Efficiently manage file and folder opening operations across your MacFleet deployment with enterprise-grade security features, application control, and comprehensive audit capabilities. This tutorial transforms basic open commands into robust file access management solutions.

Understanding Enterprise File Open Operations

Enterprise file opening requires more than basic access, demanding:

• Security validation to prevent unauthorized file access
• Application control to enforce approved software usage
• Permission verification before file operations
• Audit logging for compliance tracking
• Malware scanning integration for file safety
• Business rules enforcement for data protection

Core Open Operations

Basic File Opening

#!/bin/bash

# Simple file open with validation
open_file() {
    local file_path="$1"
    
    # Validate file exists
    if [[ ! -f "$file_path" ]]; then
        echo "Error: File '$file_path' not found"
        return 1
    fi
    
    # Open file with default application
    if open "$file_path"; then
        echo "Successfully opened '$file_path'"
        return 0
    else
        echo "Failed to open '$file_path'"
        return 1
    fi
}

# Usage example
# open_file "/Users/admin/document.pdf"

Application-Specific File Opening

#!/bin/bash

# Open file with specific application
open_with_app() {
    local file_path="$1"
    local bundle_id="$2"
    
    # Validate file exists
    if [[ ! -f "$file_path" ]]; then
        echo "Error: File '$file_path' not found"
        return 1
    fi
    
    # Open file with specified application
    if open -b "$bundle_id" "$file_path"; then
        echo "Successfully opened '$file_path' with $bundle_id"
        return 0
    else
        echo "Failed to open '$file_path' with $bundle_id"
        return 1
    fi
}

# Usage examples
# open_with_app "/Users/admin/document.txt" "com.apple.TextEdit"
# open_with_app "/Users/admin/presentation.pptx" "com.microsoft.PowerPoint"

Folder Opening

#!/bin/bash

# Open folder in Finder
open_folder() {
    local folder_path="$1"
    
    # Validate folder exists
    if [[ ! -d "$folder_path" ]]; then
        echo "Error: Folder '$folder_path' not found"
        return 1
    fi
    
    # Open folder in Finder
    if open "$folder_path"; then
        echo "Successfully opened folder '$folder_path'"
        return 0
    else
        echo "Failed to open folder '$folder_path'"
        return 1
    fi
}

# Usage example
# open_folder "/Users/admin/Documents"

Enterprise Open Management System

#!/bin/bash

# MacFleet Enterprise File Open Management System
# Comprehensive file and folder opening with enterprise features

# Configuration
SCRIPT_NAME="MacFleet Open Manager"
VERSION="1.0.0"
LOG_FILE="/var/log/macfleet_open_operations.log"
QUARANTINE_DIR="/var/quarantine/macfleet"
TEMP_DIR="/tmp/macfleet_open"
ALLOWED_EXTENSIONS=(".pdf" ".docx" ".xlsx" ".pptx" ".txt" ".png" ".jpg" ".gif" ".mp4" ".mov" ".pages" ".numbers" ".keynote")
RESTRICTED_PATHS=("/System" "/usr/bin" "/usr/sbin" "/private/var" "/Library/LaunchDaemons" "/Library/LaunchAgents")
APPROVED_APPLICATIONS=(
    "com.apple.TextEdit"
    "com.apple.Preview"
    "com.apple.QuickTimePlayerX"
    "com.microsoft.Word"
    "com.microsoft.Excel"
    "com.microsoft.PowerPoint"
    "com.adobe.Reader"
    "com.apple.iWork.Pages"
    "com.apple.iWork.Numbers"
    "com.apple.iWork.Keynote"
)
BUSINESS_HOURS_START=9
BUSINESS_HOURS_END=17
MAX_FILE_SIZE="100M"

# Create necessary directories
mkdir -p "$TEMP_DIR"
mkdir -p "$QUARANTINE_DIR"
mkdir -p "$(dirname "$LOG_FILE")"

# Logging function
log_operation() {
    local level="$1"
    local message="$2"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local username=$(whoami)
    echo "[$timestamp] [$level] [$username] $message" | tee -a "$LOG_FILE"
}

# Check if current time is within business hours
is_business_hours() {
    local current_hour=$(date +%H)
    if [[ $current_hour -ge $BUSINESS_HOURS_START && $current_hour -lt $BUSINESS_HOURS_END ]]; then
        return 0
    else
        return 1
    fi
}

# Validate file extension
is_allowed_extension() {
    local file="$1"
    local extension="${file##*.}"
    extension=".$extension"
    
    for allowed in "${ALLOWED_EXTENSIONS[@]}"; do
        if [[ "$extension" == "$allowed" ]]; then
            return 0
        fi
    done
    return 1
}

# Check if path is restricted
is_restricted_path() {
    local path="$1"
    for restricted in "${RESTRICTED_PATHS[@]}"; do
        if [[ "$path" == "$restricted"* ]]; then
            return 0
        fi
    done
    return 1
}

# Check if application is approved
is_approved_application() {
    local bundle_id="$1"
    
    for approved in "${APPROVED_APPLICATIONS[@]}"; do
        if [[ "$bundle_id" == "$approved" ]]; then
            return 0
        fi
    done
    return 1
}

# Get file size
get_file_size() {
    local file="$1"
    if [[ -f "$file" ]]; then
        stat -f%z "$file" 2>/dev/null
    else
        echo "0"
    fi
}

# Convert size string to bytes
size_to_bytes() {
    local size="$1"
    local number="${size%[A-Za-z]*}"
    local unit="${size#$number}"
    
    case "$unit" in
        "K"|"KB") echo $((number * 1024)) ;;
        "M"|"MB") echo $((number * 1024 * 1024)) ;;
        "G"|"GB") echo $((number * 1024 * 1024 * 1024)) ;;
        *) echo "$number" ;;
    esac
}

# Check file signature/magic number
check_file_signature() {
    local file="$1"
    local expected_extension="${file##*.}"
    
    if [[ ! -f "$file" ]]; then
        return 1
    fi
    
    # Get file signature
    local signature=$(file -b --mime-type "$file" 2>/dev/null)
    
    # Basic signature validation
    case "$expected_extension" in
        "pdf")
            if [[ "$signature" == "application/pdf" ]]; then
                return 0
            fi
            ;;
        "txt")
            if [[ "$signature" == "text/plain" ]]; then
                return 0
            fi
            ;;
        "docx")
            if [[ "$signature" == "application/vnd.openxmlformats-officedocument.wordprocessingml.document" ]]; then
                return 0
            fi
            ;;
        "xlsx")
            if [[ "$signature" == "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" ]]; then
                return 0
            fi
            ;;
        "pptx")
            if [[ "$signature" == "application/vnd.openxmlformats-officedocument.presentationml.presentation" ]]; then
                return 0
            fi
            ;;
        "png")
            if [[ "$signature" == "image/png" ]]; then
                return 0
            fi
            ;;
        "jpg"|"jpeg")
            if [[ "$signature" == "image/jpeg" ]]; then
                return 0
            fi
            ;;
        *)
            # Allow other extensions without strict validation
            return 0
            ;;
    esac
    
    log_operation "WARNING" "File signature mismatch: $file (expected: $expected_extension, detected: $signature)"
    return 1
}

# Scan file for malware (placeholder for integration)
scan_file_malware() {
    local file="$1"
    
    # Placeholder for malware scanning integration
    # This would integrate with enterprise antivirus solutions
    
    # Basic checks
    if [[ -f "$file" ]]; then
        # Check for suspicious extensions
        local extension="${file##*.}"
        case "$extension" in
            "exe"|"bat"|"cmd"|"scr"|"com"|"pif"|"vbs"|"js")
                log_operation "SECURITY" "Blocked suspicious file type: $file"
                return 1
                ;;
        esac
        
        # Check file size (extremely large files could be suspicious)
        local file_size=$(get_file_size "$file")
        if [[ $file_size -gt 1073741824 ]]; then  # 1GB
            log_operation "WARNING" "Large file detected: $file ($(format_size $file_size))"
        fi
    fi
    
    return 0
}

# Format file size
format_size() {
    local bytes="$1"
    local sizes=("B" "KB" "MB" "GB" "TB")
    local unit=0
    
    while [[ $bytes -gt 1024 && $unit -lt 4 ]]; do
        bytes=$((bytes / 1024))
        ((unit++))
    done
    
    echo "${bytes}${sizes[$unit]}"
}

# Get application info
get_app_info() {
    local bundle_id="$1"
    
    # Get application path
    local app_path=$(mdfind "kMDItemCFBundleIdentifier == '$bundle_id'" 2>/dev/null | head -1)
    
    if [[ -n "$app_path" ]]; then
        local app_name=$(basename "$app_path" .app)
        local app_version=$(defaults read "$app_path/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null)
        echo "$app_name v$app_version ($app_path)"
    else
        echo "Unknown application ($bundle_id)"
    fi
}

# Enhanced file open with enterprise features
enterprise_open_file() {
    local file_path="$1"
    local bundle_id="${2:-}"
    local force_open="${3:-false}"
    
    local operation_id=$(date +%s)
    log_operation "INFO" "Starting file open operation [$operation_id]: $file_path"
    
    # Pre-flight validations
    if [[ ! -f "$file_path" ]]; then
        log_operation "ERROR" "File not found: $file_path"
        return 1
    fi
    
    # Check if file path is restricted
    if is_restricted_path "$file_path"; then
        log_operation "SECURITY" "Blocked access to restricted path: $file_path"
        return 1
    fi
    
    # Validate file extension
    if ! is_allowed_extension "$file_path"; then
        log_operation "SECURITY" "Blocked file with unauthorized extension: $file_path"
        return 1
    fi
    
    # Check file size
    local file_size=$(get_file_size "$file_path")
    local max_size_bytes=$(size_to_bytes "$MAX_FILE_SIZE")
    
    if [[ $file_size -gt $max_size_bytes ]]; then
        log_operation "ERROR" "File too large: $(format_size $file_size) > $MAX_FILE_SIZE"
        return 1
    fi
    
    # Check file signature
    if ! check_file_signature "$file_path"; then
        if [[ "$force_open" != "true" ]]; then
            log_operation "SECURITY" "File signature validation failed: $file_path"
            return 1
        else
            log_operation "WARNING" "File signature validation failed but force_open enabled: $file_path"
        fi
    fi
    
    # Malware scanning
    if ! scan_file_malware "$file_path"; then
        log_operation "SECURITY" "File blocked by security scan: $file_path"
        return 1
    fi
    
    # Business hours check for sensitive files
    if [[ "$file_path" =~ (confidential|secret|private) ]] && ! is_business_hours; then
        log_operation "POLICY" "Sensitive file access outside business hours blocked: $file_path"
        return 1
    fi
    
    # Application validation if specified
    if [[ -n "$bundle_id" ]]; then
        if ! is_approved_application "$bundle_id"; then
            log_operation "SECURITY" "Blocked unauthorized application: $bundle_id"
            return 1
        fi
        
        # Check if application is installed
        local app_path=$(mdfind "kMDItemCFBundleIdentifier == '$bundle_id'" 2>/dev/null | head -1)
        if [[ -z "$app_path" ]]; then
            log_operation "ERROR" "Application not found: $bundle_id"
            return 1
        fi
        
        log_operation "INFO" "Opening with application: $(get_app_info "$bundle_id")"
    fi
    
    # Perform the open operation
    local open_command="open"
    if [[ -n "$bundle_id" ]]; then
        open_command="open -b '$bundle_id'"
    fi
    
    if eval "$open_command '$file_path'"; then
        log_operation "SUCCESS" "File opened successfully [$operation_id]: $file_path"
        
        # Log file access for audit
        log_operation "AUDIT" "File accessed: $file_path (size: $(format_size $file_size))"
        
        return 0
    else
        log_operation "ERROR" "Failed to open file [$operation_id]: $file_path"
        return 1
    fi
}

# Enhanced folder open with enterprise features
enterprise_open_folder() {
    local folder_path="$1"
    local reveal_hidden="${2:-false}"
    
    local operation_id=$(date +%s)
    log_operation "INFO" "Starting folder open operation [$operation_id]: $folder_path"
    
    # Pre-flight validations
    if [[ ! -d "$folder_path" ]]; then
        log_operation "ERROR" "Folder not found: $folder_path"
        return 1
    fi
    
    # Check if folder path is restricted
    if is_restricted_path "$folder_path"; then
        log_operation "SECURITY" "Blocked access to restricted folder: $folder_path"
        return 1
    fi
    
    # Business hours check for sensitive folders
    if [[ "$folder_path" =~ (confidential|secret|private) ]] && ! is_business_hours; then
        log_operation "POLICY" "Sensitive folder access outside business hours blocked: $folder_path"
        return 1
    fi
    
    # Count files in folder for audit
    local file_count=$(find "$folder_path" -type f 2>/dev/null | wc -l)
    local folder_size=$(du -sh "$folder_path" 2>/dev/null | awk '{print $1}')
    
    # Perform the open operation
    local open_command="open"
    if [[ "$reveal_hidden" == "true" ]]; then
        open_command="open -R"
    fi
    
    if eval "$open_command '$folder_path'"; then
        log_operation "SUCCESS" "Folder opened successfully [$operation_id]: $folder_path"
        log_operation "AUDIT" "Folder accessed: $folder_path (files: $file_count, size: $folder_size)"
        return 0
    else
        log_operation "ERROR" "Failed to open folder [$operation_id]: $folder_path"
        return 1
    fi
}

# Bulk file opening with progress monitoring
bulk_open_files() {
    local files_list="$1"
    local bundle_id="${2:-}"
    
    if [[ ! -f "$files_list" ]]; then
        log_operation "ERROR" "Files list not found: $files_list"
        return 1
    fi
    
    local total_files=$(grep -v '^#\|^$' "$files_list" | wc -l)
    local current_file=0
    local success_count=0
    local failure_count=0
    
    log_operation "INFO" "Starting bulk file open operation - Total files: $total_files"
    
    while IFS= read -r file_path; do
        # Skip empty lines and comments
        [[ -z "$file_path" || "$file_path" =~ ^#.* ]] && continue
        
        ((current_file++))
        
        # Trim whitespace
        file_path=$(echo "$file_path" | xargs)
        
        echo "Processing [$current_file/$total_files]: $(basename "$file_path")"
        
        if enterprise_open_file "$file_path" "$bundle_id"; then
            ((success_count++))
        else
            ((failure_count++))
        fi
        
        # Progress update
        local progress=$((current_file * 100 / total_files))
        echo "Progress: $progress% ($success_count successful, $failure_count failed)"
        
        # Small delay to prevent overwhelming the system
        sleep 0.5
        
    done < "$files_list"
    
    log_operation "SUCCESS" "Bulk open completed - Success: $success_count, Failed: $failure_count"
    return $failure_count
}

# Generate file access report
generate_access_report() {
    local report_file="/tmp/macfleet_access_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "MacFleet File Access Report"
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "User: $(whoami)"
        echo "=========================="
        echo ""
        
        echo "Recent File Access Operations (Last 24 hours):"
        if [[ -f "$LOG_FILE" ]]; then
            local yesterday=$(date -v-1d '+%Y-%m-%d')
            grep "$yesterday\|$(date '+%Y-%m-%d')" "$LOG_FILE" | grep -E "(AUDIT|SUCCESS)" | tail -50
        else
            echo "No log file found"
        fi
        
        echo ""
        echo "Security Events (Last 24 hours):"
        if [[ -f "$LOG_FILE" ]]; then
            local yesterday=$(date -v-1d '+%Y-%m-%d')
            grep "$yesterday\|$(date '+%Y-%m-%d')" "$LOG_FILE" | grep -E "(SECURITY|POLICY)" | tail -20
        fi
        
        echo ""
        echo "File Access Statistics:"
        if [[ -f "$LOG_FILE" ]]; then
            echo "Total Operations: $(grep -c "file open operation\|folder open operation" "$LOG_FILE" 2>/dev/null || echo "0")"
            echo "Successful: $(grep -c "SUCCESS.*opened successfully" "$LOG_FILE" 2>/dev/null || echo "0")"
            echo "Failed: $(grep -c "ERROR.*Failed to open" "$LOG_FILE" 2>/dev/null || echo "0")"
            echo "Security Blocks: $(grep -c "SECURITY.*Blocked" "$LOG_FILE" 2>/dev/null || echo "0")"
        fi
        
        echo ""
        echo "Most Accessed File Types:"
        if [[ -f "$LOG_FILE" ]]; then
            grep "File accessed:" "$LOG_FILE" | sed 's/.*File accessed: //' | sed 's/ (size:.*//' | 
            awk -F. '{print $NF}' | sort | uniq -c | sort -nr | head -10
        fi
        
    } > "$report_file"
    
    echo "File access report saved to: $report_file"
    log_operation "INFO" "Access report generated: $report_file"
}

# Check application permissions
check_app_permissions() {
    local bundle_id="$1"
    
    # Check if application has necessary permissions
    local app_path=$(mdfind "kMDItemCFBundleIdentifier == '$bundle_id'" 2>/dev/null | head -1)
    
    if [[ -z "$app_path" ]]; then
        echo "Application not found: $bundle_id"
        return 1
    fi
    
    echo "Application: $(get_app_info "$bundle_id")"
    echo "Path: $app_path"
    
    # Check code signature
    local signature_status=$(codesign -dv "$app_path" 2>&1 | grep -E "(Signature|Authority)")
    echo "Code Signature: $signature_status"
    
    # Check if application is notarized
    local notarization=$(spctl -a -vv "$app_path" 2>&1 | grep -E "(accepted|source=)")
    echo "Notarization: $notarization"
    
    return 0
}

# Main open management function
main() {
    local action="${1:-help}"
    
    case "$action" in
        "open-file")
            local file_path="$2"
            local bundle_id="$3"
            local force_open="${4:-false}"
            
            if [[ -z "$file_path" ]]; then
                echo "Usage: $0 open-file <file_path> [bundle_id] [force_open]"
                exit 1
            fi
            
            enterprise_open_file "$file_path" "$bundle_id" "$force_open"
            ;;
        "open-folder")
            local folder_path="$2"
            local reveal_hidden="${3:-false}"
            
            if [[ -z "$folder_path" ]]; then
                echo "Usage: $0 open-folder <folder_path> [reveal_hidden]"
                exit 1
            fi
            
            enterprise_open_folder "$folder_path" "$reveal_hidden"
            ;;
        "bulk-open")
            local files_list="$2"
            local bundle_id="$3"
            
            if [[ -z "$files_list" ]]; then
                echo "Usage: $0 bulk-open <files_list> [bundle_id]"
                exit 1
            fi
            
            bulk_open_files "$files_list" "$bundle_id"
            ;;
        "check-app")
            local bundle_id="$2"
            
            if [[ -z "$bundle_id" ]]; then
                echo "Usage: $0 check-app <bundle_id>"
                exit 1
            fi
            
            check_app_permissions "$bundle_id"
            ;;
        "report")
            generate_access_report
            ;;
        "help"|*)
            echo "$SCRIPT_NAME v$VERSION"
            echo "Enterprise File and Folder Open Management"
            echo ""
            echo "Usage: $0 <action> [options]"
            echo ""
            echo "Actions:"
            echo "  open-file <file_path> [bundle_id] [force_open]  - Open single file"
            echo "  open-folder <folder_path> [reveal_hidden]       - Open folder in Finder"
            echo "  bulk-open <files_list> [bundle_id]             - Open multiple files"
            echo "  check-app <bundle_id>                           - Check application permissions"
            echo "  report                                          - Generate access report"
            echo "  help                                            - Show this help message"
            echo ""
            echo "Common Bundle IDs:"
            echo "  com.apple.TextEdit          - TextEdit"
            echo "  com.apple.Preview           - Preview"
            echo "  com.microsoft.Word          - Microsoft Word"
            echo "  com.microsoft.Excel         - Microsoft Excel"
            echo "  com.microsoft.PowerPoint    - Microsoft PowerPoint"
            echo "  com.adobe.Reader            - Adobe Reader"
            echo "  com.apple.iWork.Pages       - Pages"
            echo "  com.apple.iWork.Numbers     - Numbers"
            echo "  com.apple.iWork.Keynote     - Keynote"
            echo ""
            echo "Features:"
            echo "  • Security validation and malware scanning"
            echo "  • Application control and approval management"
            echo "  • File signature verification"
            echo "  • Business hours compliance checking"
            echo "  • Comprehensive audit logging"
            echo "  • Bulk operations with progress monitoring"
            echo "  • Detailed access reporting"
            ;;
    esac
}

# Execute main function with all arguments
main "$@"