Merge pull request #960 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

.github/workflows/upload_dev.yml

@@ -21,7 +21,7 @@ jobs:
       # Create version.json with version and commit hash
       - name: Create version.json
         run: |
-          VERSION=$(cat version_latest.txt | tr -d '[:space:]')
+          VERSION=$(cat ./Config/version_latest.txt | tr -d '[:space:]')
           SHORT_SHA="${GITHUB_SHA::7}"
           echo "{\"version\": \"${VERSION}\", \"commit\": \"${SHORT_SHA}\"}" > version.json
 

Modules/CIPPCore/Public/Authentication/New-CIPPAPIConfig.ps1

@@ -76,8 +76,8 @@ function New-CIPPAPIConfig {
 
                 Write-Information 'Creating password'
                 $Step = 'Creating Application Password'
-                $AppManagementPolicy = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy" -AsApp $true -NoAuthCheck $true
-                $PasswordExpirationPolicy =  $AppManagementPolicy.applicationRestrictions.passwordcredentials |
+                $AppManagementPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy' -AsApp $true -NoAuthCheck $true
+                $PasswordExpirationPolicy = $AppManagementPolicy.applicationRestrictions.passwordcredentials |
                     Where-Object { $_.restrictionType -eq 'passwordLifetime' }
                 $PasswordBody = $null
                 if (-not ($PasswordExpirationPolicy.state -eq 'disabled' -or $null -eq $PasswordExpirationPolicy.state)) {
@@ -93,7 +93,9 @@ function New-CIPPAPIConfig {
                         $APIPassword = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($APIApp.id)/addPassword" -AsApp $true -NoAuthCheck $true -type POST -body $PasswordBody -maxRetries 3
                         break
                     } catch {
+                        $ExceptionMessage = $_.Exception.Message
                         $IsNotReplicatedYet = $_.Exception.Message -match "Resource '.*' does not exist or one of its queried reference-property objects are not present"
+                        $IsCredentialPolicyBlocked = $ExceptionMessage -match 'Credential type not allowed as per assigned policy'
                         if ($IsNotReplicatedYet -and $Attempt -lt 6) {
                             $DelaySeconds = 3
                             Write-Information "Application object not yet replicated for addPassword (attempt $Attempt of 6). Retrying in $DelaySeconds second(s)."
@@ -105,6 +107,14 @@ function New-CIPPAPIConfig {
                             }
                             continue
                         }
+
+                        if ($IsCredentialPolicyBlocked -and $Attempt -lt 6) {
+                            $DelaySeconds = [Math]::Min(30, 5 * $Attempt)
+                            Write-Information "Credential policy still blocks addPassword (attempt $Attempt of 6). Waiting for policy propagation and retrying in $DelaySeconds second(s)."
+                            Start-Sleep -Seconds $DelaySeconds
+                            continue
+                        }
+
                         throw
                     }
                 }
@@ -167,7 +177,7 @@ function New-CIPPAPIConfig {
                         } catch {
                             if ($Attempt -lt 6) {
                                 Start-Sleep -Seconds 3
-                                 Write-Information "Retrying service principal creation for AppId $($APIApp.appId) (attempt $Attempt of 6) after failure: $($_.Exception.Message)"
+                                Write-Information "Retrying service principal creation for AppId $($APIApp.appId) (attempt $Attempt of 6) after failure: $($_.Exception.Message)"
                                 continue
                             }
                             throw

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1

@@ -29,6 +29,7 @@ function Invoke-ExecApiClient {
             }
         }
         'AddUpdate' {
+            $Results = [System.Collections.Generic.List[object]]::new()
             if ($Request.Body.ClientId -or $Request.Body.AppName) {
                 $ClientId = $Request.Body.ClientId.value ?? $Request.Body.ClientId
                 $AddUpdateSuccess = $false
@@ -75,21 +76,25 @@ function Invoke-ExecApiClient {
                 }
             }
 
+            $IPValidationErrors = [System.Collections.Generic.List[string]]::new()
             if ($Request.Body.IpRange.value) {
                 $IpRange = [System.Collections.Generic.List[string]]::new()
                 $regexPattern = '^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:/\d{1,2})?|(?:[0-9A-Fa-f]{1,4}:){1,7}[0-9A-Fa-f]{1,4}(?:/\d{1,3})?)$'
                 foreach ($IP in @($Request.Body.IPRange.value)) {
+                    $IP = $IP.Trim()
                     if ($IP -match $regexPattern) {
                         $IpRange.Add($IP)
+                    } else {
+                        $IPValidationErrors.Add("'$IP' is not a valid IP address or CIDR range.")
                     }
                 }
             } else {
                 $IpRange = @()
             }
 
             if (!$AddUpdateSuccess) {
-                $Body = @{
-                    Results = @($AddedText)
+                if ($AddedText) {
+                    $Results.Add($AddedText)
                 }
             } else {
                 $ExistingClient = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$($ClientId)'"
@@ -100,13 +105,13 @@ function Invoke-ExecApiClient {
                     $Client.Enabled = $Request.Body.Enabled ?? $false
                     Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Updated API client $($Request.Body.ClientId)" -Sev 'Info'
                     if ($APIConfig.ApplicationSecret) {
-                        $Results = @{
-                            resultText = "API client updated and application secret reset for '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the new secret."
-                            copyField  = $APIConfig.ApplicationSecret
-                            state      = 'success'
-                        }
+                        $Results.Add(@{
+                                resultText = "API client updated and application secret reset for '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the new secret."
+                                copyField  = $APIConfig.ApplicationSecret
+                                state      = 'success'
+                            })
                     } else {
-                        $Results = 'API client updated'
+                        $Results.Add('API client updated')
                     }
                 } else {
                     $Client = @{
@@ -117,14 +122,30 @@ function Invoke-ExecApiClient {
                         'IPRange'      = "$(@($IpRange) | ConvertTo-Json -Compress)"
                         'Enabled'      = $Request.Body.Enabled ?? $false
                     }
-                    $Results = @{
-                        resultText = "API Client created with the name '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the secret."
-                        copyField  = $APIConfig.ApplicationSecret
-                        state      = 'success'
-                    }
+                    $Results.Add(@{
+                            resultText = "API Client created with the name '$($Client.AppName)'. Use the Copy to Clipboard button to retrieve the secret."
+                            copyField  = $APIConfig.ApplicationSecret
+                            state      = 'success'
+                        })
                 }
 
                 Add-CIPPAzDataTableEntity @Table -Entity $Client -Force | Out-Null
+            }
+
+            if ($IPValidationErrors.Count -gt 0) {
+                foreach ($ValidationError in $IPValidationErrors) {
+                    $Results.Add(@{
+                            resultText = $ValidationError
+                            state      = 'warning'
+                        })
+                }
+            }
+
+            if (!$AddUpdateSuccess) {
+                $Body = @{
+                    Results = @($Results)
+                }
+            } else {
                 $Body = @($Results)
             }
         }