feat: enhance role permission handling and introduce Get-CippHttpPermissions function

fix issue with stale permissions causing escalation alerts on api client management

Author: JohnDuprey

Modules/CIPPCore/Public/Authentication/Get-CIPPRolePermissions.ps1

@@ -17,13 +17,25 @@ function Get-CIPPRolePermissions {
     $Filter = "RowKey eq '$RoleName'"
     $Role = Get-CIPPAzDataTableEntity @Table -Filter $Filter
     if ($Role) {
-        $Permissions = $Role.Permissions | ConvertFrom-Json
+        $Permissions = ($Role.Permissions | ConvertFrom-Json).PSObject.Properties.Value
+        # Stored permissions can reference endpoints removed or renamed in later CIPP
+        # versions; drop those so stale entries don't inflate the role's permission set
+        # (e.g. failing the Test-CippApiClientRoleGrant subset check). Skip filtering if
+        # the valid-permission universe can't be resolved, rather than emptying the role.
+        try {
+            $ValidPermissions = Get-CippHttpPermissions
+            if (@($ValidPermissions).Count -gt 0) {
+                $Permissions = @($Permissions | Where-Object { $ValidPermissions -contains $_ })
+            }
+        } catch {
+            Write-Warning "Unable to resolve valid permissions to filter role '$RoleName': $($_.Exception.Message)"
+        }
         $AllowedTenants = if ($Role.AllowedTenants) { $Role.AllowedTenants | ConvertFrom-Json } else { @() }
         $BlockedTenants = if ($Role.BlockedTenants) { $Role.BlockedTenants | ConvertFrom-Json } else { @() }
         $BlockedEndpoints = if ($Role.BlockedEndpoints) { $Role.BlockedEndpoints | ConvertFrom-Json } else { @() }
         [PSCustomObject]@{
             Role             = $Role.RowKey
-            Permissions      = $Permissions.PSObject.Properties.Value
+            Permissions      = @($Permissions)
             AllowedTenants   = @($AllowedTenants)
             BlockedTenants   = @($BlockedTenants)
             BlockedEndpoints = @($BlockedEndpoints)

Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1

@@ -22,30 +22,10 @@ function Get-CippAllowedPermissions {
     )
 
     # Get all available permissions and base roles configuration
-
-    $Version = if ($env:CIPPNG -eq 'true') {
-        $env:APP_VERSION
-    } else {
-        (Get-Content -Path (Join-Path $env:CIPPRootPath 'version_latest.txt')).Trim()
-    }
     $BaseRoles = Get-Content -Path (Join-Path $env:CIPPRootPath 'Config\cipp-roles.json') | ConvertFrom-Json
     $DefaultRoles = @('superadmin', 'admin', 'editor', 'readonly', 'anonymous', 'authenticated')
 
-    $AllPermissionCacheTable = Get-CIPPTable -tablename 'cachehttppermissions'
-    $AllPermissionsRow = Get-CIPPAzDataTableEntity @AllPermissionCacheTable -Filter "PartitionKey eq 'HttpFunctions' and RowKey eq 'HttpFunctions' and Version eq '$($Version)'"
-
-    if (-not $AllPermissionsRow.Permissions) {
-        $AllPermissions = Get-CIPPHttpFunctions -ByRole | Select-Object -ExpandProperty Permission
-        $Entity = @{
-            PartitionKey = 'HttpFunctions'
-            RowKey       = 'HttpFunctions'
-            Version      = [string]$Version
-            Permissions  = [string]($AllPermissions | ConvertTo-Json -Compress)
-        }
-        Add-CIPPAzDataTableEntity @AllPermissionCacheTable -Entity $Entity -Force
-    } else {
-        $AllPermissions = $AllPermissionsRow.Permissions | ConvertFrom-Json
-    }
+    $AllPermissions = Get-CippHttpPermissions
 
     $AllowedPermissions = [System.Collections.Generic.List[string]]::new()
 

Modules/CIPPCore/Public/Authentication/Get-CippHttpPermissions.ps1

@@ -0,0 +1,50 @@
+function Get-CippHttpPermissions {
+    <#
+    .SYNOPSIS
+        Returns the set of API permissions that exist on the current HTTP functions.
+
+    .DESCRIPTION
+        Resolves the full permission universe for the running CIPP version from the
+        cachehttppermissions table, computing and caching it via Get-CIPPHttpFunctions
+        on a cache miss. Results are memoized in-process per version so hot paths
+        (Test-CIPPAccess, Get-CippAllowedPermissions) avoid repeated table reads.
+
+    .OUTPUTS
+        [string[]] of valid permission names, e.g. 'Exchange.Mailbox.ReadWrite'.
+
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Version = if ($env:CIPPNG -eq 'true') {
+        $env:APP_VERSION
+    } else {
+        (Get-Content -Path (Join-Path $env:CIPPRootPath 'version_latest.txt')).Trim()
+    }
+
+    if ($script:CippHttpPermissions -and $script:CippHttpPermissionsVersion -eq $Version) {
+        return $script:CippHttpPermissions
+    }
+
+    $AllPermissionCacheTable = Get-CIPPTable -tablename 'cachehttppermissions'
+    $AllPermissionsRow = Get-CIPPAzDataTableEntity @AllPermissionCacheTable -Filter "PartitionKey eq 'HttpFunctions' and RowKey eq 'HttpFunctions' and Version eq '$($Version)'"
+
+    if (-not $AllPermissionsRow.Permissions) {
+        $AllPermissions = Get-CIPPHttpFunctions -ByRole | Select-Object -ExpandProperty Permission
+        $Entity = @{
+            PartitionKey = 'HttpFunctions'
+            RowKey       = 'HttpFunctions'
+            Version      = [string]$Version
+            Permissions  = [string]($AllPermissions | ConvertTo-Json -Compress)
+        }
+        Add-CIPPAzDataTableEntity @AllPermissionCacheTable -Entity $Entity -Force
+    } else {
+        $AllPermissions = $AllPermissionsRow.Permissions | ConvertFrom-Json
+    }
+
+    $script:CippHttpPermissions = @($AllPermissions)
+    $script:CippHttpPermissionsVersion = $Version
+    return $script:CippHttpPermissions
+}

Modules/CIPPCore/Public/Authentication/Test-CippApiClientRoleGrant.ps1

@@ -102,7 +102,7 @@ function Test-CippApiClientRoleGrant {
         # Effective permissions a client holding this role would receive, computed the
         # same way Test-CIPPAccess evaluates an API client (single role, no base ceiling).
         $RolePermissions = @(Get-CippAllowedPermissions -UserRoles @($TargetRole))
-        $Escalation = @($RolePermissions | Where-Object { $CallerPermissions -notcontains $_ -and $_ -notmatch 'None$' })
+        $Escalation = @($RolePermissions | Where-Object { $CallerPermissions -notcontains $_ })
 
         if ($Escalation.Count -gt 0) {
             return (New-Denial "You do not have sufficient permissions to manage an API client with the '$TargetRole' role; it grants permissions beyond your own.")