I think this code is extra recursive? If I read it correctly, you generate the ExtensionRow, which includes the team id that signed it. Then, for each one, you iterate to find the extension policies, and compare to set is_managed. Is that correct?

Naively, it feels simpler to generate the underlying policy outside the forloop, and then pass allowed_extensions and allowed_team_opt to getExtensionRow. Am I mis understanding?

@directionless, getExtensionRow and getPolicyFlag operate on two different nodes of the property tree. The one node has the list of system extension installed and the other have the policy related to the system extension.

The function getExtensionRow only gets the list of the system extension installed and for each extension, it looks into the extension policy node based on team id. The two-level of indirection makes it look extra recursive.

I see that getExtensionRow and getPolicyFlag work in different places. But looks like for each row, this calls getPolicyFlag, which mostly does the same parsing, to see if teamid is allowed. So I wonder if parsing for all allowed team IDs, then checking membership would be faster than the repeated parsing. I'm not very confident in my read here.

I don't know that you can call it "recursive." genExtensionsFromPtree has a single loop that calls getExtensionRow then (conditionally) getPolicyFlag

You're right that getPolicyFlag() does not cache its lookups, meaning it will do a small amount of work to walk the ptree again each time even if multiple rows all had the same Team ID and it was determined in the first call to getPolicyFlag() that the Team ID was allowed by MDM policy. But this is a very small amount of unnecessary work, and done only a few times per table query.