diff --git a/src/Backend/AutopilotMonitor.Functions.Tests/AutopilotDeviceValidationAccessCheckTests.cs b/src/Backend/AutopilotMonitor.Functions.Tests/AutopilotDeviceValidationAccessCheckTests.cs new file mode 100644 index 00000000..eb788ed8 --- /dev/null +++ b/src/Backend/AutopilotMonitor.Functions.Tests/AutopilotDeviceValidationAccessCheckTests.cs @@ -0,0 +1,70 @@ +using System.Collections.Generic; +using AutopilotMonitor.Functions.Functions.Admin; +using AutopilotMonitor.Functions.Services.GraphResolution; +using AutopilotMonitor.Shared.Models.Graph; +using Xunit; + +namespace AutopilotMonitor.Functions.Tests; + +/// +/// Covers the reconcile decision behind the access-check probe +/// () — the +/// "rights-less admin" path where the multi-tenant app was pre-approved by someone else. +/// The HTTP entry point itself is intentionally not exercised (mocking HttpRequestData + +/// the security pipeline is more setup than it's worth, per the project's function-test +/// convention); the security-relevant logic lives in this pure helper. +/// +public class AutopilotDeviceValidationAccessCheckTests +{ + private static GraphPermissionSnapshot Snapshot(bool transient, params string[] roles) + => new GraphPermissionSnapshot + { + GrantedRoles = new HashSet(roles), + IsTransient = transient, + }; + + [Fact] + public void AccessPresent_WhenCoreRoleGranted() + { + var snapshot = Snapshot(false, GraphAppPermissions.DeviceManagementServiceConfigReadAll); + + Assert.True(AutopilotDeviceValidationConsentFunction.ResolveAccessPresent(snapshot)); + } + + [Theory] + [InlineData("devicemanagementserviceconfig.read.all")] + [InlineData("DEVICEMANAGEMENTSERVICECONFIG.READ.ALL")] + public void AccessPresent_IsCaseInsensitive(string roleCasing) + { + // Azure AD may issue the role with slightly different casing across tokens. + var snapshot = Snapshot(false, roleCasing); + + Assert.True(AutopilotDeviceValidationConsentFunction.ResolveAccessPresent(snapshot)); + } + + [Fact] + public void AccessAbsent_WhenRoleMissing() + { + // SP exists / token acquirable, but the core validation role was not consented — + // must NOT report present (would open the gate then 503 the agent forever). + var snapshot = Snapshot(false, GraphAppPermissions.DeviceManagementScriptsReadAll); + + Assert.False(AutopilotDeviceValidationConsentFunction.ResolveAccessPresent(snapshot)); + } + + [Fact] + public void AccessAbsent_WhenNoRolesGranted() + { + Assert.False(AutopilotDeviceValidationConsentFunction.ResolveAccessPresent(Snapshot(false))); + } + + [Fact] + public void AccessAbsent_WhenTransient_EvenIfRolePresent() + { + // Inconclusive probe (timeout / Graph 5xx) must never flip the gate, even if the + // (stale) granted-roles set happens to carry the role. + var snapshot = Snapshot(true, GraphAppPermissions.DeviceManagementServiceConfigReadAll); + + Assert.False(AutopilotDeviceValidationConsentFunction.ResolveAccessPresent(snapshot)); + } +} diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Admin/AutopilotDeviceValidationConsentFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Admin/AutopilotDeviceValidationConsentFunction.cs index 963766ec..6f268e56 100644 --- a/src/Backend/AutopilotMonitor.Functions/Functions/Admin/AutopilotDeviceValidationConsentFunction.cs +++ b/src/Backend/AutopilotMonitor.Functions/Functions/Admin/AutopilotDeviceValidationConsentFunction.cs @@ -1,7 +1,11 @@ +using System.Linq; using System.Net; +using System.Threading; using AutopilotMonitor.Functions.Helpers; using AutopilotMonitor.Functions.Security; using AutopilotMonitor.Functions.Services; +using AutopilotMonitor.Functions.Services.GraphResolution; +using AutopilotMonitor.Shared.Models.Graph; using Microsoft.ApplicationInsights; using Microsoft.Azure.Functions.Worker; using Microsoft.Azure.Functions.Worker.Http; @@ -12,9 +16,18 @@ namespace AutopilotMonitor.Functions.Functions.Admin; public class AutopilotDeviceValidationConsentFunction { + /// + /// Hard wall on the access-check probe's token acquire — the admin click must feel + /// responsive and never get stuck in 's long + /// consent-propagation retry chain (5 + 15 + 30 s). Mirrors + /// GetGraphPermissionsStatusFunction.StatusBudget. + /// + internal static readonly TimeSpan AccessCheckBudget = TimeSpan.FromSeconds(4); + private readonly ILogger _logger; private readonly IConfiguration _configuration; private readonly GraphTokenService _graphTokenService; + private readonly IGraphFeatureDetector _graphFeatureDetector; private readonly TelemetryClient _telemetryClient; private readonly OpsEventService _opsEventService; @@ -33,12 +46,14 @@ public class AutopilotDeviceValidationConsentFunction ILogger logger, IConfiguration configuration, GraphTokenService graphTokenService, + IGraphFeatureDetector graphFeatureDetector, TelemetryClient telemetryClient, OpsEventService opsEventService) { _logger = logger; _configuration = configuration; _graphTokenService = graphTokenService; + _graphFeatureDetector = graphFeatureDetector; _telemetryClient = telemetryClient; _opsEventService = opsEventService; } @@ -146,6 +161,101 @@ public class AutopilotDeviceValidationConsentFunction return response; } + /// + /// GET /api/config/{tenantId}/autopilot-device-validation/access-check — probes whether + /// the Autopilot Monitor service principal already holds the core validation permission + /// () in this tenant, + /// regardless of who granted consent. + /// + /// This is the "rights-less admin" escape hatch: in larger tenants the multi-tenant app is + /// often pre-approved by someone with consent rights, so the app + permission exist even though + /// the admin operating our UI cannot complete the /adminconsent redirect. When this probe + /// reports accessPresent: true, the frontend silently persists + /// ValidateAutopilotDevice/ValidateCorporateIdentifier via the normal config PUT — + /// opening both the UI badge AND the agent hard gate — without ever running the redirect. + /// + /// + /// Read-only: this endpoint never persists. It checks the SP token's roles claim (via + /// ) rather than mere token-acquirability, so we never flip + /// the gate "enabled" when the SP exists but the role was not actually consented (which would + /// otherwise leave the agent stuck in an endless 503 at the real Graph call). + /// + /// + [Function("GetAutopilotDeviceValidationAccessCheck")] + public async Task GetAccessCheck( + [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "config/{tenantId}/autopilot-device-validation/access-check")] HttpRequestData req, + string tenantId) + { + // Authentication + tenant-admin policy enforced by PolicyEnforcementMiddleware + var requestCtx = req.GetRequestContext(); + + // Always read fresh. This probe is admin-triggered (reconcile on consent-fail, the + // "detect existing access" button, post-consent verification) and low-frequency, so a + // stale cached snapshot must never decide it. In particular, a snapshot acquired during + // AAD consent propagation can carry an empty roles claim and would otherwise be cached for + // the token lifetime (~55 min) — wedging the admin out long after consent has propagated. + // Invalidating here makes every click re-acquire from AAD, so a retry always reflects reality. + _graphFeatureDetector.InvalidateTenant(requestCtx.TargetTenantId); + + bool isTransient; + bool accessPresent; + using (var budgetCts = new CancellationTokenSource(AccessCheckBudget)) + { + GraphPermissionSnapshot snapshot; + try + { + snapshot = await _graphFeatureDetector.GetSnapshotAsync(requestCtx.TargetTenantId, budgetCts.Token); + } + catch (OperationCanceledException) + { + snapshot = new GraphPermissionSnapshot { IsTransient = true }; + } + + isTransient = snapshot.IsTransient; + accessPresent = ResolveAccessPresent(snapshot); + } + + _telemetryClient.TrackEvent("ConsentAccessDetected", new Dictionary + { + ["TenantId"] = requestCtx.TargetTenantId, + ["UserId"] = requestCtx.UserPrincipalName, + ["AccessPresent"] = accessPresent.ToString(), + ["IsTransient"] = isTransient.ToString(), + }); + + var response = req.CreateResponse(HttpStatusCode.OK); + await response.WriteAsJsonAsync(new + { + accessPresent, + isTransient, + requiredPermission = GraphAppPermissions.DeviceManagementServiceConfigReadAll, + }); + return response; + } + + /// + /// Pure decision for the access-check probe: does the SP snapshot prove the core validation + /// role is effectively granted? Extracted so the reconcile decision is unit testable without + /// mocking the HTTP pipeline. + /// + /// A transient snapshot is NEVER "present" — we must not flip the agent gate to enabled on an + /// inconclusive probe (timeout / Graph 5xx), or the persisted bool could open the gate while the + /// role is actually absent, leaving the agent stuck in an endless 503 at the real Graph call. + /// Role comparison is case-insensitive: Azure AD may issue the role with slightly different + /// casing across tokens. + /// + /// + internal static bool ResolveAccessPresent(GraphPermissionSnapshot snapshot) + { + if (snapshot == null || snapshot.IsTransient) + { + return false; + } + + return snapshot.GrantedRoles.Any(r => string.Equals( + r, GraphAppPermissions.DeviceManagementServiceConfigReadAll, StringComparison.OrdinalIgnoreCase)); + } + /// /// Known consent triggers — frontend flows that initiate the AAD admin-consent dialog. /// "device-preparation" is reserved for a future DevPrep-specific consent flow; it is diff --git a/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs b/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs index 529ad815..61bc43e0 100644 --- a/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs +++ b/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs @@ -223,6 +223,7 @@ public static class EndpointAccessPolicyCatalog new("GET", "config/{tenantId}/autopilot-device-validation/consent-status", EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam), new("POST", "config/{tenantId}/autopilot-device-validation/consent-failure", EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam), new("POST", "config/{tenantId}/autopilot-device-validation/consent-success", EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam), + new("GET", "config/{tenantId}/autopilot-device-validation/access-check", EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam), new("POST", "config/{tenantId}/test-notification", EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam), // ── Graph add-on permissions ──────────────────────────────────────── diff --git a/src/Shared/AutopilotMonitor.Shared/Models/Graph/GraphAppPermissions.cs b/src/Shared/AutopilotMonitor.Shared/Models/Graph/GraphAppPermissions.cs index 4c25e876..7b867f82 100644 --- a/src/Shared/AutopilotMonitor.Shared/Models/Graph/GraphAppPermissions.cs +++ b/src/Shared/AutopilotMonitor.Shared/Models/Graph/GraphAppPermissions.cs @@ -7,6 +7,16 @@ namespace AutopilotMonitor.Shared.Models.Graph /// public static class GraphAppPermissions { + /// + /// Core enrollment device-validation permission. Required to read + /// windowsAutopilotDeviceIdentities (Autopilot Device Validation) and + /// importedDeviceIdentities (Corporate Identifier Validation). Part of the + /// publisher manifest's default-consent set — present in the SP's token roles + /// claim once admin consent has been granted by anyone in the tenant. Used by the + /// access-check probe to silently reconcile pre-approved consent. + /// + public const string DeviceManagementServiceConfigReadAll = "DeviceManagementServiceConfig.Read.All"; + /// Read display names + file names of Intune device management scripts (Platform Scripts + Remediations). public const string DeviceManagementScriptsReadAll = "DeviceManagementScripts.Read.All"; diff --git a/src/Web/autopilot-monitor-web/app/settings/TenantConfigContext.tsx b/src/Web/autopilot-monitor-web/app/settings/TenantConfigContext.tsx index b52fd857..34dd6091 100644 --- a/src/Web/autopilot-monitor-web/app/settings/TenantConfigContext.tsx +++ b/src/Web/autopilot-monitor-web/app/settings/TenantConfigContext.tsx @@ -8,6 +8,22 @@ import { useNotifications } from "../../contexts/NotificationContext"; import { api } from "@/lib/api"; import { authenticatedFetch, TokenExpiredError } from "@/lib/authenticatedFetch"; import { trackEvent } from "@/lib/appInsights"; +import { classifyAccessCheck, type AccessCheckOutcome, type AccessCheckPayload } from "@/lib/accessCheck"; + +type ValidationTrigger = "autopilot" | "corporate" | "device-preparation"; + +// Human label for a validation trigger. +const validationLabel = (t: ValidationTrigger) => + t === "corporate" ? "Corporate Identifier Validation" + : t === "device-preparation" ? "DevPrep Device Association Validation" + : "Autopilot Device Validation"; + +// Enable-confirmation suffix. DevPrep is shadow-mode (no hard gate), so its wording differs +// from the agent-gating validations. +const validationEnabledSuffix = (t: ValidationTrigger) => + t === "device-preparation" + ? " enabled (shadow mode — does not block enrollment)." + : " enabled. Backend agent endpoints are now unlocked for this tenant."; import { parseSasExpiry } from "./components/DiagnosticsSection"; import { TenantConfiguration, TenantAdmin, DiagnosticsLogPath } from "./types"; import { type BootstrapSessionItem } from "./components/BootstrapSessionsSection"; @@ -48,6 +64,12 @@ interface TenantConfigContextValue { handleToggleDeviceAssociationValidation: (newValue: boolean) => Promise; autopilotConsentInProgress: boolean; beginDeviceValidationConsentFlow: (trigger: "autopilot" | "corporate" | "device-preparation") => Promise; + /** + * Probe whether the multi-tenant app is already pre-approved in this tenant (by someone with + * consent rights) and, if so, enable validation without running the /adminconsent redirect — + * the "rights-less admin" escape hatch. + */ + detectExistingAccess: (trigger: "autopilot" | "corporate" | "device-preparation") => Promise; // Hardware whitelist manufacturerWhitelist: string; @@ -579,8 +601,8 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } // ----------------------------------------------------------------------- // Save configuration (shared by all sections) // ----------------------------------------------------------------------- - const saveConfiguration = useCallback(async (sectionName: string, overrides?: { validateAutopilotDevice?: boolean; validateCorporateIdentifier?: boolean; validateDeviceAssociation?: boolean }) => { - if (!tenantId || !config) return; + const saveConfiguration = useCallback(async (sectionName: string, overrides?: { validateAutopilotDevice?: boolean; validateCorporateIdentifier?: boolean; validateDeviceAssociation?: boolean }): Promise => { + if (!tenantId || !config) return false; try { setSavingSection(sectionName); @@ -672,6 +694,7 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } trackEvent("settings_saved", { section: sectionName }); setSuccessMessage("Configuration saved successfully!"); setTimeout(() => setSuccessMessage(null), 3000); + return true; } catch (err) { if (err instanceof TokenExpiredError) { addNotification('error', 'Session Expired', err.message, 'session-expired-error'); @@ -680,6 +703,7 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } trackEvent("settings_error", { action: "save", section: sectionName, error: msg }); setError(msg); } + return false; } finally { setSavingSection(null); } @@ -702,6 +726,59 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } // ----------------------------------------------------------------------- // Consent flow // ----------------------------------------------------------------------- + + // Probe-only: fetch the access-check and classify it. No persistence, no messaging. + // A non-ok response or thrown error (except token-expiry) is treated as "transient" (retryable), + // never "absent" — we must not conclude "no access" from an inconclusive probe. + const probeAccessCheck = useCallback(async (): Promise => { + if (!tenantId) return "absent"; + + let ok = false; + let payload: AccessCheckPayload | undefined; + try { + const response = await authenticatedFetch(api.config.autopilotAccessCheck(tenantId), getAccessToken); + ok = response.ok; + if (ok) payload = await response.json(); + } catch (err) { + if (err instanceof TokenExpiredError) throw err; + return "transient"; + } + return classifyAccessCheck(ok, payload); + }, [tenantId, getAccessToken]); + + // Persist the validation gate bool for a trigger via the shared config PUT. Returns true ONLY + // on a confirmed server persist — saveConfiguration reports failure as false (and sets the + // error). Callers MUST NOT claim success without checking this, or the admin sees "enabled" + // while the gate bool never landed. Message is caller-owned (reconcile vs normal-consent differ). + const persistValidation = useCallback( + async (trigger: ValidationTrigger): Promise => { + if (trigger === "corporate") return saveConfiguration("autopilotValidation", { validateCorporateIdentifier: true }); + if (trigger === "device-preparation") return saveConfiguration("autopilotValidation", { validateDeviceAssociation: true }); + return saveConfiguration("autopilotValidation", { validateAutopilotDevice: true }); + }, + [saveConfiguration], + ); + + // Rights-less-admin reconcile: probe whether the app's core validation permission is already + // effectively granted in this tenant (pre-approved by someone with consent rights). If so, + // persist the gate bool — opening the UI badge AND the agent hard gate — without ever running + // the /adminconsent redirect the rights-less admin can't complete. Returns "reconciled" + // (enabled), "transient" (inconclusive, retry), "absent" (no access), or "failed" (access + // present but the persist did not land — so callers never show success on a swallowed save error). + const tryReconcilePreApprovedConsent = useCallback( + async (trigger: ValidationTrigger): Promise => { + const outcome = await probeAccessCheck(); + if (outcome !== "reconciled") return outcome; + + const saved = await persistValidation(trigger); + if (!saved) return "failed"; + + setSuccessMessage(`Access is already approved by your organization — ${validationLabel(trigger)}${validationEnabledSuffix(trigger)}`); + return "reconciled"; + }, + [probeAccessCheck, persistValidation], + ); + const beginDeviceValidationConsentFlow = useCallback(async (trigger: "autopilot" | "corporate" | "device-preparation") => { if (!tenantId) return; try { @@ -760,12 +837,6 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } sessionStorage.removeItem("consentTrigger"); if (consentError) { - const errorText = consentErrorDescription - ? `${consentError}: ${decodeURIComponent(consentErrorDescription)}` - : consentError; - setError(`Admin consent failed: ${errorText}`); - setAutopilotConsentInProgress(false); - // Report consent failure to backend for observability — // without this, Azure AD errors (e.g. AADSTS50011 redirect mismatch) // are invisible to our monitoring. @@ -782,6 +853,36 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } // Best-effort — don't block the UI if reporting fails } + // Rights-less-admin path: the redirect may have failed only because THIS admin lacks + // consent rights, while the app is already pre-approved in the tenant. Probe and, if the + // permission is effectively present, silently enable instead of surfacing the error. + try { + const reconcileTrigger: ValidationTrigger = + trigger === "corporate" ? "corporate" : trigger === "device-preparation" ? "device-preparation" : "autopilot"; + const outcome = await tryReconcilePreApprovedConsent(reconcileTrigger); + if (outcome === "reconciled" || outcome === "failed") { + // "reconciled": silently enabled. "failed": access was present but the config persist + // failed — saveConfiguration already surfaced that error; don't overwrite it with the + // (now misleading) consent error. + setAutopilotConsentInProgress(false); + router.replace("/settings/tenant/autopilot"); + return; + } + } catch (err) { + if (err instanceof TokenExpiredError) { + addNotification('error', 'Session Expired', err.message, 'session-expired-error'); + setAutopilotConsentInProgress(false); + router.replace("/settings/tenant/autopilot"); + return; + } + // otherwise fall through to surface the original consent error + } + + const errorText = consentErrorDescription + ? `${consentError}: ${decodeURIComponent(consentErrorDescription)}` + : consentError; + setError(`Admin consent failed: ${errorText}`); + setAutopilotConsentInProgress(false); router.replace("/settings/tenant/autopilot"); return; } @@ -816,12 +917,25 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } // swallow — observability only } - if (trigger === "corporate") { - await saveConfiguration("autopilotValidation", { validateCorporateIdentifier: true }); - setSuccessMessage("Corporate Identifier Validation enabled. Backend agent endpoints are now unlocked for this tenant."); + // Verify the concrete role is present before opening the gate. consent-status only proves + // a token is acquirable (SP provisioned) — NOT that DeviceManagementServiceConfig.Read.All + // is in the roles claim. Persist ONLY on an authoritative "reconciled": a transient probe + // (timeout / Graph 5xx / propagation lag) is inconclusive, so opening the gate on it would + // re-introduce the exact risk this check closes (gate open while the role is unproven). + const reconcileTrigger: ValidationTrigger = + trigger === "corporate" ? "corporate" : trigger === "device-preparation" ? "device-preparation" : "autopilot"; + + const probe = await probeAccessCheck(); + if (probe === "reconciled") { + const saved = await persistValidation(reconcileTrigger); + if (saved) { + setSuccessMessage(`${validationLabel(reconcileTrigger)}${validationEnabledSuffix(reconcileTrigger)}`); + } + } else if (probe === "transient") { + setError("Admin consent succeeded, but the required permission could not be confirmed yet (access is still propagating). Please retry in a moment — toggle the option again or use 'Detect existing access'."); } else { - await saveConfiguration("autopilotValidation", { validateAutopilotDevice: true }); - setSuccessMessage("Autopilot Device Validation enabled. Backend agent endpoints are now unlocked for this tenant."); + // "absent" — consent went through but the role is genuinely not on the app in this tenant. + setError("Admin consent succeeded, but the required permission (DeviceManagementServiceConfig.Read.All) is not granted to the app in this tenant. Ensure it is included when granting consent, then try again."); } router.replace("/settings/tenant/autopilot"); } catch (err) { @@ -836,7 +950,36 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } }; handleConsentCallback(); - }, [tenantId, config, router, getAccessToken, addNotification, saveConfiguration]); + }, [tenantId, config, router, getAccessToken, addNotification, tryReconcilePreApprovedConsent, probeAccessCheck, persistValidation]); + + // Manual "Detect existing access" affordance — for admins who never even attempt the consent + // redirect because they know they lack consent rights. Probes and, on success, enables + // validation silently; otherwise surfaces an actionable message. + const detectExistingAccess = useCallback(async (trigger: ValidationTrigger) => { + if (!tenantId) return; + try { + setAutopilotConsentInProgress(true); + setError(null); + setSuccessMessage(null); + + const outcome = await tryReconcilePreApprovedConsent(trigger); + if (outcome === "transient") { + setError("Couldn't verify access right now (timed out). Please try again in a moment."); + } else if (outcome === "absent") { + setError("No existing access detected for this tenant. Complete admin consent, or ask someone with consent rights (Application or Global Administrator) to approve the app first."); + } + // "reconciled" => success message already set by the helper. + // "failed" => access present but persist failed; saveConfiguration already set the error. + } catch (err) { + if (err instanceof TokenExpiredError) { + addNotification('error', 'Session Expired', err.message, 'session-expired-error'); + } else { + setError(err instanceof Error ? err.message : "Failed to detect existing access"); + } + } finally { + setAutopilotConsentInProgress(false); + } + }, [tenantId, tryReconcilePreApprovedConsent, addNotification]); // ----------------------------------------------------------------------- // Test webhook @@ -1250,7 +1393,7 @@ export function TenantConfigProvider({ children }: { children: React.ReactNode } validateCorporateIdentifier, setValidateCorporateIdentifier, validateDeviceAssociation, setValidateDeviceAssociation, handleToggleDeviceAssociationValidation, - autopilotConsentInProgress, beginDeviceValidationConsentFlow, + autopilotConsentInProgress, beginDeviceValidationConsentFlow, detectExistingAccess, // Hardware whitelist manufacturerWhitelist, setManufacturerWhitelist, diff --git a/src/Web/autopilot-monitor-web/app/settings/components/AutopilotValidationSection.tsx b/src/Web/autopilot-monitor-web/app/settings/components/AutopilotValidationSection.tsx index a7e69907..168a1909 100644 --- a/src/Web/autopilot-monitor-web/app/settings/components/AutopilotValidationSection.tsx +++ b/src/Web/autopilot-monitor-web/app/settings/components/AutopilotValidationSection.tsx @@ -16,6 +16,11 @@ interface AutopilotValidationSectionProps { autopilotConsentInProgress: boolean; saving: boolean; onBeginConsent: (trigger: 'autopilot' | 'corporate' | 'device-preparation') => void; + /** + * Probe for pre-approved consent and enable the given validation without the redirect — for + * admins without consent rights whose tenant already had the app approved by someone else. + */ + onDetectExistingAccess?: (trigger: 'autopilot' | 'corporate' | 'device-preparation') => void | Promise; } export default function AutopilotValidationSection({ @@ -29,6 +34,7 @@ export default function AutopilotValidationSection({ autopilotConsentInProgress, saving, onBeginConsent, + onDetectExistingAccess, }: AutopilotValidationSectionProps) { const anyValidationEnabled = validateAutopilotDevice || validateCorporateIdentifier; const [disableConfirm, setDisableConfirm] = useState<'autopilot' | 'corporate' | null>(null); @@ -66,6 +72,20 @@ export default function AutopilotValidationSection({ setDisableConfirm(null); }; + // Per-validation "detect existing access" affordance — probes for pre-approved consent and + // enables that specific validation without the redirect. Shown under a disabled toggle. + const renderDetectButton = (trigger: 'autopilot' | 'corporate' | 'device-preparation') => + onDetectExistingAccess ? ( + + ) : null; + return (
@@ -89,10 +109,15 @@ export default function AutopilotValidationSection({
-
+

- Both validations require the DeviceManagementServiceConfig.Read.All permission. Enabling either option starts Microsoft Entra admin consent if not already granted. After consent, the setting is saved automatically. Granting consent requires at least the Application Administrator or Global Administrator Entra role. + These validations require the DeviceManagementServiceConfig.Read.All permission. Enabling an option starts Microsoft Entra admin consent if not already granted. After consent, the setting is saved automatically. Granting consent requires at least the Application Administrator or Global Administrator Entra role.

+ {onDetectExistingAccess && ( +

+ Already approved by your organization? In larger tenants the app is often pre-approved by someone with consent rights. If so, use Detect existing access under a disabled option to enable it without running the consent flow. +

+ )}
{/* Windows Autopilot (v1) */} @@ -113,6 +138,7 @@ export default function AutopilotValidationSection({ + {!validateAutopilotDevice && renderDetectButton('autopilot')}
{/* Windows Autopilot Device Preparation (v2) */} @@ -133,6 +159,7 @@ export default function AutopilotValidationSection({ + {!validateCorporateIdentifier && renderDetectButton('corporate')}
{/* DevPrep Device Association — Private Preview, GA-gated, shadow-mode (no enrollment block) */} @@ -160,6 +187,7 @@ export default function AutopilotValidationSection({ + {!validateDeviceAssociation && renderDetectButton('device-preparation')} )} diff --git a/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionAutopilotValidation.tsx b/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionAutopilotValidation.tsx index 06ff7d9a..bfb07a4e 100644 --- a/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionAutopilotValidation.tsx +++ b/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionAutopilotValidation.tsx @@ -13,7 +13,7 @@ export function SectionAutopilotValidation() { validateDeviceAssociation, handleToggleDeviceAssociationValidation, autopilotConsentInProgress, savingSection, - beginDeviceValidationConsentFlow, + beginDeviceValidationConsentFlow, detectExistingAccess, } = useTenantConfig(); const { user, getAccessToken } = useAuth(); @@ -39,6 +39,7 @@ export function SectionAutopilotValidation() { autopilotConsentInProgress={autopilotConsentInProgress} saving={savingSection === "autopilotValidation"} onBeginConsent={beginDeviceValidationConsentFlow} + onDetectExistingAccess={detectExistingAccess} /> diff --git a/src/Web/autopilot-monitor-web/lib/__tests__/accessCheck.test.ts b/src/Web/autopilot-monitor-web/lib/__tests__/accessCheck.test.ts new file mode 100644 index 00000000..4bb8ce07 --- /dev/null +++ b/src/Web/autopilot-monitor-web/lib/__tests__/accessCheck.test.ts @@ -0,0 +1,30 @@ +import { describe, it, expect } from "vitest"; +import { classifyAccessCheck } from "@/lib/accessCheck"; + +describe("classifyAccessCheck", () => { + it("reconciles only when access is authoritatively present", () => { + expect(classifyAccessCheck(true, { accessPresent: true, isTransient: false })).toBe("reconciled"); + }); + + it("treats a non-ok HTTP response as transient (retryable), never absent", () => { + expect(classifyAccessCheck(false, undefined)).toBe("transient"); + }); + + it("treats a transient probe as transient even if accessPresent is (stale) true", () => { + // An inconclusive probe must never flip the gate — guards against opening the agent gate + // on a timeout / Graph 5xx while the role may actually be absent. + expect(classifyAccessCheck(true, { accessPresent: true, isTransient: true })).toBe("transient"); + }); + + it("treats a missing/undefined payload as transient", () => { + expect(classifyAccessCheck(true, undefined)).toBe("transient"); + }); + + it("reports absent when the permission is authoritatively not granted", () => { + expect(classifyAccessCheck(true, { accessPresent: false, isTransient: false })).toBe("absent"); + }); + + it("reports absent when accessPresent is omitted on an authoritative response", () => { + expect(classifyAccessCheck(true, { isTransient: false })).toBe("absent"); + }); +}); diff --git a/src/Web/autopilot-monitor-web/lib/accessCheck.ts b/src/Web/autopilot-monitor-web/lib/accessCheck.ts new file mode 100644 index 00000000..32c9c6d2 --- /dev/null +++ b/src/Web/autopilot-monitor-web/lib/accessCheck.ts @@ -0,0 +1,31 @@ +// Classification for the autopilot-device-validation "access-check" probe — the rights-less +// admin reconcile path where the multi-tenant app was pre-approved by someone else in the tenant. + +export type AccessCheckOutcome = "reconciled" | "transient" | "absent"; + +export interface AccessCheckPayload { + accessPresent?: boolean; + isTransient?: boolean; +} + +/** + * Classifies an access-check probe response into a reconcile outcome. + * + * Security-critical: an inconclusive (transient) or missing-permission (absent) probe must + * NEVER reconcile to "enabled". Reconciling persists the validation gate bool, which opens the + * agent hard gate — if we did that while the role is actually absent, the agent would pass the + * first gate and then get stuck in an endless 503 at the real Graph call. Only an authoritative + * `accessPresent === true` (with `isTransient` falsy) flips to "reconciled". + * + * @param ok whether the HTTP response was ok (non-2xx => transient/retryable, not "absent") + * @param payload parsed JSON body (may be undefined when `ok` is false) + */ +export function classifyAccessCheck( + ok: boolean, + payload: AccessCheckPayload | undefined, +): AccessCheckOutcome { + if (!ok) return "transient"; + if (!payload || payload.isTransient) return "transient"; + if (!payload.accessPresent) return "absent"; + return "reconciled"; +} diff --git a/src/Web/autopilot-monitor-web/lib/api.ts b/src/Web/autopilot-monitor-web/lib/api.ts index a31ed3a9..caea8deb 100644 --- a/src/Web/autopilot-monitor-web/lib/api.ts +++ b/src/Web/autopilot-monitor-web/lib/api.ts @@ -109,6 +109,14 @@ export const api = { `${API_BASE_URL}/api/config/${tenantId}/autopilot-device-validation/consent-failure`, autopilotConsentSuccess: (tenantId: string) => `${API_BASE_URL}/api/config/${tenantId}/autopilot-device-validation/consent-success`, + /** + * Probe whether the app's core validation permission is already effectively granted in + * the tenant (pre-approved by someone with consent rights), so a rights-less admin can be + * enabled without running the failing /adminconsent redirect. Returns + * { accessPresent, isTransient, requiredPermission }. + */ + autopilotAccessCheck: (tenantId: string) => + `${API_BASE_URL}/api/config/${tenantId}/autopilot-device-validation/access-check`, testNotification: (tenantId: string) => `${API_BASE_URL}/api/config/${tenantId}/test-notification`, latestVersions: (opts?: { refresh?: boolean }) =>