Merge pull request #1073 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1

@@ -23,7 +23,7 @@ function Initialize-CIPPAuth {
     # -- Entry logging --
     $EasyAuthEnabled = [Craft.Services.AppLifecycleBridge]::IsEasyAuthConfigured()
     $IsDevStorage = ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true') -or ($env:NonLocalHostAzurite -eq 'true')
-    $KVName = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0]
+    $KVName = Get-CippKeyVaultName
 
     Write-Information "[Auth-Init] Starting — EasyAuth=$EasyAuthEnabled, DevStorage=$IsDevStorage, KVName='$KVName', DeploymentId='$env:WEBSITE_DEPLOYMENT_ID'"
 

Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1

@@ -71,8 +71,7 @@ function Set-CIPPSSOEasyAuth {
     # Set AUTH_SECRET as a KV reference when requested (initial setup)
     # Skip for implicit auth (no client secret needed — e.g. central migration app)
     if ($UseKvReferences -and -not $ImplicitAuth) {
-        $KV = $env:WEBSITE_DEPLOYMENT_ID
-        $VaultName = if ($KV) { ($KV -split '-')[0] } else { $null }
+        $VaultName = Get-CippKeyVaultName
         if ($VaultName) {
             $MergedSettings['AUTH_SECRET'] = "@Microsoft.KeyVault(VaultName=$VaultName;SecretName=SSOAppSecret)"
         }

Modules/CIPPCore/Public/Authentication/Set-CIPPSSOStoredCredentials.ps1

@@ -32,9 +32,8 @@ function Set-CIPPSSOStoredCredentials {
         return
     }
 
-    $KV = $env:WEBSITE_DEPLOYMENT_ID
-    $VaultName = if ($KV) { ($KV -split '-')[0] } else { $null }
-    if (-not $VaultName) { throw 'Cannot determine Key Vault name from WEBSITE_DEPLOYMENT_ID' }
+    $VaultName = Get-CippKeyVaultName
+    if (-not $VaultName) { throw 'Cannot determine Key Vault name (WEBSITE_SITE_NAME / WEBSITE_DEPLOYMENT_ID not set)' }
 
     if ($AppId) {
         $ExistingAppIdSecret = $null

Modules/CIPPCore/Public/Authentication/Update-CIPPSSORedirectUri.ps1

@@ -32,8 +32,7 @@ function Update-CIPPSSORedirectUri {
             $SSOMultiTenant = $Secret.SSOMultiTenant -eq 'True'
         } catch { }
     } else {
-        $KV = $env:WEBSITE_DEPLOYMENT_ID
-        $VaultName = if ($KV) { ($KV -split '-')[0] } else { $null }
+        $VaultName = Get-CippKeyVaultName
         if ($VaultName) {
             try {
                 $SSOAppId = Get-CippKeyVaultSecret -VaultName $VaultName -Name 'SSOAppId' -AsPlainText -ErrorAction Stop

Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UpdateTokensTimer.ps1

@@ -23,7 +23,7 @@ function Start-UpdateTokensTimer {
                     Write-LogMessage -API 'Update Tokens' -message 'Could not update refresh token. Will try again in 7 days.' -sev 'CRITICAL'
                 }
             } else {
-                $KV = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0]
+                $KV = Get-CippKeyVaultName
                 if ($Refreshtoken) {
                     Set-CippKeyVaultSecret -VaultName $KV -Name 'RefreshToken' -SecretValue (ConvertTo-SecureString -String $Refreshtoken -AsPlainText -Force)
                 } else {

Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1

@@ -21,7 +21,7 @@ function Get-CIPPAuthentication {
             }
             Write-Host "Got secrets from dev storage. ApplicationID: $env:ApplicationID"
         } else {
-            $keyvaultname = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0]
+            $keyvaultname = Get-CippKeyVaultName
             $Variables | ForEach-Object {
                 Set-Item -Path env:$_ -Value (Get-CippKeyVaultSecret -VaultName $keyvaultname -Name $_ -AsPlainText -ErrorAction Stop) -Force
             }

Modules/CIPPCore/Public/Get-CIPPTimerFunctions.ps1

@@ -28,12 +28,14 @@ function Get-CIPPTimerFunctions {
 
     $FunctionName = $env:WEBSITE_SITE_NAME
     $MainFunctionVersion = ($Nodes | Where-Object { $_.RowKey -eq $FunctionName }).Version
-    $AvailableNodes = $Nodes | Where-Object { $_.RowKey -match '-' -and $_.Version -eq $MainFunctionVersion } | ForEach-Object { ($_.RowKey -split '-')[1] }
-
-    # Get node name
-    if ($FunctionName -match '-') {
-        $Node = ($FunctionName -split '-')[1]
-    } else {
+    # Offloaded nodes: RowKey is '<mainname>-<suffix>'. Use the known offload suffix as the
+    # node name (Get-CippOffloadSuffix), NOT the second dash segment - a dashed main-app name
+    # (e.g. 'compaction-01-z2ir2') would otherwise yield a wrong node like '01'.
+    $AvailableNodes = $Nodes | Where-Object { (Test-CippOffloadFunctionApp -SiteName $_.RowKey) -and $_.Version -eq $MainFunctionVersion } | ForEach-Object { Get-CippOffloadSuffix -SiteName $_.RowKey }
+
+    # Get node name for the current app: the offload suffix, or 'http' for the main app.
+    $Node = Get-CippOffloadSuffix -SiteName $FunctionName
+    if (-not $Node) {
         $Node = 'http'
     }
 

Modules/CIPPCore/Public/Get-CippKeyVaultName.ps1

@@ -0,0 +1,55 @@
+function Get-CippKeyVaultName {
+    <#
+    .SYNOPSIS
+        Returns the name of the CIPP Azure Key Vault for the current instance.
+
+    .DESCRIPTION
+        The Key Vault is named after the main App Service instance, so its name equals
+        $env:WEBSITE_SITE_NAME on the main app.
+
+        Two things have to be handled:
+
+        1. Dashed instance names. Earlier code derived the vault name as
+           ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0], which keeps only the segment before
+           the first dash. That silently truncated any instance name containing a dash -
+           e.g. 'compaction-01-z2ir2' became 'compaction' - so every secret call was pointed
+           at a vault that does not exist (404). The full name must be kept intact.
+
+        2. Offloaded function apps. When function offloading is enabled, extra Function Apps
+           are deployed alongside the main app and share its Key Vault. They are named
+           '<mainname>-<suffix>' (e.g. 'compaction-01-z2ir2-standards'). Those apps must
+           resolve the SAME vault as the main app, so a known offload suffix is stripped from
+           the end of the site name. Only the fixed offload suffixes are stripped, never an
+           arbitrary trailing segment, so a legitimate dashed vault name is left intact.
+
+        This is the single source of truth for the vault name so those bugs cannot reappear
+        per call site.
+
+    .EXAMPLE
+        $VaultName = Get-CippKeyVaultName
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param()
+
+    # Primary: the App Service site name IS the vault name (on the main app).
+    # Fallback: the full deployment id. Never split on '-' (that is the truncation bug this
+    # helper exists to prevent); a dashed vault name must be kept whole.
+    $Name = if (-not [string]::IsNullOrWhiteSpace($env:WEBSITE_SITE_NAME)) {
+        $env:WEBSITE_SITE_NAME
+    } elseif (-not [string]::IsNullOrWhiteSpace($env:WEBSITE_DEPLOYMENT_ID)) {
+        $env:WEBSITE_DEPLOYMENT_ID
+    } else {
+        return $null
+    }
+
+    # If running on an offloaded app ('<mainname>-<suffix>'), strip the known suffix so it
+    # resolves the SAME vault as the main app. Get-CippOffloadSuffix is the single source of
+    # truth for the suffix list.
+    $Suffix = Get-CippOffloadSuffix -SiteName $Name
+    if ($Suffix) {
+        $Name = $Name -replace "-$([regex]::Escape($Suffix))$", ''
+    }
+
+    return $Name
+}

Modules/CIPPCore/Public/Get-CippKeyVaultSecret.ps1

@@ -37,10 +37,9 @@ function Get-CippKeyVaultSecret {
     try {
         # Derive vault name if not provided
         if (-not $VaultName) {
-            if ($env:WEBSITE_DEPLOYMENT_ID) {
-                $VaultName = ($env:WEBSITE_DEPLOYMENT_ID -split '-')[0]
-            } else {
-                throw 'VaultName not provided and WEBSITE_DEPLOYMENT_ID environment variable not set'
+            $VaultName = Get-CippKeyVaultName
+            if (-not $VaultName) {
+                throw 'VaultName not provided and could not be derived (WEBSITE_SITE_NAME / WEBSITE_DEPLOYMENT_ID not set)'
             }
         }
 

Modules/CIPPCore/Public/Get-CippOffloadSuffix.ps1

@@ -0,0 +1,49 @@
+function Get-CippOffloadSuffix {
+    <#
+    .SYNOPSIS
+        Returns the offload-app suffix for a function app name, or $null when it is not an
+        offloaded app.
+
+    .DESCRIPTION
+        When function offloading is enabled, extra Function Apps are deployed alongside the
+        main app and share its resources (Key Vault, etc.). They are named
+        '<mainname>-<suffix>' - e.g. 'compaction-01-z2ir2-standards'.
+
+        This is the SINGLE SOURCE OF TRUTH for the known offload suffixes so that vault-name
+        derivation ([[Get-CippKeyVaultName]]) and offload detection stay in sync. Matching is
+        anchored to the end and requires a whole '-<suffix>' segment, so a legitimate dashed
+        main-app name (e.g. 'compaction-01-z2ir2', which contains dashes but is NOT offloaded)
+        is never misdetected.
+
+        Keep $OffloadSuffixes in sync with the deployment's offload app names.
+
+    .PARAMETER SiteName
+        Function app name to inspect. Defaults to $env:WEBSITE_SITE_NAME (the current app).
+
+    .EXAMPLE
+        Get-CippOffloadSuffix -SiteName 'compaction-01-z2ir2-standards'   # -> 'standards'
+
+    .EXAMPLE
+        Get-CippOffloadSuffix -SiteName 'compaction-01-z2ir2'             # -> $null
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $false)]
+        [AllowNull()]
+        [AllowEmptyString()]
+        [string]$SiteName = $env:WEBSITE_SITE_NAME
+    )
+
+    $OffloadSuffixes = @('proc', 'auditlog', 'standards', 'usertasks')
+
+    if ([string]::IsNullOrWhiteSpace($SiteName)) { return $null }
+
+    foreach ($Suffix in $OffloadSuffixes) {
+        if ($SiteName -match "-$([regex]::Escape($Suffix))$") {
+            return $Suffix
+        }
+    }
+
+    return $null
+}