Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev

Author: KelvinTegelaar

.github/copilot-instructions.md

@@ -162,3 +162,44 @@ Detailed PowerShell coding conventions are in `.github/instructions/powershell-c
 - Do not create new Azure Function trigger folders — use the existing five triggers
 - Do not call `Write-Output` in HTTP functions — return an `[HttpResponseContext]` (the outer trigger handles `Push-OutputBinding`)
 - Do not hardcode tenant IDs or secrets — use environment variables and `Get-GraphToken`
+
+## Commit messages
+
+Generate all commit messages in **Conventional Commits** format:
+
+```
+<type>(<optional scope>): <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+**Rules:**
+
+- **Type** is required and must be one of:
+  - `feat` — a new feature
+  - `fix` — a bug fix
+  - `docs` — documentation only
+  - `style` — formatting, whitespace, no code-behavior change
+  - `refactor` — code change that neither fixes a bug nor adds a feature
+  - `perf` — a performance improvement
+  - `test` — adding or correcting tests
+  - `build` — build system or dependency changes
+  - `ci` — CI/CD configuration changes
+  - `chore` — routine maintenance, no production code change
+  - `revert` — reverts a previous commit
+- **Scope** is optional and given in parentheses after the type (e.g. `feat(identity):`). Use a short, lowercase area name when it adds clarity.
+- **Description** is a short, imperative-mood summary ("add", not "added"/"adds"), lowercase, no trailing period, ideally ≤ 72 characters.
+- **Body** (optional) explains the *what* and *why*, not the *how*. Separate it from the description with one blank line.
+- **Breaking changes** are indicated with a `!` before the colon (e.g. `feat!:`) and/or a `BREAKING CHANGE:` footer describing the change.
+- Reference issues/PRs in the footer where relevant (e.g. `Closes #123`).
+
+**Examples:**
+
+```
+feat(identity): add bulk user offboarding endpoint
+fix(graph): handle expired token on retry
+docs: update authentication model overview
+refactor(standards)!: rename remediation parameter
+```

.github/workflows/Conventional_Commits.yml

@@ -0,0 +1,65 @@
+name: Conventional Commits Check
+
+on:
+  # Using pull_request_target instead of pull_request for secure handling of fork PRs
+  pull_request_target:
+    # Re-run on title edits so a corrected title clears the check
+    types: [opened, synchronize, reopened, edited]
+    # Only check PRs targeting the dev branch
+    branches:
+      - dev
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  conventional-commits:
+    name: Validate Conventional Commits
+    runs-on: ubuntu-slim
+    steps:
+      - name: Validate PR title
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const title = context.payload.pull_request.title || '';
+            const pattern = /^(feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert)(\(.+\))?!?: .+/i;
+
+            if (pattern.test(title)) {
+              console.log(`✓ PR title follows Conventional Commits format: "${title}"`);
+              return;
+            }
+
+            console.log(`❌ PR title does not follow Conventional Commits format: "${title}"`);
+
+            const message = [
+              '❌ **This PR title does not follow the [Conventional Commits](https://www.conventionalcommits.org/) format.**',
+              '',
+              'Expected format: `type(scope)?: description`',
+              '',
+              'Allowed types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`, `build`, `revert`',
+              '',
+              'Examples:',
+              '- `feat: add SharePoint external user management`',
+              '- `fix(auth): handle expired refresh tokens`',
+              '- `docs: update self-hosting guide`',
+              '',
+              `Received: \`${title}\``,
+              '',
+              '🔒 This PR has been automatically closed. Please update the title to match the format above and reopen the PR.'
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.issue.number,
+              body: message
+            });
+
+            await github.rest.pulls.update({
+              ...context.repo,
+              pull_number: context.issue.number,
+              state: 'closed'
+            });
+
+            core.setFailed(`PR title does not follow Conventional Commits format: "${title}"`);

Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1

@@ -122,7 +122,7 @@ function Add-CIPPApplicationPermission {
         if (!$svcPrincipalId) { continue }
 
         foreach ($SingleResource in $App.ResourceAccess | Where-Object -Property Type -EQ 'Role') {
-            if ($SingleResource.id -in $CurrentRoles.appRoleId) { continue }
+            if ($CurrentRoles | Where-Object { $_.appRoleId -eq $SingleResource.id -and $_.resourceId -eq $svcPrincipalId.id }) { continue }
             [pscustomobject]@{
                 principalId = $($ourSVCPrincipal.id)
                 resourceId  = $($svcPrincipalId.id)

Modules/CIPPCore/Public/Authentication/Get-CIPPRolePermissions.ps1

@@ -25,7 +25,13 @@ function Get-CIPPRolePermissions {
         try {
             $ValidPermissions = Get-CippHttpPermissions
             if (@($ValidPermissions).Count -gt 0) {
-                $Permissions = @($Permissions | Where-Object { $ValidPermissions -contains $_ })
+                $ValidBases = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+                foreach ($ValidPermission in $ValidPermissions) {
+                    $null = $ValidBases.Add(($ValidPermission -replace '\.(ReadWrite|Read)$', ''))
+                }
+                $Permissions = @($Permissions | Where-Object {
+                        $ValidBases.Contains(($_ -replace '\.(ReadWrite|Read)$', ''))
+                    })
             }
         } catch {
             Write-Warning "Unable to resolve valid permissions to filter role '$RoleName': $($_.Exception.Message)"

Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1

@@ -49,9 +49,13 @@ function Get-CIPPAuthentication {
                 }
             }
 
-            if (-not $env:SAMCertificate) {
-                # First run on this instance: provision the certificate now.
+            if (-not $env:SAMCertificate -and $env:SAMCertProvisionAttempted -ne 'true') {
+                # First run on this instance: provision the certificate now, at most once per
+                # process. The guard also breaks a recursion loop: Update-CIPPSAMCertificate
+                # calls Get-GraphToken, which re-enters this function when the AppCache
+                # ApplicationId does not match the environment.
                 # Set-CIPPSAMCertificate refreshes $env:SAMCertificate on success.
+                $env:SAMCertProvisionAttempted = 'true'
                 Write-Information 'No SAM certificate found, provisioning one now'
                 $CertResult = Update-CIPPSAMCertificate -ErrorAction Stop
                 Write-LogMessage -message "Provisioned SAM certificate during authentication load. Thumbprint: $($CertResult.Thumbprint), storage mode: $($CertResult.StorageMode)" -Sev 'Info' -API 'CIPP Authentication'

Modules/CIPPCore/Public/Get-CippKeyVaultSecret.ps1

@@ -60,6 +60,10 @@ function Get-CippKeyVaultSecret {
                 break
             } catch {
                 $lastError = $_
+                # 404 is definitive - the secret does not exist and retrying cannot change that
+                if ($_.Exception.Message -match '404|SecretNotFound') {
+                    throw "Failed to retrieve secret '$Name' from vault '$VaultName': $($_.Exception.Message)"
+                }
                 if ($i -lt ($maxRetries - 1)) {
                     Start-Sleep -Seconds $retryDelay
                     $retryDelay *= 2  # Exponential backoff

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecDeployAppTemplate.ps1

@@ -51,7 +51,12 @@ function Invoke-ExecDeployAppTemplate {
             try {
                 $Config = $App.config
                 if ($Config -is [string]) {
-                    $Config = $Config | ConvertFrom-Json -Depth 100
+                    # Parse case-sensitive to survive templates carrying both 'applicationName'
+                    # and 'ApplicationName', then collapse them via a case-insensitive dictionary.
+                    $Parsed = $Config | ConvertFrom-Json -Depth 100 -AsHashtable
+                    $Config = [ordered]@{}
+                    foreach ($Key in $Parsed.Keys) { $Config[$Key] = $Parsed[$Key] }
+                    $Config = [PSCustomObject]$Config
                 }
 
                 $AppType = "$($App.appType ?? $App.AppType)"

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1

@@ -22,6 +22,7 @@ function Invoke-ExecCompareIntunePolicy {
         'windowsQualityUpdatePolicies' = 'windowsQualityUpdatePolicies'
         'windowsQualityUpdateProfiles' = 'windowsQualityUpdateProfiles'
         'Intents'                      = 'Intents'
+        'ManagedAppPolicies'           = 'AppProtection'
     }
 
     try {

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1

@@ -225,6 +225,11 @@ function Invoke-ListIntunePolicy {
                     method = 'GET'
                     url    = "/deviceManagement/intents?`$top=1000"
                 }
+                @{
+                    id     = 'ManagedAppPolicies'
+                    method = 'GET'
+                    url    = '/deviceAppManagement/managedAppPolicies?$orderby=displayName'
+                }
             )
 
             $BulkResults = New-GraphBulkRequest -Requests $BulkRequests -tenantid $TenantFilter
@@ -236,6 +241,7 @@ function Invoke-ListIntunePolicy {
                 $URLName = $_.Id
                 $_.body.Value | ForEach-Object {
                     $AssignmentContext = $_.'assignments@odata.context'
+                    $PolicyODataType = $_.'@odata.type'
                     $policyTypeName = switch -Wildcard ($AssignmentContext) {
                         '*microsoft.graph.windowsIdentityProtectionConfiguration*' { 'Identity Protection' }
                         '*microsoft.graph.windows10EndpointProtectionConfiguration*' { 'Endpoint Protection' }
@@ -264,6 +270,14 @@ function Invoke-ListIntunePolicy {
                         $policyTypeName = switch ($URLName) {
                             'deviceCompliancePolicies' { 'Compliance Policy' }
                             'Intents' { 'Endpoint Security' }
+                            'ManagedAppPolicies' {
+                                switch -Wildcard ($PolicyODataType) {
+                                    '*iosManagedAppProtection*' { 'iOS App Protection' }
+                                    '*androidManagedAppProtection*' { 'Android App Protection' }
+                                    '*windowsManagedAppProtection*' { 'Windows App Protection' }
+                                    default { 'App Protection' }
+                                }
+                            }
                             default { $AssignmentContext }
                         }
                     }

Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1

@@ -123,13 +123,15 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
             $BlockedDomainsMatches = $true
         }
         'AllowSpecificExternal' {
-            $AllowedDomainsMatches = -not (Compare-Object -ReferenceObject $AllowedDomainsAsAList -DifferenceObject $CurrentAllowedDomains)
+            # Both lists are already Sort-Object'd; compare as joined strings. Avoids Compare-Object,
+            # whose parameter binder coerces an empty array @() to $null and then throws.
+            $AllowedDomainsMatches = (@($AllowedDomainsAsAList) -join ',') -eq (@($CurrentAllowedDomains) -join ',')
             $BlockedDomainsMatches = (!$CurrentBlockedDomains -or @($CurrentBlockedDomains).Count -eq 0)
         }
         'BlockSpecificExternal' {
             # Allowed should be AllowAllKnownDomains, blocked domains already parsed above
             $AllowedDomainsMatches = $IsCurrentAllowAllKnownDomains
-            $BlockedDomainsMatches = -not (Compare-Object -ReferenceObject $BlockedDomains -DifferenceObject $CurrentBlockedDomains)
+            $BlockedDomainsMatches = (@($BlockedDomains) -join ',') -eq (@($CurrentBlockedDomains) -join ',')
         }
     }