Merge pull request #1063 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

.gitignore

@@ -24,3 +24,7 @@ Shared/CIPPSharp/obj/
 !/profile.ps1
 .DS_Store
 proxyman.pem
+
+# Pester test runner artifacts (Invoke-CippTests.ps1 -CI / -Coverage)
+Tests/TestResults.xml
+Tests/coverage.xml

Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1

@@ -234,6 +234,7 @@ function Add-CIPPScheduledTask {
                 Results              = 'Planned'
                 AlertComment         = [string]$task.AlertComment
                 CustomSubject        = [string]$task.CustomSubject
+                PsaTicketStrategy    = [string]($task.PsaTicketStrategy.value ?? $task.PsaTicketStrategy)
             }
 
 

Modules/CIPPCore/Public/Compare-CIPPIntuneAssignments.ps1

@@ -80,7 +80,7 @@ function Compare-CIPPIntuneAssignments {
             $ExpectedGroupIds = @(
                 $ExpectedCustomGroup.Split(',').Trim() | ForEach-Object {
                     $name = $_
-                    $AllGroupsCache | Where-Object { $_.displayName -like $name } | Select-Object -ExpandProperty id
+                    $AllGroupsCache | Where-Object { $_.displayName -like ($name -replace '\[', '`[' -replace '\]', '`]') } | Select-Object -ExpandProperty id
                 } | Where-Object { $_ }
             )
             $MissingIds = @($ExpectedGroupIds | Where-Object { $_ -notin $ExistingIncludeGroupIds })
@@ -97,7 +97,7 @@ function Compare-CIPPIntuneAssignments {
             $ExpectedExcludeIds = @(
                 $ExpectedExcludeGroup.Split(',').Trim() | ForEach-Object {
                     $name = $_
-                    $AllGroupsCache | Where-Object { $_.displayName -like $name } | Select-Object -ExpandProperty id
+                    $AllGroupsCache | Where-Object { $_.displayName -like ($name -replace '\[', '`[' -replace '\]', '`]') } | Select-Object -ExpandProperty id
                 } | Where-Object { $_ }
             )
             $MissingExcludeIds = @($ExpectedExcludeIds | Where-Object { $_ -notin $ExistingExcludeGroupIds })

Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1

@@ -35,7 +35,8 @@ function Compare-CIPPIntuneObject {
             'isSynced'
             'locationInfo',
             'templateId',
-            'source'
+            'source',
+            'package'
         )
 
         $excludeProps = $defaultExcludeProperties + $ExcludeProperties

Modules/CIPPCore/Public/Get-CIPPMSPAppInstallCommand.ps1

@@ -0,0 +1,113 @@
+function Get-CIPPMSPAppInstallCommand {
+    <#
+    .SYNOPSIS
+        Builds the install/uninstall command lines for an MSP RMM app for a single tenant.
+    .DESCRIPTION
+        Shared by Invoke-AddMSPApp (manual/queue deploy) and New-CIPPIntuneAppDeployment
+        (the 'Deploy Intune Application Template' standard). Each parameter value may be:
+          - a flat string, optionally containing %CIPP variables% that resolve per-tenant
+            (Application Template shape), or
+          - an object keyed by tenant customerId (legacy per-tenant deploy shape).
+        Values are resolved for the tenant, run through Get-CIPPTextReplacement so any
+        %variables% are substituted with the tenant's value, then escaped with
+        ConvertTo-CIPPSafePwshArg before being placed on the command line.
+    .PARAMETER RmmName
+        The MSP tool identifier (datto, syncro, Huntress, automate, cwcommand, ninja, NCentral).
+    .PARAMETER Params
+        The params object from the app config / request body.
+    .PARAMETER Tenant
+        The tenant object, requires customerId and defaultDomainName.
+    .PARAMETER PackageName
+        Package name for ninja/NCentral installs (not stored under params).
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$RmmName,
+
+        $Params,
+
+        [Parameter(Mandatory = $true)]
+        $Tenant,
+
+        [string]$PackageName
+    )
+
+    $InstallParams = [PSCustomObject]$Params
+
+    # Resolve a raw parameter value for this tenant: pick the per-tenant keyed value when the
+    # value is an object (legacy shape), otherwise use it as-is (template shape), then replace
+    # any %CIPP variables% using the tenant context. Returns the raw (unescaped) string.
+    function Resolve-MSPValue {
+        param($Value)
+        if ($null -eq $Value) { return '' }
+        if ($Value -is [string]) {
+            $Resolved = $Value
+        } elseif ($Value -is [System.Collections.IDictionary]) {
+            $Resolved = [string]$Value[$Tenant.customerId]
+        } elseif ($Value -is [pscustomobject]) {
+            $Resolved = [string]$Value.$($Tenant.customerId)
+        } else {
+            $Resolved = [string]$Value
+        }
+        if ($Resolved -match '%') {
+            $Resolved = Get-CIPPTextReplacement -TenantFilter $Tenant.defaultDomainName -Text $Resolved
+        }
+        return $Resolved
+    }
+
+    $DetectionScriptContent = $null
+
+    switch ($RmmName) {
+        'datto' {
+            $DattoUrl = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.DattoURL)
+            $DattoGuid = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.DattoGUID)
+            $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -URL $DattoUrl -GUID $DattoGuid"
+            $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1'
+        }
+        'ninja' {
+            $NinjaPackage = ConvertTo-CIPPSafePwshArg -Value ([string]$PackageName)
+            $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -InstallParam $NinjaPackage"
+            $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1'
+        }
+        'Huntress' {
+            $HuntressOrgKey = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.Orgkey)
+            $HuntressAccountKey = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.AccountKey)
+            $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -OrgKey $HuntressOrgKey -acctkey $HuntressAccountKey"
+            $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\install.ps1 -Uninstall'
+        }
+        'syncro' {
+            $SyncroUrl = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.ClientURL)
+            $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -URL $SyncroUrl"
+            $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1'
+        }
+        'NCentral' {
+            $NCentralPackage = ConvertTo-CIPPSafePwshArg -Value ([string]$PackageName)
+            $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -InstallParam $NCentralPackage"
+            $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1'
+        }
+        'automate' {
+            $ServerRaw = Resolve-MSPValue $InstallParams.Server
+            $AutomateServer = ConvertTo-CIPPSafePwshArg -Value $ServerRaw
+            $AutomateInstallerToken = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.InstallerToken)
+            $AutomateLocationId = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.LocationID)
+            $installCommandLine = "c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Bypass .\install.ps1 -Server $AutomateServer -InstallerToken $AutomateInstallerToken -LocationID $AutomateLocationId"
+            $uninstallCommandLine = "c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1 -Server $AutomateServer"
+            $DetectionScriptContent = (Get-Content 'AddMSPApp\automate.detection.ps1' -Raw) -replace '##SERVER##', $ServerRaw
+        }
+        'cwcommand' {
+            $CwClientUrl = ConvertTo-CIPPSafePwshArg -Value (Resolve-MSPValue $InstallParams.ClientURL)
+            $installCommandLine = "powershell.exe -ExecutionPolicy Bypass .\install.ps1 -Url $CwClientUrl"
+            $uninstallCommandLine = 'powershell.exe -ExecutionPolicy Bypass .\uninstall.ps1'
+        }
+        default {
+            throw "Unknown MSP app type '$RmmName'"
+        }
+    }
+
+    return [PSCustomObject]@{
+        InstallCommandLine     = $installCommandLine
+        UninstallCommandLine   = $uninstallCommandLine
+        DetectionScriptContent = $DetectionScriptContent
+    }
+}

Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1

@@ -78,6 +78,29 @@ function New-CIPPIntuneAppDeployment {
         }
     }
 
+    # Build IntuneBody from raw config if not pre-built (template/standard path). MSP apps store
+    # only the vendor + params in the template, so build the install command here using the shared
+    # helper, which resolves %CIPP variables% in the params per-tenant.
+    if (-not $IntuneBody -and $AppType -eq 'MSPApp') {
+        $MSPAppName = $AppConfig.MSPAppName ?? $AppConfig.rmmname.value ?? $AppConfig.rmmname
+        if ([string]::IsNullOrWhiteSpace($MSPAppName)) {
+            throw 'MSP app vendor (rmmname) is required for MSP app deployments but was not found in the template config.'
+        }
+        # Ensure the file-loading block below can locate the packaged app files.
+        $AppConfig | Add-Member -NotePropertyName 'MSPAppName' -NotePropertyValue $MSPAppName -Force
+
+        $IntuneBody = Get-Content (Join-Path $env:CIPPRootPath "AddMSPApp\$MSPAppName.app.json") | ConvertFrom-Json
+        $IntuneBody.displayName = $AppConfig.Applicationname ?? $AppConfig.displayName
+
+        $TenantObj = Get-Tenants -TenantFilter $TenantFilter
+        $CommandResult = Get-CIPPMSPAppInstallCommand -RmmName $MSPAppName -Params $AppConfig.params -Tenant $TenantObj -PackageName $AppConfig.PackageName
+        $IntuneBody.installCommandLine = $CommandResult.InstallCommandLine
+        $IntuneBody.UninstallCommandLine = $CommandResult.UninstallCommandLine
+        if ($CommandResult.DetectionScriptContent) {
+            $IntuneBody.detectionRules[0].scriptContent = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($CommandResult.DetectionScriptContent))
+        }
+    }
+
     # Load files based on app type (only for types that need them)
     $Intunexml = $null
     $Infile = $null

Modules/CIPPCore/Public/Send-CIPPAlert.ps1

@@ -16,6 +16,7 @@ function Send-CIPPAlert {
         $TableName,
         $RowKey = [string][guid]::NewGuid(),
         $Attachments,
+        $AffectedUser,
         [switch]$UseStandardizedSchema
     )
     Write-Information 'Shipping Alert'
@@ -326,21 +327,31 @@ function Send-CIPPAlert {
 
     if ($Type -eq 'psa') {
         Write-Information 'Trying to send to PSA'
-        if ($config.sendtoIntegration) {
-            if ($PSCmdlet.ShouldProcess('PSA', 'Sending alert')) {
-                try {
-                    $Alert = @{
-                        TenantId   = $TenantFilter
-                        AlertText  = "$HTMLContent"
-                        AlertTitle = "$($Title)"
-                    }
-                    New-CippExtAlert -Alert $Alert
-                    Write-LogMessage -API 'Webhook Alerts' -tenant $TenantFilter -message "Sent PSA alert $title" -sev info
-                } catch {
-                    $ErrorMessage = Get-CippException -Exception $_
-                    Write-Information "Could not send alerts to ticketing system: $($ErrorMessage.NormalizedError)"
-                    Write-LogMessage -API 'Webhook Alerts' -tenant $TenantFilter -message "Could not send alerts to ticketing system: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        if (-not $config.sendtoIntegration) {
+            Write-Information 'PSA delivery skipped: sendtoIntegration is disabled in CippNotifications config. Enable it under Settings -> Notifications to route alerts to your PSA.'
+            return
+        }
+        if ($PSCmdlet.ShouldProcess('PSA', 'Sending alert')) {
+            try {
+                $Alert = @{
+                    TenantId   = $TenantFilter
+                    AlertText  = "$HTMLContent"
+                    AlertTitle = "$($Title)"
+                }
+                if ($AffectedUser) {
+                    $Alert.AffectedUser = $AffectedUser
+                    $UserLabel = if ($AffectedUser.UPN) { $AffectedUser.UPN } elseif ($AffectedUser.AzureOID) { "OID:$($AffectedUser.AzureOID)" } else { 'unknown' }
+                    Write-Information "PSA alert AffectedUser: $UserLabel"
+                }
+                $PsaResult = New-CippExtAlert -Alert $Alert
+                if ($PsaResult) {
+                    Write-Information "PSA result: $PsaResult"
                 }
+                Write-LogMessage -API 'Webhook Alerts' -tenant $TenantFilter -message "Sent PSA alert $title" -sev info
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-Information "Could not send alerts to ticketing system: $($ErrorMessage.NormalizedError)"
+                Write-LogMessage -API 'Webhook Alerts' -tenant $TenantFilter -message "Could not send alerts to ticketing system: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
             }
         }
     }

Modules/CIPPCore/Public/Send-CIPPScheduledTaskAlert.ps1

@@ -146,7 +146,65 @@ function Send-CIPPScheduledTaskAlert {
         # Send to configured alert targets
         switch -wildcard ($TaskInfo.PostExecution) {
             '*psa*' {
-                Send-CIPPAlert -Type 'psa' -Title $title -HTMLContent $HTML -TenantFilter $TenantFilter
+                $PsaSplitSent = $false
+                if ($TaskType -eq 'Alert' -and $Results -is [array] -and $Results.Count -gt 0 -and $Results[0] -isnot [string]) {
+                    try {
+                        $ExtConfigTable = Get-CIPPTable -TableName Extensionsconfig
+                        $ExtConfig = (Get-CIPPAzDataTableEntity @ExtConfigTable).config | ConvertFrom-Json -ErrorAction SilentlyContinue
+                        $HaloConfig = $ExtConfig.HaloPSA
+
+                        # Per-task PsaTicketStrategy (configured on the alert) overrides the global
+                        # HaloPSA.LinkTicketsToUsers toggle. Lets MSPs decide on a per-alert basis
+                        # whether a wide alert (e.g. "users without MFA") should produce one ticket
+                        # per user or one consolidated ticket per tenant.
+                        $TaskStrategy = $TaskInfo.PsaTicketStrategy
+                        $ShouldSplit = switch ($TaskStrategy) {
+                            'split' { $true }
+                            'consolidated' { $false }
+                            default { [bool]$HaloConfig.LinkTicketsToUsers }
+                        }
+
+                        if ($HaloConfig -and $HaloConfig.Enabled -and $ShouldSplit) {
+                            $UpnFieldCandidates = @('UserPrincipalName', 'userPrincipalName', 'UPN', 'userId', 'Userkey')
+                            $RowProperties = $Results[0].PSObject.Properties.Name
+                            $UpnField = $UpnFieldCandidates | Where-Object { $_ -in $RowProperties } | Select-Object -First 1
+
+                            if ($UpnField) {
+                                $DisplayFieldCandidates = @('DisplayName', 'displayName', 'userDisplayName')
+                                $DisplayField = $DisplayFieldCandidates | Where-Object { $_ -in $RowProperties } | Select-Object -First 1
+
+                                $Groups = $Results | Group-Object -Property $UpnField
+
+                                foreach ($Group in $Groups) {
+                                    $GroupKey = $Group.Name
+                                    $GroupHTMLFragment = $Group.Group | ConvertTo-Html -Fragment
+                                    $GroupHTML = $GroupHTMLFragment -replace '<table>', "This alert is for tenant $TenantFilter. <br /><br /> $TableDesign<table class=adaptiveTable>" | Out-String
+
+                                    if ([string]::IsNullOrWhiteSpace($GroupKey)) {
+                                        # Rows without a usable user identifier - send as a single tenant-scoped ticket.
+                                        Send-CIPPAlert -Type 'psa' -Title $title -HTMLContent $GroupHTML -TenantFilter $TenantFilter
+                                    } else {
+                                        $GroupDisplayName = if ($DisplayField) { $Group.Group[0].$DisplayField } else { $null }
+                                        $UserLabel = if ($GroupDisplayName) { "$GroupDisplayName ($GroupKey)" } else { $GroupKey }
+                                        $UserTitle = "$title - $UserLabel"
+                                        $AffectedUser = [pscustomobject]@{
+                                            UPN         = $GroupKey
+                                            DisplayName = $GroupDisplayName
+                                        }
+                                        Send-CIPPAlert -Type 'psa' -Title $UserTitle -HTMLContent $GroupHTML -TenantFilter $TenantFilter -AffectedUser $AffectedUser
+                                    }
+                                }
+                                $PsaSplitSent = $true
+                            }
+                        }
+                    } catch {
+                        Write-Information "Failed to split PSA alert by user, falling back to consolidated ticket: $($_.Exception.Message)"
+                    }
+                }
+
+                if (-not $PsaSplitSent) {
+                    Send-CIPPAlert -Type 'psa' -Title $title -HTMLContent $HTML -TenantFilter $TenantFilter
+                }
             }
             '*email*' {
                 $EmailParams = @{

Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1

@@ -114,7 +114,7 @@ function Set-CIPPAssignedApplication {
                     $resolvedGroupIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999&$select=id,displayName' -tenantid $TenantFilter | ForEach-Object {
                         $Group = $_
                         foreach ($SingleName in $GroupNames) {
-                            if ($Group.displayName -like $SingleName) {
+                            if ($Group.displayName -like ($SingleName -replace '\[', '`[' -replace '\]', '`]')) {
                                 $Group.id
                             }
                         }
@@ -161,7 +161,7 @@ function Set-CIPPAssignedApplication {
                 $ResolvedExcludeIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999&$select=id,displayName' -tenantid $TenantFilter | ForEach-Object {
                     $Group = $_
                     foreach ($SingleName in $ExcludeGroupNames) {
-                        if ($Group.displayName -like $SingleName) {
+                        if ($Group.displayName -like ($SingleName -replace '\[', '`[' -replace '\]', '`]')) {
                             $Group.id
                         }
                     }

Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1

@@ -89,7 +89,7 @@ function Set-CIPPAssignedPolicy {
                     $resolvedGroupIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$select=id,displayName&$top=999' -tenantid $TenantFilter |
                         ForEach-Object {
                             foreach ($SingleName in $GroupNames) {
-                                if ($_.displayName -like $SingleName) {
+                                if ($_.displayName -like ($SingleName -replace '\[', '`[' -replace '\]', '`]')) {
                                     $_.id
                                 }
                             }
@@ -129,7 +129,7 @@ function Set-CIPPAssignedPolicy {
                 $ResolvedExcludeIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$select=id,displayName&$top=999' -tenantid $TenantFilter |
                     ForEach-Object {
                         foreach ($SingleName in $ExcludeGroupNames) {
-                            if ($_.displayName -like $SingleName) {
+                            if ($_.displayName -like ($SingleName -replace '\[', '`[' -replace '\]', '`]')) {
                                 $_.id
                             }
                         }