Merge pull request #14 from KelvinTegelaar/dev

pull[bot] · web-flow · commit 101ec621653a · 2026-04-05T05:36:27.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/CIPPCore.psd1 b/Modules/CIPPCore/CIPPCore.psd1
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecAppApprovalTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecAppApprovalTemplate.ps1
@@ -63,6 +63,9 @@ function Push-ExecAppApprovalTemplate {
                     Add-CIPPDelegatedPermission -RequiredResourceAccess $Application.requiredResourceAccess -ApplicationId $App -Tenantfilter $Item.Tenant
                     Add-CIPPApplicationPermission -RequiredResourceAccess $Application.requiredResourceAccess -ApplicationId $App -Tenantfilter $Item.Tenant
                 }
+                if ($TemplateData.IncludeInEnterpriseAppList -and $InstantiateResult.servicePrincipal.id) {
+                    $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/servicePrincipals/$($InstantiateResult.servicePrincipal.id)" -type PATCH -tenantid $Item.Tenant -body '{"tags":["WindowsAzureActiveDirectoryIntegratedApp"]}'
+                }
             } else {
                 Write-LogMessage -message "Gallery Template deployment completed but application ID not returned for $($TemplateData.AppName) in tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add Gallery App' -sev Warning
             }
@@ -121,11 +124,11 @@ function Push-ExecAppApprovalTemplate {
 
                 if ($CreatedApp.appId) {
                     # Create service principal for the application
-                    $ServicePrincipalBody = @{
-                        appId = $CreatedApp.appId
-                    } | ConvertTo-Json
-
-                    $null = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Item.tenant -body $ServicePrincipalBody
+                    $ServicePrincipalBody = @{ appId = $CreatedApp.appId }
+                    if ($TemplateData.IncludeInEnterpriseAppList) {
+                        $ServicePrincipalBody.tags = @('WindowsAzureActiveDirectoryIntegratedApp')
+                    }
+                    $null = New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Item.tenant -body ($ServicePrincipalBody | ConvertTo-Json)
 
                     Write-LogMessage -message "Successfully deployed Application Manifest $($TemplateData.AppName) to tenant $($Item.Tenant). Application ID: $($CreatedApp.appId)" -tenant $Item.Tenant -API 'Add App Manifest' -sev Info
 
@@ -143,13 +146,24 @@ function Push-ExecAppApprovalTemplate {
 
         } else {
             # Handle Enterprise Apps (existing logic)
-            $ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName&`$top=999" -tenantid $Item.Tenant
+            $ServicePrincipalList = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$select=AppId,id,displayName,tags&`$top=999" -tenantid $Item.Tenant
             if ($Item.AppId -notin $ServicePrincipalList.appId) {
                 Write-Information "Adding $($Item.AppId) to tenant $($Item.Tenant)."
-                $PostResults = New-GraphPostRequest 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Item.tenant -body "{ `"appId`": `"$($Item.appId)`" }"
+                $SpBody = [ordered]@{ appId = $Item.appId }
+                if ($TemplateData.IncludeInEnterpriseAppList) {
+                    $SpBody.tags = @('WindowsAzureActiveDirectoryIntegratedApp')
+                }
+                $PostResults = New-GraphPostRequest 'https://graph.microsoft.com/beta/servicePrincipals' -type POST -tenantid $Item.tenant -body ($SpBody | ConvertTo-Json)
                 Write-LogMessage -message "Added $($Item.AppId) to tenant $($Item.Tenant)" -tenant $Item.Tenant -API 'Add Multitenant App' -sev Info
             } else {
                 Write-LogMessage -message "This app already exists in tenant $($Item.Tenant). We're adding the required permissions." -tenant $Item.Tenant -API 'Add Multitenant App' -sev Info
+                if ($TemplateData.IncludeInEnterpriseAppList) {
+                    $ExistingSP = $ServicePrincipalList | Where-Object { $_.appId -eq $Item.AppId }
+                    if ($ExistingSP -and 'WindowsAzureActiveDirectoryIntegratedApp' -notin $ExistingSP.tags) {
+                        $UpdatedTags = @($ExistingSP.tags) + 'WindowsAzureActiveDirectoryIntegratedApp'
+                        $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/servicePrincipals/$($ExistingSP.id)" -type PATCH -tenantid $Item.Tenant -body (@{ tags = $UpdatedTags } | ConvertTo-Json)
+                    }
+                }
             }
             Add-CIPPApplicationPermission -TemplateId $TemplateId -Tenantfilter $Item.Tenant
             Add-CIPPDelegatedPermission -TemplateId $TemplateId -Tenantfilter $Item.Tenant
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1
@@ -25,7 +25,7 @@ function Invoke-ExecBackendURLs {
         }
     }
 
-    $results = [PSCustomObject]@{
+    $results = @{
         ResourceGroup      = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/overview"
         KeyVault           = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.KeyVault/vaults/$($env:WEBSITE_SITE_NAME)/secrets"
         FunctionApp        = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/appServices"
@@ -40,11 +40,12 @@ function Invoke-ExecBackendURLs {
         Hosted             = $env:CIPP_HOSTED -eq 'true' ?? $false
         OS                 = $IsLinux ? 'Linux' : 'Windows'
         SKU                = $env:WEBSITE_SKU
-        Timezone           = $env:WEBSITE_TIME_ZONE ?? 'UTC'
-        BusinessHoursStart = $env:CIPP_BUSINESS_HOURS_START ?? '09:00'
-        BusinessHoursEnd   = $env:CIPP_BUSINESS_HOURS_END ?? '17:00'
     }
 
+    $ConfigTable = Get-CIPPTable -tablename Config
+    $TimeSettings = Get-CIPPAzDataTableEntity @ConfigTable -Filter "PartitionKey eq 'TimeSettings' and RowKey eq 'TimeSettings'"
+    $results.Timezone = $TimeSettings.Timezone ?? 'UTC'
+
 
     $body = @{Results = $Results }
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1
@@ -9,97 +9,36 @@ function Invoke-ExecTimeSettings {
     param($Request, $TriggerMetadata)
 
     try {
-        $Subscription = Get-CIPPAzFunctionAppSubId
-        if ($env:WEBSITE_RESOURCE_GROUP) {
-            $RGName = $env:WEBSITE_RESOURCE_GROUP
-        } else {
-            $Owner = $env:WEBSITE_OWNER_NAME
-            if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
-                $RGName = $Matches.RGName
-            } else {
-                Write-Information "Could not determine resource group from environment variables. Owner: $Owner"
-                $RGName = $null
-            }
-        }
-
-        $FunctionName = $env:WEBSITE_SITE_NAME
         $Timezone = $Request.Body.Timezone.value ?? $Request.Body.Timezone
-        $BusinessHoursStart = $Request.Body.BusinessHoursStart.value ?? $Request.Body.BusinessHoursStart
 
-        # Validate timezone format
         if (-not $Timezone) {
             throw 'Timezone is required'
         }
 
-        if (!$IsLinux) {
-            # Get Timezone standard name for Windows
-            $Timezone = Get-TimeZone -Id $Timezone | Select-Object -ExpandProperty StandardName
-        }
-
-        # Calculate business hours end time (10 hours after start)
-        $BusinessHoursEnd = $null
-        if ($env:WEBSITE_SKU -eq 'FlexConsumption') {
-            if (-not $BusinessHoursStart) {
-                throw 'Business hours start time is required for Flex Consumption plans'
-            }
-
-            # Validate time format (HH:mm)
-            if ($BusinessHoursStart -notmatch '^\d{2}:\d{2}$') {
-                throw 'Business hours start time must be in HH:mm format'
-            }
-
-            # Calculate end time (start + 10 hours)
-            $StartTime = [DateTime]::ParseExact($BusinessHoursStart, 'HH:mm', $null)
-            $EndTime = $StartTime.AddHours(10)
-            $BusinessHoursEnd = $EndTime.ToString('HH:mm')
-        }
-
-        Write-Information "Updating function app time settings: Timezone=$Timezone, BusinessHoursStart=$BusinessHoursStart, BusinessHoursEnd=$BusinessHoursEnd"
-
-        # Build app settings hashtable
-        # Linux Consumption (Dynamic SKU) does not support WEBSITE_TIME_ZONE
-        $IsLinuxConsumption = $IsLinux -and $env:WEBSITE_SKU -ne 'FlexConsumption'
-
-        if ($IsLinuxConsumption) {
-            Write-Information 'Skipping WEBSITE_TIME_ZONE — not supported on Linux Consumption plans'
-            $Results = @{
-                Results = 'Timezone setting is not supported on Linux Consumption function apps. No changes were made.'
-                SKU     = $env:WEBSITE_SKU
-            }
-            return ([HttpResponseContext]@{
-                    StatusCode = [httpstatusCode]::OK
-                    Body       = $Results
-                })
-        }
-
-        $AppSettings = @{
-            'WEBSITE_TIME_ZONE' = $Timezone
+        # Validate the IANA timezone ID is recognised by .NET
+        try {
+            $null = [TimeZoneInfo]::FindSystemTimeZoneById($Timezone)
+        } catch {
+            throw "Invalid timezone: '$Timezone' is not a recognised IANA timezone ID"
         }
 
-        if ($env:WEBSITE_SKU -eq 'FlexConsumption') {
-            $AppSettings['CIPP_BUSINESS_HOURS_START'] = $BusinessHoursStart
-            $AppSettings['CIPP_BUSINESS_HOURS_END'] = $BusinessHoursEnd
+        $Config = @{
+            PartitionKey = 'TimeSettings'
+            RowKey       = 'TimeSettings'
+            Timezone     = $Timezone
         }
 
-        # Update app settings using ARM REST via managed identity
-        Update-CIPPAzFunctionAppSetting -Name $FunctionName -ResourceGroupName $RGName -AppSetting $AppSettings | Out-Null
+        $ConfigTable = Get-CIPPTable -tablename Config
+        Add-CIPPAzDataTableEntity @ConfigTable -Entity $Config -Force | Out-Null
 
-        Write-LogMessage -API 'ExecTimeSettings' -headers $Request.Headers -message "Updated time settings: Timezone=$Timezone, BusinessHours=$BusinessHoursStart-$BusinessHoursEnd" -Sev 'Info'
-
-        $Results = @{
-            Results  = 'Time settings updated successfully. Please note that timezone changes may require a function app restart to take effect.'
-            Timezone = $Timezone
-            SKU      = $env:WEBSITE_SKU
-        }
-
-        if ($env:WEBSITE_SKU -eq 'FlexConsumption') {
-            $Results.BusinessHoursStart = $BusinessHoursStart
-            $Results.BusinessHoursEnd = $BusinessHoursEnd
-        }
+        Write-LogMessage -API 'ExecTimeSettings' -headers $Request.Headers -message "Updated time settings: Timezone=$Timezone" -Sev 'Info'
 
         return ([HttpResponseContext]@{
                 StatusCode = [httpstatusCode]::OK
-                Body       = $Results
+                Body       = @{
+                    Results  = 'Time settings updated successfully.'
+                    Timezone = $Timezone
+                }
             })
 
     } catch {
diff --git a/Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1 b/Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1
@@ -8,6 +8,7 @@ function Invoke-ListLogs {
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
     $Table = Get-CIPPTable
+    $TzId = if ($env:CIPP_TIMEZONE) { $env:CIPP_TIMEZONE } else { 'UTC' }
 
     $TemplatesTable = Get-CIPPTable -tablename 'templates'
     $Templates = Get-CIPPAzDataTableEntity @TemplatesTable
@@ -21,7 +22,8 @@ function Invoke-ListLogs {
         }
     } elseif ($Request.Query.logentryid) {
         # Return single log entry by RowKey
-        $DateFilter = ConvertTo-CIPPODataFilterValue -Value ($Request.Query.DateFilter ?? (Get-Date -UFormat '%Y%m%d')) -Type Date
+        $LocalNow = [TimeZoneInfo]::ConvertTimeBySystemTimeZoneId([DateTime]::UtcNow, $TzId)
+        $DateFilter = ConvertTo-CIPPODataFilterValue -Value ($Request.Query.DateFilter ?? $LocalNow.ToString('yyyyMMdd')) -Type Date
         $SafeLogEntryId = ConvertTo-CIPPODataFilterValue -Value $Request.Query.logentryid -Type Guid
         $Filter = "RowKey eq '{0}' and PartitionKey eq '{1}'" -f $SafeLogEntryId, $DateFilter
         $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList
@@ -99,11 +101,11 @@ function Invoke-ListLogs {
             } elseif ($StartDate) {
                 $Filter = "PartitionKey eq '{0}'" -f $StartDate
             } else {
-                $Filter = "PartitionKey eq '{0}'" -f (Get-Date -UFormat '%Y%m%d')
+                $Filter = "PartitionKey eq '{0}'" -f [TimeZoneInfo]::ConvertTimeBySystemTimeZoneId([DateTime]::UtcNow, $TzId).ToString('yyyyMMdd')
             }
         } else {
             $LogLevel = 'Info', 'Warn', 'Warning', 'Error', 'Critical', 'Alert'
-            $PartitionKey = Get-Date -UFormat '%Y%m%d'
+            $PartitionKey = [TimeZoneInfo]::ConvertTimeBySystemTimeZoneId([DateTime]::UtcNow, $TzId).ToString('yyyyMMdd')
             $username = '*'
             $TenantFilter = $null
             $Filter = "PartitionKey eq '{0}'" -f $PartitionKey
diff --git a/Modules/CIPPCore/Public/Get-CIPPTimerFunctions.ps1 b/Modules/CIPPCore/Public/Get-CIPPTimerFunctions.ps1
@@ -8,6 +8,20 @@ function Get-CIPPTimerFunctions {
     $ConfigTable = Get-CIPPTable -tablename Config
     $Config = Get-CIPPAzDataTableEntity @ConfigTable -Filter "PartitionKey eq 'OffloadFunctions' and RowKey eq 'OffloadFunctions'"
 
+    $TimeSettings = Get-CIPPAzDataTableEntity @ConfigTable -Filter "PartitionKey eq 'TimeSettings' and RowKey eq 'TimeSettings'"
+    $ScheduleTimeZone = [TimeZoneInfo]::Utc
+    if ($TimeSettings.Timezone) {
+        try {
+            $ScheduleTimeZone = [TimeZoneInfo]::FindSystemTimeZoneById($TimeSettings.Timezone)
+            Write-Information "Timezone: $($TimeSettings.Timezone)"
+        } catch {
+            Write-Warning "Invalid timezone '$($TimeSettings.Timezone)' in TimeSettings config, falling back to UTC"
+            $ScheduleTimeZone = [TimeZoneInfo]::Utc
+        }
+    } else {
+        Write-Information 'Timezone: UTC (default) - no timezone specified in TimeSettings config'
+    }
+
     # Check running nodes
     $VersionTable = Get-CIPPTable -tablename 'Version'
     $Nodes = Get-CIPPAzDataTableEntity @VersionTable -Filter "PartitionKey eq 'Version' and RowKey ne 'Version' and RowKey ne 'frontend'"
@@ -32,10 +46,10 @@ function Get-CIPPTimerFunctions {
 
     $CIPPCoreModuleRoot = Get-Module -Name CIPPCore | Select-Object -ExpandProperty ModuleBase
 
-    if (!('NCronTab.Advanced.CrontabSchedule' -as [type])) {
+    if (!('Cronos.CronExpression' -as [type])) {
         try {
-            $NCronTab = Join-Path -Path $CIPPCoreModuleRoot -ChildPath 'lib\NCrontab.Advanced.dll'
-            Add-Type -Path $NCronTab
+            $Cronos = Join-Path -Path $CIPPCoreModuleRoot -ChildPath 'lib\Cronos.dll'
+            Add-Type -Path $Cronos
         } catch {}
     }
 
@@ -77,9 +91,9 @@ function Get-CIPPTimerFunctions {
 
             $CronCount = ($CronString -split ' ' | Measure-Object).Count
             if ($CronCount -eq 5) {
-                $Cron = [Ncrontab.Advanced.CrontabSchedule]::Parse($CronString)
+                $Cron = [Cronos.CronExpression]::Parse($CronString)
             } elseif ($CronCount -eq 6) {
-                $Cron = [Ncrontab.Advanced.CrontabSchedule]::Parse($CronString, [Ncrontab.Advanced.Enumerations.CronStringFormat]::WithSeconds)
+                $Cron = [Cronos.CronExpression]::Parse($CronString, [Cronos.CronFormat]::IncludeSeconds)
             } else {
                 Write-Warning "Invalid cron expression for $($Orchestrator.Command): $($Orchestrator.Cron)"
                 continue
@@ -95,15 +109,15 @@ function Get-CIPPTimerFunctions {
                 }
             }
 
-            $Now = Get-Date
+            $Now = [DateTime]::UtcNow
             if ($ListAllTasks.IsPresent) {
-                $NextOccurrence = [datetime]$Cron.GetNextOccurrence($Now)
+                $NextOccurrence = $Cron.GetNextOccurrence($Now, $ScheduleTimeZone)
             } else {
-                $NextOccurrences = $Cron.GetNextOccurrences($Now.AddMinutes(-15), $Now.AddMinutes(15))
+                $NextOccurrences = $Cron.GetOccurrences($Now.AddMinutes(-15), $Now.AddMinutes(15), $ScheduleTimeZone)
                 if (!$Status -or $Status.LastOccurrence -eq 'Never') {
-                    $NextOccurrence = $NextOccurrences | Where-Object { $_ -le (Get-Date) } | Select-Object -First 1
+                    $NextOccurrence = $NextOccurrences | Where-Object { $_ -le [DateTime]::UtcNow } | Select-Object -First 1
                 } else {
-                    $NextOccurrence = $NextOccurrences | Where-Object { $_ -gt $Status.LastOccurrence.DateTime.ToLocalTime() -and $_ -le (Get-Date) } | Select-Object -First 1
+                    $NextOccurrence = $NextOccurrences | Where-Object { $_ -gt $Status.LastOccurrence.DateTime.ToUniversalTime() -and $_ -le [DateTime]::UtcNow } | Select-Object -First 1
                 }
             }
 
diff --git a/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 b/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1
@@ -44,7 +44,9 @@ function Write-LogMessage {
     if ($sev -eq 'Debug' -and $env:DebugMode -ne $true) {
         return
     }
-    $PartitionKey = (Get-Date -UFormat '%Y%m%d').ToString()
+    $TzId = if ($env:CIPP_TIMEZONE) { $env:CIPP_TIMEZONE } else { 'UTC' }
+    $LocalNow = [TimeZoneInfo]::ConvertTimeBySystemTimeZoneId([DateTime]::UtcNow, $TzId)
+    $PartitionKey = $LocalNow.ToString('yyyyMMdd')
     $TableRow = @{
         'Tenant'       = [string]$tenant
         'API'          = [string]$API
diff --git a/Modules/CIPPCore/lib/Cronos.dll b/Modules/CIPPCore/lib/Cronos.dll
diff --git a/Modules/CIPPCore/lib/NCrontab.Advanced.dll b/Modules/CIPPCore/lib/NCrontab.Advanced.dll
diff --git a/profile.ps1 b/profile.ps1
@@ -140,9 +140,13 @@ if (!$LastStartup -or $CurrentVersion -ne $LastStartup.Version) {
         Write-LogMessage -message 'Failed to clear durables after update' -LogData (Get-CippException -Exception $_) -Sev 'Error'
     }
 
-    $ReleaseTable = Get-CippTable -tablename 'cacheGitHubReleaseNotes'
-    Remove-AzDataTableEntity @ReleaseTable -Entity @{ PartitionKey = 'GitHubReleaseNotes'; RowKey = 'GitHubReleaseNotes' } -ErrorAction SilentlyContinue
-    Write-Debug 'Cleared GitHub release notes cache to force refresh on version update.'
+    try {
+        $ReleaseTable = Get-CippTable -tablename 'cacheGitHubReleaseNotes'
+        Remove-AzDataTableEntity @ReleaseTable -Entity @{ PartitionKey = 'GitHubReleaseNotes'; RowKey = 'GitHubReleaseNotes' } -ErrorAction SilentlyContinue
+        Write-Debug 'Cleared GitHub release notes cache to force refresh on version update.'
+    } catch {
+        Write-Debug -Message 'Failed to clear GitHub release notes cache after update' -LogData (Get-CippException -Exception $_) -Sev 'Error'
+    }
 }
 $SwVersion.Stop()
 $Timings['VersionCheck'] = $SwVersion.Elapsed.TotalMilliseconds
@@ -152,6 +156,26 @@ if ($env:AzureWebJobsStorage -ne 'UseDevelopmentStorage=true' -and $env:NonLocal
     Set-CIPPOffloadFunctionTriggers
 }
 
+$SwTimezone = [System.Diagnostics.Stopwatch]::StartNew()
+try {
+    $TimeSettingsTable = Get-CIPPTable -tablename Config
+    $TimeSettings = Get-CIPPAzDataTableEntity @TimeSettingsTable -Filter "PartitionKey eq 'TimeSettings' and RowKey eq 'TimeSettings'"
+    if ($TimeSettings.Timezone) {
+        # Validate before storing
+        $null = [TimeZoneInfo]::FindSystemTimeZoneById($TimeSettings.Timezone)
+        $env:CIPP_TIMEZONE = $TimeSettings.Timezone
+        Write-Information "Timezone: $($TimeSettings.Timezone)"
+    } else {
+        $env:CIPP_TIMEZONE = 'UTC'
+        Write-Information 'Timezone: UTC (default)'
+    }
+} catch {
+    $env:CIPP_TIMEZONE = 'UTC'
+    Write-Warning "Failed to load timezone from config, defaulting to UTC: $($_.Exception.Message)"
+}
+$SwTimezone.Stop()
+$Timings['Timezone'] = $SwTimezone.Elapsed.TotalMilliseconds
+
 $TotalStopwatch.Stop()
 $Timings['Total'] = $TotalStopwatch.Elapsed.TotalMilliseconds
 
