mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 13:10:13 +00:00
e4c4dd57db
Adds opt-in resolution of Intune Platform Script + Remediation display names in
session timelines via a tenant-side appRoleAssignment grant. No app manifest
change, no impact on customers who don't enable it. Architecture is reusable for
future optional Graph permissions: catalog -> detector -> resolver -> endpoint.
Backend
- GraphFeatureDetector parses the `roles` claim from the SP access token and
caches the (token, roles) bundle per tenant. GetSnapshotAsync surfaces a
transient flag so admin-UI callers can render "unknown" instead of a
misleading "0 of 0 granted" when token acquire times out.
- GraphTokenService now accepts a CancellationToken so optional-feature callers
can apply tight budgets instead of inheriting the 5+15+30 s retry chain.
- ScriptDisplayNameResolver: cache-first, list-pull-on-cold-tenant, per-ID
fallback. Throttle-aware abort: skip per-ID for kinds whose full-pull hit a
transient failure; break the per-ID loop on the first HttpRequestException.
Total budget 5 s, with a tight 1.5 s sub-budget on the token acquire.
- Azure Table `ScriptNameCache` + direct-TableClient fail-loud repository
(mirrors TableOffboardingAuditRepository pattern). Daily
ScriptNameCacheCleanupFunction: 7 d positive / 1 h NotFound TTL.
- POST /api/tenants/{id}/scripts/display-names (body-carried refs to dodge URL
length limits; backend cap 200 refs/request).
- GET /api/tenants/{id}/graph-permissions/status (4 s budget; includes app
ClientId so the UI can render an exact grant command).
- POST /api/tenants/{id}/graph-permissions/refresh (invalidates token cache).
- All three routes registered in EndpointAccessPolicyCatalog (MemberRead for the
resolve, TenantAdminOrGA for the admin-UI surfaces).
Web
- `useScriptDisplayNames` hook with stable refset fingerprint (no spurious
refetches on parent re-renders); clears stale map on tenant/refset change so
a session switch never leaks names across tenants.
- Chunked POST loop: 200-ref batches with partial-success semantics. Preserves
earlier chunks when later ones fail (non-2xx OR transport throw); only
TokenExpiredError propagates so auth flow can react.
- ScriptExecutions renders " . {DisplayName}" alongside existing label/short-id,
keyed by Kind + policyId so Platform/Remediation under the same id never
collide.
- New Settings section "Optional Graph capabilities": status table with granted
/ not granted / unknown, copy-paste PS one-liner with ClientId baked in,
refresh button gated on response.ok.
Customer-facing
- scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1: idempotent
grant / verify / revoke script. -Features ScriptDisplayNames (high level) or
-Permissions ... (admin-UI generated). Pure ASCII for PS 5.1 compat.
- docs/customer-graph-add-on-permissions.md: end-to-end customer guide
covering prerequisites, the appRoleAssignment pattern, and revocation.
Tests
- 1718 backend xUnit / 364 web vitest. Highlights: JWT roles parsing edge
cases; full-pull-429 suppresses per-ID; per-ID-429 breaks loop; transient
detection via GetSnapshotAsync; chunked partial success (HTTP failure + thrown
transport); TokenExpiredError propagation; EndpointPolicyCatalogCompleteness
covers the three new routes by reflection.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
91 lines
3.3 KiB
C#
91 lines
3.3 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.Linq;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Threading;
|
|
using System.Threading.Tasks;
|
|
using AutopilotMonitor.Shared.DataAccess;
|
|
using AutopilotMonitor.Shared.Models.Graph;
|
|
|
|
namespace AutopilotMonitor.Functions.Tests.GraphResolution;
|
|
|
|
/// <summary>
|
|
/// In-memory <see cref="IScriptNameCacheRepository"/> fake. Reusable across PR-B (cleanup
|
|
/// function tests) and PR-C (resolver integration tests).
|
|
/// </summary>
|
|
internal sealed class FakeScriptNameCacheRepository : IScriptNameCacheRepository
|
|
{
|
|
public Dictionary<(string Tenant, ScriptKind Kind, string Id), ScriptDisplayNameEntry> Entries { get; } = new();
|
|
public Dictionary<(string Tenant, ScriptKind Kind), ScriptNameCacheMeta> Meta { get; } = new();
|
|
public List<(string Tenant, ScriptKind Kind, string Id)> DeleteCalls { get; } = new();
|
|
|
|
/// <summary>If non-null, the next Delete call throws this exception (one-shot).</summary>
|
|
public Exception? NextDeleteThrows { get; set; }
|
|
|
|
public Task<IReadOnlyDictionary<ScriptRef, ScriptDisplayNameEntry>> GetManyAsync(
|
|
string tenantId, IReadOnlyCollection<ScriptRef> refs, CancellationToken ct = default)
|
|
{
|
|
var result = new Dictionary<ScriptRef, ScriptDisplayNameEntry>();
|
|
foreach (var r in refs)
|
|
{
|
|
if (Entries.TryGetValue((tenantId, r.Kind, r.Id), out var entry))
|
|
{
|
|
result[r] = entry;
|
|
}
|
|
}
|
|
return Task.FromResult<IReadOnlyDictionary<ScriptRef, ScriptDisplayNameEntry>>(result);
|
|
}
|
|
|
|
public Task UpsertManyAsync(string tenantId, IReadOnlyCollection<ScriptDisplayNameEntry> entries, CancellationToken ct = default)
|
|
{
|
|
foreach (var e in entries)
|
|
{
|
|
Entries[(tenantId, e.Kind, e.ScriptId)] = e;
|
|
}
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
public Task<ScriptNameCacheMeta?> TryGetMetaAsync(string tenantId, ScriptKind kind, CancellationToken ct = default)
|
|
{
|
|
Meta.TryGetValue((tenantId, kind), out var meta);
|
|
return Task.FromResult<ScriptNameCacheMeta?>(meta);
|
|
}
|
|
|
|
public Task UpsertMetaAsync(ScriptNameCacheMeta meta, CancellationToken ct = default)
|
|
{
|
|
Meta[(meta.TenantId, meta.Kind)] = meta;
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
public async IAsyncEnumerable<ScriptDisplayNameEntry> QueryExpiredAsync(
|
|
DateTimeOffset positiveCutoff,
|
|
DateTimeOffset notFoundCutoff,
|
|
[EnumeratorCancellation] CancellationToken ct = default)
|
|
{
|
|
// Snapshot to allow mutation-during-enumeration in tests.
|
|
foreach (var entry in Entries.Values.ToList())
|
|
{
|
|
ct.ThrowIfCancellationRequested();
|
|
var cutoff = entry.IsNotFound ? notFoundCutoff : positiveCutoff;
|
|
if (entry.FetchedAt < cutoff)
|
|
{
|
|
yield return entry;
|
|
}
|
|
await Task.Yield();
|
|
}
|
|
}
|
|
|
|
public Task DeleteAsync(string tenantId, ScriptKind kind, string scriptId, CancellationToken ct = default)
|
|
{
|
|
DeleteCalls.Add((tenantId, kind, scriptId));
|
|
if (NextDeleteThrows != null)
|
|
{
|
|
var ex = NextDeleteThrows;
|
|
NextDeleteThrows = null;
|
|
throw ex;
|
|
}
|
|
Entries.Remove((tenantId, kind, scriptId));
|
|
return Task.CompletedTask;
|
|
}
|
|
}
|