[pull] dev from KelvinTegelaar:dev - #159
Open
pull[bot] wants to merge 1219 commits into
Open
Conversation
Add `Sync-CippContainerUpdateState` and use it in both timer and container management endpoints so stale "update available" results are corrected after a restart. The update-check flow now also captures and preserves `RemoteBuildDate` and `CheckedTag`, and the settings/status response includes build-date metadata for both running and remote images.
Ensure container image build timestamps are converted from PowerShell DateTime values into UTC ISO 8601 strings before they are returned or stored. This avoids ambiguous unspecified kinds and keeps timer-driven update checks and container management responses consistent.
Resolve container update settings through the shared sync path so never-saved fields default to auto-restart on, hourly checks, and 23:00 while still respecting explicit disabled or empty values. Also tighten status reconciliation after restarts and fix check-time validation/formatting so early UTC hours are accepted correctly.
Refactors the SSO migration checks in `Test-CIPPAccess` to use explicit permission flags. This keeps the forced migration prompt limited to users who can manage app settings and skips migration lookups for users with no assigned permissions.
Add a shared Autopilot profile name validator and use it in both the HTTP endpoint and default deployment profile flow. This catches unsupported Intune characters before submission so the API returns a clear bad request or logged error instead of an opaque service-side 500.
Add `Resolve-CIPPDlpAdvancedRule` and apply it across template capture, policy deploy, and drift comparison so DLP rules keep either `AdvancedRule` or flat condition fields, never both. Update DLP rule field metadata to expose `RuleConditions` and include `AdvancedRule`, then normalize advanced-rule JSON during comparison to avoid false drift from formatting or key-order differences.
… missing" This reverts commit 24db2c5.
Suppress the SSO migration prompt until the SAM app is configured, matching the same setup-completion check used by GetCippAlerts.
Synced from CyberDrain/CIPP@e8fffcd
chore: Update repository links to new owner Synced from CyberDrain/CIPP@15b92c3
Guard the forced SSO migration prompt behind initial setup completion. The setup wizard must run first and the SAM app must be configured before ExecSSOSetup can create the CIPP-SSO registration. Backend checks ApplicationID env var; frontend passes setupCompleted prop to ForcedSsoMigrationDialog. Synced from CyberDrain/CIPP@805cd1b
Add a new Super Admin custom domains experience for the CIPP App Service. This includes a backend endpoint to list, validate, add, secure, and remove hostname bindings, plus a frontend wizard and tab entry to guide DNS setup and managed certificate provisioning. Synced from CyberDrain/CIPP@48b0ca6
Add '*/organization' to the list of URIs that bypass tenant authorization checks, allowing organization-level Graph API calls to proceed without tenant filtering. Synced from CyberDrain/CIPP@a47d53f
Synced from CyberDrain/CIPP@34507d2
…anagement Updated the Invoke-CIPPSharePointTemplateDeploy function to support site type differentiation (SharePoint or Teams) and added an override option for site types. Enhanced the UI components to reflect these changes, including site type selection in the template builder. Synced from CyberDrain/CIPP@9ff328b
… deployment Enhanced the Invoke-CIPPSharePointTemplateDeploy function to track and log failures during permission setting for sites and libraries. Introduced a mechanism to summarize failures and update deployment status accordingly. Updated UI text for clarity in permission management options. Synced from CyberDrain/CIPP@a683180
Fresh deployments carry template placeholder values (e.g. LongApplicationId, AppSecret) until the setup wizard completes. Previously these were treated as valid credentials, causing EasyAuth issuer reconciliation to rewrite a correctly configured issuer and break sign-in. Now placeholder values are detected and the instance is treated as unconfigured. Synced from CyberDrain/CIPP@77776c5
Adds a full SharePoint Permissions report with cached data collection, PDF export, and oversharing signal detection (tenant-wide grants, external grants, direct Full Control, detached libraries). Key additions: - Backend: SharePointPermissions cache type, batched site collection via activity triggers, REST API endpoints for listing/setting/removing library permissions, role definitions, site user access, and multi-queue status - Frontend: Permissions Report page with charts and filters, Library Permissions dialog (add/change/remove/inheritance control), Check User Access dialog, multi-queue progress tracker, query refresh button, reusable PDF primitives - Sharing report enhancements: sprawl signals (anonymous editable links, never-expiring links, folder shares, external recipients), top libraries/recipients charts, PDF export, queue progress tracking Synced from CyberDrain/CIPP@a2156f3
Clean up the CIPP_SSO_RESET app setting when EasyAuth is already active (setup completed externally), and skip auto-configuration when the flag is set without EasyAuth — directing users to the setup wizard instead. Also remove the flag at the end of successful SSO setup flows (both migration and manual credential paths) so warmup's auto-configure can proceed on the next restart. Synced from CyberDrain/CIPP@4f8da0f
Fixes a crash when the tenant has no Group.Unified directory setting. The old code created the setting via POST then immediately read it back—due to eventual consistency the read returned nothing, causing a null assignment error. Now the setting is created in a single POST with the desired values already in place (using the live template or a built-in fallback). The patch path is also hardened to rebuild the values collection rather than mutating matched objects, and a guard prevents patching over a partial/empty read. Adds Pester tests covering all three remediation paths. fixes #205 Synced from CyberDrain/CIPP@4df7194
Set-User returns no body on success, and New-ExoBulkRequest only synthesises a success record when OperationGuid is supplied. Without it, every successful user was invisible and runs reported '0 out of N' with no errors. Fixes by: - Adding OperationGuid (UPN) to every batch request so successes are visible - Using OperationGuid as the error target for human-readable failure logs - Wrapping BatchResults in @() so Count is always reliable - Warning when Exchange returns fewer results than users requested - Adding Pester tests covering all the above scenarios fixes #237 Synced from CyberDrain/CIPP@26695ad
Replace Get-CIPPDomain with Get-Tenants to correctly resolve defaultDomainName when adding trusted IPs. fixes #242 Synced from CyberDrain/CIPP@f356d26
Wrap `Get-AzDataTableLargeEntity` so callers can still pass their own error settings, while incomplete entity errors are intercepted, logged once per row, and re-emitted only for non-recoverable failures. Also updates the bundled AzBobbyTables runtime to support the new handling. Synced from CyberDrain/CIPP@1cd99ad
Move Get-CippExoErrorText out of Resolve-CippExoBulkResult into its own GraphHelper file so it can be reused and keep the bulk-result resolver focused. The error text extraction behavior remains the same. Synced from CyberDrain/CIPP@f37f879
Ensure BECRun passes `UserIds` as an array when calling `Search-UnifiedAuditLog`, matching EXO's expected `String[]` binding. Also guard against missing `AuditData` before `ConvertFrom-Json` so users with no matching events are treated as clean results instead of failures. Synced from CyberDrain/CIPP@d8b2eec
Refactor the tenant domain lookup in Invoke-ExecAddTrustedIP to handle the 'AllTenants' case directly, ensuring correct behavior when the tenant filter is set to 'AllTenants'. This change improves clarity and functionality in the trusted IP addition process. Synced from CyberDrain/CIPP@376b48d
Remove the local ConvertTo-IdList wrapper in Invoke-ExecBrandingSettings and call ConvertTo-CIPPCoverImageIdList directly. Switch image-delete filtering from a pipeline to .Where() to prevent the comma-wrapped array from being passed whole to Where-Object, which caused surviving ids to be space-joined into one bogus id and silently emptied the gallery. Add Pester tests covering the delete id-list bookkeeping. Synced from CyberDrain/CIPP@e07e81a
Get-CIPPTable previously called New-AzDataTable on every invocation, which 409s once the table exists and bills like any other request. This adds a synchronized in-memory cache so CreateTable is only issued once per account+table combination. New helpers: - Initialize-CIPPTables: seeds the cache at warmup via a single ListTables call - Unregister-CIPPTable: invalidates cache entries after a table is dropped All existing Remove-AzDataTable call sites updated to call Unregister-CIPPTable, preventing stale cache entries from causing TableNotFound errors. Cache is shared across the runspace pool via ModuleInjections. Pester tests added covering deduplication, cross-account isolation, warmup seeding, and cache invalidation. Synced from CyberDrain/CIPP@140cd0a
Extend the MCP dynamic client registration redirect URI check to also accept URIs registered on the instance's MCP resource app in Entra, in addition to the static known-client allowlist and loopback addresses. The lookup is lazy, cached per-runspace for 60 s, and keyed to the configured app's client ID to avoid stale hits after a reconfiguration. Failures (e.g. Graph outage) cache as empty so a flaky upstream cannot be amplified into a flood of Graph calls. Moves the McpClient lookup before the URI loop so the app ID is available for the cache key and the error message can suggest adding the URI to the resource app registration. Synced from CyberDrain/CIPP@aaec863
Enhance the BEC pipeline to collect and return richer indicators: suspect-user sign-ins with country/city, usage-location foreign activity analysis, safelist and sharing-link audit changes, sent-mail burst/repeat-subject analysis, and malicious app catalog matching (including tenant-wide catalog hits). It also updates Huntress rogue app matching to use MaliciousApps.json and fixes a malformed Hudu BEC link. Update the BEC UI/PDF and sample preview data to surface the new checks (now through Check 11), add clearer risk messaging/scoring, show geo context and error states, and align wording/documentation with the 7-day analysis model. Also fix BEC page polling refresh behavior so overwrite is one-shot instead of being retriggered on later refetches. Synced from CyberDrain/CIPP@48f2e94
Improve BEC analysis signal quality by normalizing sign-in/device timestamps to ISO-8601, separating successful foreign sign-ins from failed spray noise, and flagging mailbox permission changes that target the investigated user. Update the BEC page, PDF report, sample preview data, and user docs to reflect the new weighting and messaging so tenant-wide churn is de-emphasized while direct compromise indicators are prioritized. Synced from CyberDrain/CIPP@1b32a13
Replace `Remove-EmptyArrays` with `Format-CIPPCAPolicy` so CA policy PATCH bodies are canonicalized to desired state (`[]`/`null`) instead of silently preserving tenant drift. Wire this into both template deployment and full-policy edit flows, and add focused Pester coverage for canonicalization and endpoint behavior. Also expand the CA policy builder to support include/exclude guest or external user assignments, application and workload identity filters, authentication context references, and custom grant controls, with guardrails for invalid Entra combinations. `openapi.json` was regenerated to reflect the updated request/response shapes. Synced from CyberDrain/CIPP@fe79a9d
Use resolved recipient IDs (UserId) for calendar/contact permission removal instead of display names, and still pass display names for clearer logging. Update list endpoints to resolve UserId values, pick folders by FolderType for locale-safe matching, and trim EXO payloads with -Select to reduce response size and ambiguity. Synced from CyberDrain/CIPP@9bc0fb5
Refactors CVE cache/report paths to stream rows and device payloads instead of materializing large intermediate collections, reducing memory pressure in both DB cache jobs and HTTP reads. Updates Add-CIPPDbItem orphan cleanup to use per-run RunId stamping so authoritative writes never delete rows from the same run, and avoids writing fresh count rows for empty/failed mailbox permission batches. Also adds robust mailbox-folder permission removal for ambiguous display names, fixes AllAffected CVE exception tenant resolution, and expands Pester coverage for these behaviors. Synced from CyberDrain/CIPP@157fbfd
Excluded tenants retained cached rows in the DB that were never cleaned up, causing them to appear in the estate-wide secure score view with empty TenantId and domain as display name. Adds a partition-key filter against the known-tenant lookup before processing rows, and adds Pester tests covering the fix. Synced from CyberDrain/CIPP@3bb8230
Fixes incorrect sharepoint.com URLs for tenants on sovereign clouds (German .de, GCC High .us, DoD -mil.us, 21Vianet .cn). - Add Get-CIPPSharePointDomain to map onmicrosoft TLD to SharePoint domain - Update Get-SharePointAdminLink to read the real domain from the root site host instead of hardcoding sharepoint.com - Propagate SharePointDomain through Get/Set-CIPPSPOTenant, New-CIPPSharepointSite, and template deploy - Invalidate stale cached URLs whose TLD doesn't match the tenant's initial domain - Fix single-domain autodiscover path where [0] on a bare string returns a char - Add Pester tests covering all cloud variants and fallback paths Closes #269 Synced from CyberDrain/CIPP@4007eae
Add `-noPagination $true` to the sign-in log query to avoid unnecessary pagination, and shorten the device code login warning/info messages for clarity. Synced from CyberDrain/CIPP@98a50ed
Reworks SharePoint/OneDrive sharing-links caching to stream writes per page with scan state, checkpoints, idempotent site completion, per-drive delta tokens, and finalization pruning/recount logic. Adds shared DBCache helpers, RunId support in Add-CIPPDbItem for cross-activity cleanup, and comprehensive Pester coverage for resume, incremental/full fallback, contention, and finalization behavior. Also fixes TanStack Query v5 queue polling callbacks to stop refetching when queue status is complete, and updates generated OpenAPI query parameters/descriptions. Synced from CyberDrain/CIPP@b1a76f0
…0812 chore(licenses): update Microsoft license SKU data (2026-08-12) Synced from CyberDrain/CIPP@26fcf43
Align Copilot standards, list output, and the settings UI with the actual Graph values for web search and Designer image generation. This updates the option ordering, handles inverted and three-state labels correctly, and clarifies the docs so admins do not assume all Copilot settings use the same 1/0 semantics. Synced from CyberDrain/CIPP@de06cae
Condenses over-long code comments across backend and frontend files to shorter, clearer versions while preserving the key technical rationale. Synced from CyberDrain/CIPP@71c300d
- Add feed shape validation to skip silently when GitHub Pages returns an error page instead of valid JSON - Build a lookup table from both the Huntress feed and CIPP MaliciousApps.json so matches from either list are fully described - Fall back to the service principal's own display name so alert rows are never anonymous - Rename 'Huntress Added' to 'Listed On' and add a 'Source' field indicating Huntress or CIPP - Add Pester tests covering feed availability guards and per-source match descriptions Synced from CyberDrain/CIPP@3a9a5f4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )