fix: prevent cert provision loop and skip KV 404 retries

Add SAMCertProvisionAttempted guard to break recursion when Update-CIPPSAMCertificate calls Get-GraphToken, which re-enters Get-CIPPAuthentication before the cert env var is set.

Also short-circuit Key Vault retry loop on 404 responses since the secret is definitively absent and retrying with backoff only adds latency.

Author: JohnDuprey

Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1

@@ -49,9 +49,13 @@ function Get-CIPPAuthentication {
                 }
             }
 
-            if (-not $env:SAMCertificate) {
-                # First run on this instance: provision the certificate now.
+            if (-not $env:SAMCertificate -and $env:SAMCertProvisionAttempted -ne 'true') {
+                # First run on this instance: provision the certificate now, at most once per
+                # process. The guard also breaks a recursion loop: Update-CIPPSAMCertificate
+                # calls Get-GraphToken, which re-enters this function when the AppCache
+                # ApplicationId does not match the environment.
                 # Set-CIPPSAMCertificate refreshes $env:SAMCertificate on success.
+                $env:SAMCertProvisionAttempted = 'true'
                 Write-Information 'No SAM certificate found, provisioning one now'
                 $CertResult = Update-CIPPSAMCertificate -ErrorAction Stop
                 Write-LogMessage -message "Provisioned SAM certificate during authentication load. Thumbprint: $($CertResult.Thumbprint), storage mode: $($CertResult.StorageMode)" -Sev 'Info' -API 'CIPP Authentication'

Modules/CIPPCore/Public/Get-CippKeyVaultSecret.ps1

@@ -60,6 +60,10 @@ function Get-CippKeyVaultSecret {
                 break
             } catch {
                 $lastError = $_
+                # 404 is definitive - the secret does not exist and retrying cannot change that
+                if ($_.Exception.Message -match '404|SecretNotFound') {
+                    throw "Failed to retrieve secret '$Name' from vault '$VaultName': $($_.Exception.Message)"
+                }
                 if ($i -lt ($maxRetries - 1)) {
                     Start-Sleep -Seconds $retryDelay
                     $retryDelay *= 2  # Exponential backoff