[pull] dev from KelvinTegelaar:dev - #133
Open
pull[bot] wants to merge 8103 commits into
Open
Conversation
Older app templates could carry both 'assignTo' and 'AssignTo' keys, causing ConvertFrom-Json to throw. Introduces ConvertFrom-CippAppConfig to handle the collision by preferring the canonical casing. Updates ExecDeployAppTemplate and IntuneAppTemplateDeploy to use it. Normalises the frontend to emit 'AssignTo' and strip 'assignTo' when loading templates. Synced from CyberDrain/CIPP@9658fb2
feat(dashboard): add all-tenants dashboard view Synced from CyberDrain/CIPP@19e7f07
…-invites feat: grant shared mailbox and calendar access during user onboarding Synced from CyberDrain/CIPP@107f5be
…atalog The template editor downloaded intuneCollection.json in full to name a policy's settings: 17MB parsed, 1MB compressed, ~70ms of main-thread JSON.parse and ~18MB retained, to read the ~2% of definitions a policy actually references. The fetch was gated on the parsed policy, so it could not even start until the template request had returned. Definitions are now split into one file per setting under public/intune-definitions and fetched by id, 24 at a time. A 379-setting baseline pulls 47KB over the wire instead of 1MB, needs no meaningful parse, and caches each definition independently, so a second policy sharing settings re-fetches nothing. Files are named by the SHA-256 of the setting id rather than the id itself: ids run to 278 characters and would overrun the 260-character Windows MAX_PATH, breaking checkout and build on Windows. Settings are also grouped into collapsible categories. Update-IntuneCollection now captures categoryId and resolves display names from deviceManagement/configurationCategories, writing the category records to intuneCategories.json for reuse elsewhere. Sections key on category id, not display name: Intune has thirteen categories called "Security", and grouping by name fused Event Log Service's settings with Remote Desktop's under one heading. Where the catalog has no category the setting id namespace stands in. Also fixes a setting with no value yet - an ADMX text box left blank, which Intune sends as a value object carrying no `value` at all - being classified as an unknown type. Those rendered read-only and, because edits skip unsupported settings, could never be filled in. An untouched empty setting still round-trips without gaining a value it never had. frontend/public/intuneCollection.json is left in place and still written by the generator. Nothing reads it now that the UI fetches the per-definition files, but keeping it current costs nothing beyond disk and leaves the option open. Synced from CyberDrain/CIPP@af8b4b2
Synced from CyberDrain/CIPP@053a6ef
Drop the special-case that injected empty `locale` and `language` values when `Language` was `user-select`. This keeps the deployment profile payload aligned with the default object shape and avoids sending Graph fields that were being forced to empty strings. Synced from CyberDrain/CIPP@ddb044f
Improve cross-tenant sensitivity label template deployment by stripping tenant-scoped RMS template IDs from captured labels, normalizing encryption rights into the New-/Set-Label write format, and preserving portable rights-based encryption settings. Also adds parent label re-resolution by name when captured ParentId values are tenant-specific, skips invalid ParentId on updates, and adds focused Pester coverage for rights conversion and portability behavior. Synced from CyberDrain/CIPP@1d6cf5d
Look up the default Intune platform restrictions policy by its id suffix instead of filtering on an inconsistent Graph type, and log when the default policy cannot be found. Also normalize unset settings to booleans so comparisons, remediation payloads, and BPA reporting do not drift because of `$null` values. Synced from CyberDrain/CIPP@0e1bbc7
…r visibility (issue 128) Updated the group report to include owners in the data retrieval and added functionality to toggle the display of owners in the UI. The group description was also modified to reflect the inclusion of owners. This improves the overall visibility and management of group data. Synced from CyberDrain/CIPP@0308b6e
Fix PSScriptAnalyzer warnings across the backend: - Reorder null comparisons to use `$null -eq $var` pattern - Rename unapproved verb functions (Process-*, Parse-*, Clean-*, Normalize-*) to approved verb equivalents (ConvertTo-*, ConvertFrom-*, Expand-*) - Remove unused `SupportsShouldProcess` from Start-BillingTimer - Rename loop variables to avoid shadowing outer scope variables Synced from CyberDrain/CIPP@0abca90
Synced from CyberDrain/CIPP@382ce7c
Synced from CyberDrain/CIPP@8311cea
refactor(advanced): reorganize super-admin into dedicated sections Synced from CyberDrain/CIPP@6e26586
…resolution Exchange bulk requests were only checking the final error record, silently hiding failures anywhere earlier in the batch. This meant rejected group membership changes were reported to the operator as succeeded. Introduce Resolve-CippExoBulkResult to correlate each result back to its operation by OperationGuid (newly stamped on all Exchange bulk requests). When an error cannot be attributed to a specific operation, all otherwise-unconfirmed operations are reported as failed rather than guessed successful. Fix group type routing by looking up what each group actually is from Graph (mailEnabled/securityEnabled/groupTypes) instead of trusting the posted type, which is missing on older template-stored options and stale on groups converted after the option was saved. Only fall back to the posted value when the lookup returned nothing. Report groups deliberately skipped during copy (dynamic, AD-synced, public, already-member) so the operator sees which groups were left out and why, rather than silently dropping them. Fix the Add User form's template application effect re-firing whenever any watched field changed, overwriting groups the operator had manually added. Gate the effect on whether the template selection has actually changed. Add 11 new Pester test suites (1,500+ lines) covering all group membership code paths and error scenarios, and 2 frontend test suites for the form regression and vacation actions. Synced from CyberDrain/CIPP@aa41c3e
Replaces CSOM/SOAP ProcessQuery with SharePoint REST API for site admin operations, using certificate-based app-only authentication instead of delegated (refresh token) auth. Benefits: - Removes dependency on GDAP holding SharePoint Administrator role in customer tenant - Aligns with other SharePoint permission endpoints that already use app-only auth - Improves reliability by eliminating 'Attempted to perform an unauthorized operation' failures Also: - Enhances input validation and normalization for OnedriveAccessUser parameter - Improves error messages and logging - Removes debug Write-Host output from HTTP endpoint - Changes result handling to array format for better multi-user operation rendering - Updates documentation comment in Restore-CIPPSPODeletedSite Synced from CyberDrain/CIPP@45eef74
- Fixed relative path issues by using $env:CIPPRootPath with Join-Path and -LiteralPath for robust file access - Added excludeGroup parameter support in Choco and MSP app deployments - Fixed potential object mutation issue in AddMSPApp by parsing template JSON per tenant instead of once globally - Added -Raw parameter to Get-Content for safer JSON parsing Synced from CyberDrain/CIPP@051772b
Add three test cases for Auto Expanding Archive handling in mailbox caching: - Per-mailbox archive state when org setting is unavailable - Organization-level setting overriding per-mailbox values - Graceful degradation when org config lookup fails Also add New-ExoRequest stub and import Get-CIPPAutoExpandingArchiveState helper to support these tests. Synced from CyberDrain/CIPP@1cc7cc8
Add `.DESCRIPTION` metadata to many CIPP HTTP entrypoints so the generated API docs better explain what each endpoint does and how its key parameters behave. No functional behavior changed. Synced from CyberDrain/CIPP@dcfabc8
…eval Feat: Retrieve Intune-managed BIOS passwords Synced from CyberDrain/CIPP@22da468
Standardize comparison of HTTP query and body parameters against boolean values instead of string literals. Replace `-eq 'true'` with `-eq $true` to prevent type coercion bugs and improve clarity. Extract boolean assignments into descriptive variables with clarifying comments. Add parameter validation to endpoints that require specific parameters. This resolves inconsistent boolean handling patterns across ~40 endpoints and improves code maintainability. Synced from CyberDrain/CIPP@ecd09d3
…tering - Add ConvertTo-CIPPODataFilterValue for Id, Name, and Type parameters to prevent OData injection attacks - Move Type and TenantFilter filtering to query level (storage) instead of client-side for better performance and security - Improve tenant resolution to handle both customerId and defaultDomainName formats - Build HashSet for allowed tenant identifiers to efficiently check access control - Add tenant lookup to correctly resolve and display tenant domain names in results Synced from CyberDrain/CIPP@f0812cc
Synced from CyberDrain/CIPP@36d084e
Boolean request flags must be compared to $true/$false variables, not strings 'true'/'false', because the OpenAPI generator infers field types from code patterns. String comparisons cause the spec to type them as strings, shipping mistyped MCP tool contracts. Normalized booleans also must never be interpolated into strings (e.g., URLs or filters), since $false renders as 'False' when the parameter is absent, silently corrupting the request. Fixes: - Invoke-ListSites: use -eq $true instead of -eq 'true' (two occurrences) - Invoke-ListGroups: fix Graph URL that was passing 'groups//' instead of 'groups?' for list requests, adds explanatory comment New test (EntrypointBooleanFlags.Tests.ps1) validates these patterns across all HTTP entrypoints, catching regressions before they ship. Tooling: Updated build scripts to properly handle CIPPTests module during dev builds (copy contents to avoid directory nesting) and include it in the watch list. Synced from CyberDrain/CIPP@9b9564d
Synced from CyberDrain/CIPP@30cb11b
…eporting DB Snapshot the Domain Analyser results already computed into the Domains table into CippReportingDB as type DomainAnalyser during the Graph cache collection, so custom tests and reports can read DNS hygiene, email authentication state and domain health scores through Get-CIPPTestData without needing network access from the test sandbox. Rows are keyed by domain so nightly reruns upsert in place, and a tenant the analyser has not run for is skipped rather than recorded as an authoritative empty set. Move the Domain Analyser timer from 05:30 to 01:30 so it completes ahead of the 03:00 DB cache run and the 04:00 test run, matching the pattern the Intune report-export timer already uses. Closes #235 Synced from CyberDrain/CIPP@3f3247f
…the sharing-links scan A NoAccess-locked site (typically an offboarded user's OneDrive) blocks all content access including sharing-link redemption, so its links are dead while the lock stands. The scan previously completed such sites as failed, which protected their cached rows every cycle and logged a warning per site per scan. A locked site now completes un-failed without scanning, letting finalisation prune its inactive links; an unlock later triggers a fresh full scan that re-adds them. Locks appearing mid-scan get the same treatment at the drive level. Synced from CyberDrain/CIPP@94b9e73
…icate The tenant quota endpoint and the quota alert called SPO admin REST StorageQuotas() with a delegated client-secret token, which 401s on tenants where the service account lacks SharePoint admin rights; the endpoint then swallowed the failure into "Not available" and the alert silently skipped the tenant. Cert-based app-only auth - the same mode the other SPO admin REST callers already use - succeeds on the tenants the delegated call failed on. Synced from CyberDrain/CIPP@d0f916a
feat(halo): add configurable ticket request source Synced from CyberDrain/CIPP@62ca847
When a role rule grants X.ReadWrite, it now also matches X.Read endpoints in the permission universe. Previously, objects that only declare a .Read endpoint (e.g. Endpoint.Device) would silently lose access when the role was configured with the .ReadWrite variant. Synced from CyberDrain/CIPP@47644a1
When Graph or Exchange reads failed, the GroupTemplate standard treated the empty result as 'tenant has no groups' and recreated every templated group on each run. Entra permits duplicate displayNames, so each failed read silently produced twins (2→4→6…). Adds try/catch guards around both the Graph groups read and the Exchange dynamic distribution group read, logging an error and returning early on failure rather than proceeding with an empty baseline. Also adds Pester tests covering the happy path (existing group not recreated, genuinely empty tenant creates group) and the failure paths (Graph failure, Exchange failure, report mode). Synced from CyberDrain/CIPP@0e93789
Replace the legacy name-list policy lookup with a two-pass resolution: prefer an exact name match, then fall back to the built-in default policy (via IsDefault flag or 'Default' name) when the configured name is one of the known portal/cmdlet aliases. Also detect the built-in policy via IsDefault rather than relying solely on the 'Default' name string. Synced from CyberDrain/CIPP@325b40a
…ink-to-SharePoint-Portal feat: Add SharePoint Portal link to Hudu Magic Dash Synced from CyberDrain/CIPP@bcb443a
…dash-to-purview-portal fix: Update Compliance Portal URL to Purview link Synced from CyberDrain/CIPP@9cba749
- Improved `Invoke-EditGroup` function to better handle owner additions and removals with enhanced identity resolution. - Updated `CippApiDialog` to integrate CSV field handling and nested value resolution. - Introduced `CippDataTableButton` and `CippTableCardButton` components for improved action handling in data tables. - Added sub-table functionality in `CippDataTable` for displaying members and owners with dynamic API integration. - Refactored `CIPPTableToptoolbar` to support parent row attachment for bulk actions. These changes enhance the usability and functionality of group management and data display within the CIPP module. Synced from CyberDrain/CIPP@791c697
fix(standards): clarify UserSubmissions drift rule state Synced from CyberDrain/CIPP@2ad9c1f
Feat: Quarantine overhaul with enhanced message details and actions Synced from CyberDrain/CIPP@23ff8d1
Synced from CyberDrain/CIPP@5b10ea4
Synced from CyberDrain/CIPP@3ba5d04
Synced from CyberDrain/CIPP@bf559bb
Synced from CyberDrain/CIPP@707f1a5
Synced from CyberDrain/CIPP@16e907b
Synced from CyberDrain/CIPP@03f456f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )