Merge pull request #1066 from KelvinTegelaar/dev

pull[bot] · web-flow · commit d8541cb56b76 · 2026-07-03T00:41:12.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/.github/workflows/psscriptanalyzer.yml b/.github/workflows/psscriptanalyzer.yml
@@ -0,0 +1,47 @@
+# SAST for PowerShell: PSScriptAnalyzer with SARIF upload to the GitHub Security tab
+# ISO 27001:2022 A.8.28/8.29 evidence — CodeQL does not support PowerShell, so
+# PSScriptAnalyzer is the SAST tool for CIPP-API.
+name: SAST - PSScriptAnalyzer
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+  schedule:
+    - cron: "30 5 * * 1" # Weekly, catches newly added rules against unchanged code
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  psscriptanalyzer:
+    if: github.repository_owner == 'KelvinTegelaar'
+    name: Run PSScriptAnalyzer
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Run PSScriptAnalyzer
+        uses: microsoft/psscriptanalyzer-action@v1.1
+        with:
+          path: .\
+          recurse: true
+          # Security-focused rules; extend with full default ruleset if desired
+          includeRule:
+            '"PSAvoidUsingPlainTextForPassword",
+            "PSAvoidUsingConvertToSecureStringWithPlainText",
+            "PSAvoidUsingUsernameAndPasswordParams",
+            "PSUsePSCredentialType",
+            "PSAvoidUsingInvokeExpression",
+            "PSAvoidGlobalVars",
+            "PSAvoidUsingComputerNameHardcoded",
+            "PSUseDeclaredVarsMoreThanAssignments"'
+          output: results.sarif
+
+      - name: Upload SARIF to Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif
diff --git a/Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest011.ps1 b/Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest011.ps1
@@ -13,15 +13,24 @@ function Invoke-CippTestGenericTest011 {
             return
         }
 
-        # Load standards.json for friendly name resolution
+        # Load standards.json for friendly name and compliance-tag resolution
         $StandardsLabelMap = @{}
+        $StandardsTagMap = @{}
         $StandardsJsonPath = Join-Path $env:CIPPRootPath 'Config\standards.json'
         if (Test-Path $StandardsJsonPath) {
             $StandardsJson = Get-Content $StandardsJsonPath -Raw | ConvertFrom-Json
             foreach ($Std in $StandardsJson) {
                 if ($Std.name -and $Std.label) {
                     $StandardsLabelMap[$Std.name] = $Std.label
                 }
+                if ($Std.name -and $Std.tag) {
+                    # Keep human-readable compliance-framework references (CIS, NIST, etc. - they
+                    # contain spaces) and drop internal single-token tags like 'mip_search_auditlog'.
+                    $FrameworkTags = @($Std.tag | Where-Object { $_ -is [string] -and $_ -match '\s' })
+                    if ($FrameworkTags.Count -gt 0) {
+                        $StandardsTagMap[$Std.name] = ($FrameworkTags -join ', ')
+                    }
+                }
             }
         }
 
@@ -130,6 +139,26 @@ function Invoke-CippTestGenericTest011 {
             return $null
         }
 
+        # Helper: resolve a standard's compliance-framework tags (CIS/NIST/etc.). Template-based
+        # standards (Intune/CA/Quarantine) have no standards.json entry, so they return empty.
+        $ResolveTags = {
+            param($StandardName)
+            if ([string]::IsNullOrWhiteSpace($StandardName)) { return '' }
+            if ($StandardsTagMap.ContainsKey($StandardName)) { return $StandardsTagMap[$StandardName] }
+            return ''
+        }
+
+        # Helper: render a stored CurrentValue/ExpectedValue (plain string, bool, or compact JSON)
+        # safely inside a markdown table cell - escape pipes, collapse newlines, and truncate blobs.
+        $FormatValue = {
+            param($Value)
+            if ($null -eq $Value -or "$Value" -eq '') { return '' }
+            $Text = [string]$Value
+            $Text = $Text -replace '\|', '\|' -replace '\r?\n', ' '
+            if ($Text.Length -gt 300) { $Text = $Text.Substring(0, 297) + '...' }
+            return $Text
+        }
+
         foreach ($Template in $AlignmentItems) {
             $TemplateName = $Template.StandardName
             $Score = $Template.AlignmentScore
@@ -168,24 +197,32 @@ function Invoke-CippTestGenericTest011 {
 
             # Compliant items
             if ($CompliantItems.Count -gt 0) {
-                $null = $Result.Append("| Standard | Status |`n")
-                $null = $Result.Append("|----------|--------|`n")
+                $null = $Result.Append("#### Compliant Standards`n`n")
+                $null = $Result.Append("| Standard | Tags | Status |`n")
+                $null = $Result.Append("|----------|------|--------|`n")
                 foreach ($Item in $CompliantItems) {
                     $FriendlyName = & $ResolveDisplayName $Item.StandardName $TemplateSettings
                     if (-not $FriendlyName) { continue }
-                    $null = $Result.Append("| $FriendlyName | ✅ Compliant |`n")
+                    $Tags = & $ResolveTags $Item.StandardName
+                    $null = $Result.Append("| $FriendlyName | $Tags | ✅ Compliant |`n")
                 }
                 $null = $Result.Append("`n")
             }
 
-            # Non-compliant items
+            # Non-compliant items — include the compliance tags and the reason for failure
+            # (expected value from the standard vs. the current config on the tenant).
             if ($NonCompliantItems.Count -gt 0) {
-                $null = $Result.Append("| Standard | Status |`n")
-                $null = $Result.Append("|----------|--------|`n")
+                $null = $Result.Append("#### Non-Compliant Standards`n`n")
+                $null = $Result.Append("| Standard | Tags | Expected Value | Current Value (on tenant) |`n")
+                $null = $Result.Append("|----------|------|----------------|---------------------------|`n")
                 foreach ($Item in $NonCompliantItems) {
                     $FriendlyName = & $ResolveDisplayName $Item.StandardName $TemplateSettings
                     if (-not $FriendlyName) { continue }
-                    $null = $Result.Append("| $FriendlyName | ❌ Non-Compliant |`n")
+                    $Tags = & $ResolveTags $Item.StandardName
+                    $Expected = & $FormatValue $Item.ExpectedValue
+                    $Current = & $FormatValue $Item.CurrentValue
+                    if (-not $Current) { $Current = '_Not configured / no data_' }
+                    $null = $Result.Append("| $FriendlyName | $Tags | $Expected | $Current |`n")
                 }
                 $null = $Result.Append("`n")
             }
@@ -194,25 +231,27 @@ function Invoke-CippTestGenericTest011 {
             if ($LicenseMissingItems.Count -gt 0) {
                 $null = $Result.Append("#### Standards Not Applied Due to Missing Licenses`n`n")
                 $null = $Result.Append("These items are part of this baseline, but your environment does not meet the minimum required licenses for them to be applied.`n`n")
-                $null = $Result.Append("| Standard | Status |`n")
-                $null = $Result.Append("|----------|--------|`n")
+                $null = $Result.Append("| Standard | Tags | Status |`n")
+                $null = $Result.Append("|----------|------|--------|`n")
                 foreach ($Item in $LicenseMissingItems) {
                     $FriendlyName = & $ResolveDisplayName $Item.StandardName $TemplateSettings
                     if (-not $FriendlyName) { continue }
-                    $null = $Result.Append("| $FriendlyName | ⚠️ License Missing |`n")
+                    $Tags = & $ResolveTags $Item.StandardName
+                    $null = $Result.Append("| $FriendlyName | $Tags | ⚠️ License Missing |`n")
                 }
                 $null = $Result.Append("`n")
             }
 
             # Reporting disabled items
             if ($ReportingDisabledItems.Count -gt 0) {
                 $null = $Result.Append("#### Standards With Reporting Disabled`n`n")
-                $null = $Result.Append("| Standard | Status |`n")
-                $null = $Result.Append("|----------|--------|`n")
+                $null = $Result.Append("| Standard | Tags | Status |`n")
+                $null = $Result.Append("|----------|------|--------|`n")
                 foreach ($Item in $ReportingDisabledItems) {
                     $FriendlyName = & $ResolveDisplayName $Item.StandardName $TemplateSettings
                     if (-not $FriendlyName) { continue }
-                    $null = $Result.Append("| $FriendlyName | ⏸️ Reporting Disabled |`n")
+                    $Tags = & $ResolveTags $Item.StandardName
+                    $null = $Result.Append("| $FriendlyName | $Tags | ⏸️ Reporting Disabled |`n")
                 }
                 $null = $Result.Append("`n")
             }
diff --git a/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 b/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
@@ -32,6 +32,12 @@ function Invoke-HuduExtensionSync {
         # Get Asset cache
         $HuduAssetCache = Get-CippTable -tablename 'CacheHuduAssets'
 
+        # Get Relations cache - Hudu's relations API has no per-company filter, so this is cached
+        # globally and shared across every tenant's sync instead of pulling the full relations
+        # table (30s+ on large instances) on every single sync run.
+        $HuduRelationsCache = Get-CippTable -tablename 'CacheHuduRelations'
+        $HuduRelationsCacheTTLMinutes = 15
+
         # Import license mapping
         $LicTable = [System.IO.File]::ReadAllText((Join-Path $env:CIPPRootPath 'Config\ConversionTable.csv')) | ConvertFrom-Csv
 
@@ -132,7 +138,49 @@ function Invoke-HuduExtensionSync {
             $ExcludeSerials = $DefaultSerials
         }
 
-        $HuduRelations = Get-HuduRelations
+        $RelationsCacheMeta = Get-CIPPAzDataTableEntity @HuduRelationsCache -Filter "PartitionKey eq 'CacheMetadata' and RowKey eq 'LastRefresh'"
+        $RelationsCacheAgeMinutes = if ($RelationsCacheMeta.LastRefresh) { ((Get-Date).ToUniversalTime() - [datetime]$RelationsCacheMeta.LastRefresh).TotalMinutes } else { $null }
+
+        if ($null -ne $RelationsCacheAgeMinutes -and $RelationsCacheAgeMinutes -lt $HuduRelationsCacheTTLMinutes) {
+            $CachedRelationRows = Get-CIPPAzDataTableEntity @HuduRelationsCache -Filter "PartitionKey eq 'HuduRelation'"
+            $HuduRelations = foreach ($CachedRelationRow in $CachedRelationRows) {
+                [PSCustomObject]@{
+                    id            = $CachedRelationRow.RowKey
+                    fromable_type = $CachedRelationRow.FromableType
+                    fromable_id   = $CachedRelationRow.FromableId
+                    toable_type   = $CachedRelationRow.ToableType
+                    toable_id     = $CachedRelationRow.ToableId
+                }
+            }
+        } else {
+            $HuduRelations = Get-HuduRelations
+
+            $ExistingRelationRows = Get-CIPPAzDataTableEntity @HuduRelationsCache -Filter "PartitionKey eq 'HuduRelation'"
+            if ($ExistingRelationRows) {
+                Remove-AzDataTableEntity @HuduRelationsCache -Entity $ExistingRelationRows -Force
+            }
+
+            $RelationEntities = foreach ($Relation in $HuduRelations) {
+                [PSCustomObject]@{
+                    PartitionKey  = 'HuduRelation'
+                    RowKey        = [string]$Relation.id
+                    FromableType  = [string]$Relation.fromable_type
+                    FromableId    = [string]$Relation.fromable_id
+                    ToableType    = [string]$Relation.toable_type
+                    ToableId      = [string]$Relation.toable_id
+                }
+            }
+            if ($RelationEntities) {
+                Add-CIPPAzDataTableEntity @HuduRelationsCache -Entity $RelationEntities -Force
+            }
+
+            $RelationsCacheMetaEntity = [PSCustomObject]@{
+                PartitionKey = 'CacheMetadata'
+                RowKey       = 'LastRefresh'
+                LastRefresh  = (Get-Date).ToUniversalTime().ToString('o')
+            }
+            Add-CIPPAzDataTableEntity @HuduRelationsCache -Entity $RelationsCacheMetaEntity -Force
+        }
         [System.Collections.Generic.List[object]]$Links = @(
             @{
                 Title = 'M365 Admin Portal'
diff --git a/host.json b/host.json
@@ -16,9 +16,9 @@
         "distributedTracingEnabled": false,
         "version": "None"
       },
-      "defaultVersion": "10.5.6",
+      "defaultVersion": "10.5.7",
       "versionMatchStrategy": "Strict",
       "versionFailureStrategy": "Fail"
     }
   }
-}
+}
diff --git a/version_latest.txt b/version_latest.txt
@@ -1 +1 @@
-10.5.6
+10.5.7

Original file line number	Diff line number	Diff line change
`@@ -16,9 +16,9 @@`
`16`	`16`	`"distributedTracingEnabled": false,`
`17`	`17`	`"version": "None"`
`18`	`18`	`},`
`19`		`- "defaultVersion": "10.5.6",`
	`19`	`+ "defaultVersion": "10.5.7",`
`20`	`20`	`"versionMatchStrategy": "Strict",`
`21`	`21`	`"versionFailureStrategy": "Fail"`
`22`	`22`	`}`
`23`	`23`	`}`
`24`		`-}`
	`24`	`+}`