Prevent race conditions for duplicate audit logs

Author: Zacgoose

Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1

@@ -19,6 +19,21 @@ function Invoke-CippWebhookProcessing {
         return
     }
 
+    # Immediately claim this event ID to prevent concurrent workers from processing the same event.
+    # Uses Insert (no -Force) so a 409 conflict means another worker already claimed it.
+    # -ErrorAction Stop ensures non-terminating errors enter the catch block.
+    try {
+        Add-CIPPAzDataTableEntity @AuditLogTable -Entity @{
+            PartitionKey = $TenantFilter
+            RowKey       = $Data.Id
+            Title        = 'Processing'
+            Tenant       = $TenantFilter
+        } -ErrorAction Stop
+    } catch {
+        Write-Host "Audit log $($Data.Id) already claimed by another worker. Skipping."
+        return
+    }
+
     $Tenant = Get-Tenants -IncludeErrors | Where-Object { $_.defaultDomainName -eq $TenantFilter }
     Write-Host "Received data. Our Action List is $($Data.CIPPAction)"
 
@@ -93,15 +108,15 @@ function Invoke-CippWebhookProcessing {
         AlertComment          = $AlertComment
     } | ConvertTo-Json -Depth 15 -Compress
 
-    $CIPPAlert = @{
-        Type         = 'table'
-        Title        = $GenerateJSON.Title
-        JSONContent  = $JsonContent
-        TenantFilter = $TenantFilter
-        TableName    = 'AuditLogs'
+    # Update the sentinel row claimed earlier with full audit log data
+    Add-CIPPAzDataTableEntity @AuditLogTable -Entity @{
+        PartitionKey = $TenantFilter
         RowKey       = $Data.Id
-    }
-    $LogId = Send-CIPPAlert @CIPPAlert
+        Title        = $GenerateJSON.Title
+        Data         = [string]$JsonContent
+        Tenant       = $TenantFilter
+    } -Force
+    $LogId = $Data.Id
 
     $AuditLogLink = '{0}/tenant/administration/audit-logs/log?logId={1}&tenantFilter={2}' -f $CIPPURL, $LogId, $Tenant.defaultDomainName
     $GenerateEmail = New-CIPPAlertTemplate -format 'html' -data $Data -ActionResults $ActionResults -CIPPURL $CIPPURL -Tenant $Tenant.defaultDomainName -AuditLogLink $AuditLogLink -AlertComment $AlertComment