTP 500. Jamf Pro then recorded a failed
+    delivery for work that had already succeeded, and retried it.
+    Jamf device names are user-assigned and routinely non-ASCII.
+    """
+    resp = _post_hook(
+        client,
+        jawa_env,
+        monkeypatch,
+        ConfigurablePopen(stdout=stdout, returncode=0),
+        output=True,
+    )
+    assert resp.status_code == 202, (
+        f"successful script with non-ASCII stdout returned "
+        f"{resp.status_code}"
+    )
+
+
+def test_non_zero_exit_is_not_reported_as_success(
+    client, jawa_env, monkeypatch
+):
+    """A script that ran and failed must not answer 2xx.
+
+    This is the assertion whose absence let `if return_code != 0:` be
+    inverted with the whole suite still green.
+    """
+    resp = _post_hook(
+        client,
+        jawa_env,
+        monkeypatch,
+        ConfigurablePopen(stdout=b"boom\n", returncode=1),
+    )
+    assert resp.status_code >= 500, (
+        f"script exited 1 but the receiver answered {resp.status_code}; "
+        f"Jamf Pro would record a successful delivery"
+    )
+
+
+@pytest.mark.parametrize(
+    "err",
+    [
+        pytest.param(FileNotFoundError("no such script"), id="missing"),
+        pytest.param(PermissionError("not executable"), id="not-executable"),
+    ],
+)
+def test_script_that_cannot_start_is_not_reported_as_success(
+    client, jawa_env, monkeypatch, err
+):
+    """A retired or chmod-stripped script must not answer 2xx.
+
+    Deleting a webhook while Jamf Pro is unreachable retires the script
+    but leaves the Jamf webhook enabled, so this is reachable without
+    anyone hand-editing anything.
+    """
+    resp = _post_hook(
+        client, jawa_env, monkeypatch, ConfigurablePopen(raises=err)
+    )
+    assert resp.status_code >= 500, (
+        f"Popen raised {type(err).__name__} but the receiver answered "
+        f"{resp.status_code}"
+    )
+    assert "valid webhook received" not in resp.get_data(as_text=True)
+
+
+def test_disabled_template_webhook_is_refused(client, jawa_env, fake_popen):
+    """`enabled: False` must mean the JAWA endpoint is not live.
+
+    template_view stores enabled=False for triggers Jamf Pro creates in
+    the disabled state, and the enable screen tells the operator the
+    webhook "is not yet enabled". The receiver never read the field, so
+    that notice was false and the endpoint was open from that moment.
+    """
+    _make_webhook(jawa_env, enabled=False)
+    resp = client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers=_basic_auth("hookuser", "hookpass"),
+    )
+    assert resp.status_code == 401
+    assert fake_popen.calls == [], "a disabled automation executed its script"
+
+
+def test_absent_enabled_key_still_runs(client, jawa_env, fake_popen):
+    """Only an explicit False rejects.
+
+    The non-template handlers write no `enabled` key at all, so treating
+    a missing key as disabled would break every Jamf Pro, Okta, custom
+    and timed automation.
+    """
+    _make_webhook(jawa_env)
+    resp = client.post(
+        "/hooks/testhook",
+        json=PAYLOAD,
+        headers=_basic_auth("hookuser", "hookpass"),
+    )
+    assert resp.status_code == 200
+    assert len(fake_popen.calls) == 1
diff --git a/tests/test_template_catalog.py b/tests/test_template_catalog.py
index 6f0f471..c0fccbd 100644
--- a/tests/test_template_catalog.py
+++ b/tests/test_template_catalog.py
@@ -1035,7 +1035,148 @@ def test_deployed_script_is_executable(jawa_env):
         "mode-check", "#!/usr/bin/env python3\nprint('hi')\n"
     )
     mode = stat.S_IMODE(os.stat(dest).st_mode)
-    assert mode == 0o755, (
+    assert mode & stat.S_IXUSR, (
         f"_write_script left {oct(mode)} on {dest}; the receiver execs "
-        f"this path directly, so it must be 0o755"
+        f"this path directly, so the owner execute bit is required"
+    )
+    # The receiver runs as the same `jawa` user that owns the file, so
+    # owner-execute is the whole requirement -- and substitute_params
+    # bakes the credential set's client_secret into this source, so any
+    # group or other bit hands that secret to every local account.
+    leaked = mode & (
+        stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
+        | stat.S_IROTH | stat.S_IWOTH | stat.S_IXOTH
+    )
+    assert not leaked, (
+        f"_write_script left {oct(mode)} on {dest}; this file can hold a "
+        f"client_secret and must not be readable beyond its owner"
+    )
+
+
+def test_write_script_retargets_a_python_shebang(jawa_env):
+    """J17: the deployed script must name an interpreter that has the deps.
+
+    The receiver spawns scripts bare -- Popen([script_path, payload]) --
+    so the shebang alone picks the interpreter. `#!/usr/bin/env python3`
+    resolves to the SYSTEM python, but installer.sh pip-installs
+    requirements.txt into JAWA's venv only, and six of the seven bundled
+    templates import `requests`. They raised ModuleNotFoundError on
+    first trigger while the receiver reported success.
+    """
+    import sys
+
+    from views import template_view
+
+    dest = template_view._write_script(
+        "shebang-check", "#!/usr/bin/env python3\nprint('hi')\n"
+    )
+    first_line = open(dest, encoding="utf-8").readline().rstrip("\n")
+    assert first_line == f"#!{sys.executable}", (
+        f"deployed shebang is {first_line!r}; it must name the "
+        f"interpreter JAWA itself runs under, which is the one with "
+        f"requirements.txt installed"
+    )
+
+
+def test_write_script_leaves_a_non_python_shebang_alone(jawa_env):
+    """An operator's bash script is theirs; only python is retargeted."""
+    from views import template_view
+
+    dest = template_view._write_script(
+        "bash-check", "#!/bin/bash\necho hi\n"
+    )
+    first_line = open(dest, encoding="utf-8").readline().rstrip("\n")
+    assert first_line == "#!/bin/bash"
+
+
+def _non_stdlib_imports(source: str) -> set:
+    """Top-level third-party module names imported by a script."""
+    import ast
+    import sys
+
+    stdlib = getattr(sys, "stdlib_module_names", frozenset())
+    found = set()
+    for node in ast.walk(ast.parse(source)):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                found.add(alias.name.split(".")[0])
+        elif isinstance(node, ast.ImportFrom) and node.level == 0:
+            if node.module:
+                found.add(node.module.split(".")[0])
+    return {m for m in found if m and m not in stdlib}
+
+
+def test_deployed_script_interpreter_can_import_its_dependencies(
+    workflow, jawa_env
+):
+    """The invariant "JAWA never registers a template it cannot run".
+
+    The three pre-existing gates all verified the WRONG interpreter:
+    `ruff --select F821,F401` does not resolve packages, the
+    exec(compile(...)) helper runs inside the pytest process where
+    `requests` is importable by definition, and the shebang test only
+    asserted a `#!` exists. This one runs the deployed script's own
+    interpreter, which is the resolution the receiver actually uses.
+    """
+    import subprocess
+
+    from views import template_view
+
+    slug = workflow["slug"]
+    source = _script_source(workflow)
+    needed = _non_stdlib_imports(source)
+    if not needed:
+        pytest.skip(f"{slug} imports nothing outside the stdlib")
+
+    dest = template_view._write_script(f"dep-check-{slug}", source)
+    shebang = open(dest, encoding="utf-8").readline().rstrip("\n")
+    assert shebang.startswith("#!"), f"{slug} lost its shebang"
+    interpreter = shebang[2:].strip().split()
+
+    for module in sorted(needed):
+        proc = subprocess.run(
+            interpreter + ["-c", f"import {module}"],
+            capture_output=True,
+        )
+        assert proc.returncode == 0, (
+            f"{slug} imports {module!r}, but the interpreter its deployed "
+            f"shebang names ({' '.join(interpreter)}) cannot import it. "
+            f"The receiver spawns this script bare, so this is the "
+            f"interpreter that will actually run it.\n"
+            f"{proc.stderr.decode('utf-8', errors='replace')}"
+        )
+
+
+def test_every_outbound_call_in_a_bundled_script_is_bounded(workflow):
+    """An unbounded HTTP call pins a Waitress worker until the kernel gives up.
+
+    The receiver blocks the request thread for the whole life of the
+    script (proc.stdout.read() then proc.wait(), no timeout), and the
+    app serves with threads=15 shared with the console. `requests`
+    without `timeout=` inherits no socket timeout at all -- indefinitely
+    for a peer that stops responding without closing. Slack and Teams are
+    internet endpoints reached from a self-hosted box behind a corporate
+    egress path, which is exactly where silent drops happen.
+    """
+    import ast
+
+    source = _script_source(workflow)
+    unbounded = []
+    for node in ast.walk(ast.parse(source)):
+        if not isinstance(node, ast.Call):
+            continue
+        func = node.func
+        if not isinstance(func, ast.Attribute):
+            continue
+        if not (isinstance(func.value, ast.Name) and func.value.id == "requests"):
+            continue
+        if func.attr not in ("get", "post", "put", "delete", "patch", "request"):
+            continue
+        if not any(kw.arg == "timeout" for kw in node.keywords):
+            unbounded.append(f"line {node.lineno}: requests.{func.attr}")
+
+    assert not unbounded, (
+        f"{workflow['slug']} makes outbound calls with no timeout, each of "
+        f"which can pin a webhook worker indefinitely:\n  "
+        + "\n  ".join(unbounded)
     )
diff --git a/tests/test_templates.py b/tests/test_templates.py
index 26d28f9..15b1500 100644
--- a/tests/test_templates.py
+++ b/tests/test_templates.py
@@ -104,9 +104,14 @@ def test_blank_auth_field_does_not_lock_the_webhook_out(
             "/hooks/blank-auth-hook",
             json={"webhook": {"webhookEvent": "MobileDeviceEnrolled"}},
         )
-        assert resp.status_code == 200, (
-            f"inbound event rejected {resp.status_code}; the webhook is "
-            f"permanently locked out"
+        # The regression this guards is a permanent 401 lockout, so 401
+        # is the status that matters. Asserting 200 instead used to pass
+        # only because the receiver swallowed a non-zero script exit and
+        # answered 200 anyway; the stub script here genuinely fails on
+        # this payload, and that is a separate concern from auth.
+        assert resp.status_code != 401, (
+            "inbound event rejected 401; the webhook is permanently "
+            "locked out"
         )
 
 
diff --git a/views/_type_handlers/jamf_handler.py b/views/_type_handlers/jamf_handler.py
index 0939db3..40aa345 100644
--- a/views/_type_handlers/jamf_handler.py
+++ b/views/_type_handlers/jamf_handler.py
@@ -119,8 +119,18 @@ def _build_auth_xml(form: Any) -> str:
             if basic_user == "null" and basic_pass == "null":
                 auth_xml = "<authentication_type>NONE</authentication_type>"
             else:
-                auth_xml += f"<username>{basic_user or 'null'}</username>"
-                auth_xml += f"<password>{basic_pass or 'null'}</password>"
+                # Escaped for the same reason _build_webhook_xml escapes
+                # name and event: this is hand-built f-string XML, and a
+                # value that closes its own element injects sibling
+                # elements into the <webhook> object -- including a
+                # second <url>, which would point Jamf Pro's deliveries
+                # elsewhere while JAWA's record still showed its own
+                # callback. A password containing a bare & or < also just
+                # produces a body Jamf rejects with an opaque error.
+                safe_user = xml_escape(basic_user or "null")
+                safe_pass = xml_escape(basic_pass or "null")
+                auth_xml += f"<username>{safe_user}</username>"
+                auth_xml += f"<password>{safe_pass}</password>"
     return auth_xml
 
 
diff --git a/views/home_view.py b/views/home_view.py
index 6e132cc..6df431c 100644
--- a/views/home_view.py
+++ b/views/home_view.py
@@ -29,7 +29,7 @@
 import base64
 import json
 import os
-from typing import Union
+from typing import Optional, Union
 
 import requests
 from flask import (
@@ -80,13 +80,39 @@
 ERROR_MSG_SIGN_IN = "Please sign in again"
 
 
-def _resolve_url_from_server(form, server_json: dict) -> str:
-    """Determine the Jamf Pro URL from form data and server config."""
-    if form.get("active_url"):
-        return str(form.get("active_url"))
-    jps_url = server_json.get("jps_url")
-    if jps_url:
-        return str(jps_url)
+def _resolve_url_from_server(form, server_json: dict) -> Optional[str]:
+    """Determine the Jamf Pro URL from form data and server config.
+
+    Returns None when the form asks for a host this instance is not
+    configured for, which the caller must treat as a failed login.
+
+    `active_url` renders only as a two-option <select> over the URLs the
+    operator configured, so the UI presents the server as pinned -- but
+    this resolver used to honour whatever a POST supplied. Every gate
+    after this point (the token fetch, the activationcode shape check)
+    queries *this* URL, so an attacker-chosen host answers all of them
+    and none of them authenticates anything. The allow-list is what
+    makes those gates meaningful, so it belongs here rather than in
+    them.
+    """
+    configured = [
+        _strip_trailing_slash(str(url))
+        for url in (
+            server_json.get("jps_url"),
+            server_json.get("alternate_jps"),
+        )
+        if url
+    ]
+    requested = form.get("active_url")
+    if requested:
+        candidate = _strip_trailing_slash(str(requested))
+        if configured and candidate not in configured:
+            return None
+        return candidate
+    if configured:
+        return configured[0]
+    # No JPS pinned yet (first-time setup): the login form still offers a
+    # free-text URL field, and there is nothing to check it against.
     return _strip_trailing_slash(form.get("url", ""))
 
 
@@ -183,9 +209,18 @@ def login() -> Response:
         if os.path.isfile(server_file):
             with open(server_file) as json_file:
                 server_json = json.load(json_file)
-            session["url"] = _resolve_url_from_server(
-                request.form, server_json
-            )
+            resolved = _resolve_url_from_server(request.form, server_json)
+            if resolved is None:
+                logthis.warning(
+                    "Refusing a login against an unconfigured Jamf Pro "
+                    f"URL: {request.form.get('active_url')!r}"
+                )
+                return _login_error(
+                    "Unrecognized server",
+                    "That Jamf Pro server is not one this JAWA is "
+                    "configured to use.",
+                )
+            session["url"] = resolved
         else:
             session["url"] = _strip_trailing_slash(request.form.get("url", ""))
 
diff --git a/views/template_view.py b/views/template_view.py
index 4ef9329..347fd36 100644
--- a/views/template_view.py
+++ b/views/template_view.py
@@ -30,6 +30,7 @@
 import math
 import os
 import re
+import sys
 from typing import Any, Dict, List, Optional, Union
 
 import requests
@@ -87,6 +88,19 @@
 )
 TEMPLATE_SCRIPTS_DIR = os.path.join(BASE_DIR, "data", "workflows", "scripts")
 SCRIPTS_DIR = os.path.join(BASE_DIR, "scripts")
+
+
+def _ensure_scripts_dir() -> None:
+    """Create the deployed-script directory if it is not there yet.
+
+    `scripts/` is gitignored and carries no tracked file, so a fresh
+    `git clone` install has no such directory. Both writers below open a
+    path inside it directly, and the template path does so *after*
+    creating the webhook in Jamf Pro -- so without this the first
+    template a new operator enables strands a live Jamf webhook that
+    JAWA has no record of, and every retry gets HTTP 409.
+    """
+    os.makedirs(SCRIPTS_DIR, exist_ok=True)
 WEBHOOKS_FILE = os.path.join(BASE_DIR, "data", "webhooks.json")
 CREDENTIALS_FILE = os.path.join(BASE_DIR, "data", "credentials.json")
 
@@ -137,11 +151,15 @@ def _install_package(
     B14 mistake, where the trigger becomes invisible and uneditable.
     """
     script = package["script"]
+    _ensure_scripts_dir()
     safe_filename = secure_filename(script["filename"])
     script_path = os.path.join(SCRIPTS_DIR, safe_filename)
     with open(script_path, "w", encoding="utf-8") as f:
-        f.write(script["content"])
-    os.chmod(script_path, 0o755)
+        f.write(_retarget_shebang(script["content"]))
+    # Owner-only, and the same reason as _write_script: an imported
+    # package can carry credential values, and the explicit chmod
+    # overrides the operator's umask.
+    os.chmod(script_path, 0o700)
 
     auth = auth_fields or {
         "webhook_username": "null",
@@ -387,8 +405,37 @@ def substitute_params(
     return script_content
 
 
+_PYTHON_SHEBANG_RE = re.compile(r"^#!.*python[0-9.]*\s*$")
+
+
+def _retarget_shebang(content: str) -> str:
+    """Point a bundled template's shebang at JAWA's own interpreter.
+
+    The receiver spawns scripts bare -- `Popen([script_path, payload])`
+    -- so the shebang alone chooses the interpreter. Every bundled
+    template shipped `#!/usr/bin/env python3`, which resolves to the
+    SYSTEM python, while the installer pip-installs requirements.txt
+    into JAWA's venv only. Six of the seven bundled templates import
+    `requests`, so they raised ModuleNotFoundError on their first real
+    trigger and the receiver reported success anyway.
+
+    `sys.executable` is the venv interpreter the service already runs
+    under (`ExecStart=.../venv/bin/python3`), so writing it here makes
+    the guarantee true by construction rather than by convention.
+
+    Only a python shebang is retargeted: an operator-supplied script may
+    legitimately be bash, and its shebang is theirs to choose.
+    """
+    lines = content.split("\n")
+    if lines and _PYTHON_SHEBANG_RE.match(lines[0]):
+        lines[0] = f"#!{sys.executable}"
+        return "\n".join(lines)
+    return content
+
+
 def _write_script(name: str, content: str) -> str:
     """Write script content to a unique file and return the absolute path."""
+    _ensure_scripts_dir()
     safe_name = name.replace(" ", "_").replace("/", "_").lower()
     dest_filename = f"{safe_name}.py"
     dest_path = os.path.join(SCRIPTS_DIR, dest_filename)
@@ -400,8 +447,14 @@ def _write_script(name: str, content: str) -> str:
         counter += 1
 
     with open(dest_path, "w", encoding="utf-8") as f:
-        f.write(content)
-    os.chmod(dest_path, 0o755)
+        f.write(_retarget_shebang(content))
+    # Owner-only: substitute_params bakes the credential set's
+    # client_secret into this source, and the explicit chmod overrides a
+    # hardened umask, so 0o755 handed the secret to every local account
+    # on a host whose whole point is an isolated `jawa` service user.
+    # The receiver runs it as the same user that owns it, so 0o700 is
+    # all it ever needs.
+    os.chmod(dest_path, 0o700)
     return dest_path
 
 
diff --git a/webhook/jawa_receiver.py b/webhook/jawa_receiver.py
index 6a52cf3..4783c2c 100644
--- a/webhook/jawa_receiver.py
+++ b/webhook/jawa_receiver.py
@@ -52,6 +52,16 @@
 blueprint = Blueprint("jawa_receiver", __name__, template_folder="templates")
 
 
+class ScriptExecutionError(Exception):
+    """The automation's script could not be run, or exited non-zero.
+
+    Raised instead of returning the error text, because a returned value
+    is indistinguishable from script stdout and the caller then answers
+    2xx either way -- the same "reports success, did nothing" shape that
+    made template webhooks appear to fire for a whole release.
+    """
+
+
 def load_json(file_path: str) -> Union[Dict[str, Any], List[Any]]:
     with open(file_path, "r") as fin:
         return json.load(fin)
@@ -67,6 +77,17 @@ def validate_webhook(
     truth_test = False
     for each_webhook in webhooks_json:
         if each_webhook["name"] == webhook_name:
+            # A webhook Jamf Pro created in the disabled state must not
+            # have a live JAWA endpoint: the enable screen tells the
+            # operator it is not yet enabled, and until this was read
+            # that notice was false. Only an explicit False rejects --
+            # entries from the non-template handlers carry no such key.
+            if each_webhook.get("enabled") is False:
+                logthis.warning(
+                    f"Rejecting /hooks/{webhook_name}: the automation is "
+                    "not enabled."
+                )
+                return False
             truth_test = True
             if (
                 # Missing auth keys default to the "null" no-auth
@@ -79,6 +100,10 @@ def validate_webhook(
                 or each_webhook.get("api_key", "null") != webhook_apikey
             ):
                 truth_test = False
+            # Stop at the first name match. Without this, two entries
+            # sharing a name let the LAST decide authentication while
+            # run_script executes the FIRST.
+            break
 
     return truth_test
 
@@ -101,7 +126,13 @@ def script_results(webhook_data: JSONType, each_webhook: Dict) -> bytes:
         output = proc.stdout.read()
         return_code = proc.wait()
 
-        for each_line in output.decode().split("\n"):
+        # Tolerant for the same reason as the response decode below: a
+        # script that exited 0 must not be turned into a failure by the
+        # bytes it chose to print. Strict decode here raised before the
+        # response path was ever reached.
+        for each_line in output.decode(
+            "utf-8", errors="replace"
+        ).split("\n"):
             if each_line:
                 logthis.info(f"{each_webhook.get('name')} - {each_line}")
 
@@ -110,13 +141,18 @@ def script_results(webhook_data: JSONType, each_webhook: Dict) -> bytes:
                 f"Script execution failed for {each_webhook.get('name')} "
                 f"with exit code {return_code}"
             )
+            raise ScriptExecutionError(
+                f"script exited {return_code}"
+            )
 
         return output
+    except ScriptExecutionError:
+        raise
     except Exception as err:
         logthis.error(
             f"Error executing script for webhook {each_webhook.get('name')}: {err}"
         )
-        return str(err).encode()
+        raise ScriptExecutionError(str(err)) from err
 
 
 def custom_output_options(
@@ -185,7 +221,23 @@ def webhook_handler(
             f"Validated authentication for /hooks/{webhook_name}, running script..."
         )
         webhook_tag, custom_output = custom_output_options(webhook_name)
-        output = run_script(webhook_data, webhook_name).decode("ascii")
+        try:
+            raw = run_script(webhook_data, webhook_name)
+        except ScriptExecutionError as err:
+            # Never answer 2xx for a script that did not run: Jamf Pro
+            # records delivery status, and a 200 here is what made a dead
+            # automation indistinguishable from a working one.
+            return {"webhook": f"{webhook_name}", "error": str(err)}, 500
+        if raw is None:
+            logthis.error(
+                f"Webhook {webhook_name} disappeared between validation "
+                "and execution; nothing ran."
+            )
+            return {"webhook": f"{webhook_name}", "error": "not found"}, 404
+        # Match the decode used for the log lines above. A device name
+        # with an accent is not an error, and decode("ascii") turned a
+        # SUCCESSFUL run into a 500 that Jamf Pro then retried.
+        output = raw.decode("utf-8", errors="replace")
         if custom_output and webhook_tag == "custom":
             return {"webhook": f"{webhook_name}", "result": f"{output}"}, 202
         else:

From e9bde4564ff90604cc181f423f82d7d351189ca9 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Mon, 31 Aug 2026 12:00:52 -0500
Subject: [PATCH 82/84] fix: refuse an unsupported Python before removing an
 existing install (J30)

Found by a manual install on a real host, which is the gate this release
plan exists to require. Evidence: Ubuntu on AWS, Python 3.8.10.

    ERROR: Could not find a version that satisfies the requirement
      Werkzeug~=3.1.5 (from versions: 0.1, ... 3.0.4, 3.0.5, 3.0.6)
    ERROR: No matching distribution found for Werkzeug~=3.1.5

PyPI serves nothing above 3.0.6 to a 3.8 interpreter, so the requirements
install aborted at Werkzeug and Flask was never installed. journalctl shows
the service crash-looping five times on ModuleNotFoundError: No module named
'flask' until systemd gave up with "Start request repeated too quickly".

The failure was not the bug. The ordering was:

  1. cleaninstall - backup, then uninstall - runs before any dependency work.
  2. pip install -r requirements.txt ran as "& spinner $!" with its exit
     status never checked.
  3. There is no set -e anywhere in the script.
  4. So it continued to "[########################](100%) Installation
     complete!" and created and enabled the systemd unit.

An operator on 3.8 upgrading from a working 3.1.1 therefore lost their
install, got a dead service, and was told the installation completed. data/
survived; the application did not.

The script already knew how to do this. The clone step three stages earlier
does cloneStatus=$? with the comment "spinner propagates the background
job's exit code", and spinner() does end with wait $pid; return $?. The
pattern was simply never applied to the pip steps.

The floor is not negotiable by accident: ~=3.0.1 allowed <3.1.0, the
Werkzeug patches land at 3.1.4/3.1.5, and 3.1+ requires Python 3.9+. So
"runs on 3.8" and "ships without the open Werkzeug advisory" are mutually
exclusive. Rather than strand 20.04 silently or ship the vulnerable pin,
this refuses early and documents an escape hatch.

  - checkPythonFloor() is the first statement of install(), before the
    certificate check and well before cleaninstall, so an unsupported host
    is refused with its existing install intact. It names the detected
    version and the supported platforms.
  - JAWA_ALLOW_UNPATCHED_WERKZEUG=1 holds Werkzeug at 3.0.6 via sed on the
    cloned requirements.txt, prints the advisory being accepted, and pauses.
    Named for what it accepts rather than for the Python version. Documented
    in README under Server Requirements, with the upgrade notes pointing at
    it.
  - The requirements install is now checked, by exit status AND by an
    import flask probe, which tests the invariant that actually failed. It
    aborts before the service is created.
  - "Double-check your dependencies (python3, python3-pip, git, curl, etc.)"
    is gone. It named the one thing that was demonstrably true.

Service reporting, same root cause one layer out: only jawa was ever
verified, and the two systemctl restart calls discarded their exit status.
Real installs failed nginx repeatedly - eight times in the log from this
host - while the installer said nothing, and a broken nginx means the
console is unreachable even when jawa is healthy. Both restarts now record
their status, both units are checked, and the failure message names the
specific unit with the diagnostic that fits it: journalctl for jawa, and
nginx -t for nginx, since an nginx control-process failure is almost always
a config or certificate error and nginx -t prints the offending line.

Also fixed, all surfaced by the same run:

  - "python3 -m pip" with no subcommand was used as a presence probe. It
    dumped thirty lines of pip usage onto the operator's terminal, and its
    exit code is version-dependent: on a newer pip, which exits 1 for
    no-args, it would have aborted with "python3-pip was not installed
    successfully" while pip was installed. Now "pip --version".
  - 47 clear calls and 3 tput calls assumed the host's terminfo knows $TERM.
    A modern terminal forwarded over SSH is usually absent from a server's
    terminfo, and every one then failed - which also broke the
    carriage-return progress redraw, so output arrived mangled as
    "'xterm-ghostty': unknown terminal type.ing services...". Falls back to
    TERM=xterm when tput cannot use the inherited value.
  - The only single-quoted echo containing $installDir printed it literally.
  - restoreBackup ran four cp -R calls with no existence guards and no log
    redirection, unlike the backup half which guards each one. An upgrade
    from an install lacking scripts/ or resources/ - the common case, since
    neither is tracked - printed "cp: ... No such file or directory" onto
    the operator's terminal mid-progress-bar. The trailing-slash form
    "$item/" also means different things to GNU and BSD cp; now "$item/.",
    which is the explicit contents-merge on both.

checkPythonFloor was extracted into a standalone harness with stub
interpreters and exercised at Python 3.8, 3.9, 3.12 and 4.0, with and
without the override: 3.8 refuses with exit 2, 3.9/3.12/4.0 pass with no
hold, and 3.8 with the override passes holding Werkzeug. The harness caught
two bugs in the fix itself, a message reading "Python 9+" and an $0 that is
"bash" when the script is piped, so the override instruction now mirrors the
documented command. The per-unit service check was exercised the same way
against a stub systemctl for all four up/down combinations.

bash -n clean. The 11 multi-byte spinner glyphs hash byte-identical to the
previous revision.
---
 README.md        |  21 +++++-
 bin/installer.sh | 181 +++++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 186 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index 689008a..c16197c 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,22 @@ JAWA and [Jamf Routines](https://learn.jamf.com/r/en-US/jamf-routines-documentat
 > the OS version is what determines the Python version. Ubuntu 20.04 ships Python 3.8 and
 > RHEL/Rocky 8 ships Python 3.6, neither of which satisfies JAWA's dependencies — use Ubuntu 22.04
 > or later, or RHEL/Rocky 9 or later.
+>
+> The installer checks this **before it touches an existing install** and stops with the detected
+> version if the host is below Python 3.9. The specific blocker is Werkzeug: its patched releases
+> require Python 3.9 or later, and no patched Werkzeug exists for 3.8, so a 3.8 host cannot run
+> JAWA without a known security advisory.
+>
+> If you accept that advisory and need to install on Python 3.8 anyway, set
+> `JAWA_ALLOW_UNPATCHED_WERKZEUG=1`:
+>
+> ```bash
+> sudo JAWA_ALLOW_UNPATCHED_WERKZEUG=1 bash ./installer.sh
+> ```
+>
+> This holds Werkzeug at 3.0.6 — the newest release available to Python 3.8 — and prints the
+> advisory you are accepting. It is a stopgap for hosts that cannot be upgraded yet, not a
+> supported configuration.
 
 ### Network Requirements:
 
@@ -228,7 +244,10 @@ Find JAWA releases [here.](https://github.com/jamf/JAWA/releases)
   longer support Python 3.8. Ubuntu 20.04 (Python 3.8) and RHEL/Rocky 8 (Python 3.6) can no longer
   run JAWA — RHEL/Rocky 8 in fact stopped being able to when JAWA moved to Flask 3, which the
   stated requirements had not caught up with. Check `python3 --version` on the host before
-  upgrading.
+  upgrading. The installer now enforces this itself: it verifies the Python version **before**
+  backing up or removing anything, so an unsupported host is refused with its existing install
+  intact rather than left with a dead service. If you must install on Python 3.8 and accept an
+  unpatched Werkzeug, see `JAWA_ALLOW_UNPATCHED_WERKZEUG` under Server Requirements.
 - **Content JAWA ships inside `data/` is not upgraded in place.** The installer preserves your
   `data/` directory across an upgrade, which protects your automations and settings, but it also
   means the bundled template scripts and the webhook event catalog stay at the version you first
diff --git a/bin/installer.sh b/bin/installer.sh
index 8e600b9..d251650 100644
--- a/bin/installer.sh
+++ b/bin/installer.sh
@@ -237,7 +237,74 @@ Please make sure you:
 "
 }
 
+# Minimum Python minor version. Werkzeug's patched releases (3.1.4+) require
+# Python >= 3.9, and there is no patched Werkzeug for 3.8 -- PyPI serves
+# nothing above 3.0.6 to a 3.8 interpreter. So "runs on 3.8" and "ships
+# without the open Werkzeug advisory" are mutually exclusive.
+jawaMinPyMinor=9
+werkzeugPy38Fallback="3.0.6"
+holdWerkzeug="no"
+
+checkPythonFloor() {
+  # Runs FIRST, before anything destructive. This used to be discovered at
+  # the 85% mark -- after cleaninstall had already removed the operator's
+  # working install -- so a 3.8 host was left with a dead service behind a
+  # "[########################](100%) Installation complete!" message.
+  if [ ! -x /usr/bin/python3 ]; then
+    /bin/echo "Python 3 is not present at /usr/bin/python3."
+    /bin/echo "JAWA requires Python 3.${jawaMinPyMinor} or later. Install it and run this installer again."
+    /bin/echo "Your existing JAWA install, if any, has NOT been modified. Exiting..."
+    exit 2
+  fi
+  local pyMajor pyMinor pyVer
+  pyVer=$(/usr/bin/python3 -c 'import sys; print("%d.%d" % sys.version_info[:2])' 2>/dev/null)
+  pyMajor=${pyVer%%.*}
+  pyMinor=${pyVer##*.}
+  if [ -z "$pyMajor" ] || [ -z "$pyMinor" ]; then
+    /bin/echo "Could not determine the Python version reported by /usr/bin/python3."
+    /bin/echo "Your existing JAWA install, if any, has NOT been modified. Exiting..."
+    exit 2
+  fi
+  /bin/echo "Detected Python $pyVer" >>/var/log/jawaInstall.log 2>&1
+  if [ "$pyMajor" -gt 3 ]; then
+    return 0
+  fi
+  if [ "$pyMajor" -eq 3 ] && [ "$pyMinor" -ge "$jawaMinPyMinor" ]; then
+    return 0
+  fi
+  if [ "${JAWA_ALLOW_UNPATCHED_WERKZEUG:-0}" = "1" ]; then
+    holdWerkzeug="yes"
+    /bin/echo ""
+    /bin/echo "WARNING: Python $pyVer is below JAWA's 3.${jawaMinPyMinor} floor, and"
+    /bin/echo "JAWA_ALLOW_UNPATCHED_WERKZEUG=1 is set. Werkzeug will be held at"
+    /bin/echo "$werkzeugPy38Fallback, which is the newest release available to Python $pyVer and"
+    /bin/echo "carries an OPEN, UNPATCHED security advisory. You are accepting that."
+    /bin/echo "The supported fix is Ubuntu 22.04+ / RHEL-Rocky 9+ (Python 3.${jawaMinPyMinor}+)."
+    /bin/echo ""
+    /bin/echo "Holding Werkzeug at $werkzeugPy38Fallback for Python $pyVer per JAWA_ALLOW_UNPATCHED_WERKZEUG=1" >>/var/log/jawaInstall.log 2>&1
+    /bin/sleep 5
+    return 0
+  fi
+  /bin/echo ""
+  /bin/echo "JAWA 3.2 requires Python 3.${jawaMinPyMinor} or later. This host has Python $pyVer."
+  /bin/echo ""
+  /bin/echo "  Ubuntu 20.04 ships Python 3.8 and RHEL/Rocky 8 ships 3.6; neither is supported."
+  /bin/echo "  Supported: Ubuntu 22.04+ or RHEL/Rocky 9+."
+  /bin/echo ""
+  /bin/echo "  Reason: JAWA's Werkzeug security fix is only published for Python 3.${jawaMinPyMinor}+."
+  /bin/echo "  There is no patched Werkzeug for Python $pyVer."
+  /bin/echo ""
+  /bin/echo "  To install anyway with an UNPATCHED Werkzeug ($werkzeugPy38Fallback), re-run with"
+  /bin/echo "  JAWA_ALLOW_UNPATCHED_WERKZEUG=1 set, e.g.:"
+  /bin/echo "      sudo JAWA_ALLOW_UNPATCHED_WERKZEUG=1 bash ./installer.sh"
+  /bin/echo ""
+  /bin/echo "Your existing JAWA install, if any, has NOT been modified. Exiting..."
+  /bin/echo "Refusing to install: Python $pyVer is below the 3.${jawaMinPyMinor} floor." >>/var/log/jawaInstall.log 2>&1
+  exit 2
+}
+
 install() {
+  checkPythonFloor
   /usr/bin/clear
   # Variables
 
@@ -368,7 +435,11 @@ install() {
     /bin/echo "Exiting..."
     exit 2
   fi
-  /usr/bin/python3 -m pip
+  # `python3 -m pip` with no subcommand dumps 30 lines of usage onto the
+  # operator's terminal, and its exit code is version-dependent -- newer
+  # pip exits 1 for no-args, which made this abort with "python3-pip was
+  # not installed successfully" while pip was in fact installed.
+  /usr/bin/python3 -m pip --version >>/var/log/jawaInstall.log 2>&1
   if [ $? -eq 0 ]; then
     /bin/echo "python3-pip installed." >>/var/log/jawaInstall.log 2>&1
   else
@@ -427,8 +498,8 @@ if [ -d "$currentDir/jawabackup-$timenow" ]; then
   # for gzip support in uwsgi
   #/usr/bin/apt-get install --no-install-recommends -y -q libpcre3-dev libz-dev
 
-  /bin/echo -ne '[#############           ](65%) Setting permissions for $installDir/jawa... '
-  /bin/echo '[#############           ](65%) Setting permissions for $installDir/jawa ' >>/var/log/jawaInstall.log 2>&1
+  /bin/echo -ne "[#############           ](65%) Setting permissions for $installDir/jawa... "
+  /bin/echo "[#############           ](65%) Setting permissions for $installDir/jawa " >>/var/log/jawaInstall.log 2>&1
   chown -R jawa "$installDir/jawa" & spinner $! ""
 
 
@@ -453,7 +524,29 @@ if [ -d "$currentDir/jawabackup-$timenow" ]; then
   /usr/bin/clear
   /bin/echo -ne '[#################       ](85%) pip installing jawa requirements.txt file in venv... '
   /bin/echo '[#################       ](85%) pip installing jawa requirements.txt file in venv... ' >>/var/log/jawaInstall.log 2>&1
-  "$installDir/jawa/venv/bin/python" -m pip install -r "$installDir/jawa/requirements.txt" >>/var/log/jawaInstall.log 2>&1 & spinner $! "" #
+  if [ "$holdWerkzeug" = "yes" ]; then
+    /bin/sed -i "s/^Werkzeug~=.*/Werkzeug~=$werkzeugPy38Fallback/" "$installDir/jawa/requirements.txt" >>/var/log/jawaInstall.log 2>&1
+    /bin/echo "Held Werkzeug at $werkzeugPy38Fallback in requirements.txt" >>/var/log/jawaInstall.log 2>&1
+  fi
+  "$installDir/jawa/venv/bin/python" -m pip install -r "$installDir/jawa/requirements.txt" >>/var/log/jawaInstall.log 2>&1 & spinner $! ""
+  # spinner propagates the background job's exit code (see the clone step).
+  # Unchecked, a failed resolve here marched on to "100% Installation
+  # complete!" and enabled a systemd unit that crash-looped on
+  # ModuleNotFoundError -- the dependency failure was only visible in the log.
+  requirementsStatus=$?
+  if [ "$requirementsStatus" -ne 0 ] || ! "$installDir/jawa/venv/bin/python" -c 'import flask' >/dev/null 2>&1; then
+    /usr/bin/clear
+    /bin/echo ""
+    /bin/echo "JAWA's Python dependencies failed to install, so the service cannot start."
+    /bin/echo "This is NOT a missing python3/pip/git/curl -- those are present."
+    /bin/echo ""
+    /bin/echo "The failing lines are in /var/log/jawaInstall.log. To see them:"
+    /bin/echo "    grep -E 'ERROR|No matching distribution' /var/log/jawaInstall.log | tail"
+    /bin/echo ""
+    /bin/echo "Aborting before the service is created." 
+    /bin/echo "Python dependency install FAILED (status $requirementsStatus); flask not importable. Aborting." >>/var/log/jawaInstall.log 2>&1
+    exit 2
+  fi #
   #pip install --upgrade uwsgi
   /usr/bin/clear
   /bin/echo -ne '[##################      ](90%) Creating jawa service in systemd... '
@@ -500,22 +593,55 @@ EOF
   /bin/echo '[######################  ](98%) Restarting services... ' >>/var/log/jawaInstall.log 2>&1
   /bin/systemctl enable jawa.service >>/var/log/jawaInstall.log 2>&1
   /bin/systemctl restart jawa.service >>/var/log/jawaInstall.log 2>&1
+  jawaRestart=$?
+  [ "$jawaRestart" -ne 0 ] && /bin/echo "systemctl restart jawa.service exited $jawaRestart" >>/var/log/jawaInstall.log 2>&1
   /usr/bin/clear
   /bin/echo -ne '[####################### ](99%) Restarting services... \r'
   /bin/echo '[####################### ](99%) Restarting services... ' >>/var/log/jawaInstall.log 2>&1
   /bin/systemctl restart nginx.service >>/var/log/jawaInstall.log 2>&1
+  nginxRestart=$?
+  [ "$nginxRestart" -ne 0 ] && /bin/echo "systemctl restart nginx.service exited $nginxRestart" >>/var/log/jawaInstall.log 2>&1
   /usr/bin/clear
   /bin/echo -ne '[########################](100%) Installation complete! \r'
   /bin/echo '[########################](100%) Restarting services... untini! ' >>/var/log/jawaInstall.log 2>&1
   /bin/sleep 1.5
 
   /usr/bin/clear
-  status=$(/bin/systemctl is-active --quiet jawa && echo Service is running)
-  if [ "$status" != "Service is running" ]; then
-      echo "Uh oh!  The jawa service is not running. Check /var/log/jawaInstall.log for errors and restart the service."
-      echo "Uh oh!  The jawa service is not running. Check /var/log/jawaInstall.log for errors and restart the service." >>/var/log/jawaInstall.log 2>&1
-      echo "Double-check your dependencies (python3, python3-pip, git, curl, etc.) and try again."
-      echo "Double-check your dependencies (python3, python3-pip, git, curl, etc.) and try again." >>/var/log/jawaInstall.log 2>&1
+  # Check every unit the install depends on and name the ones that failed.
+  # Only jawa was ever verified, so a broken nginx reported "Installation
+  # complete!" with an unreachable console -- and real installs failed nginx
+  # repeatedly while this said nothing. The diagnostic differs per unit:
+  # jawa's reason is in journalctl, nginx's is almost always a config or
+  # certificate error, which `nginx -t` prints with the offending line.
+  failedUnits=""
+  for unit in jawa nginx; do
+    if ! /bin/systemctl is-active --quiet "$unit"; then
+      failedUnits="$failedUnits $unit"
+    fi
+  done
+  if [ -n "$failedUnits" ]; then
+      echo "Uh oh!  The installation finished, but these services are NOT running:$failedUnits"
+      echo "Uh oh!  Services not running after install:$failedUnits" >>/var/log/jawaInstall.log 2>&1
+      echo ""
+      for unit in $failedUnits; do
+        case "$unit" in
+        jawa)
+          echo "  jawa.service - the JAWA application itself."
+          echo "    JAWA will not answer at all until this starts."
+          echo "    See why:  journalctl -u jawa.service -n 50 --no-pager"
+          ;;
+        nginx)
+          echo "  nginx.service - the TLS reverse proxy in front of JAWA."
+          echo "    The web console is unreachable without it, even if jawa is healthy."
+          echo "    Usually a config or certificate problem. Check the config first,"
+          echo "    which names the offending file and line:"
+          echo "      nginx -t"
+          echo "    Then:  journalctl -u nginx.service -n 30 --no-pager"
+          ;;
+        esac
+        echo ""
+      done
+      echo "The full installer log is at /var/log/jawaInstall.log"
       echo ""
       if [[ $jawaPassword != "" ]]; then
         /bin/echo "The following service account was created on your OS for running the JAWA application, and for creating the cron tasks."
@@ -525,7 +651,7 @@ EOF
       fi
       exit 2
   else
-      echo "Jawa service is running!" >>/var/log/jawaInstall.log 2>&1
+      echo "jawa.service and nginx.service are both running." >>/var/log/jawaInstall.log 2>&1
   fi
 
   if [ -e "$installDir/jawa/static/jawadone.txt" ]; then
@@ -793,10 +919,25 @@ restoreBackup() {
               /usr/bin/python3 "$installDir/jawa/bin/v2_upgrade.py" "$currentDir/jawabackup-$timenow" >>/var/log/jawaInstall.log 2>&1 & spinner $! ""
             fi
           fi
-        /bin/cp -R "$currentDir/jawabackup-$timenow/data/" $installDir/jawa/
-        /bin/cp -R "$currentDir/jawabackup-$timenow/resources/" $installDir/jawa/
-        /bin/cp -R "$currentDir/jawabackup-$timenow/scripts/" $installDir/jawa/
-        /bin/cp -R "$currentDir/jawabackup-$timenow/jawa_icon.png" $installDir/jawa/static/img/jawa_icon.png
+        # Guarded and logged, to match the backup half above. These four
+        # copies previously ran bare: an upgrade from an install that
+        # never had a scripts/ or resources/ directory -- the common
+        # case, since neither is tracked -- printed "cp: ... No such
+        # file or directory" straight onto the operator's terminal in
+        # the middle of the progress bar.
+        #
+        # "$item/." rather than "$item/": the trailing-slash form means
+        # different things to GNU and BSD cp (contents vs. the directory
+        # itself), and "/." is the explicit contents-merge on both.
+        for item in data resources scripts; do
+          if [ -d "$currentDir/jawabackup-$timenow/$item" ]; then
+            /bin/mkdir -p "$installDir/jawa/$item" >>/var/log/jawaInstall.log 2>&1
+            /bin/cp -R "$currentDir/jawabackup-$timenow/$item/." "$installDir/jawa/$item/" >>/var/log/jawaInstall.log 2>&1
+          fi
+        done
+        if [ -e "$currentDir/jawabackup-$timenow/jawa_icon.png" ]; then
+          /bin/cp "$currentDir/jawabackup-$timenow/jawa_icon.png" "$installDir/jawa/static/img/jawa_icon.png" >>/var/log/jawaInstall.log 2>&1
+        fi
 }
 
 
@@ -941,6 +1082,16 @@ if [ "$EUID" -ne 0 ]; then
   exit 1
 fi
 
+# 47 `clear` calls and 3 `tput` calls assume the host's terminfo knows
+# $TERM. A modern terminal forwarded over SSH (ghostty, kitty, wezterm) is
+# often absent from a server's terminfo, and every one of them then fails --
+# which also breaks the carriage-return progress redraw, so lines arrive
+# mangled ("'xterm-ghostty': unknown terminal type.ing services...").
+if ! tput clear >/dev/null 2>&1; then
+  /bin/echo "TERM='${TERM:-}' is unknown to this host's terminfo; falling back to TERM=xterm." >>/var/log/jawaInstall.log 2>&1
+  export TERM=xterm
+fi
+
 readme
 displayMenu
 

From ab827fd0b723a25e0d5bdfe81958a6a592e7bc5c Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Mon, 31 Aug 2026 17:07:46 -0500
Subject: [PATCH 83/84] fix: preserve a valid TLS certificate across an upgrade
 (J31)

Found by a real remote deploy: the installer reported success, the jawa
service was healthy, and the console was unreachable in a browser. The
operator's valid certificate had been replaced by an expired copy that
happened to be sitting in the install directory.

install() ended its certificate check with an unconditional
`cp ./{jawa.crt,jawa.key} /etc/ssl/certs/`. nginx reads the pair from
/etc/ssl/certs, so a host that already runs JAWA has a working pair there
and the copy in the current directory is usually a leftover from the first
install. Two consequences: a stale copy silently overwrote a valid
certificate, and an upgrade with no certs in the current directory failed
the check and pushed a working install into the self-signed menu.

This is long-standing behaviour, not new in 3.2 -- the header comment has
admitted it all along ("mv your certs (it uses cp instead)").

The certificate decision is now, with no new prompts:

  no local certs + valid installed  -> keep the installed pair, print expiry
  no local certs + none installed   -> certsMenu, as before
  unusable local + valid installed  -> refuse, name the reason, keep working
  otherwise                         -> install, then warn if expired or
                                       expiring within 30 days

certIsExpired() deliberately reports "not expired" for a file that will not
parse: a file we cannot read is not a file we can call expired. Bare
`openssl x509 -checkend 0` reports a *missing* file as expired, which would
have turned a nonexistent certificate into an expiry problem.

Two more fixes in the same path:

- selfsigned() wrote the pair to $installDir (/usr/local, set at the
  entrypoint) and then recursed into install(), which re-checks ./jawa.crt
  in the *current* directory. Choosing "Create Self-Signed certificate"
  from any other directory looped certsMenu forever, with option 2 the only
  exit. Now writes to $currentDir.

- installDir carried a trailing slash from one of its three assignments
  ("/usr/local/" against "/usr/local" elsewhere), so "$installDir/jawa"
  became "/usr/local//jawa" in the systemd unit's ExecStart, the pip -r
  argument, and the final "JAWA installed at" line. Normalized, with "/"
  itself left intact, and applied to operator-supplied paths too.

Verified against real openssl certificates (valid, expired, 10-day,
unparseable) with the decision logic sliced verbatim out of this file:
8 cases, plus a mutation check confirming the pre-fix logic serves the
expired certificate where the fix serves the valid one.
---
 bin/installer.sh | 122 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 110 insertions(+), 12 deletions(-)

diff --git a/bin/installer.sh b/bin/installer.sh
index d251650..fa3e3fc 100644
--- a/bin/installer.sh
+++ b/bin/installer.sh
@@ -245,6 +245,19 @@ jawaMinPyMinor=9
 werkzeugPy38Fallback="3.0.6"
 holdWerkzeug="no"
 
+normalizeInstallDir() {
+  # Strip trailing slashes so "$installDir/jawa" cannot become
+  # "/usr/local//jawa". The paths were inconsistent -- one assignment used
+  # "/usr/local/" while two others used "/usr/local" -- which put a double
+  # slash into the systemd unit's ExecStart, the pip -r argument, and the
+  # final "JAWA installed at" line. Harmless to the kernel, but it makes
+  # the unit file and the logs look broken and defeats string comparison
+  # of paths. Keep "/" itself intact rather than reducing it to "".
+  while [ "$installDir" != "/" ] && [ "${installDir%/}" != "$installDir" ]; do
+    installDir="${installDir%/}"
+  done
+}
+
 checkPythonFloor() {
   # Runs FIRST, before anything destructive. This used to be discovered at
   # the 85% mark -- after cleaninstall had already removed the operator's
@@ -303,31 +316,111 @@ checkPythonFloor() {
   exit 2
 }
 
+# Prints a certificate's expiry date, or "unreadable" if it will not parse.
+certExpiry() {
+  local enddate
+  enddate=$(/usr/bin/openssl x509 -enddate -noout -in "$1" 2>/dev/null) || {
+    /bin/echo "unreadable"
+    return
+  }
+  /bin/echo "${enddate#notAfter=}"
+}
+
+# 0 when the certificate is already expired. An unparseable file returns 1: a
+# file we cannot read is not a file we can call expired.
+certIsExpired() {
+  /usr/bin/openssl x509 -noout -in "$1" >/dev/null 2>&1 || return 1
+  ! /usr/bin/openssl x509 -checkend 0 -noout -in "$1" >/dev/null 2>&1
+}
+
+# 0 when the certificate both parses and has not expired -- i.e. nginx can
+# actually serve it. `-checkend 0` already fails on an unreadable file, which
+# is the behaviour we want here: garbage is not usable either.
+certIsUsable() {
+  /usr/bin/openssl x509 -checkend 0 -noout -in "$1" >/dev/null 2>&1
+}
+
+# Say so when the certificate JAWA will actually serve is expired or close to
+# it. An expired cert makes the console unreachable in a browser while every
+# service check still passes, so silence here reads as an installer bug.
+warnIfCertStale() {
+  if certIsExpired "$1"; then
+    /bin/echo ""
+    /bin/echo "WARNING: $1 EXPIRED on $(certExpiry "$1")."
+    /bin/echo "         Browsers will refuse the JAWA console until it is replaced."
+    /bin/echo ""
+    /bin/echo "WARNING: serving expired cert $1" >>/var/log/jawaInstall.log 2>&1
+  elif /usr/bin/openssl x509 -noout -in "$1" >/dev/null 2>&1 &&
+    ! /usr/bin/openssl x509 -checkend 2592000 -noout -in "$1" >/dev/null 2>&1; then
+    /bin/echo "NOTE: $1 expires within 30 days ($(certExpiry "$1"))."
+    /bin/echo "NOTE: cert $1 expires within 30 days" >>/var/log/jawaInstall.log 2>&1
+  fi
+}
+
 install() {
   checkPythonFloor
   /usr/bin/clear
   # Variables
 
 
-  x=0
-
-  if [ ! -f ./jawa.crt ] >/dev/null 2>&1; then
-    /bin/echo "Unable to locate jawa.crt in $currentDir" >>/var/log/jawaInstall.log 2>&1
-    x=$(($x + 1))
+  # Certificates. nginx reads /etc/ssl/certs/jawa.{crt,key}, so a host that
+  # already runs JAWA has a working pair there and the copy sitting in the
+  # current directory is often a stale leftover from the first install. This
+  # used to `cp` over the installed pair unconditionally, which is how a valid
+  # certificate gets replaced by an expired one -- a downgrade the operator
+  # only discovers later, as a browser error on a console the installer just
+  # reported as a success. Never trade a valid certificate for an expired one,
+  # and never make an upgrade re-supply certificates it already has.
+  certsDir="/etc/ssl/certs"
+  haveLocalCerts="no"
+  haveInstalledCerts="no"
+  if [ -f ./jawa.crt ] && [ -e ./jawa.key ]; then
+    haveLocalCerts="yes"
+  else
+    if [ ! -f ./jawa.crt ]; then
+      /bin/echo "Unable to locate jawa.crt in $currentDir" >>/var/log/jawaInstall.log 2>&1
+    fi
+    if [ ! -e ./jawa.key ]; then
+      /bin/echo "Unable to locate jawa.key in $currentDir" >>/var/log/jawaInstall.log 2>&1
+    fi
   fi
-  if [ ! -e ./jawa.key ] >/dev/null 2>&1; then
-    /bin/echo "Unable to locate jawa.key in $currentDir" >>/var/log/jawaInstall.log 2>&1
-    x=$(($x + 1))
+  if [ -f "$certsDir/jawa.crt" ] && [ -e "$certsDir/jawa.key" ]; then
+    haveInstalledCerts="yes"
   fi
 
-  if [[ $x -ne 0 ]]; then
+  if [ "$haveLocalCerts" == "no" ] && [ "$haveInstalledCerts" == "yes" ]; then
+    # Upgrading a host that already has certificates. Demanding them in the
+    # current directory again would push a working install into the
+    # self-signed menu for no reason.
+    /bin/echo "Keeping the certificate already installed at $certsDir/jawa.crt (expires: $(certExpiry "$certsDir/jawa.crt"))."
+    /bin/echo "Keeping installed cert $certsDir/jawa.crt" >>/var/log/jawaInstall.log 2>&1
+    warnIfCertStale "$certsDir/jawa.crt"
+  elif [ "$haveLocalCerts" == "no" ]; then
     /bin/echo "Security requirements are not satisfied.
         Missing items are identified above--please provide the items in the installer directory before installing.
 
         Consult the admin guide for more information concerning certificates."
     certsMenu
+  elif [ "$haveInstalledCerts" == "yes" ] && certIsUsable "$certsDir/jawa.crt" && ! certIsUsable ./jawa.crt; then
+    # The copy in the current directory is expired or unreadable and the
+    # installed one still works. Installing the bad copy would take the
+    # console offline, so keep what works and say why.
+    if /usr/bin/openssl x509 -noout -in ./jawa.crt >/dev/null 2>&1; then
+      certRejectReason="has EXPIRED (expired: $(certExpiry ./jawa.crt))"
+    else
+      certRejectReason="is not a readable certificate"
+    fi
+    /bin/echo ""
+    /bin/echo "NOT replacing the installed certificate."
+    /bin/echo "  $currentDir/jawa.crt $certRejectReason"
+    /bin/echo "  $certsDir/jawa.crt is still valid (expires: $(certExpiry "$certsDir/jawa.crt"))"
+    /bin/echo "  Keeping the valid one. Replace the copy in $currentDir to install a new certificate."
+    /bin/echo ""
+    /bin/echo "Refused to overwrite valid $certsDir/jawa.crt with unusable ./jawa.crt ($certRejectReason)" >>/var/log/jawaInstall.log 2>&1
+  else
+    /bin/cp ./{jawa.crt,jawa.key} "$certsDir/"
+    warnIfCertStale "$certsDir/jawa.crt"
   fi
-  /bin/cp ./{jawa.crt,jawa.key} /etc/ssl/certs/
   # checking for service
   if [ -e /etc/systemd/system/jawa.service ]; then
     status=$(/bin/systemctl is-active --quiet jawa && echo Service is running)
@@ -339,7 +432,7 @@ install() {
     fi
     installDir=$(dirname "$projectDir")
     if [[ $installDir != "" ]]; then
-      installDir="/usr/local/"
+      installDir="/usr/local"
     fi
     echo "JAWA directory detected at $installDir" >> /var/log/jawaInstall.log 2>&1
     read -r -p "Existing JAWA detected - would you like to upgrade? [y/n]:  " yn
@@ -363,6 +456,8 @@ install() {
         else
           installDir="/usr/local/$new_dir"
         fi
+        # An operator answering "/opt/jawa/" must not produce "/opt/jawa//jawa".
+        normalizeInstallDir
       fi
       read -p "The jawa project directory will be created in $installDir
          Please confirm [y|n]: " yn
@@ -873,7 +968,10 @@ certsMenu() {
 }
 selfsigned() {
   /bin/echo "Creating SSL cert" >>/var/log/jawaInstall.log 2>&1
-  /usr/bin/openssl req -x509 -nodes -days 365 -newkey rsa:2048 -subj "/C=US/ST=MN/L=Minneapolis/CN=jawa" -keyout "$installDir/jawa.key" -out "$installDir/jawa.crt" >>/var/log/jawaInstall.log 2>&1
+  # Must land in $currentDir, not $installDir: install() re-checks ./jawa.crt
+  # in the current directory, so writing elsewhere sent the operator back to
+  # certsMenu forever unless they happened to be running from /usr/local.
+  /usr/bin/openssl req -x509 -nodes -days 365 -newkey rsa:2048 -subj "/C=US/ST=MN/L=Minneapolis/CN=jawa" -keyout "$currentDir/jawa.key" -out "$currentDir/jawa.crt" >>/var/log/jawaInstall.log 2>&1
   install
 }
 upgradeFromV2() {

From 207eede2f8188d7fd865be391ece88a93840a927 Mon Sep 17 00:00:00 2001
From: ball42 <christopher.ball@jamf.com>
Date: Mon, 31 Aug 2026 17:21:57 -0500
Subject: [PATCH 84/84] fix: label and colourise the certificate decision the
 installer reports (J31)

The refusal guard fired correctly on a real host, but the message led with
paths and left the operator to work out which certificate was which and
what the consequence was. Reported from a live run: "at my first glance i
wasn't sure which cert was which and what the impact was".

Roles now lead each line and the outcome is stated outright:

  Certificate: keeping the one already in use. Nothing was replaced.

    IN USE    /etc/ssl/certs/jawa.crt
              VALID       expires Nov  5 13:41:31 2026 GMT

    OFFERED   /home/ubuntu/jawa.crt
              EXPIRED     expired Sep  3 03:30:49 2025 GMT

    Impact: none. JAWA keeps serving the certificate marked IN USE,
    so the console stays reachable. The OFFERED file was left untouched.

Expired and unreadable states print red, valid green, the 30-day notice
yellow, and expiry dates cyan.

Colour is raw ANSI rather than tput. This is precisely the host family
where tput fails: a modern $TERM forwarded over SSH is often absent from a
server's terminfo, which is what produced "'xterm-ghostty': unknown
terminal type" mid-progress-bar. printf puts real ESC bytes into the
variables so a plain /bin/echo prints them, since this script has never
relied on `echo -e`.

Three constraints, each verified:

- The source stays pure ASCII -- escapes are written as printf '\033[31m',
  so no literal control byte is committed and the CI hygiene check that
  rejects non-ASCII outside the spinner charsets still passes.
- The install log stays uncoloured. Colour is applied only to terminal
  output; every line written to jawaInstall.log is plain, so the log
  remains greppable.
- It degrades. initColour leaves all six variables empty unless stdout is
  a terminal and NO_COLOR is unset, so a redirected or piped run emits no
  escape sequences at all.

Labels are padded before being wrapped in colour, not after: padding
afterwards counts the ESC bytes toward the field width and misaligns the
column by the length of the escape sequence.

The eight certificate outcomes are unchanged -- presentation only.
---
 bin/installer.sh | 79 ++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 70 insertions(+), 9 deletions(-)

diff --git a/bin/installer.sh b/bin/installer.sh
index fa3e3fc..19fa5b8 100644
--- a/bin/installer.sh
+++ b/bin/installer.sh
@@ -245,6 +245,39 @@ jawaMinPyMinor=9
 werkzeugPy38Fallback="3.0.6"
 holdWerkzeug="no"
 
+# Colour, as raw ANSI rather than tput: a server's terminfo frequently does not
+# know a modern $TERM forwarded over SSH (see the TERM fallback at the bottom),
+# and every tput call then fails. printf puts real ESC bytes into these
+# variables, so a plain `/bin/echo "${cRed}..."` prints them -- this script has
+# never relied on `echo -e`, whose behaviour differs between shells and builds.
+#
+# All six are empty unless stdout is a terminal, so a redirected run stays
+# clean, and the >>jawaInstall.log lines are written uncoloured on purpose: the
+# log must stay greppable. NO_COLOR is honoured (https://no-color.org).
+initColour() {
+  cReset=""
+  cBold=""
+  cRed=""
+  cGreen=""
+  cYellow=""
+  cDate=""
+  if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    cReset=$(printf '\033[0m')
+    cBold=$(printf '\033[1m')
+    cRed=$(printf '\033[1;31m')
+    cGreen=$(printf '\033[1;32m')
+    cYellow=$(printf '\033[1;33m')
+    cDate=$(printf '\033[36m')
+  fi
+}
+
+# Pads a role label to a fixed width BEFORE it is wrapped in colour. Padding
+# afterwards would count the ESC bytes toward the field width and misalign the
+# column by exactly the length of the escape sequence.
+certLabel() {
+  printf "%-${2:-8}s" "$1"
+}
+
 normalizeInstallDir() {
   # Strip trailing slashes so "$installDir/jawa" cannot become
   # "/usr/local//jawa". The paths were inconsistent -- one assignment used
@@ -346,13 +379,19 @@ certIsUsable() {
 warnIfCertStale() {
   if certIsExpired "$1"; then
     /bin/echo ""
-    /bin/echo "WARNING: $1 EXPIRED on $(certExpiry "$1")."
+    /bin/echo "${cRed}WARNING${cReset}  the certificate JAWA will serve is ${cRed}EXPIRED${cReset}."
+    /bin/echo "         $1"
+    /bin/echo "         expired ${cDate}$(certExpiry "$1")${cReset}"
     /bin/echo "         Browsers will refuse the JAWA console until it is replaced."
     /bin/echo ""
     /bin/echo "WARNING: serving expired cert $1" >>/var/log/jawaInstall.log 2>&1
   elif /usr/bin/openssl x509 -noout -in "$1" >/dev/null 2>&1 &&
     ! /usr/bin/openssl x509 -checkend 2592000 -noout -in "$1" >/dev/null 2>&1; then
-    /bin/echo "NOTE: $1 expires within 30 days ($(certExpiry "$1"))."
+    /bin/echo ""
+    /bin/echo "${cYellow}NOTE${cReset}     the certificate JAWA will serve expires within 30 days."
+    /bin/echo "         $1"
+    /bin/echo "         expires ${cDate}$(certExpiry "$1")${cReset}"
+    /bin/echo ""
     /bin/echo "NOTE: cert $1 expires within 30 days" >>/var/log/jawaInstall.log 2>&1
   fi
 }
@@ -392,7 +431,12 @@ install() {
     # Upgrading a host that already has certificates. Demanding them in the
     # current directory again would push a working install into the
     # self-signed menu for no reason.
-    /bin/echo "Keeping the certificate already installed at $certsDir/jawa.crt (expires: $(certExpiry "$certsDir/jawa.crt"))."
+    /bin/echo ""
+    /bin/echo "${cBold}Certificate: no jawa.crt/jawa.key here, so the installed one is kept.${cReset}"
+    /bin/echo ""
+    /bin/echo "  ${cBold}$(certLabel "IN USE")${cReset}  $certsDir/jawa.crt"
+    /bin/echo "            ${cGreen}$(certLabel "VALID" 10)${cReset}  expires ${cDate}$(certExpiry "$certsDir/jawa.crt")${cReset}"
+    /bin/echo ""
     /bin/echo "Keeping installed cert $certsDir/jawa.crt" >>/var/log/jawaInstall.log 2>&1
     warnIfCertStale "$certsDir/jawa.crt"
   elif [ "$haveLocalCerts" == "no" ]; then
@@ -405,18 +449,34 @@ install() {
     # The copy in the current directory is expired or unreadable and the
     # installed one still works. Installing the bad copy would take the
     # console offline, so keep what works and say why.
+    # Roles first, paths second. The operator reading this at a progress bar
+    # needs to know which certificate is which and what it means before they
+    # need to know where either one lives.
     if /usr/bin/openssl x509 -noout -in ./jawa.crt >/dev/null 2>&1; then
-      certRejectReason="has EXPIRED (expired: $(certExpiry ./jawa.crt))"
+      certRejectState="EXPIRED"
+      certRejectDetail="expired ${cDate}$(certExpiry ./jawa.crt)${cReset}"
+      certRejectReason="has expired ($(certExpiry ./jawa.crt))"
     else
+      certRejectState="UNREADABLE"
+      certRejectDetail="not a valid certificate file"
       certRejectReason="is not a readable certificate"
     fi
     /bin/echo ""
-    /bin/echo "NOT replacing the installed certificate."
-    /bin/echo "  $currentDir/jawa.crt $certRejectReason"
-    /bin/echo "  $certsDir/jawa.crt is still valid (expires: $(certExpiry "$certsDir/jawa.crt"))"
-    /bin/echo "  Keeping the valid one. Replace the copy in $currentDir to install a new certificate."
+    /bin/echo "${cBold}Certificate: keeping the one already in use. Nothing was replaced.${cReset}"
+    /bin/echo ""
+    /bin/echo "  ${cBold}$(certLabel "IN USE")${cReset}  $certsDir/jawa.crt"
+    /bin/echo "            ${cGreen}$(certLabel "VALID" 10)${cReset}  expires ${cDate}$(certExpiry "$certsDir/jawa.crt")${cReset}"
+    /bin/echo ""
+    /bin/echo "  ${cBold}$(certLabel "OFFERED")${cReset}  $currentDir/jawa.crt"
+    /bin/echo "            ${cRed}$(certLabel "$certRejectState" 10)${cReset}  $certRejectDetail"
+    /bin/echo ""
+    /bin/echo "  ${cBold}Impact:${cReset} none. JAWA keeps serving the certificate marked IN USE,"
+    /bin/echo "  so the console stays reachable. The OFFERED file was left untouched."
+    /bin/echo ""
+    /bin/echo "  To install a new certificate, replace jawa.crt and jawa.key in"
+    /bin/echo "  $currentDir and run this installer again."
     /bin/echo ""
-    /bin/echo "Refused to overwrite valid $certsDir/jawa.crt with unusable ./jawa.crt ($certRejectReason)" >>/var/log/jawaInstall.log 2>&1
+    /bin/echo "Refused to overwrite valid $certsDir/jawa.crt with unusable ./jawa.crt (offered cert $certRejectReason)" >>/var/log/jawaInstall.log 2>&1
   else
     /bin/cp ./{jawa.crt,jawa.key} "$certsDir/"
     warnIfCertStale "$certsDir/jawa.crt"
@@ -1148,6 +1208,7 @@ EOF
 currentDir=$(pwd)
 installDir=/usr/local
 timenow=$(date +%m-%d-%y_%T)
+initColour
 
 #branch="main"  # Default branch name if no arguments are provided