Merge pull request #985 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 1da775b15b2c · 2026-06-01T18:41:10.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 b/Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1
@@ -45,15 +45,15 @@ function Add-CIPPW32ScriptApplication {
     )
 
     # Get the standard Chocolatey package location (relative to function app root)
-    $IntuneWinFile = 'AddChocoApp\IntunePackage.intunewin'
-    $ChocoXmlFile = 'AddChocoApp\Choco.App.xml'
+    $IntuneWinFile = Join-Path $env:CIPPRootPath 'AddChocoApp\IntunePackage.intunewin'
+    $ChocoXmlFile = Join-Path $env:CIPPRootPath 'AddChocoApp\Choco.App.xml'
 
     if (-not (Test-Path $IntuneWinFile)) {
-        throw "Chocolatey IntunePackage.intunewin not found at: $IntuneWinFile (Current directory: $PWD)"
+        throw "Chocolatey IntunePackage.intunewin not found at: $IntuneWinFile (CIPPRootPath: $env:CIPPRootPath)"
     }
 
     if (-not (Test-Path $ChocoXmlFile)) {
-        throw "Choco.App.xml not found at: $ChocoXmlFile (Current directory: $PWD)"
+        throw "Choco.App.xml not found at: $ChocoXmlFile (CIPPRootPath: $env:CIPPRootPath)"
     }
 
     # Parse the Choco XML to get encryption info. We need a wrapper around the application and this is a tiny intune file, perfect for our purpose.
diff --git a/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 b/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
@@ -320,7 +320,6 @@ function Test-CIPPAccess {
                     $PermissionsFound = $true
                 } catch {
                     Write-Information $_.Exception.Message
-                    continue
                 }
             }
             $swRolePerms.Stop()
@@ -477,38 +476,12 @@ function Test-CIPPAccess {
             } else {
                 # No permissions found for any roles
                 if ($TenantList.IsPresent) {
-                    return @('AllTenants')
-                }
-                return $true
-                if ($APIAllowed) {
-                    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter.value ?? $Request.Body.tenantFilter ?? $Request.Query.tenantId ?? $Request.Body.tenantId.value ?? $Request.Body.tenantId ?? $env:TenantID
-                    # Check tenant level access
-                    if (($Role.BlockedTenants | Measure-Object).Count -eq 0 -and $Role.AllowedTenants -contains 'AllTenants') {
-                        $TenantAllowed = $true
-                    } elseif ($TenantFilter -eq 'AllTenants') {
-                        $TenantAllowed = $false
-                    } else {
-                        $Tenant = ($Tenants | Where-Object { $TenantFilter -eq $_.customerId -or $TenantFilter -eq $_.defaultDomainName }).customerId
-
-                        if ($Role.AllowedTenants -contains 'AllTenants') {
-                            $AllowedTenants = $Tenants.customerId
-                        } else {
-                            $AllowedTenants = $Role.AllowedTenants
-                        }
-                        if ($Tenant) {
-                            $TenantAllowed = $AllowedTenants -contains $Tenant -and $Role.BlockedTenants -notcontains $Tenant
-                            if (!$TenantAllowed) { continue }
-                            break
-                        } else {
-                            $TenantAllowed = $true
-                            break
-                        }
-                    }
+                    return @()
                 }
+                throw 'Access to this CIPP API endpoint is not allowed, the user does not have the required permission'
             }
 
             if (!$TenantAllowed -and $Functionality -notmatch 'AnyTenant') {
-
                 if (!$APIAllowed) {
                     throw "Access to this CIPP API endpoint is not allowed, you do not have the required permission: $APIRole"
                 }
@@ -519,14 +492,13 @@ function Test-CIPPAccess {
                 } else {
                     return $true
                 }
-
             }
         } else {
             # No permissions found for any roles
             if ($TenantList.IsPresent) {
-                return @('AllTenants')
+                return @()
             }
-            return $true
+            throw 'Access to this CIPP API endpoint is not allowed, the user does not have the required permission'
         }
         $swUserBranch.Stop()
         $AccessTimings['UserBranch'] = $swUserBranch.Elapsed.TotalMilliseconds
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1
@@ -34,11 +34,21 @@ function Set-CIPPDBCacheOneDriveUsage {
 
         $Result = New-GraphBulkRequest -tenantid $TenantFilter -Requests @($BulkRequests) -asapp $true
         $Sites = @(($Result | Where-Object { $_.id -eq 'listAllSites' }).body.value)
-        $UsageBase64 = ($Result | Where-Object { $_.id -eq 'usage' }).body
-        $UsageJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($UsageBase64))
-        $OneDriveUsage = @(($UsageJson | ConvertFrom-Json).value)
+
+        $UsageResponse = $Result | Where-Object { $_.id -eq 'usage' }
+        if ($UsageResponse.status -and $UsageResponse.status -ne 200) {
+            throw ($UsageResponse.body.error.message ?? "Usage report request failed with status $($UsageResponse.status)")
+        }
+        $UsageBody = $UsageResponse.body
+        if ($UsageBody -is [string]) {
+            $UsageJson = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($UsageBody))
+            $OneDriveUsage = @(($UsageJson | ConvertFrom-Json).value)
+        } else {
+            $OneDriveUsage = @($UsageBody.value)
+        }
 
         foreach ($UsageRow in $OneDriveUsage) {
+            if ($null -eq $UsageRow) { continue }
             $UsageRow | Add-Member -NotePropertyName 'id' -NotePropertyValue $UsageRow.siteId -Force
             $UsageRow | Add-Member -NotePropertyName 'userPrincipalName' -NotePropertyValue $UsageRow.ownerPrincipalName -Force
         }
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1
@@ -51,6 +51,7 @@ function Set-CIPPDBCacheSharePointSiteUsage {
 
         # Ensure a stable row key for usage rows.
         foreach ($UsageRow in $UsageRows) {
+            if ($null -eq $UsageRow) { continue }
             $UsageRow | Add-Member -NotePropertyName 'id' -NotePropertyValue $UsageRow.siteId -Force
         }
 
@@ -99,4 +100,4 @@ function Set-CIPPDBCacheSharePointSiteUsage {
     } catch {
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache SharePoint site usage: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)
     }
-}
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1
@@ -31,6 +31,60 @@ function Invoke-ExecUniversalSearchV2 {
         'Applications' {
             $Results = Search-CIPPDbData -SearchTerms $SearchTerms -Types 'Apps', 'ServicePrincipals' -Limit $Limit -Properties 'id', 'appId', 'displayName', 'publisherName', 'appOwnerOrganizationId' -TenantFilter $TenantFilter
         }
+        'Licenses' {
+            # SKU lookup is universal — always search across all tenants regardless of caller scope.
+            # No Properties filter so service plan names / friendly names embedded in the JSON
+            # still pass the secondary verification pass.
+            $Raw = Search-CIPPDbData -SearchTerms $SearchTerms -Types 'LicenseOverview' -TenantFilter 'allTenants'
+
+            $BySku = [ordered]@{}
+            foreach ($Row in $Raw) {
+                $Data = $Row.Data
+                if (-not $Data -or [string]::IsNullOrWhiteSpace($Data.skuId)) { continue }
+                $Key = ([string]$Data.skuId).ToLowerInvariant()
+
+                if (-not $BySku.Contains($Key)) {
+                    $BySku[$Key] = [PSCustomObject]@{
+                        skuId          = [string]$Data.skuId
+                        skuPartNumber  = [string]$Data.skuPartNumber
+                        displayName    = [string]$Data.License
+                        servicePlans   = @($Data.ServicePlans)
+                        tenantCount    = 0
+                        totalAssigned  = 0
+                        totalAvailable = 0
+                        tenants        = [System.Collections.Generic.List[object]]::new()
+                    }
+                }
+
+                $Entry = $BySku[$Key]
+                if ([string]::IsNullOrWhiteSpace($Entry.skuPartNumber) -and $Data.skuPartNumber) { $Entry.skuPartNumber = [string]$Data.skuPartNumber }
+                if ([string]::IsNullOrWhiteSpace($Entry.displayName) -and $Data.License) { $Entry.displayName = [string]$Data.License }
+                if ((-not $Entry.servicePlans -or $Entry.servicePlans.Count -eq 0) -and $Data.ServicePlans) { $Entry.servicePlans = @($Data.ServicePlans) }
+
+                $Entry.tenantCount++
+                $Used = 0; [int]::TryParse([string]$Data.CountUsed, [ref]$Used) | Out-Null
+                $Total = 0; [int]::TryParse([string]$Data.TotalLicenses, [ref]$Total) | Out-Null
+                $Entry.totalAssigned += $Used
+                $Entry.totalAvailable += $Total
+                $Entry.tenants.Add([PSCustomObject]@{
+                        tenant = [string]$Row.Tenant
+                        used   = $Used
+                        total  = $Total
+                    })
+            }
+
+            $Aggregated = $BySku.Values | Sort-Object -Property tenantCount -Descending | Select-Object -First $Limit
+
+            # Shape into the same envelope as other types so the frontend can use match.Data
+            $Results = foreach ($Item in $Aggregated) {
+                [PSCustomObject]@{
+                    Tenant = ''
+                    Type   = 'Licenses'
+                    RowKey = "Licenses-$($Item.skuId)"
+                    Data   = $Item
+                }
+            }
+        }
         default {
             $Results = Search-CIPPDbData -SearchTerms $SearchTerms -Types 'Users' -Limit $Limit -Properties 'id', 'userPrincipalName', 'displayName' -TenantFilter $TenantFilter
         }

Original file line number	Diff line number	Diff line change
`@@ -45,15 +45,15 @@ function Add-CIPPW32ScriptApplication {`
`45`	`45`	`)`
`46`	`46`
`47`	`47`	`# Get the standard Chocolatey package location (relative to function app root)`
`48`		`- $IntuneWinFile = 'AddChocoApp\IntunePackage.intunewin'`
`49`		`- $ChocoXmlFile = 'AddChocoApp\Choco.App.xml'`
	`48`	`+ $IntuneWinFile = Join-Path $env:CIPPRootPath 'AddChocoApp\IntunePackage.intunewin'`
	`49`	`+ $ChocoXmlFile = Join-Path $env:CIPPRootPath 'AddChocoApp\Choco.App.xml'`
`50`	`50`
`51`	`51`	`if (-not (Test-Path $IntuneWinFile)) {`
`52`		`- throw "Chocolatey IntunePackage.intunewin not found at: $IntuneWinFile (Current directory: $PWD)"`
	`52`	`+ throw "Chocolatey IntunePackage.intunewin not found at: $IntuneWinFile (CIPPRootPath: $env:CIPPRootPath)"`
`53`	`53`	`}`
`54`	`54`
`55`	`55`	`if (-not (Test-Path $ChocoXmlFile)) {`
`56`		`- throw "Choco.App.xml not found at: $ChocoXmlFile (Current directory: $PWD)"`
	`56`	`+ throw "Choco.App.xml not found at: $ChocoXmlFile (CIPPRootPath: $env:CIPPRootPath)"`
`57`	`57`	`}`
`58`	`58`
`59`	`59`	`# Parse the Choco XML to get encryption info. We need a wrapper around the application and this is a tiny intune file, perfect for our purpose.`
Original file line number	Diff line number	Diff line change
`@@ -51,6 +51,7 @@ function Set-CIPPDBCacheSharePointSiteUsage {`
`51`	`51`
`52`	`52`	`# Ensure a stable row key for usage rows.`
`53`	`53`	`foreach ($UsageRow in $UsageRows) {`
	`54`	`+ if ($null -eq $UsageRow) { continue }`
`54`	`55`	`$UsageRow \| Add-Member -NotePropertyName 'id' -NotePropertyValue $UsageRow.siteId -Force`
`55`	`56`	`}`
`56`	`57`
`@@ -99,4 +100,4 @@ function Set-CIPPDBCacheSharePointSiteUsage {`
`99`	`100`	`} catch {`
`100`	`101`	`Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache SharePoint site usage: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)`
`101`	`102`	`}`
`102`		`-}`
	`103`	`+}`