Merge pull request #2561 from microsoft/QuickCalLogExceptions

Change Quick Exceptions to be the default

Author: dpaulson45

Calendar/CalLogHelpers/CalLogCSVFunctions.ps1

@@ -589,7 +589,7 @@ function BuildCSV {
     if ($duplicateCount -gt 0) {
         Write-Host -ForegroundColor Yellow "Removed [$duplicateCount] duplicate Calendar Log entries before processing."
     }
-    $script:GCDO = @($dedupedCalLogs)
+    $script:GCDO = $dedupedCalLogs.ToArray()
     $script:MailboxList = @{}
     # Initialize lookup caches to avoid redundant CN resolution across hundreds of log entries
     $script:SMTPAddressCache = @{}

Calendar/CalLogHelpers/CalLogInfoFunctions.ps1

@@ -4,17 +4,29 @@
 <#
 .SYNOPSIS
 Checks if a set of Calendar Logs is from the Organizer.
+
+Modern Sharing can replicate the Organizer's items into a Delegate's mailbox, so a
+positive ResponseType/ExternalSharingMasterId match is not sufficient on its own. When
+an Identity is supplied this function additionally validates that the From / Organizer
+on the qualifying row resolves to the user being analyzed.
 #>
 function SetIsOrganizer {
     param(
-        $CalLogs
+        $CalLogs,
+        [string] $Identity
     )
     [bool] $IsOrganizer = $false
 
     foreach ($CalLog in $CalLogs) {
         if ($CalLog.ItemClass -eq "Ipm.Appointment" -and
             $CalLog.ExternalSharingMasterId -eq "NotFound" -and
             ($CalLog.ResponseType -eq "1" -or $CalLog.ResponseType -eq "Organizer")) {
+
+            if (-not [string]::IsNullOrEmpty($Identity) -and -not (Test-CalLogFromMatchesIdentity -CalLog $CalLog -Identity $Identity)) {
+                Write-Verbose "SetIsOrganizer: ResponseType is Organizer on this row but From does not resolve to [$Identity]. Likely a Modern Sharing copy; skipping."
+                continue
+            }
+
             $IsOrganizer = $true
             Write-Host -ForegroundColor Green "IsOrganizer: [$IsOrganizer]"
             return $IsOrganizer
@@ -24,6 +36,203 @@ function SetIsOrganizer {
     return $IsOrganizer
 }
 
+<#
+.SYNOPSIS
+Returns $true when the raw CalLog's From / Sender / SenderEmailAddress resolves to the
+supplied Identity (SMTP address). Used to confirm that an Organizer-typed row really
+belongs to the user being analyzed, and not a Modern-Sharing copy of someone else's data.
+#>
+function Test-CalLogFromMatchesIdentity {
+    param(
+        $CalLog,
+        [string] $Identity
+    )
+
+    if ([string]::IsNullOrEmpty($Identity)) {
+        return $false
+    }
+
+    $candidates = @()
+    if ($null -ne $CalLog.From) { $candidates += [string]$CalLog.From }
+    if ($null -ne $CalLog.Sender) { $candidates += [string]$CalLog.Sender }
+    if ($null -ne $CalLog.SenderEmailAddress) { $candidates += [string]$CalLog.SenderEmailAddress }
+
+    $identityLocal = ($Identity -split '@')[0]
+
+    foreach ($candidate in $candidates) {
+        if ([string]::IsNullOrEmpty($candidate)) { continue }
+
+        # Try the resolved SMTP first (requires MailboxList to be populated by BuildCSV).
+        if ($null -ne $script:MailboxList -and $script:MailboxList.Count -gt 0) {
+            $resolved = GetSMTPAddress $candidate
+            if (-not [string]::IsNullOrEmpty($resolved) -and
+                [string]::Equals($resolved.Trim(), $Identity.Trim(), [System.StringComparison]::OrdinalIgnoreCase)) {
+                return $true
+            }
+        }
+
+        # Embedded SMTP form: '"Name" <user@contoso.com>'
+        if ($candidate -match '<([^>]+@[^>]+)>') {
+            if ([string]::Equals($Matches[1].Trim(), $Identity.Trim(), [System.StringComparison]::OrdinalIgnoreCase)) {
+                return $true
+            }
+        }
+
+        # Direct SMTP match
+        if ([string]::Equals($candidate.Trim(), $Identity.Trim(), [System.StringComparison]::OrdinalIgnoreCase)) {
+            return $true
+        }
+
+        # Last-resort: the CN often contains the SMTP local-part as a hint.
+        if (-not [string]::IsNullOrEmpty($identityLocal) -and
+            $candidate -match [regex]::Escape($identityLocal)) {
+            return $true
+        }
+    }
+
+    return $false
+}
+
+<#
+.SYNOPSIS
+Classifies the user being analyzed as a Delegate-of-Organizer, Delegate-of-Attendee,
+or Attendee based on the Enhanced CalLogs.
+
+A user is a Delegate when their logs contain a Modern Sharing copy of another mailbox's
+calendar entries (SharedFolderName != 'Not Shared') AND they either (a) take changes on
+those shared rows themselves, or (b) receive Resp.* messages on behalf of the shared
+mailbox owner.
+
+The DelegateForSmtp output is the SMTP of the mailbox the user is delegating for.
+When the meeting Organizer's SMTP matches DelegateForSmtp the user is a Delegate of the
+Organizer; otherwise the user is a Delegate of some Attendee.
+
+This function must be called after BuildCSV has populated $script:EnhancedCalLogs and
+the SMTP lookup caches.
+#>
+function SetDelegateRole {
+    param(
+        [array] $EnhancedCalLogs,
+        [string] $Identity
+    )
+
+    $script:IsDelegateOfOrganizer = $false
+    $script:IsDelegateOfAttendee = $false
+    $script:DelegateForSmtp = $null
+
+    if ($null -eq $EnhancedCalLogs -or $EnhancedCalLogs.Count -eq 0) {
+        return
+    }
+
+    if ($script:IsOrganizer -or $script:IsRoomMB) {
+        return
+    }
+
+    [array] $sharedRows = $EnhancedCalLogs | Where-Object { $_.SharedFolderName -ne 'Not Shared' }
+    if ($sharedRows.Count -eq 0) {
+        Write-Verbose "SetDelegateRole: No Modern Sharing rows for [$Identity]."
+        return
+    }
+
+    # Determine whether the user takes action on the shared rows themselves.
+    [array] $userChangesOnShared = $sharedRows | Where-Object {
+        $_.TriggerAction -in @('Create', 'Update', 'SoftDelete', 'MoveToDeletedItems', 'HardDelete') -and
+        (Test-ResponsibleUserMatchesIdentity -ResponsibleUser $_.ResponsibleUser -SenderSmtp $_.Sender -Identity $Identity)
+    }
+
+    # Resp.* rows that arrived inside the shared folder are the "received all Resp's" signal.
+    [array] $sharedRespRows = $sharedRows | Where-Object { $_.ItemClass -like 'Resp.*' }
+
+    if ($userChangesOnShared.Count -eq 0 -and $sharedRespRows.Count -eq 0) {
+        Write-Verbose "SetDelegateRole: User [$Identity] has Modern Sharing rows but no delegate activity."
+        return
+    }
+
+    # Identify the mailbox the user is delegating for. ReceivedRepresenting is the strongest
+    # signal because it's set by transport when mail is delivered on behalf of someone else.
+    [array] $representingValues = $sharedRows |
+        Where-Object {
+            -not [string]::IsNullOrEmpty($_.ReceivedRepresenting) -and
+            $_.ReceivedRepresenting -ne '-' -and
+            $_.ReceivedRepresenting -ne 'NotFound'
+        } |
+        ForEach-Object { ([string]$_.ReceivedRepresenting).Trim() }
+
+    if ($representingValues.Count -gt 0) {
+        $script:DelegateForSmtp = ($representingValues | Group-Object | Sort-Object Count -Descending | Select-Object -First 1).Name
+    }
+
+    # Determine the meeting Organizer's SMTP (most common From across all appointment rows).
+    $organizerSmtp = Get-MeetingOrganizerSmtp -EnhancedCalLogs $EnhancedCalLogs
+
+    # Fall back to the Organizer SMTP if ReceivedRepresenting was not informative.
+    if ([string]::IsNullOrEmpty($script:DelegateForSmtp)) {
+        $script:DelegateForSmtp = $organizerSmtp
+    }
+
+    if (-not [string]::IsNullOrEmpty($organizerSmtp) -and
+        -not [string]::IsNullOrEmpty($script:DelegateForSmtp) -and
+        [string]::Equals($script:DelegateForSmtp, $organizerSmtp, [System.StringComparison]::OrdinalIgnoreCase)) {
+        $script:IsDelegateOfOrganizer = $true
+        Write-Host -ForegroundColor Magenta "IsDelegateOfOrganizer: [$Identity] is acting as a Delegate of the Organizer [$($script:DelegateForSmtp)]."
+    } else {
+        $script:IsDelegateOfAttendee = $true
+        Write-Host -ForegroundColor Magenta "IsDelegateOfAttendee: [$Identity] is acting as a Delegate of the Attendee [$($script:DelegateForSmtp)]."
+    }
+}
+
+<#
+.SYNOPSIS
+Compares a ResponsibleUser / Sender SMTP value (from EnhancedCalLogs) to the Identity.
+#>
+function Test-ResponsibleUserMatchesIdentity {
+    param(
+        [string] $ResponsibleUser,
+        [string] $SenderSmtp,
+        [string] $Identity
+    )
+
+    if ([string]::IsNullOrEmpty($Identity)) { return $false }
+
+    foreach ($value in @($ResponsibleUser, $SenderSmtp)) {
+        if ([string]::IsNullOrEmpty($value) -or $value -eq '-' -or $value -eq 'NotFound') { continue }
+        if ([string]::Equals($value.Trim(), $Identity.Trim(), [System.StringComparison]::OrdinalIgnoreCase)) {
+            return $true
+        }
+    }
+    return $false
+}
+
+<#
+.SYNOPSIS
+Returns the most-common From SMTP across appointment rows in the Enhanced CalLogs, which
+is treated as the meeting Organizer's SMTP.
+#>
+function Get-MeetingOrganizerSmtp {
+    param(
+        [array] $EnhancedCalLogs
+    )
+
+    if ($null -eq $EnhancedCalLogs -or $EnhancedCalLogs.Count -eq 0) {
+        return $null
+    }
+
+    [array] $appointmentFrom = $EnhancedCalLogs |
+        Where-Object {
+            ($_.ItemClass -eq 'Ipm.Appointment' -or $_.ItemClass -like 'Exception*') -and
+            -not [string]::IsNullOrEmpty($_.From) -and
+            $_.From -ne '-' -and
+            $_.From -ne 'NotFound'
+        } |
+        ForEach-Object { ([string]$_.From).Trim() }
+
+    if ($appointmentFrom.Count -eq 0) {
+        return $null
+    }
+
+    return ($appointmentFrom | Group-Object | Sort-Object Count -Descending | Select-Object -First 1).Name
+}
+
 <#
 .SYNOPSIS
 Checks if a set of Calendar Logs is from a Resource Mailbox.

Calendar/CalLogHelpers/ExceptionCollectionFunctions.ps1

@@ -87,8 +87,8 @@ function Convert-AppointmentRecurrenceBlobToBytes {
 }
 
 function Get-RecentExceptionCutoff {
-    if ($FastExceptions.IsPresent -and -not $AllExceptions.IsPresent) {
-        return (Get-Date).Date.AddMonths(-6)
+    if (-not $ClassicExceptions.IsPresent -and -not $AllExceptions.IsPresent) {
+        return (Get-Date).Date.AddMonths(-3)
     }
 
     return $null
@@ -308,7 +308,7 @@ function CollectExceptionLogsLegacy {
     $ExceptionLogs = $ExceptionLogs | Where-Object { $_.ItemClass -notlike "IPM.Appointment*" }
     $cutoffDate = Get-RecentExceptionCutoff
     if ($null -ne $cutoffDate) {
-        Write-Host -ForegroundColor Yellow "Filtering legacy Exception logs to only keep items with OriginalStartDate in the last 6 months."
+        Write-Host -ForegroundColor Yellow "Filtering legacy Exception logs to only keep items with OriginalStartDate in the last 3 months."
         $ExceptionLogs = FilterExceptionLogsByRecency -ExceptionLogs $ExceptionLogs
     }
 
@@ -335,8 +335,8 @@ function CollectExceptionLogsFast {
 
     $cutoffDate = Get-RecentExceptionCutoff
     if ($null -ne $cutoffDate) {
-        Write-Host -ForegroundColor Cyan "Keeping only Exception dates from the last 6 months: [$($cutoffDate.ToString('yyyy-MM-dd'))] and newer."
-        Write-Host -ForegroundColor Cyan "[$($exceptionDates.Count)] Exception date(s) match the 6 month time frame."
+        Write-Host -ForegroundColor Cyan "Keeping only Exception dates from the last 3 months: [$($cutoffDate.ToString('yyyy-MM-dd'))] and newer."
+        Write-Host -ForegroundColor Cyan "[$($exceptionDates.Count)] Exception date(s) match the 3 month time frame."
     }
 
     if ($exceptionDates.Count -eq 0) {
@@ -372,7 +372,7 @@ function CollectExceptionLogs {
     Write-Verbose "Meeting IsRecurring: $IsRecurring"
 
     if ($IsRecurring) {
-        if ($FastExceptions.IsPresent -and [string]::IsNullOrEmpty($ExceptionDate)) {
+        if (-not $ClassicExceptions.IsPresent -and [string]::IsNullOrEmpty($ExceptionDate)) {
             try {
                 CollectExceptionLogsFast -Identity $Identity -MeetingID $MeetingID
             } catch {