[pull] dev from KelvinTegelaar:dev - #133
Open
pull[bot] wants to merge 8146 commits into
Open
Conversation
added 28 commits
August 5, 2026 22:49
![github-actions[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
fix: update Recommended Roles doc links to maintaining-cipp path Synced from CyberDrain/CIPP@08b6d60
…rd compares vs soft Synced from CyberDrain/CIPP@1fbc0e8
Every client-facing PDF drew itself: six reports carried six covers, three carried their own stylesheet, and four ignored the footer, watermark and cover note entirely. A report now supplies its content and nothing else — ReportDocument supplies the theme, styles, cover and page furniture. Reports are content only. 3,097 lines net removed across the six. None of them declares a stylesheet, a theme, a raw <Page>, or names a style; the report builder keeps the sheet from context because it renders arbitrary Markdown. Branding gained named colour roles. Charts, headings, body, subtitles, footer, info cards, data tables, cover text, infographics and the watermark can each be set, and each falls back to the brand colour — an install that set only a colour renders exactly as before. Presets can be created, renamed, cloned and assigned per report type, and a live preview renders the real reports against sample data. Fixes found on the way: - footer laid out to nothing (absolute box with no stated height) - page numbers never painted (inherited lineHeight compounds across relayouts) - watermark drawn under content, so chart cards hid it - DataTable sized columns with flex, putting every row on its own grid - long values overflowed their column; react-pdf's only mid-word break draws a hyphen, so they are now broken at a width measured against Helvetica's metrics - a global "never hyphenate" registered by one report silently governed all of them Page setup keeps only paper and branding. Cover, footer and watermark overrides are gone from templates: they let a template contradict the preset it pointed at. Stored keys are ignored rather than migrated. Synced from CyberDrain/CIPP@31f2266
Adds build/tools/build-openapi.ps1 — a PowerShell AST-based OpenAPI 3.1 generator that replaces regex scanning. Key improvements:
- Correctly types fields read as `$Field.value` as LabelValue objects instead of plain strings (the root cause of silent null failures)
- Follows request bodies into downstream helpers (Set-CIPPUser etc.) to recover fields not visible in the entrypoint
- Adds Get-CippMcpSafePropertyName to rename OData options ($filter → odata_filter) so MCP client schemas stay valid
- Fixes Invoke-CippMcpApiRequest to unwrap { Results, Metadata } envelopes and reverse parameter aliases on dispatch
- Adds CI workflow to detect spec drift on PRs
- Adds openapi-overrides/ for endpoints whose contract cannot be statically derived
- Regenerates openapi.json from the new generator
- Adds Pester test suites for the generator, projection, and gateway
Synced from CyberDrain/CIPP@73cd6a9
Synced from CyberDrain/CIPP@25f2bd4
Graph $batch returns HTTP 200 even when individual sub-requests fail (e.g. 429 throttling), silently dropping policy types from the collection. Previously this caused decided drift rows (Accepted, Denied*, CustomerSpecific) to be pruned and reappear as 'New' on the next run. - IntunePoliciesCollected / CAPoliciesCollected are now false when any batch item returns ≥400 - Standards-type rows are only pruned when their Status is null or 'New'; decided rows are retained across transient key-enumeration drops - Template-scoped runs never prune (they cannot see every valid key) - Tests refactored to use a shared Get-CIPPAzDataTableEntity mock and extended to cover all new pruning rules Synced from CyberDrain/CIPP@a5cd5d6
Synced from CyberDrain/CIPP@3155b01
Stop emitting explicit `additionalProperties: true` in generated object response schemas so Swagger UI no longer invents `additionalProp1` fields in examples. Also add a diagnostic script that compares documented OpenAPI response fields against live `List*` endpoint output to catch casing and schema drift that static inference can miss. Synced from CyberDrain/CIPP@7e56f6b
Replaces the legacy per-tenant activity trigger orchestration with a shared helper (Get-CIPPTenantAllowBlockListItems) that batches all four list types in a single ExoBulkRequest. Introduces Get-CIPPTenantAllowBlockListReport to serve cached results from the reporting DB. The HTTP endpoint now supports UseReportDB=true and routes AllTenants requests through the report DB by default. The frontend gains a ReportDB toggle via useCippReportDB, AllTenants layout support, and conditional Tenant column. Also fixes Select-Object property-casing bugs in ListMailboxes and ListMailboxCAS. Synced from CyberDrain/CIPP@6e4c328
The generator was documenting the full Graph entity type for every List endpoint, which was measurably wrong (e.g. ListSharedMailboxAccountEnabled documented 90 fields but returned 8). This commit: - Distinguishes 'graph' (proven: endpoint selects or reshapes fields) from 'graph-entity' (unproven: pure passthrough) in x-cipp-field-source - Uses BackendFields as the field authority when the endpoint reshapes the Graph response itself - Adds Get-OutputMemberName to extract Add-Member/Sort-Object/Where-Object -Property spellings and use them to correct field casing without inventing new fields - Removes explicit additionalProperties: true from open response records; open-by-omission has the same JSON Schema semantics but avoids the Swagger UI 'additionalProp1' placeholder Synced from CyberDrain/CIPP@26bdfda
Move API docs loading from /api/ListOpenApiSpec to /openapi.json, remove the ListOpenApiSpec endpoint, and wire Docker/appsettings so the generated spec is copied and served as a precompressed static file. Update build-openapi to emit a frontend public copy, improve HTTP method inference (POST for mutations, GET for query-capable reads), and refresh tests/spec output to match the new contract and tagging behavior. Synced from CyberDrain/CIPP@fd182bd
Get-CippException returns a NormalizedError property, but these call sites read NormalizedMessage, which does not exist. Every one produced an error string that ended at the colon with nothing after it, e.g. "Failed to add app template: ". Synced from CyberDrain/CIPP@5bf47b5
Synced from CyberDrain/CIPP@6eb1c2a
- Filter known MCP client IDs from API auth so frontend doesn't report unsaved changes - Fix SearchTools tiebreaking to prefer closest-length match over alphabetical - Inline input schemas when search returns ≤3 results to save a GetToolInfo round trip - Add suggestions when SearchTools finds no matches (prefix stemming) - Fix ConvertTo-Json pipeline unrolling that changed JSON shape by row count - Refuse JSON-RPC batch requests (removed in MCP 2025-06-18) with 400 instead of mangling ids - Return empty string body for JSON-RPC notifications instead of 'null' - Echo back only supported protocol versions during initialize handshake - Propagate parameter descriptions to MCP input schemas - Fall back to first description line when summary equals the endpoint name - Log unknown connector tag names with known alternatives - Surface near-match suggestions when ExecTool receives an unknown tool name - Report truncated names in GetToolInfo when >20 are requested - Add OpenAPI spec test: mutation-verb or ReadWrite endpoints must not be GET - Add Pester tests for array shape consistency across row counts Synced from CyberDrain/CIPP@6b56bbe
…into dev Synced from CyberDrain/CIPP@ff9aebc
When an authentication method is enabled but no included users/groups resolve, the standard now sets `GroupIds` to `all_users`. This prevents enabled methods from being saved without a target scope and keeps behavior consistent with tenant-wide enforcement. Synced from CyberDrain/CIPP@774848c
Change `Set-CIPPAuthenticationPolicy` to throw when current policy state cannot be read instead of returning a string, so remediation failures are no longer reported as successful writes. Also capture the standard remediation call result with `$null = ...` to prevent output-stream leakage and keep remediation logging aligned with actual PATCH success. Synced from CyberDrain/CIPP@fa70e3a
feat(setup): gate app behind setup wizard until SAM configured Synced from CyberDrain/CIPP@a6f683d
added 30 commits
August 25, 2026 11:29
…ms meeting policy Adds AllowExternalNonTrustedMeetingChat (CIS 8.5.8) and AllowCloudRecording (CIS 8.5.9) to the Teams Global Meeting Policy standard and its baseline, closing the gap where both were detectable (CIS_8_5_8 / CIS_8_5_9 and already cached) but settable by no standard. Both are opt-in (Off / On, or blank to keep the tenant's current value) rather than enforced switches like the sibling settings, so existing deployments are never surprised into disabling cloud recording; picking Off applies the CIS-recommended value. Confirmed against the Teams admin ConfigApi: both properties are booleans and the merge-PUT payload applies and reverts cleanly. Synced from CyberDrain/CIPP@ef0b61d
Update the conditional access template edit page title logic so it shows "Loading..." while data is still being fetched, then falls back to "Unnamed Template" only when a loaded template has no display name. This avoids briefly showing an incorrect unnamed state during load. Synced from CyberDrain/CIPP@649f259
The tenant-mapping table only offered a delete action, and the integration Sync button always queued every mapped tenant. Add a Sync Now row action that queues just the selected tenant via the existing ExecExtensionSync TenantID path, passing the tenant domain so the queued run is tagged to that tenant in the logbook. Synced from CyberDrain/CIPP@55dbb4d
When a caller passes $top=1, Graph uses it as the page size, causing the full collection to be fetched one record per round trip. This change sets NoPagination=true automatically when $top=1 is detected, unless the caller explicitly overrides with NoPagination or manualPagination. Synced from CyberDrain/CIPP@f15eabf
Make each assessment category row in `AssessmentCard` interactive and route to its matching dashboard tab (`identity`, `devices`, `custom`). Navigation now preserves the current `reportId` query so users land on the same test suite context, and includes keyboard support (`Enter`/`Space`) plus button semantics and hover affordances for accessibility. Synced from CyberDrain/CIPP@b38b1c9
Invoke-ExecRefreshMyAccess returned TooManyRequests on its per-user cooldown without logging it, unlike its success and error paths — the throttle was invisible in the audit log. Write an Info line naming the user and the retry hint on that path, and assert it in the cooldown test. Synced from CyberDrain/CIPP@4af4d23
Add retryDelayWithRetryAfter to ApiGetCall and ApiGetCallWithPagination so that when the server returns a Retry-After header the client waits the indicated duration (capped at 60 s) instead of applying react-query's default exponential backoff. Falls back to exponential backoff when no header is present. Also adds Vitest tests covering 503 recovery, persistent 503 exhaustion, no-retry on 500, and Retry-After delay honouring. Synced from CyberDrain/CIPP@74c20c8
Synced from CyberDrain/CIPP@b0a0366
…lt-envelope fix(scheduler): poorly formatted post-execution results Synced from CyberDrain/CIPP@f23303d
feat(standards): add external compliance trust standard Synced from CyberDrain/CIPP@2580cf8
…e-target feat(halo): add psaTicketId field to wizards/api Synced from CyberDrain/CIPP@cc1a16e
Closes a tenant-authorization gap where a scheduled task could carry a tenant-identifying parameter pointing to a different tenant than the authorized one. - Strip tenant params (TenantFilter/Tenant/TenantId) from stored Parameters at creation time in Add-CIPPScheduledTask, logging an Error when the value mismatches the picked tenant - Force-override any remaining tenant params to the authorized task tenant at execution time in Push-ExecScheduledCommand - Expand orchestrator to inject the primary tenant param alongside TenantFilter - Rename -Tenant to -TenantFilter (with Alias) in Set-CIPPAuthenticationPolicy and Set-CIPPRegistrationCampaign so the scheduler recognizes them as protected scope - Hide Tenant/TenantId from the function-parameters UI so they are never user-editable - Add Pester regression tests for both creation-time and execution-time defenses Synced from CyberDrain/CIPP@1b5523c
A tenant group request ({type:'Group', value:<guid>}) previously resolved to a null $Tenant and fell through to an unconditional allow, letting restricted roles target groups they were never granted.
Fix authorizes group requests by matching the requested group GUID against the role's explicitly granted group entries. If not matched, the request is hard-denied. Member expansion is never performed for the access decision.
Adds regression tests covering allow, deny, and no-member-expansion cases.
Synced from CyberDrain/CIPP@6b66ff7
Updated the API request for fetching permission grant policies to remove the $expand parameter, as it is auto-expanded on GET requests. This change ensures compatibility with the Microsoft Graph API. Synced from CyberDrain/CIPP@4c04d78
Add `id` to the `$select` parameter when expanding `includedGroups` on MDM policies, ensuring group IDs are returned alongside display names. fixes #357 Synced from CyberDrain/CIPP@1f02924
Include `openid profile offline_access` alongside the MCP `user_impersonation` scope in the protected-resource metadata and EasyAuth default scopes. This ensures discovery-based MCP clients request refresh tokens and avoids repeated hourly re-consent, while reusing shared scope variables for both CIPPNG and non-CIPPNG app setting updates. Synced from CyberDrain/CIPP@6b2cd0e
Regenerate backend/Config/PermissionsTranslator.json from AzAdvertizer's published Entra ID API permissions dataset (669 -> 2656 unique entries). This adds 1988 permission GUIDs that were missing, including Exchange.ManageV2 - a missing GUID is silently dropped during delegated/application grants (Add-CIPPDelegatedPermission translates required GUIDs to scope values by id), so those permissions never applied when pushing multi-tenant apps even though a manual consent resolved them. Add build/tools/Update-PermissionsTranslator.ps1: fetches the source, validates count + well-known anchor GUIDs, reshapes both delegated and application permissions, merges to preserve current-only GUIDs (e.g. Partner Center user_impersonation), dedupes to one row per GUID, and writes LF for cross-platform-stable output. Add .github/workflows/update-permissions-translator.yml: weekly + manual refresh that revalidates and opens a PR against dev when the file changes, mirroring the license SKU automation. No credentials needed - the source is unauthenticated. Synced from CyberDrain/CIPP@5c6632e
Computed CSV columns for members and owners were always included in the Select-Object call even when the corresponding expand was not requested, causing permanently blank columns in the UI and exports. Refactored to build the property list dynamically and only add membersCsv/ownersCsv when the relevant expand flag is set. Synced from CyberDrain/CIPP@158b07e
Add a "Reactivate Archived OneDrive" row action on the OneDrive page and a
new Invoke-ExecReactivateSite endpoint that unarchives a site via the Graph
beta site:unarchive endpoint (POST /beta/sites/{id}/unarchive, app-only with
Sites.FullControl.All). The composite site id is built from the row's host,
siteId and webId so no lookup is made against the locked, archived site.
The confirmation warns that reactivation is asynchronous (up to 24 hours) and
may incur Microsoft 365 Archive charges and require Unlicensed OneDrive
billing to be enabled on the tenant. Errors that look like a Locked/blocked
or billing failure surface a hint to reactivate from the SharePoint admin
center.
Refs #419
Synced from CyberDrain/CIPP@b43805b
Synced from CyberDrain/CIPP@defd932
Replace the combined EXO bulk call with two targeted `New-ExoRequest` calls and project only the fields stored in cache. This reduces payload size and keeps the merge logic the same by matching `Get-MailContact` to `Get-Contact` results via directory ID or identity. Synced from CyberDrain/CIPP@cac5767
Update MDO alerts listing to include both Microsoft Defender for Office 365 and Microsoft Defender for Endpoint by broadening the Graph `serviceSource` filter in live and all-tenant cache paths. Rename the UI/docs navigation from “MDO Alerts” to “Defender Alerts”, add `serviceSource` to visible table columns, and refresh the endpoint/openapi description to match the new scope. Synced from CyberDrain/CIPP@e434ffe
When Delete user is selected, tasks incompatible with user deletion (e.g. convert to shared mailbox, revoke sessions) are now skipped on both the backend and cleared in the frontend form. Adds Pester and Vitest tests covering the new guard logic. Synced from CyberDrain/CIPP@5d600f1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )