4 Commits

Author	SHA1	Message	Date
Oliver Kieselbach	e214e8dc1a	feat(scripts): -Features All meta-value grants every optional permission at once ... All is a script-side convenience that expands to every GraphFeatureCatalog feature (works with -Revoke too). The catalog sync test now pins All in the ValidateSet while keeping it out of the catalog comparison, and the admin UI mentions the shorthand next to the generated grant command. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-21 18:32:48 +02:00
Oliver Kieselbach	c9701301ea	feat(scripts): Cloud Shell ambient-identity sign-in for Grant-AutopilotMonitorAddOn ... Try Connect-MgGraph -Identity first (Azure Cloud Shell issues a delegated token for the signed-in admin, avoiding the device-code flow that Conditional Access commonly blocks), probe Graph readability, and fall back to interactive sign-in with explicit scopes otherwise. The AppRoleAssignment.ReadWrite.All scope guard now applies only to the interactive path, since ambient-identity tokens carry a fixed scope set. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-21 18:24:31 +02:00
Oliver Kieselbach	1c5f69a9fe	w365: CloudPc device validator — cert-CN-bound fallback for Cloud PCs (#127) ... * w365: CloudPc device validator — cert-CN-bound fallback for Cloud PCs Windows 365 Cloud PCs are never Autopilot-registered, so the serial lookup (and the Corporate Identifier fallback) structurally reject them and Cloud PC first-connect enrollment could not be monitored. New stage-3 fallback in the device-validation chain: extract the Intune device id from the chain-validated MDM client certificate's Subject CN (field-verified: CN == managedDevice id == cloudPC.managedDeviceId) and require a matching cloudPC object in the claimed tenant (Graph v1.0 virtualEndpoint/cloudPCs, $filter=managedDeviceId eq). Only service-provisioned Cloud PCs have such an object — a regular enrolled non-Autopilot device still ends in the 403, and local W365 markers are never consulted for auth. - Shared: ValidatorType.CloudPc = 5, TenantConfiguration.ValidateCloudPcDevice (default false, tenant-admin writable), GraphAppPermissions.CloudPCReadAll, GraphFeatureCatalog feature W365CloudPcValidation -> CloudPC.Read.All - Backend: CloudPcDeviceValidator (AutopilotDeviceValidator sibling contract: 30/5 min cache, 2 attempts, transient->503; GUID gate before the OData filter; exact-match guard; Graph 403 = definitive "grant missing", not transient), SecurityValidator CN extraction + fallback stage + hard gate, wiring through the 5 agent endpoints, TableConfigRepository persistence - Consent script: W365CloudPcValidation in catalog/ValidateSet/help; NEW GraphFeatureCatalogSyncTests pins C# catalog <-> grant script (previously comment-only lock-step) - Bootstrap dev script v2.3-dev.3: guard 4 (uptime window) exempted while the Cloud-PC relax is active — Cloud PCs run headless for days before first connect; the fresh-profile window is the time anchor there (+ Pester tests) - Web: validation toggle + context plumbing, ValidatedBy "CloudPc" label, privacy-page validation claim generalized (Last updated bumped) - Docs: OKF concept doc backend/cloudpc-device-validation.md + index + log Verified: web tsc clean, ESLint 0 errors (99 pre-existing warnings = ratchet cap, none added). .NET build/tests and Pester run in CI — SDK download and pwsh are unavailable in this sandbox's network policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqEFrcAHhWgCvgJgHGzMuv * w365: agent-side IsCloudPc flag + engine expectation "no Device-ESP phase" Companion to the CloudPc validator: the agent now classifies Windows 365 Cloud PCs locally with the bootstrap's field-verified marker AND (HKLM\SOFTWARE\Microsoft\Windows365 key + installed CloudManagedDesktopExtension service, probed via its Services registry key so net48 needs no System.ServiceProcess). SKIP-safe: any error resolves false. Never an auth input - backend admission stays exclusively the cert-CN-bound Graph lookup (ValidatedBy=CloudPc); the two signals are independent and may disagree. Two transport rails: - Session metadata: SessionRegistration.IsCloudPc -> Sessions table (sticky-true OR across re-registrations, IsSelfDeployingProfile pattern) -> SessionsIndex full mirror -> SessionSummary -> new isCloudPc search filter end to end (SearchSessions + QueryRawSessions + pagination fingerprint + all three in-memory predicates; MCP search_sessions / query_raw_sessions params + summary projection; web type, Cloud PC pill, SessionInfoCard enrollment label, CSV export appended column). - Decision engine: isCloudPc rides the EnrollmentFactsObserved payload, recorded set-once for BOTH values in EnrollmentScenarioObservations.CloudPc and annotates the scenario profile reason cloud_pc_first_connect:no_device_esp_expected - the engine-recorded expectation that Device-ESP already ran headless at provisioning and the session starts at Account Setup. Deliberately reason+observation only: no completion arm depends on DeviceSetup, Mode stays AccountSetup/IME- classified (Classic), EspConfig keeps configured-FirstSync semantics. Positive marker surfaces as cloud_pc_marker in the audit-trail census. Updater idempotency: the cloudPcAnnotates gate keeps the generic v1 reason branch from re-claiming the slot on repeat posts (would bump EvidenceOrdinal every post). Additive-nullable observation - no state schema bump (v4 convention), serializer roundtrip pinned. Tests: CloudPcDetector resolver (marker AND, throwing probe), registration body, facts-signal payload shape, updater annotation/idempotency/ self-deploying interplay, reducer observation both values + census fold, serializer roundtrip, index projection superset, sticky-true both directions. Suites: DecisionCore 500, Functions 3941, Agent V2 2154, vitest 632 - all green; tsc web+MCP clean; ESLint 0 errors (cap 99). Docs: cloudpc-device-validation.md follow-up section replaced with the shipped mechanism + log entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-07 12:31:08 +02:00
Oliver Kieselbach	e4c4dd57db	feat(backend,web): optional Graph add-on permissions for Intune script display names ... Adds opt-in resolution of Intune Platform Script + Remediation display names in session timelines via a tenant-side appRoleAssignment grant. No app manifest change, no impact on customers who don't enable it. Architecture is reusable for future optional Graph permissions: catalog -> detector -> resolver -> endpoint. Backend - GraphFeatureDetector parses the `roles` claim from the SP access token and caches the (token, roles) bundle per tenant. GetSnapshotAsync surfaces a transient flag so admin-UI callers can render "unknown" instead of a misleading "0 of 0 granted" when token acquire times out. - GraphTokenService now accepts a CancellationToken so optional-feature callers can apply tight budgets instead of inheriting the 5+15+30 s retry chain. - ScriptDisplayNameResolver: cache-first, list-pull-on-cold-tenant, per-ID fallback. Throttle-aware abort: skip per-ID for kinds whose full-pull hit a transient failure; break the per-ID loop on the first HttpRequestException. Total budget 5 s, with a tight 1.5 s sub-budget on the token acquire. - Azure Table `ScriptNameCache` + direct-TableClient fail-loud repository (mirrors TableOffboardingAuditRepository pattern). Daily ScriptNameCacheCleanupFunction: 7 d positive / 1 h NotFound TTL. - POST /api/tenants/{id}/scripts/display-names (body-carried refs to dodge URL length limits; backend cap 200 refs/request). - GET /api/tenants/{id}/graph-permissions/status (4 s budget; includes app ClientId so the UI can render an exact grant command). - POST /api/tenants/{id}/graph-permissions/refresh (invalidates token cache). - All three routes registered in EndpointAccessPolicyCatalog (MemberRead for the resolve, TenantAdminOrGA for the admin-UI surfaces). Web - `useScriptDisplayNames` hook with stable refset fingerprint (no spurious refetches on parent re-renders); clears stale map on tenant/refset change so a session switch never leaks names across tenants. - Chunked POST loop: 200-ref batches with partial-success semantics. Preserves earlier chunks when later ones fail (non-2xx OR transport throw); only TokenExpiredError propagates so auth flow can react. - ScriptExecutions renders " . {DisplayName}" alongside existing label/short-id, keyed by Kind + policyId so Platform/Remediation under the same id never collide. - New Settings section "Optional Graph capabilities": status table with granted / not granted / unknown, copy-paste PS one-liner with ClientId baked in, refresh button gated on response.ok. Customer-facing - scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1: idempotent grant / verify / revoke script. -Features ScriptDisplayNames (high level) or -Permissions ... (admin-UI generated). Pure ASCII for PS 5.1 compat. - docs/customer-graph-add-on-permissions.md: end-to-end customer guide covering prerequisites, the appRoleAssignment pattern, and revocation. Tests - 1718 backend xUnit / 364 web vitest. Highlights: JWT roles parsing edge cases; full-pull-429 suppresses per-ID; per-ID-429 breaks loop; transient detection via GetSnapshotAsync; chunked partial success (HTTP failure + thrown transport); TokenExpiredError propagation; EndpointPolicyCatalogCompleteness covers the three new routes by reflection. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-19 01:14:21 +02:00