2 Commits

Author	SHA1	Message	Date
Oliver Kieselbach	1c5f69a9fe	w365: CloudPc device validator — cert-CN-bound fallback for Cloud PCs (#127) ... * w365: CloudPc device validator — cert-CN-bound fallback for Cloud PCs Windows 365 Cloud PCs are never Autopilot-registered, so the serial lookup (and the Corporate Identifier fallback) structurally reject them and Cloud PC first-connect enrollment could not be monitored. New stage-3 fallback in the device-validation chain: extract the Intune device id from the chain-validated MDM client certificate's Subject CN (field-verified: CN == managedDevice id == cloudPC.managedDeviceId) and require a matching cloudPC object in the claimed tenant (Graph v1.0 virtualEndpoint/cloudPCs, $filter=managedDeviceId eq). Only service-provisioned Cloud PCs have such an object — a regular enrolled non-Autopilot device still ends in the 403, and local W365 markers are never consulted for auth. - Shared: ValidatorType.CloudPc = 5, TenantConfiguration.ValidateCloudPcDevice (default false, tenant-admin writable), GraphAppPermissions.CloudPCReadAll, GraphFeatureCatalog feature W365CloudPcValidation -> CloudPC.Read.All - Backend: CloudPcDeviceValidator (AutopilotDeviceValidator sibling contract: 30/5 min cache, 2 attempts, transient->503; GUID gate before the OData filter; exact-match guard; Graph 403 = definitive "grant missing", not transient), SecurityValidator CN extraction + fallback stage + hard gate, wiring through the 5 agent endpoints, TableConfigRepository persistence - Consent script: W365CloudPcValidation in catalog/ValidateSet/help; NEW GraphFeatureCatalogSyncTests pins C# catalog <-> grant script (previously comment-only lock-step) - Bootstrap dev script v2.3-dev.3: guard 4 (uptime window) exempted while the Cloud-PC relax is active — Cloud PCs run headless for days before first connect; the fresh-profile window is the time anchor there (+ Pester tests) - Web: validation toggle + context plumbing, ValidatedBy "CloudPc" label, privacy-page validation claim generalized (Last updated bumped) - Docs: OKF concept doc backend/cloudpc-device-validation.md + index + log Verified: web tsc clean, ESLint 0 errors (99 pre-existing warnings = ratchet cap, none added). .NET build/tests and Pester run in CI — SDK download and pwsh are unavailable in this sandbox's network policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqEFrcAHhWgCvgJgHGzMuv * w365: agent-side IsCloudPc flag + engine expectation "no Device-ESP phase" Companion to the CloudPc validator: the agent now classifies Windows 365 Cloud PCs locally with the bootstrap's field-verified marker AND (HKLM\SOFTWARE\Microsoft\Windows365 key + installed CloudManagedDesktopExtension service, probed via its Services registry key so net48 needs no System.ServiceProcess). SKIP-safe: any error resolves false. Never an auth input - backend admission stays exclusively the cert-CN-bound Graph lookup (ValidatedBy=CloudPc); the two signals are independent and may disagree. Two transport rails: - Session metadata: SessionRegistration.IsCloudPc -> Sessions table (sticky-true OR across re-registrations, IsSelfDeployingProfile pattern) -> SessionsIndex full mirror -> SessionSummary -> new isCloudPc search filter end to end (SearchSessions + QueryRawSessions + pagination fingerprint + all three in-memory predicates; MCP search_sessions / query_raw_sessions params + summary projection; web type, Cloud PC pill, SessionInfoCard enrollment label, CSV export appended column). - Decision engine: isCloudPc rides the EnrollmentFactsObserved payload, recorded set-once for BOTH values in EnrollmentScenarioObservations.CloudPc and annotates the scenario profile reason cloud_pc_first_connect:no_device_esp_expected - the engine-recorded expectation that Device-ESP already ran headless at provisioning and the session starts at Account Setup. Deliberately reason+observation only: no completion arm depends on DeviceSetup, Mode stays AccountSetup/IME- classified (Classic), EspConfig keeps configured-FirstSync semantics. Positive marker surfaces as cloud_pc_marker in the audit-trail census. Updater idempotency: the cloudPcAnnotates gate keeps the generic v1 reason branch from re-claiming the slot on repeat posts (would bump EvidenceOrdinal every post). Additive-nullable observation - no state schema bump (v4 convention), serializer roundtrip pinned. Tests: CloudPcDetector resolver (marker AND, throwing probe), registration body, facts-signal payload shape, updater annotation/idempotency/ self-deploying interplay, reducer observation both values + census fold, serializer roundtrip, index projection superset, sticky-true both directions. Suites: DecisionCore 500, Functions 3941, Agent V2 2154, vitest 632 - all green; tsc web+MCP clean; ESLint 0 errors (cap 99). Docs: cloudpc-device-validation.md follow-up section replaced with the shipped mechanism + log entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-07 12:31:08 +02:00
Oliver Kieselbach	e4c4dd57db	feat(backend,web): optional Graph add-on permissions for Intune script display names ... Adds opt-in resolution of Intune Platform Script + Remediation display names in session timelines via a tenant-side appRoleAssignment grant. No app manifest change, no impact on customers who don't enable it. Architecture is reusable for future optional Graph permissions: catalog -> detector -> resolver -> endpoint. Backend - GraphFeatureDetector parses the `roles` claim from the SP access token and caches the (token, roles) bundle per tenant. GetSnapshotAsync surfaces a transient flag so admin-UI callers can render "unknown" instead of a misleading "0 of 0 granted" when token acquire times out. - GraphTokenService now accepts a CancellationToken so optional-feature callers can apply tight budgets instead of inheriting the 5+15+30 s retry chain. - ScriptDisplayNameResolver: cache-first, list-pull-on-cold-tenant, per-ID fallback. Throttle-aware abort: skip per-ID for kinds whose full-pull hit a transient failure; break the per-ID loop on the first HttpRequestException. Total budget 5 s, with a tight 1.5 s sub-budget on the token acquire. - Azure Table `ScriptNameCache` + direct-TableClient fail-loud repository (mirrors TableOffboardingAuditRepository pattern). Daily ScriptNameCacheCleanupFunction: 7 d positive / 1 h NotFound TTL. - POST /api/tenants/{id}/scripts/display-names (body-carried refs to dodge URL length limits; backend cap 200 refs/request). - GET /api/tenants/{id}/graph-permissions/status (4 s budget; includes app ClientId so the UI can render an exact grant command). - POST /api/tenants/{id}/graph-permissions/refresh (invalidates token cache). - All three routes registered in EndpointAccessPolicyCatalog (MemberRead for the resolve, TenantAdminOrGA for the admin-UI surfaces). Web - `useScriptDisplayNames` hook with stable refset fingerprint (no spurious refetches on parent re-renders); clears stale map on tenant/refset change so a session switch never leaks names across tenants. - Chunked POST loop: 200-ref batches with partial-success semantics. Preserves earlier chunks when later ones fail (non-2xx OR transport throw); only TokenExpiredError propagates so auth flow can react. - ScriptExecutions renders " . {DisplayName}" alongside existing label/short-id, keyed by Kind + policyId so Platform/Remediation under the same id never collide. - New Settings section "Optional Graph capabilities": status table with granted / not granted / unknown, copy-paste PS one-liner with ClientId baked in, refresh button gated on response.ok. Customer-facing - scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1: idempotent grant / verify / revoke script. -Features ScriptDisplayNames (high level) or -Permissions ... (admin-UI generated). Pure ASCII for PS 5.1 compat. - docs/customer-graph-add-on-permissions.md: end-to-end customer guide covering prerequisites, the appRoleAssignment pattern, and revocation. Tests - 1718 backend xUnit / 364 web vitest. Highlights: JWT roles parsing edge cases; full-pull-429 suppresses per-ID; per-ID-429 breaks loop; transient detection via GetSnapshotAsync; chunked partial success (HTTP failure + thrown transport); TokenExpiredError propagation; EndpointPolicyCatalogCompleteness covers the three new routes by reflection. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-19 01:14:21 +02:00