[pull] dev from KelvinTegelaar:dev - #148
Open
pull[bot] wants to merge 643 commits into
Open
Conversation
Synced from CyberDrain/CIPP@29cc78a
Synced from CyberDrain/CIPP@b6f96ca
Limit app management policy comparison to the restriction fields this standard actually controls before sorting and JSON diffing. This prevents false, permanent deviations when Microsoft Graph adds extra properties (such as null `excludeActors`) to returned restriction objects. Synced from CyberDrain/CIPP@3a0b876
…and-settle-window-changes perf(auditlog): performance improvements Synced from CyberDrain/CIPP@64e5ab2
Update the inactive accounts report to include `lastSuccessfulSignInDateTime` when determining a user's most recent activity, preventing recently active users from being flagged as inactive. Also change `lastRefreshedDateTime` to use the users cache row timestamp (actual refresh time) instead of request time. Frontend report columns and generated OpenAPI schema were updated to expose the new field and refreshed metadata. Synced from CyberDrain/CIPP@47170a6
a new alert for unlicensed OneDrive data nearing deletion was introduced in alerts.json, allowing for better monitoring of unlicensed accounts and accidental data loss. Synced from CyberDrain/CIPP@eb3eb30
Variable substitution ran only at the Graph request layer, after New-CIPPCAPolicy had already done its named-location existence check and excludeLocations displayName->id rewrite on the raw %token% text. An existing location could never match: every deploy created a duplicate named location (the POST body is substituted at send time, so the duplicate carried the resolved name) and the policy body kept the raw token, which the request layer resolved to a display name where Graph requires a namedLocation GUID - failing with 1040: NamedLocation does not exist in the directory. Resolve variables once at the top of New-CIPPCAPolicy (covers manual deploy, standards and restore), in the standard's report path so the compare diffs resolved values instead of flagging permanent drift, and in the batch loader so DependencyMap keys stay consistent. Pester repro covers both the existing-location and new-location paths. Synced from CyberDrain/CIPP@b4c64e3
A saved AccountId with bearer auth off, or an out-of-range expiry value, made New-Push throw at parameter binding. New-PwPushLink swallowed the exception into $false, so the extension test reported "PWPush is not enabled" while password flows fell back to plain text passwords in notifications. - Only pass AccountId to New-Push when bearer auth is on and the saved value is non-empty; a placeholder or stale selection no longer kills the push. - Drop ExpireAfterDays/ExpireAfterViews values outside PassPushPosh's accepted ranges (1-90 / 1-100) with a logged warning instead of letting validation throw. - ExecExtensionTest now checks Enabled explicitly and surfaces the real exception via a new -ThrowOnError switch instead of collapsing every failure into "PWPush is not enabled". - Make placeholder dropdown rows with an empty id unselectable in integration settings so the poison value cannot be saved again. Synced from CyberDrain/CIPP@07e0415
…rsions card - New Update-CIPPVersionHistory warmup step persists version transitions (previous/new version, image tags, UTC timestamp) to the VersionHistory table. The event RowKey derives from the version pair, so nodes racing through warmup upsert one event instead of duplicating. Registered in all three appsettings WarmupScripts lists; soft-fail like the rest. - Get-CIPPVersionHistory exposes the recorded history via GetVersion (VersionHistory/LastUpdate) and ExecContainerManagement Status (UpgradeHistory), rendered as a Last Updated row on the Versions card and an Update History card on the container management page. - GetVersion also returns the hosting shape (hosting type, App Service SKU, runtime stack) read from the environment only, and degrades to Unknown fields instead of failing outright when the GitHub release check is rate-limited or unreachable. - Versions card shows Hosting / SKU / Runtime Stack in a compact two-column layout with a Copy for Ticket button that produces a paste-ready plain-text block for support tickets. Synced from CyberDrain/CIPP@2f35ff3
…rker Initialize-PassPushPosh is a no-op once a session is initialized, and CRAFT workers are long-lived and shared - each worker kept the auth headers and base URL from whatever configuration it saw first, so config changes and key rotations never applied until a container restart. Pass -Force so every push runs with the currently saved configuration. Also redact APIKey/Bearer in the logged initialization parameters instead of writing the raw key to the information stream. Synced from CyberDrain/CIPP@b8df60c
Adds a 'Generate Support File' speed dial action that captures the current page's API traffic, instance version/hosting details, and signed-in user identity into a downloadable JSON bundle. - New `CippSupportBundleDialog` component handles the collection lifecycle (options → collecting → ready/error) - New `support-bundle.js` utility: axios interceptor for recording, redaction of emails/GUIDs/domains with consistent tokenisation, and JSON download - `GetVersion` endpoint extended with `ResourceGroup`, `Domains`, and `DomainsAuthoritative` hosting fields via ARM helpers - Redaction keeps the instance hostname intact so support can still identify the installation Synced from CyberDrain/CIPP@4e53fc8
Synced from CyberDrain/CIPP@8329ceb
Replace `New-Push` with a direct `Invoke-PasswordPusherAPI` call in `New-PwPushLink` so authenticated pushes no longer fail when pwpush returns string account IDs (for example `acct_...`). The request payload is now built in the API’s expected `password` schema (`expire_after_days`, `expire_after_views`, `deletable_by_viewer`, `passphrase`, optional `account_id`), keeps range guards with warnings for invalid saved settings, and derives the returned link from `json_url`/`html_url` while preserving retrieval-step behavior. Synced from CyberDrain/CIPP@b83822e
Synced from CyberDrain/CIPP@bdf3b56
Four cached readers missed the v10.7.3 tenant-scope enforcement (0aa6200d), each reachable by a tenant-restricted custom role: - Invoke-ListHVEAccounts: UseReportDB=true with tenantFilter=AllTenants hits Get-CIPPDbItem's cross-partition sentinel (-ne is case-insensitive) and returned every tenant's HVE accounts. - Invoke-DomainAnalyser_List: AnyTenant skips the framework per-tenant check and the endpoint read the Domains table raw, so AllTenants returned every tenant's domain/DNS posture and any single tenant was readable by naming it. - Invoke-ListAlertResults: AnyTenant with no self-scoping let any tenant's fired-alert items be read by naming the tenant. - Invoke-ListSnoozedAlerts: returned every snooze record, tenant names and alert content previews included. Each now pipes its rows through Select-CippAllowedTenantData on the column that carries the row's tenant, the same pattern the 0aa6200d endpoints use: unrestricted callers pass through untouched, restricted callers keep only their tenants' rows. Get-CIPPDomainAnalyser additionally skipped per-scope isolation on its in-worker results cache: entries are keyed by tenant filter alone and workers serve many users, so results computed under one caller's scope could be replayed to a caller with a different scope for up to five minutes. Tenant-restricted requests now bypass that cache in both directions; unrestricted callers and background runs keep it. Synced from CyberDrain/CIPP@d12f07a
Adds /api/ListGuestUsers classifying guests as Active, Stale, Pending Acceptance, Never Signed In or Disabled from Graph beta sign-in activity, falling back to invitation-state-only statuses on tenants without Entra ID P1. New guest-users page with clickable summary count cards that filter the table, status filter presets, and a re-invite row action reusing /api/AddGuest for pending or stale guests. Synced from CyberDrain/CIPP@25dea1b
New-SharingLinksTestData seeds a dedicated document library with many small files and organization-scope links (chunked and resumable via -StartIndex, Retry-After aware, -Cleanup to remove). The measurement script times the scan phases (delta paging, permission batches, the real site activity) and projects wall time against the background activity budget; the comparison script benchmarks the classic delta-plus-permissions collection against the PrincipalCount pre-filter and Graph Search discovery on the same drive. All three require a dot-sourced Initialize-DevEnvironment session. Synced from CyberDrain/CIPP@76834eb
AnyTenant skips the framework per-tenant check, so each endpoint now gates itself: restricted callers resolve the target tenant through the scope-narrowed Get-Tenants (or filter rows via Select-CippAllowedTenantData), failing closed. Estate-wide config writes (extension/custom-data mappings, tenant onboarding, tenant group rules) require an unrestricted scope. Covers 26 endpoints, with Pester tests for the three gate shapes. Synced from CyberDrain/CIPP@0072989
Improve queue priority resolution for orchestrations and starter jobs: - Start-CIPPOrchestrator now resolves priority via a fallback chain: explicit InputObject.Priority (range-validated) → ambient CraftOperationContext → HTTP-triggered default (P2) → background default (P4) - Start-UserTasksOrchestrator explicitly sets P2 for user task orchestrations so they don't queue behind P4 background fan-outs - Add-CippQueueMessage gains a Priority parameter, defaults to P2 for HTTP requests and P5 otherwise, with graceful fallback for older Craft runtimes that lack the priority overload Synced from CyberDrain/CIPP@4616513
Invoke-AddExConnector ran Get-CIPPTextReplacement once before the tenant loop with an unassigned $Tenant, so %variable% tokens in the connector comment resolved against a null tenant. Move the replacement inside the per-tenant loop on a per-tenant copy of the params, so tokens resolve against each target tenant and one tenant's resolved values never feed the next tenant's replacement. Synced from CyberDrain/CIPP@ba81145
Use `Get-Variable` to fetch `CraftOperationContext` from global scope in orchestrator and queue helpers. This keeps priority detection working on current Craft workers while still degrading cleanly to defaults on older runtimes where the variable is absent. Synced from CyberDrain/CIPP@3dedce3
Adds a stub for Get-CippUserAgent in the HaloPSA ticket Pester tests to prevent failures caused by the new dependency in New-HaloPSATicket. Synced from CyberDrain/CIPP@8be1d34
…-tenant scans The SharePointPermissions cache is manual-only, so nothing refreshes it on a schedule. Push-StoreSharePointPermissions discarded an entire run whenever the fan-in was short (a single failed or reclaimed batch drops ~20 sites), so a large tenant could go run after run without a successful write. Its cached rows then aged past the 30-day reporting retention and the report reverted to "No cached permission data found" - while the silent failure left the prior data on screen, so the run looked like it had worked. - Tolerate a missing batch: write the sites that were collected and carry every expected site that did not come back over from the prior cache, flagged Skipped, instead of throwing the whole run away. ExpectedSiteIds (now passed by the collector) is what distinguishes a failed batch from a deleted site. A run that collected nothing still writes nothing, so genuinely stale data is not re-stamped fresh and still expires on schedule. - Bound store-step memory (this path threw OutOfMemoryException on a 112k-assignment tenant): stream rows into one Add-CIPPDbItem invocation and release each site's rows as they are written, and read the prior cache only for the sites being restored, one at a time by RowKey prefix, instead of materialising the whole tenant. Adds Push-StoreSharePointPermissions.Tests.ps1 covering complete runs, carry-over of a missing batch, returned-Skipped restore, the no-collection guard and the no-expected-ids back-compat path. Synced from CyberDrain/CIPP@27fc17f
Update Domain Analyser orchestration so scheduled fan-out only targets tenants with required Exchange capabilities, while on-demand API-triggered runs explicitly bypass that filter and run for the selected tenant(s). The orchestrator now builds tenant batches directly for all-tenant runs and keeps targeted single-tenant queueing behavior. Synced from CyberDrain/CIPP@f5d4c20
Push-ExecScheduledCommand wrote the whole task result array to the Information stream as JSON (twice per run), which the task host captures verbatim into its log. A vulnerabilities alert on a large estate returns thousands of per-CVE objects, so one run could emit several MB per tenant and evict all other operational history from the durable log ring within about an hour. Route the result dumps through a small helper that serialises only the first N array elements and hard-caps the string length, so a large result costs a few KB instead of megabytes and the full array is never serialised for the log. The result used for delivery and storage is untouched. Synced from CyberDrain/CIPP@72af320
Updated the Disable Guests standard to include a configurable grace period for soft-deleting already-disabled guest accounts. The help text and executive summary were revised to clarify the new functionality, emphasizing the reduction of security risks from dormant accounts while maintaining a clean user directory. The impact level was increased to high, reflecting the significance of these changes. Additionally, tests were updated to ensure compliance with the new deleteGraceDays feature. Synced from CyberDrain/CIPP@3b8b228
Invoke-RestMethod returns a top-level JSON array as a single Object[], so returning it directly made @(Get-HaloTicketType) a nested array. Assign to a variable and write it out to properly enumerate rows. Adds a Pester test covering this behavior. Synced from CyberDrain/CIPP@a99c681
Introduced a new action to view identity coverage for policies, allowing users to see which identities are included or excluded by a policy. Updated the policy actions table in the documentation to reflect this change. Additionally, added new translation keys for coverage reasons in the CIPP translations and improved formatting for displaying coverage information in the UI. Synced from CyberDrain/CIPP@d94a489
Fixes several backend regressions and data-shape issues across alerts and reporting endpoints. Access checks now read Type/SkipCache/TenantId from both query and body so MCP-dispatched requests no longer return empty results; Azure AD Connect status now reports real elapsed sync hours (and exposes the raw timestamp separately); and SharePoint quota totals now cast string fields to numeric values before aggregation. The phishing alert handler now downgrades known regional Exchange API route-miss errors to a stable “API unavailable” message while preserving normal failure alerts for real errors, and new Pester coverage verifies user-only filtering plus this error behavior. openapi.json was regenerated to reflect the updated request/response contracts and parameter descriptions. Synced from CyberDrain/CIPP@0f01241
Synced from CyberDrain/CIPP@8a7d336
Introduces a 5-minute InstanceHealth timer that reduces container log lines into sample and client rows, a boot marker recorded on warmup, and a stalled-run predicate. Adds the ListInstanceDiagnostics endpoint (Checks/Timeline actions) and a new frontend Diagnostics tab with charts, checks, events, and API client tables. Includes table cleanup rules, log presets, translations, and unit tests for the new PowerShell and JS helpers. Synced from CyberDrain/CIPP@89a556f
…ate can't deploy Apple enrollment (ADE) policies are Settings Catalog policies whose template marks every Setup Assistant option required. Microsoft keeps adding new required options (recently accessibility appearance and Liquid Glass), so a template captured before an option existed can no longer be deployed - Graph rejects the create with an opaque "A required Setting in the template is not present in the policy" error that names only an internal GUID. Add a deploy-only ThrowOnMissingRequired guard to Select-CIPPIntuneAvailableSetting that, for the enrollment family only, diffs the policy's settings against the tenant's required setting templates (already fetched to filter unavailable settings) and throws an actionable error naming the missing settings and how to fix them. Scoped strictly to templateFamily enrollment* / technologies enrollment so Endpoint Security and generic Catalog policies - which deploy fine as a subset - are never validated. The comparison and drift paths never set the switch, so their behaviour is unchanged. Synced from CyberDrain/CIPP@80b5e53
Synced from CyberDrain/CIPP@63fe1f8
Split Test-CIPPAccess into smaller pieces: New-CippMeResponse for the /me endpoint, Get-CippRequestIPAddress for IP parsing, and Find-CippBaseRole for base-role matching, all moved to Private/Authentication. CIPPCore.psm1 now dot-sources Private functions alongside Public but only exports the Public ones. Also fixes Test-CippRoleTenantScope so an unresolved (but present) tenant filter is denied on the allow pass instead of always returning true, while the BlockedEndpoints pass opts into the old fail-closed behavior via a new -TreatUnresolvedAsInScope switch. Adds characterization and unit tests covering these paths. Synced from CyberDrain/CIPP@0b0f5f6
…en via %ADETokenId%
Apple ADE enrollment policies are Settings Catalog policies that only deploy with
a creationSource ("DepTokenId_{tokenId}") binding them to the target tenant's ADE
enrollment-program token. Without it the DCV2 create fails with an opaque generic
error. CIPP dropped creationSource on capture and never set it on deploy, so these
policies could never be deployed.
- Capture (New-CIPPIntuneTemplate): for enrollment-family policies, store
creationSource "DepTokenId_%ADETokenId%", stripping the source tenant's token so
the binding is filled per target tenant.
- Deploy (Set-CIPPIntunePolicy): the token id resolves per tenant from the
ADETokenId custom variable via Get-CIPPTextReplacement; if it is unset or the
policy carries no creationSource, fail early with the tenant's real token id(s)
rather than the opaque Graph error, and keep CreationSource on edit (PUT) for
enrollment policies instead of stripping it.
- Deploy drawer: never prompt for or show the token; ADETokenId is resolved
server-side and surfaced only as a clear error when it is missing.
Synced from CyberDrain/CIPP@6a79dc5
Regenerated from the Microsoft Graph beta configurationSettings/configurationCategories catalog via build/tools/Update-IntuneCollection.ps1 (previous refresh was 2026-08-07). - 18329 setting definitions (was ~stale Aug snapshot), 1012 categories - backend/Config/intuneCollection.json + intuneCategories.json, the 256 frontend/public/intune-definitions bundles, and frontend/public/intuneCategories.json Notably now includes the Apple enrollment (ADE) ade_* settings (user affinity, Setup Assistant panes incl. accessibility appearance and Liquid Glass), so the Intune template editor resolves them to display names and option pickers instead of raw setting definition ids. Synced from CyberDrain/CIPP@727e028
Get-MalwareFilterPolicy no longer returns the legacy configurable "Action" property that this test read, so $Policy.Action was always $null. That made every policy trip the -notin check (marking the test Failed on every tenant) while the "Current Action" table column rendered blank, since it was populated from the same missing property. Read FileTypeAction instead (the real quarantine/drop response on the malware filter policy) and accept Quarantine or Reject, matching the sibling MS.EXO.10.1/10.3 tests which already read EnableFileFilter and ZapEnabled. Also refresh the remediation doc, which cited the removed Set-MalwareFilterPolicy -Action parameter. Fixes #569 Synced from CyberDrain/CIPP@8a9c164
- Added a new role entry in SAMManifest.json for enhanced role management. - Removed the requirement for the 'Billing Administrator' GDAP role in help texts across standards and baseline standards. - Updated PowerShell equivalent commands for disabling self-service licenses to reflect current practices. - Adjusted caching and API request handling in related PowerShell scripts to support app-only authentication. - Enhanced test cases to validate the new API request parameters. These changes improve clarity in documentation and streamline the management of self-service licenses. Synced from CyberDrain/CIPP@ce2e0b4
Add the offline_access delegated Graph scope alongside the existing openid/profile/email on the CIPP-SSO app registration, so EasyAuth can obtain refresh tokens without re-consent. - New-CIPPSSOApp declares all four scopes on new apps (and patches existing ones on any re-run). - Update-CIPPSSOPreconsent grants offline_access in the AllPrincipals consent grant; it runs every warmup and self-heals existing installs. - Update-CIPPSSORedirectUri backfills requiredResourceAccess at warmup so app registrations created before offline_access was added declare it too, additively and without dropping existing scopes. Synced from CyberDrain/CIPP@aace2f8
…update-20260911 chore(permissions): update Entra API permission translator (2026-09-11) Synced from CyberDrain/CIPP@43b6b34
Adds deprecation notice pointing to ListGraphRequest with auditLogs/signIns endpoint, which supports proper paging via manualPagination and nextLink. Restricts this endpoint to a single page (noPagination) and adds a Deprecation response header to signal upcoming removal. Synced from CyberDrain/CIPP@0d47d5e
Synced from CyberDrain/CIPP@e2cab5a
Add Get-CIPPEgressLedger to read Craft's daily egress-ledger.json and compute per-bucket egress deltas in Start-InstanceHealthSample. Track egress-cap rejections (count + distinct client names) in Get-CIPPInstanceHealthSample. Surface an egress check and per-bucket egress data in Invoke-ListInstanceDiagnostics, including cap usage percentage and rejected clients. Add an egress chart to the diagnostics timeline UI with a formatBytes helper, and cover all new behavior with backend and frontend tests. Synced from CyberDrain/CIPP@aaab3e0
Adds EgressBytes, EgressBytesToday, EgressCapBytes, EgressRejectClients, and EgressRejectCount fields to the openapi schema to reflect storage egress tracking additions. Synced from CyberDrain/CIPP@a6af9cb
…nt at warmup Strict discovery clients (Copilot CLI reads only the challenge header; ChatGPT/VS Code read the discovery docs) only get a refresh token if offline_access is in the advertised scope set. Those settings (WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES, CRAFT_PRM, CRAFT_PRM_AS) are written only by Save to Azure, and a code deploy doesn't regenerate them — so an instance that never re-saved after offline_access was added kept handing out a scope with no refresh token. - Extract Get-CippMcpScopeAppSettings as the single source of truth for those settings; Invoke-ExecApiClient SaveToAzure now uses it (no behaviour change, deterministic output). - Initialize-CIPPAuth warmup step 3d reconciles the scope advertisement on drift only (offline_access / resource scope missing from the header or discovery docs), writing the identical values and requesting one restart to converge. Once present it never writes again, so no restart loop. Synced from CyberDrain/CIPP@ca1fc51
… templates and baselines Synced from CyberDrain/CIPP@24b66d5
…update-20260914 chore(permissions): update Entra API permission translator (2026-09-14) Synced from CyberDrain/CIPP@331ba7f
Craft now writes a per-API-client egress accounting table (15 min buckets plus daily rollups per client and instance-total) instead of a single-file egress-ledger.json. Replace Get-CIPPEgressLedger with Get-CIPPEgressAccounting, which reads the new table, resolves client names via Get-CippApiClient, and returns bucket/daily aggregates or null when accounting is off. Update Start-InstanceHealthSample and Get-CIPPInstanceHealthSample to drop the old log-scraped egress reject tracking, and rework Invoke-ListInstanceDiagnostics' Checks and Timeline actions to surface the richer Egress block (cap status, shed requests, busiest clients) instead of the old EgressBytes/EgressCapBytes sample fields. Update and add corresponding Pester tests. Synced from CyberDrain/CIPP@2c5c715
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )