Merge pull request #1032 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Config/standards.json

@@ -4930,7 +4930,7 @@
     "name": "standards.SPFileRequests",
     "cat": "SharePoint Standards",
     "tag": [],
-    "helpText": "*Requires 'Sharing Level for OneDrive and SharePoint' to be set to Anyone* Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.",
+    "helpText": "Enables or disables File Requests for SharePoint and OneDrive, allowing users to create secure upload-only links. Optionally sets the maximum number of days for the link to remain active before expiring.",
     "docsDescription": "File Requests allow users to create secure upload-only share links where uploads are hidden from other people using the link. This creates a secure and private way for people to upload files to a folder. This feature is not enabled by default on new tenants and requires PowerShell configuration. This standard enables or disables this feature and optionally configures link expiration settings for both SharePoint and OneDrive.",
     "executiveText": "Enables secure file upload functionality that allows external users to submit files directly to company folders without seeing other submissions or folder contents. This provides a professional and secure way to collect documents from clients, vendors, and partners while maintaining data privacy and security.",
     "addedComponent": [
@@ -8085,8 +8085,12 @@
       {
         "type": "number",
         "name": "standards.SPOVersionControl.ExpireVersionsAfterDays",
-        "label": "Expire Versions After Days (0 = never, when auto trim is off)",
-        "default": 0
+        "label": "Expire Versions After Days (0 = never, otherwise 30-36500, when auto trim is off)",
+        "default": 0,
+        "validators": {
+          "min": { "value": 0, "message": "Use 0 for never, or 30 or more days" },
+          "max": { "value": 36500, "message": "Maximum value is 36500" }
+        }
       },
       {
         "type": "switch",

Modules/CIPPCore/Public/Get-CIPPSiteVersionCleanupStatus.ps1

@@ -0,0 +1,83 @@
+function Get-CIPPSiteVersionCleanupStatus {
+    <#
+    .SYNOPSIS
+    Get the progress of a file version batch delete (trim) job for a SharePoint site
+
+    .DESCRIPTION
+    Queries the progress of the file version batch delete job for a SharePoint site via the
+    CSOM GetFileVersionBatchDeleteJobProgress method on the Tenant object, using the same
+    ProcessQuery channel as Start-CIPPSiteVersionCleanup. Reports the status of a cleanup
+    previously started with Start-CIPPSiteVersionCleanup.
+
+    Unlike NewFileVersionBatchDeleteJob / RemoveFileVersionBatchDeleteJob (which return an
+    SpoOperation object that the client serialises with a <Query SelectAllProperties="true">),
+    GetFileVersionBatchDeleteJobProgress returns a plain String whose content is a JSON blob.
+    It is therefore invoked as a bare <Method> inside <Actions> with no <Query> wrapper - asking
+    for SelectAllProperties on a String fails server-side with "Cannot find stub for type
+    System.String". The ProcessQuery response is an array whose only String element is the JSON
+    progress payload, which this function parses and returns. (Confirmed against a captured
+    Get-SPOSiteFileVersionBatchDeleteJobProgress request.)
+
+    .PARAMETER TenantFilter
+    Tenant to query
+
+    .PARAMETER SiteUrl
+    Full URL of the SharePoint site to query
+
+    .EXAMPLE
+    Get-CIPPSiteVersionCleanupStatus -TenantFilter 'contoso.onmicrosoft.com' -SiteUrl 'https://contoso.sharepoint.com/sites/MySite'
+
+    .FUNCTIONALITY
+    Internal
+
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [Parameter(Mandatory = $true)]
+        [string]$SiteUrl
+    )
+
+    $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter
+    $AdminUrl = $SharePointInfo.AdminUrl
+    $EscapedSiteUrl = [System.Security.SecurityElement]::Escape($SiteUrl)
+
+    # CSOM pattern: Tenant Constructor -> GetFileVersionBatchDeleteJobProgress(siteUrl).
+    # The method returns a String (JSON), so it is called directly in <Actions> with no <Query>.
+    $XML = @"
+<Request AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" LibraryVersion="16.0.0.0" ApplicationName="SharePoint Online PowerShell (16.0.24908.0)" xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009"><Actions><ObjectPath Id="40" ObjectPathId="39" /><Method Name="GetFileVersionBatchDeleteJobProgress" Id="41" ObjectPathId="39"><Parameters><Parameter Type="String">$EscapedSiteUrl</Parameter></Parameters></Method></Actions><ObjectPaths><Constructor Id="39" TypeId="{268004ae-ef6b-4e9b-8425-127220d84719}" /></ObjectPaths></Request>
+"@
+
+    $AdditionalHeaders = @{
+        'Accept' = 'application/json;odata=verbose'
+    }
+
+    $Response = New-GraphPostRequest -scope "$AdminUrl/.default" -tenantid $TenantFilter -Uri "$AdminUrl/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AddedHeaders $AdditionalHeaders
+
+    # ProcessQuery returns a JSON array; if it came back as raw text, parse it first.
+    if ($Response -is [string]) {
+        $Response = $Response | ConvertFrom-Json
+    }
+
+    # The first array element carries ErrorInfo for the whole request.
+    $ErrorInfo = $Response | Where-Object { $_.PSObject.Properties.Name -contains 'ErrorInfo' } | Select-Object -First 1
+    if ($ErrorInfo.ErrorInfo) {
+        throw "SharePoint returned an error querying version cleanup status for $SiteUrl : $($ErrorInfo.ErrorInfo.ErrorMessage)"
+    }
+
+    # GetFileVersionBatchDeleteJobProgress returns its payload as the only String element.
+    $ProgressJson = $Response | Where-Object { $_ -is [string] } | Select-Object -First 1
+
+    if ([string]::IsNullOrWhiteSpace($ProgressJson)) {
+        return [PSCustomObject]@{
+            SiteUrl = $SiteUrl
+            Status  = 'NoJob'
+            Message = 'No file version batch delete job found for this site.'
+        }
+    }
+
+    $Progress = $ProgressJson | ConvertFrom-Json
+    Add-Member -InputObject $Progress -MemberType NoteProperty -Name 'SiteUrl' -Value $SiteUrl -Force
+    return $Progress
+}

Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1

@@ -112,7 +112,7 @@ function New-CIPPCAPolicy {
             $JSONobj.conditions.users.excludeGuestsOrExternalUsers.externalTenants.PSObject.Properties.Remove('@odata.context')
         }
         if ($State -and $State -ne 'donotchange') {
-            $JSONobj.state = $State
+            $JSONobj | Add-Member -NotePropertyName 'state' -NotePropertyValue $State -Force
         }
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
@@ -543,7 +543,7 @@ function New-CIPPCAPolicy {
                 return $false
             } else {
                 if ($State -eq 'donotchange') {
-                    $JSONobj.state = $CheckExisting.state
+                    $JSONobj | Add-Member -NotePropertyName 'state' -NotePropertyValue $CheckExisting.state -Force
                     $RawJSON = ConvertTo-Json -InputObject $JSONobj -Depth 10 -Compress
                 }
                 # Preserve any exclusion groups named "Vacation Exclusion - <PolicyDisplayName>" from existing policy

Modules/CIPPCore/Public/Start-CIPPSiteVersionCleanup.ps1

@@ -75,6 +75,18 @@ function Start-CIPPSiteVersionCleanup {
     }
 
     if ($PSCmdlet.ShouldProcess($SiteUrl, 'Start file version batch delete job')) {
-        return New-GraphPostRequest -scope "$AdminUrl/.default" -tenantid $TenantFilter -Uri "$AdminUrl/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AddedHeaders $AdditionalHeaders
+        $Response = New-GraphPostRequest -scope "$AdminUrl/.default" -tenantid $TenantFilter -Uri "$AdminUrl/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AddedHeaders $AdditionalHeaders
+
+        # CSOM reports validation failures as HTTP 200 with a populated ErrorInfo on the first
+        # array element. Surface it instead of returning a silent "success" the caller can't see.
+        if ($Response -is [string]) {
+            $Response = $Response | ConvertFrom-Json
+        }
+        $ErrorInfo = $Response | Where-Object { $_.PSObject.Properties.Name -contains 'ErrorInfo' } | Select-Object -First 1
+        if ($ErrorInfo.ErrorInfo) {
+            throw "SharePoint rejected the version cleanup job for $SiteUrl : $($ErrorInfo.ErrorInfo.ErrorMessage)"
+        }
+
+        return $Response
     }
 }

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSPOVersionCleanup.ps1

@@ -0,0 +1,31 @@
+function Invoke-ListSPOVersionCleanup {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Sharepoint.Site.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+    $SiteUrl = $Request.Query.SiteUrl ?? $Request.Body.SiteUrl
+
+    try {
+        $Result = Get-CIPPSiteVersionCleanupStatus -TenantFilter $TenantFilter -SiteUrl $SiteUrl
+        Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Retrieved version cleanup status for $SiteUrl" -sev Info
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API $APIName -tenant $TenantFilter -headers $Headers -message "Failed to retrieve version cleanup status for $SiteUrl : $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        $Result = "Failed to retrieve version cleanup status: $($ErrorMessage.NormalizedError)"
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return [HttpResponseContext]@{
+        StatusCode = $StatusCode
+        Body       = @{ Results = $Result }
+    }
+}

Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1

@@ -109,7 +109,7 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
         # This ensures drift detection compares against the desired state, not the original template state
         if ($Settings.state -and $Settings.state -ne 'donotchange') {
             Write-Information "Overriding template state from '$($Policy.state)' to '$($Settings.state)' for drift comparison"
-            $Policy.state = $Settings.state
+            $Policy | Add-Member -NotePropertyName 'state' -NotePropertyValue $Settings.state -Force
         }
 
         $CheckExististing = $AllCAPolicies | Where-Object -Property displayName -EQ $Settings.TemplateList.label

Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1

@@ -18,7 +18,7 @@ function Invoke-CIPPStandardSPOVersionControl {
         ADDEDCOMPONENT
             {"type":"switch","name":"standards.SPOVersionControl.EnableAutoTrim","label":"Enable Automatic Version Trimming (Microsoft managed)"}
             {"type":"number","name":"standards.SPOVersionControl.MajorVersionLimit","label":"Maximum Major Versions (when auto trim is off)","default":50}
-            {"type":"number","name":"standards.SPOVersionControl.ExpireVersionsAfterDays","label":"Expire Versions After Days (0 = never, when auto trim is off)","default":0}
+            {"type":"number","name":"standards.SPOVersionControl.ExpireVersionsAfterDays","label":"Expire Versions After Days (0 = never, otherwise 30-36500, when auto trim is off)","default":0,"validators":{"min":{"value":0,"message":"Use 0 for never, or 30 or more days"},"max":{"value":36500,"message":"Maximum value is 36500"}}}
             {"type":"switch","name":"standards.SPOVersionControl.ApplyToExistingSites","label":"Apply to all existing sites and document libraries"}
         IMPACT
             Medium Impact
@@ -53,6 +53,15 @@ function Invoke-CIPPStandardSPOVersionControl {
     $DesiredMajorVersionLimit = [int]($Settings.MajorVersionLimit ?? 50)
     $DesiredExpireVersionsAfterDays = [int]($Settings.ExpireVersionsAfterDays ?? 0)
 
+    # SharePoint only accepts 0 (never expire) or 30-36500 days for version expiration. Reject
+    # anything in the 1-29 gap (or above the max) up front so we never send a value the tenant
+    # will refuse. This is the same 30-day floor the version cleanup (trim) job enforces.
+    if (-not $DesiredAutoTrim -and $DesiredExpireVersionsAfterDays -ne 0 -and
+        ($DesiredExpireVersionsAfterDays -lt 30 -or $DesiredExpireVersionsAfterDays -gt 36500)) {
+        Write-LogMessage -API 'Standards' -tenant $Tenant -message "SPOVersionControl: ExpireVersionsAfterDays must be 0 (never) or between 30 and 36500 days. Received '$DesiredExpireVersionsAfterDays'. Skipping standard." -sev Error
+        return
+    }
+
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant | Select-Object -Property _ObjectIdentity_, TenantFilter, EnableAutoExpirationVersionTrim, MajorVersionLimit, ExpireVersionsAfterDays
     } catch {