Merge pull request #1080 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Config/FeatureFlags.json

@@ -71,5 +71,35 @@
       "/cipp/advanced/diagnostics"
     ],
     "Hidden": true
+  },
+  {
+    "Id": "BackendSettings",
+    "Name": "Backend Settings",
+    "Description": "Backend settings page showing Azure resource URLs. Hidden on hosted instances.",
+    "Enabled": true,
+    "AllowUserToggle": false,
+    "Timers": [],
+    "Endpoints": [
+      "ExecBackendURLs"
+    ],
+    "Pages": [
+      "/cipp/settings/backend"
+    ],
+    "Hidden": true
+  },
+  {
+    "Id": "FunctionOffloading",
+    "Name": "Function Offloading",
+    "Description": "Function offloading configuration page. Hidden in CIPP-NG.",
+    "Enabled": true,
+    "AllowUserToggle": false,
+    "Timers": [],
+    "Endpoints": [
+      "ExecOffloadFunctions"
+    ],
+    "Pages": [
+      "/cipp/advanced/super-admin/function-offloading"
+    ],
+    "Hidden": true
   }
 ]

Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1

@@ -39,6 +39,18 @@ function Push-CIPPTestsList {
         # Function discovery happens inside Invoke-CIPPTestCollection via Get-Command (path-independent).
         $Suites = @('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'Custom', 'E8')
 
+        # Optional caller-supplied suite filter (e.g. a Custom-only run). When present, restrict
+        # the emitted suites to the requested subset so we don't spin up every suite unnecessarily.
+        if ($Item.Suites) {
+            $Requested = @($Item.Suites)
+            $Suites = @($Suites | Where-Object { $_ -in $Requested })
+            if ($Suites.Count -eq 0) {
+                Write-Information "No suites matched the requested filter ($($Requested -join ', ')) for tenant $TenantFilter. Skipping."
+                return @()
+            }
+            Write-Information "Suite filter applied for $TenantFilter — running: $($Suites -join ', ')"
+        }
+
         $Tasks = foreach ($Suite in $Suites) {
             [PSCustomObject]@{
                 FunctionName = 'CIPPTestCollection'

Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1

@@ -15,7 +15,12 @@ function Start-CIPPDBTestsRun {
         [string]$TenantFilter = 'allTenants',
 
         [Parameter(Mandatory = $false)]
-        [switch]$Force
+        [switch]$Force,
+
+        # Optional subset of suites to run (e.g. 'Custom'). Omit to run every suite.
+        # Suite names must match the ValidateSet in Invoke-CIPPTestCollection.
+        [Parameter(Mandatory = $false)]
+        [string[]]$Suites
     )
 
     Write-Information "Starting tests run for tenant: $TenantFilter"
@@ -64,11 +69,16 @@ function Start-CIPPDBTestsRun {
         # The tenants below were already filtered by data presence above, so we pass
         # SkipDbCheck=$true to avoid a redundant CountsOnly round-trip per tenant.
         $Batch = foreach ($Tenant in $AllTenantsList) {
-            @{
+            $ListItem = @{
                 FunctionName = 'CIPPTestsList'
                 TenantFilter = $Tenant
                 SkipDbCheck  = $true
             }
+            # Propagate an optional suite filter so Phase 1 emits only the requested suites.
+            if ($Suites) {
+                $ListItem.Suites = @($Suites)
+            }
+            $ListItem
         }
 
         Write-Information "Built batch of $($Batch.Count) tenant test list activities"

Modules/CIPPCore/Public/Get-CIPPTestResultsTenants.ps1

@@ -0,0 +1,166 @@
+function Get-CIPPTestResultsTenants {
+    <#
+    .SYNOPSIS
+        Retrieves CIPP test results across one, many, or all tenants with flexible filtering.
+
+    .DESCRIPTION
+        Queries the shared CippTestResults table server-side (partition / row / status / type /
+        risk / category) so a single test can be compared across every tenant in one call. This is
+        the cross-tenant counterpart to Get-CIPPTestResults (which is scoped to a single tenant).
+
+        Custom test rows are enriched with their definition (Description / ReturnType /
+        MarkdownTemplate) from the CustomPowershellScripts table so the off-canvas detail renders
+        identically to the per-tenant dashboard. Every row is stamped with its tenant identity
+        (Tenant / TenantId / TenantName) and a serialisable LastRun timestamp for display.
+
+    .PARAMETER TenantFilter
+        One or more tenant domains. Omit, or pass 'AllTenants' / 'allTenants', to query every tenant.
+
+    .PARAMETER TestId
+        One or more test IDs (the row's RowKey), e.g. 'CustomScript-<guid>'.
+
+    .PARAMETER Status
+        One or more statuses to filter on (Passed / Failed / Investigate / Skipped / Informational).
+
+    .PARAMETER TestType
+        Restrict to a single test type (Identity / Devices / Custom).
+
+    .PARAMETER Risk
+        Restrict to a single risk level (High / Medium / Low).
+
+    .PARAMETER Category
+        Restrict to a single category.
+
+    .EXAMPLE
+        Get-CIPPTestResultsTenants -TestId 'CustomScript-1234' -TestType 'Custom'
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string[]]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [string[]]$TestId,
+
+        [Parameter(Mandatory = $false)]
+        [string[]]$Status,
+
+        [Parameter(Mandatory = $false)]
+        [string]$TestType,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Risk,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Category
+    )
+
+    $Table = Get-CippTable -tablename 'CippTestResults'
+
+    # Build a single OData filter so all narrowing happens server-side. A cross-partition scan
+    # (no PartitionKey clause) is acceptable here because it is always bounded by a RowKey/Status/
+    # TestType clause when driven from the UI.
+    $FilterParts = [System.Collections.Generic.List[string]]::new()
+
+    $AllTenants = (-not $TenantFilter) -or ($TenantFilter -contains 'AllTenants') -or ($TenantFilter -contains 'allTenants')
+    if (-not $AllTenants) {
+        $TenantClause = (@($TenantFilter | Where-Object { $_ }) | ForEach-Object { "PartitionKey eq '$_'" }) -join ' or '
+        if ($TenantClause) { $FilterParts.Add("($TenantClause)") }
+    }
+    if ($TestId) {
+        $TestClause = (@($TestId | Where-Object { $_ }) | ForEach-Object { "RowKey eq '$_'" }) -join ' or '
+        if ($TestClause) { $FilterParts.Add("($TestClause)") }
+    }
+    if ($Status) {
+        $StatusClause = (@($Status | Where-Object { $_ }) | ForEach-Object { "Status eq '$_'" }) -join ' or '
+        if ($StatusClause) { $FilterParts.Add("($StatusClause)") }
+    }
+    if ($TestType) { $FilterParts.Add("TestType eq '$TestType'") }
+    if ($Risk) { $FilterParts.Add("Risk eq '$Risk'") }
+    if ($Category) { $FilterParts.Add("Category eq '$Category'") }
+
+    $Filter = $FilterParts -join ' and '
+
+    $GetParams = @{}
+    if ($Filter) { $GetParams.Filter = $Filter }
+    $Results = @(Get-CIPPAzDataTableEntity @Table @GetParams)
+
+    if ($Results.Count -eq 0) { return @() }
+
+    # Map tenant domain (PartitionKey) -> tenant identity for display and access control.
+    $TenantLookup = @{}
+    try {
+        foreach ($Tenant in (Get-Tenants -IncludeErrors)) {
+            if ($Tenant.defaultDomainName) {
+                $TenantLookup[$Tenant.defaultDomainName] = $Tenant
+            }
+        }
+    } catch {
+        Write-Warning "Get-CIPPTestResultsTenants: failed to load tenant list: $($_.Exception.Message)"
+    }
+
+    # Enrich Custom rows with their definition (latest version per ScriptGuid), mirroring the
+    # per-tenant enrichment in Invoke-ListTests so the shared off-canvas renders identically.
+    $CustomMeta = @{}
+    if (@($Results | Where-Object { $_.TestType -eq 'Custom' }).Count -gt 0) {
+        $ScriptTable = Get-CippTable -tablename 'CustomPowershellScripts'
+        $Scripts = @(Get-CIPPAzDataTableEntity @ScriptTable -Filter "PartitionKey eq 'CustomScript'")
+        $LatestByGuid = @{}
+        foreach ($Script in $Scripts) {
+            if (-not $Script.ScriptGuid) { continue }
+            $Existing = $LatestByGuid[$Script.ScriptGuid]
+            if (-not $Existing -or [int]$Script.Version -gt [int]$Existing.Version) {
+                $LatestByGuid[$Script.ScriptGuid] = $Script
+            }
+        }
+        foreach ($Script in $LatestByGuid.Values) {
+            # Treat a missing Enabled property as enabled, matching Invoke-CIPPTestCollection.
+            # A disabled (or deleted) script can still have stale results in the table; surfacing
+            # this lets the UI show that the data no longer reflects an active test.
+            $EnabledProp = $Script.PSObject.Properties['Enabled']
+            $CustomMeta[$Script.ScriptGuid] = [PSCustomObject]@{
+                ScriptName       = $Script.ScriptName ?? ''
+                Description      = $Script.Description ?? ''
+                ReturnType       = $Script.ReturnType ?? 'JSON'
+                MarkdownTemplate = $Script.MarkdownTemplate ?? ''
+                Enabled          = (-not $EnabledProp) -or [bool]$EnabledProp.Value
+            }
+        }
+    }
+
+    foreach ($Result in $Results) {
+        $TenantInfo = $TenantLookup[$Result.PartitionKey]
+        $Result | Add-Member -NotePropertyName 'Tenant' -NotePropertyValue $Result.PartitionKey -Force
+        $Result | Add-Member -NotePropertyName 'TenantId' -NotePropertyValue ($TenantInfo.customerId ?? '') -Force
+        $Result | Add-Member -NotePropertyName 'TenantName' -NotePropertyValue ($TenantInfo.displayName ?? $Result.PartitionKey) -Force
+
+        # Surface the Azure entity timestamp as a stable, serialisable last-run field.
+        $LastRun = $Result.Timestamp
+        if ($LastRun -is [DateTimeOffset]) {
+            $LastRun = $LastRun.UtcDateTime.ToString('o')
+        } elseif ($LastRun) {
+            $LastRun = [string]$LastRun
+        }
+        $Result | Add-Member -NotePropertyName 'LastRun' -NotePropertyValue $LastRun -Force
+
+        if ($Result.TestType -eq 'Custom') {
+            $ScriptGuid = ($Result.RowKey -replace '^CustomScript-', '')
+            if (-not [string]::IsNullOrWhiteSpace($ScriptGuid) -and $CustomMeta.ContainsKey($ScriptGuid)) {
+                $Meta = $CustomMeta[$ScriptGuid]
+                $Result | Add-Member -NotePropertyName 'Description' -NotePropertyValue $Meta.Description -Force
+                $Result | Add-Member -NotePropertyName 'ReturnType' -NotePropertyValue $Meta.ReturnType -Force
+                $Result | Add-Member -NotePropertyName 'MarkdownTemplate' -NotePropertyValue $Meta.MarkdownTemplate -Force
+                $Result | Add-Member -NotePropertyName 'Enabled' -NotePropertyValue $Meta.Enabled -Force
+                if ([string]::IsNullOrWhiteSpace($Result.Name) -and $Meta.ScriptName) {
+                    $Result | Add-Member -NotePropertyName 'Name' -NotePropertyValue $Meta.ScriptName -Force
+                }
+            } else {
+                # Result exists but the script no longer does (deleted). The data is stale — flag
+                # it as not enabled so the column stays populated and truthful.
+                $Result | Add-Member -NotePropertyName 'Enabled' -NotePropertyValue $false -Force
+            }
+        }
+    }
+
+    return $Results
+}

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1

@@ -24,6 +24,18 @@ function Invoke-ListFeatureFlags {
                 elseIf ($Flag.Id -eq 'AppInsights') {
                     $Flag.Enabled = $false
                 }
+                elseIf ($Flag.Id -eq 'FunctionOffloading') {
+                    $Flag.Enabled = $false
+                }
+            }
+        }
+
+        # Hosted instances hide the backend settings page (Azure resource URLs)
+        if ($env:CIPP_HOSTED -eq 'true') {
+            foreach ($Flag in $FeatureFlags) {
+                if ($Flag.Id -eq 'BackendSettings') {
+                    $Flag.Enabled = $false
+                }
             }
         }
 

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecCustomTestRun.ps1

@@ -0,0 +1,48 @@
+function Invoke-ExecCustomTestRun {
+    <#
+    .SYNOPSIS
+        Triggers a Custom test-suite run for one or all tenants.
+
+    .DESCRIPTION
+        Re-runs the enabled Custom tests against the most recent cached data for the requested
+        tenant(s) by starting the standard tests orchestration with a Custom-only suite filter.
+        Used by the cross-tenant Custom Test Report to refresh results on demand.
+
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+
+    .ROLE
+        Tenant.Tests.ReadWrite
+    #>
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    $TenantFilter = 'allTenants'
+    try {
+        $TenantFilterRaw = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        # Accept a plain string, a {value} object, or a single-element array of either.
+        if ($TenantFilterRaw -is [array]) { $TenantFilterRaw = $TenantFilterRaw | Select-Object -First 1 }
+        if ($TenantFilterRaw -is [pscustomobject]) { $TenantFilterRaw = $TenantFilterRaw.value }
+        if (-not [string]::IsNullOrWhiteSpace($TenantFilterRaw)) { $TenantFilter = [string]$TenantFilterRaw }
+        if ($TenantFilter -eq 'AllTenants') { $TenantFilter = 'allTenants' }
+
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Starting Custom test run for: $TenantFilter" -sev Info
+        $null = Start-CIPPDBTestsRun -TenantFilter $TenantFilter -Suites 'Custom' -Force
+
+        $Scope = if ($TenantFilter -eq 'allTenants') { 'all tenants' } else { $TenantFilter }
+        $StatusCode = [HttpStatusCode]::OK
+        $Body = [PSCustomObject]@{ Results = "Successfully started a custom test run for $Scope. Results will populate here as each tenant completes." }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to start custom test run: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::BadRequest
+        $Body = [PSCustomObject]@{ Results = "Failed to start custom test run: $($ErrorMessage.NormalizedError)" }
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}