[pull] dev from KelvinTegelaar:dev - #133
Open
pull[bot] wants to merge 8232 commits into
Open
Conversation
added 28 commits
August 13, 2026 17:13
![github-actions[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Wrap the SPO ProcessQuery call in a targeted catch so tenant-level SharePoint app-only consent gaps are surfaced as a clear, actionable error. When the admin endpoint returns 401, the function now throws a specific exception (tagged with `SPOAccessDenied`) that distinguishes configuration/access denial from transient request failures and points operators to reset CPV permissions. Synced from CyberDrain/CIPP@dfe3b2b
Wraps Update-AzDataTableEntity so callers can merge into rows that already exist without creating missing ones. Add-CIPPAzDataTableEntity's UpsertMerge recreates a concurrently deleted row as a stateless shell, which in the audit log claim path becomes a row that can never be parsed or drained and re-enters every processing cycle. Push-AuditLogProcessingBatchV2 already depends on it. Synced from CyberDrain/CIPP@f01e6c6
Ensure permissions are always serialized as a JSON array, even when a single permission is returned. Synced from CyberDrain/CIPP@5a41570
…ions Introduce Repair-CIPPTable to recreate missing Azure tables and refresh the cache, handling concurrent creation scenarios. Add Test-CIPPTableNotFound to identify errors indicating a table does not exist, ensuring robust error handling in entity operations. Include comprehensive Pester tests for both functions to validate their behavior and integration. Synced from CyberDrain/CIPP@9b28834
Implement retry logic for Add, Get, and Remove operations in case of TableNotFound errors. This includes invalidating the CreateTable cache, recreating the table, and retrying the operation to prevent stale entries from disrupting data operations. Synced from CyberDrain/CIPP@3403433
When running DB tests with `allTenants`, filter cached tenant partitions against the current managed tenant list before execution. This prevents tests from running on excluded or removed tenants and logs how many stale cached tenants were skipped. Synced from CyberDrain/CIPP@157fbb8
Domain Analyser does not expose a `DMARCRecord` property. Replace it with the actual properties: `DMARCPresent`, `DMARCFullPolicy`, and `DMARCActionPolicy`. Synced from CyberDrain/CIPP@0b36f94
…y row Both customDataformatters opened by collapsing the selection to row[0] and returned a single object. CippApiDialog only enters bulk request mode when the formatter returns an array, so one request went out and the remaining selected rows were silently skipped while the dialog reported success. Map over the selection in both, as Start Version Cleanup Job already does. Edit Site now evaluates isGroupSite per row, so a mixed selection is no longer judged by the first site's rootWebTemplate. Fixes #226 Synced from CyberDrain/CIPP@9135881
Synced from CyberDrain/CIPP@d77a930
feat: mcp docs search tools Synced from CyberDrain/CIPP@a888ae8
- Remove false-positive throws in OneDrive and SharePoint cached report functions when usage rows are empty — an empty usage set is a valid cached result and the merge is a left join on the site listing anyway. - Add CippSharePointQuotaCard component showing tenant-wide storage usage bar on the SharePoint page. - Add anonymization and empty-usage-report alerts to the SharePoint page table header so users understand why owner/usage columns may be blank. Synced from CyberDrain/CIPP@85a8b14
Sites and OneDrive drives with no matching usage report row were showing '0 GB' for storage, which is indistinguishable from a genuinely empty drive. Null is now preserved and passed through so the UI can show the absence of data rather than a misleading zero. Also adds Multi-Geo support to the SharePoint quota card: per-geo usage chips are shown when the tenant spans more than one geo location, and the raw GeoLocations array is now included in the ListSharepointQuota response. Synced from CyberDrain/CIPP@7cfe118
A throw in the delta lookup escaped Push-ExecScheduledCommand with no result written, leaving the task on the orchestrator's Pending claim to be re-picked as stale every hour. Changes: - Wrap delta lookup + refresh in try/catch; record failure on the task and reschedule instead of leaking the exception - Normalise bare-number Recurrence values (days) before the recurrence switch so they stay recurring - Extract New-CIPPTaskDeltaQuery to centralise trigger→delta-params mapping across task creation, rebuild, and repair - Get-DeltaQueryUrl now self-heals a missing DeltaQueries row by rebuilding from the owning task's trigger - New-GraphDeltaQuery promotes Write-Error to throw so callers can catch it - Add DeltaQueries to the backup table list - Add Pester tests for all three changed functions Synced from CyberDrain/CIPP@9e29339
- Refactor shared GitHub function-app call into a reusable helper - On 401/403/429 from a configured PAT, log a warning and fall back to the anonymous function-app path for GET requests - Serve cached releases on refresh failure instead of 500-ing - Change release notes dialog default selection to baseTag (vX.Y.0) so feature release notes lead; hotfix notes remain accessible via dropdown Synced from CyberDrain/CIPP@4878da5
Add -NoFallback switch to Invoke-GitHubApiRequest to skip the anonymous function-app fallback. Use it in the extension test endpoint so a rejected PAT returns an error instead of a false success. Synced from CyberDrain/CIPP@c7ec759
Synced from CyberDrain/CIPP@4ebd248
Synced from CyberDrain/CIPP@da95ad2
Synced from CyberDrain/CIPP@5f7b527
Synced from CyberDrain/CIPP@888e38c
Synced from CyberDrain/CIPP@162e81d
Synced from CyberDrain/CIPP@5de48fd
Synced from CyberDrain/CIPP@00686a9
Synced from CyberDrain/CIPP@7d2a9c3
Synced from CyberDrain/CIPP@ebbc9db
Synced from CyberDrain/CIPP@60636ff
Relocate the User Defaults page to `/identity/administration/users/user-defaults` and rename it to User Templates in the UI. Add a users-specific tab layout with tabs for Users and User Templates, remove the old Tenant Manage tab entry, and add a redirect from the legacy route to preserve existing links. Synced from CyberDrain/CIPP@d44b676
corrects issue with function offloading not getting registered Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Synced from CyberDrain/CIPP@aa4922d
Decouples the People Picker standard from the site cache. SPOSites is now a generic per-site SharePoint settings cache (sharing, lifecycle, version policy, People Picker, unmanaged-device access) keyed by site id, reusable by any site-level standard, instead of holding a People-Picker-specific tenant row. - SPGuestPeoplePicker reads the tenant default from the SPOTenant cache and the per-site values from SPOSites; both standards still evaluate entirely from cache. - Register SPOSites in the frontend cache-type registry and category map (it was only in the backend registry). - SPOTenant collector regains the opt-in -UseCertificate so the baseline collects the tenant default with certificate auth on miss. Synced from CyberDrain/CIPP@1ca2931
Eight registered cache types have no Set-CIPPDBCache<Type> collector of their own - they are written as a side-effect of another collector (e.g. SharePointSiteListing by Set-CIPPDBCacheSharePointSiteUsage, Fido2Configuration by the auth methods policy collector). Running one from the cache admin failed with "Cache function not found". Add a 'collectedBy' field to those types in the cache-type registry (both the backend and frontend copies) naming the producing collector, and have Invoke-ExecCIPPDBCache resolve it so a run of a derived type runs the collector that populates it. No types are dropped and no bulk-collection efficiency is lost. Synced from CyberDrain/CIPP@992904c
- Added logging for successful operations and error messages in various functions, including `Add-CIPPGDAPRoleTemplate`, `Get-CIPPLAPSPassword`, and others. - Improved error handling by capturing exceptions and logging detailed error messages. - Updated parameters in several functions to include headers and API names for better traceability. - Ensured consistent logging format across different scripts to maintain clarity in logs. Synced from CyberDrain/CIPP@63c453b
Setting ShowPeoplePickerSuggestionsForGuestUsers is ~2s per site server-side and serialized - CSOM batching hits SharePoint's per-request resource cap (~3-4 sites) with no speedup - so a 500-site tenant took ~30 min in one baseline run. Add Set-CIPPSPOSiteBulk, which acquires the SPO admin token once and fans the per-site CSOM writes out through CIPPRestClient.SendConcurrent, and use it from the People Picker baseline executor and classic standard. Measured ~5.6x on 500 sites (~5 min), no throttling (the admin host's pool cap keeps concurrency in check); per-site failures are reported without aborting the sweep. Synced from CyberDrain/CIPP@06d897d
Invoke-ExecPermissionRepair and Invoke-ExecTestRefresh each embedded a "$Var: text" sequence in a double-quoted log message. PowerShell parses $UpdatedBy: / $TenantFilter: as a scope-qualified variable reference, and the trailing space is not a valid variable-name character, so each file failed to parse. ModuleBuilder surfaced this while compiling CIPPHTTP.psm1, leaving the two functions undefined. Brace the names (${Var}:) so the colon is literal.
Synced from CyberDrain/CIPP@c6afd0d
Synced from CyberDrain/CIPP@40e21f7
…tandards SPOVersionControl (standard + baseline) and OneDriveLicensedQuota drove their SPO reads/writes through delegated auth, which 401s on tenants without delegated SPO admin. Switch them to -UseCertificate (Get-CIPPSPOTenant, the SetFileVersionPolicy CSOM method, and the per-site Set-CIPPSPOSiteBulk fan-out), matching the People Picker standard. Verified app-only cert works for all three paths - including the SetFileVersionPolicy method - on a cert-only tenant. Synced from CyberDrain/CIPP@8f801f3
… standard The People Picker standard evaluated from the reporting cache (up to a day stale for a standard that writes) and reported post-remediation status from the site enumeration, which is eventually-consistent and lags writes by minutes. Read live instead: the prepare hook and classic standard read the tenant default (authoritative) and sites (enumeration, fresher than cache) before deciding, and after remediation re-read each CHANGED object AUTHORITATIVELY - Get-CIPPSPOTenant and the new Get-CIPPSPOSiteBulk single-site reads, never the lagging enumeration - to confirm the write stuck and report the true result. Adds Get-CIPPSPOSiteBulk (concurrent authoritative single-site reads via SendConcurrent). Baseline read.cacheType stays SPOSites only to name an existing collector; the prepare reads live, so collectorArgs/refreshCache are dropped. Synced from CyberDrain/CIPP@6070a5e
Message trace 'days' search used two separate now-timestamps for Start/End, occasionally exceeding the backend's 10-day window guard by call latency. Now captures UtcNow once and derives Start from it. Also surfaces backend error messages on the message trace page when a search fails, clearing stale results and info banners instead of leaving them in place. Adds Pester and Vitest regression tests for both fixes. Synced from CyberDrain/CIPP@a8bbe1d
…s via batched reads The tenant enumeration returns default/empty values for ~19 per-site fields (site owner, per-site sharing controls, People Picker, ...) - only the single-site GetSitePropertiesByUrl returns them, and no Graph or enumeration variant supplies them (confirmed exhaustively across CSOM and Graph beta). Rather than pay a per-site read just to fix one field, use it to populate the whole accurate set. - Get-CIPPSPOSiteBulk now batches multiple GetSitePropertiesByUrl reads per ProcessQuery (-BatchSize, default 5) and runs -MaxConcurrency (default 4) at once, mapping each returned SiteProperties back to its URL; a failed batch marks its sites for per-site fallback. - Set-CIPPDBCacheSPOSites overlays the enumeration-broken fields (owner name/email/login, sharing link scopes, People Picker, hub/Teams flags, ...) from that authoritative read, falling back to the enumeration value when a site's read did not return. The cache grows from ~23 to 51 fields. Measured on a 526-site tenant: 109s at batch 5 / concurrency 4 (fewer round-trips than the prior single-read path), OwnerName populated on all 526 rows, values matching authoritative single-site reads. Synced from CyberDrain/CIPP@50cf738
Graph's message trace applies a silent ~48h default window when no receivedDateTime filter is present, causing older messages to be missed when searching by messageId alone. Backend: when no explicit start/end is given but a messageId/messageTraceId is, sweep backwards through 10-day windows (Graph's per-request cap) up to the 90-day lookback limit until a match is found. Frontend: CippQuarantineTable and CippUserReportedMessagesTable now pin an explicit +/-1 day window around the message's received time when viewing its trace, instead of relying on Graph's default. Adds backend Pester and frontend vitest coverage for the sweep and window-pinning behavior. Synced from CyberDrain/CIPP@8b1cf39
Test-CIPPGDAPGroupMappings is now called with -CreateMissing so stale role and template mappings pointing at deleted groups are recreated instead of just reported. Groups created during the GDAPRoles pass are appended to the in-memory partner group list so the subsequent template pass re-links to them rather than creating duplicates. Added a 'Created' status to the success reporting branch and unit tests covering both passes. Synced from CyberDrain/CIPP@1e44a12
Set-CIPPSAMCertificate previously threw when the DevSecrets Secret row didn't exist, breaking certificate-only First Setup flows. Now creates the row if missing instead of throwing. Adds Pester tests covering both the fresh-row and existing-row cases. Synced from CyberDrain/CIPP@02cf08d
…ayStep Added the ability to add users directly within the UsersDisplayStep of the patch wizard. This includes a user selector for adding multiple users, improved tenant handling for user addition, and updated UI elements to reflect the changes. The functionality ensures users can be added without navigating back to the main Users page, enhancing the overall user experience. Synced from CyberDrain/CIPP@aa959d8
Graph API expects the property name `perUserMfaState`, not `perUserMFAstate`. Using the wrong casing caused Graph to silently drop the property, so per-user MFA state was never updated. Adds Pester tests to verify the batch request body and PATCH behavior. Synced from CyberDrain/CIPP@6588475
Synced from CyberDrain/CIPP@a17a495
Synced from CyberDrain/CIPP@4783028
CippDocs.Tests.ps1 failed because three published slugs in Config/DocsPublishedPages.txt no longer matched what the repo derives: - jit-admin-templates/add|edit: the pages were renamed from add-jit-admin-template(.md) to add(.md); docs.cipp.app already serves the shorter slugs, so the snapshot is updated to match. - user-defaults: the file lived under identity/administration/users/ but SUMMARY.md (and the live URL) place it one level up at identity/administration/user-defaults. Move the file to match so the path-derived URL and the published slug agree. Synced from CyberDrain/CIPP@c915860
roles/add.md was SUMMARY-nested under role-templates/mappings, so docs.cipp.app serves it at role-templates/mappings/add, but the file's location made Get-CippDocLink derive tenant/gdap-management/roles/add. Move it into role-templates/mappings/ (and mappings.md -> that folder's README) so the path-derived URL, the SUMMARY nesting and the live slug all agree, and update the published-pages snapshot to match. Synced from CyberDrain/CIPP@dd09d77
…gurations - Introduced a new API endpoint `/api/ListStorageCleanupScan` to retrieve storage cleanup scan data. - Updated `openapi.json` to include the new endpoint and its response structure. - Added `StorageCleanupScan` type to CIPPDB cache configurations in both JSON files. - Removed references to the Storage Report from the SharePoint browser component to streamline the UI. - Updated documentation to reflect the changes in cache types and API responses. Synced from CyberDrain/CIPP@4db74c2
Locks in the behaviours fixed in 7fc1bcc61 so they cannot regress silently: a fresh healthy row is trusted without re-reading domains, a row last derived over 7 days ago (or with no LastRefresh) is re-read and picks up a new default, a refresh scoped to one tenant re-reads even when the Alias matches the display name, a domain-scoped refresh resolves to the customerId and scopes the relationship pull, a failed domains read keeps a cached custom default over the fallback's initial domain and flags the row for retry, and one tenant's fallback does not flag the next tenant. LastRefresh is supplied as a DateTimeOffset, as the table returns it. Five of the eight fail against the pre-fix function. Synced from CyberDrain/CIPP@c058094
Synced from CyberDrain/CIPP@43d621a
The scheduled-task list resolved the selected tenant to its default domain and customerId only. A task created via the API with the tenant's initial .onmicrosoft.com domain (or any non-default identifier) in tenantFilter was stored under that value and then filtered out of the tenant view, only reappearing under *AllTenants (CyberDrain/CIPP#491). Resolve default domain, initial domain, and customerId - the same three identifiers Get-Tenants itself accepts as -TenantFilter - in both the storage query filter and the allowed-tenant access check, so a task keyed on any of them shows under the tenant and stays visible to tenant-scoped callers. Adds endpoint regression tests covering the filter and the access check. Synced from CyberDrain/CIPP@8feddfa
Synced from CyberDrain/CIPP@54a0f80
…ement - Implemented a new API endpoint for editing group visibility in both the group index and administration pages. - Enhanced the Invoke-EditGroup function to log success and error messages for visibility changes. - Added UI components for selecting group visibility options (Public/Private) with appropriate validation and confirmation prompts. Synced from CyberDrain/CIPP@a65ac37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )