Dev to release - #352
Merged
Merged
Conversation
fix(frontend): fix side-nav SwipeableDrawer bugs on mobile
card lists gain a per-session toggle to the real MRT table with whatever columns the page shows; the table toolbar carries a return button. the toggle never persists; refresh resets to the tableViewMode preference. phone table chrome is rebuilt around one shared bottom sheet: page actions move into the actions fab, bulk actions into the table header, and the sheet (opened from a kebab labeled Table options on both bars) carries data source controls, presets, fields shown, export, refresh and rows-per-page. the footer slims to range plus prev/next below md (mrt wraps a full footer under its 720px pivot), and narrow viewports size the table's scroll viewport from measurement (container position plus footer height, scroll reset on flip) so desktop-tuned maxHeightOffset numbers cannot stack a second scrollbar on phones. filter and search state now lives in CippDataTable rather than the toolbar: the cards and table branches mount alternating toolbar instances, and toolbar-local state plus mount effects previously wiped graph filters, column changes, preset highlights and bulk selection on every flip. pages pass dataSourceControls (live/cached + sync) as its own prop; desktop renders it in the card header, phones only in the sheet. card view renders on the same Card surface as the table path (overflow visible keeps the controls bar sticky), and the card bar adopts the desktop toolbar's tonal primitives, extracted to toolbar-primitives.js. also adds tableViewMode to the preferences save allowlist; it was silently unsaveable since it shipped.
feat(mobile): session toggle between card view and the full table
Tenant default domains are single unbreakable tokens that exceeded phone-width cards, pushing the status pill off the right edge. Fixes by adding `overflowWrap: anywhere` and `minWidth: 0` to the task name, and `flexShrink: 0` + `whiteSpace: nowrap` to the status pill. Updates the Storybook story to use realistic long tenant domain names and adds a phone-viewport play test that asserts the pill stays within the drawer bounds.
…lert Adds an optional display name separator setting. When configured, CIPP protects both the full display name and the part before the separator. This supports display names such as "John Doe | Contoso", while also matching "John Doe". Signed-off-by: Corsw <108132302+Corsw@users.noreply.github.com>
Check for the default branding localization before creating it, and treat only the known object-conflict race as a recovered informational condition. Keep unexpected creation failures at error severity and cover the behavior with Pester tests.
fix(mobile): cards->table toggle scroll and mobile nav drawer surface
Custom roles are now canonically defined by PermissionRules ({Include, Exclude}
-like glob arrays, same semantics as base roles in cipp-roles.json) and expanded
against the live permission universe at read time, so wildcard roles automatically
cover endpoints added in later releases. The flat Permissions map remains as a
fail-safe snapshot for older backends. Legacy roles migrate losslessly to
concrete-string rules (in memory on read, persisted by the roles list action).
The role editor gains a Simple/Advanced toggle: simple mode is an include/exclude
pattern builder with per-rule live match counts, zero-match warnings, grouped
pattern autocomplete, an effective-permissions preview, and an automatic
CIPP.Core.Read guard. Advanced mode still edits the per-category grid and now
emits concrete-string rules on save. Also fixes the frontend matchPattern bug
(only the first wildcard was expanded and dots were unescaped).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Allows superadmins to impersonate any role to preview CIPP as that role sees it. - Backend: `Resolve-CippImpersonation` validates and swaps the user context before all access checks; audit logged once per worker per user+role pair - Frontend: `impersonation.js` manages state in localStorage, injects `x-cipp-impersonate-role` header on every API call, and busts the Craft cache via `_imp` query param - `CippImpersonationBanner` renders a fixed warning bar with an Exit button that clears caches and reloads - Impersonate action added to the Roles table (superadmins only, superadmin role excluded) - Pester tests for `Resolve-CippImpersonation`; Vitest tests for `impersonation.js`
Build assigned license choices from the full user dataset so licenses beyond the table heuristic sample remain selectable. Closes #281
Move role impersonation logic into Get-CIPPAccessRole so all downstream authorization checks (API client grants, Sherweb, alerts, domain health, etc.) consistently see the impersonated role, matching the behavior of Test-CIPPAccess.
Replace the flat permission list in the rule expansion panel with collapsible accordions. Each permission entry now shows the count of API endpoints it covers and can be expanded to reveal each endpoint's name and description. ReadWrite grants also surface the Read endpoints when Read is not separately matched.
Filter out null/empty values and deduplicate roles when combining derived and user roles to prevent issues with duplicate or empty role entries.
fix(mobile): flex wrapping on configuration-backup
Move role impersonation resolution to after the IP range check so that impersonated roles' IP restrictions never apply to the superadmin. This prevents the superadmin from being locked out of the UI when simulating a role with narrow IP allowlists. Also render the impersonation banner on the unauthenticated page so users can exit impersonation if the simulated role causes a /me failure, and update the confirmation text to clarify IP restrictions are not simulated.
Enhances the role impersonation confirmation dialog with an Alert explaining that simulation tests a single role in isolation, and that custom roles are restrictive rather than additive when combined with base roles.
A stale /me message without a SWA identity was hiding the sign-in prompt. Now the server explanation is only shown when clientPrincipal is present, ensuring unauthenticated users see the sign-in page instead.
- Add TemplateList field and descriptions to TemplateGuid/TemplateID clarifying GUID resolution behavior - Add PermissionRules object schema to role management endpoint - Update field sources for intune template list response fields - Add new /api/ListPartnerTenantInfo endpoint schema
Move refresh, export, and reset actions above the 'Fields shown' column list in the mobile filter sheet. Since the field list can be a dozen rows, placing utilities first reduces scrolling for the most common actions. Adds a test to assert the DOM order.
Severity words like 'High', 'Medium', 'Critical' are ambiguous without context on mobile cards. Add a MUTE_ALONE set so those chips get a field-name caption, matching the existing behavior for bare booleans. Also register 'risk' and 'result' as STATUS_FIELDS so they land in the chips row rather than the detail grid.
On mobile, the three permission report buttons rendered as a full-width banner wall before any content. They now live in the page-actions FAB sheet as list rows, consistent with other sheet actions. Also fixes the FAB close selector to include `[role='button']` (ListItemButton renders as a div), so dialogs opened from the sheet aren't stacked underneath it. Additional polish: embedded card lists drop unnecessary padding/chrome, settings pages remove top padding on mobile (TabbedLayout handles spacing), and the tab picker gets a corrected top gap.
Signed-off-by: jonwbstr <jon.wbstr@gmail.com>
…ink-to-SharePoint-Portal feat: Add SharePoint Portal link to Hudu Magic Dash
…dash-to-purview-portal fix: Update Compliance Portal URL to Purview link
- Added `Add-CIPPGroupOwner` and `Remove-CIPPGroupOwner` functions for managing group ownership. - Introduced `Get-CIPPGroupType` function to classify groups based on their type. - Updated `Add-CIPPGroupMember` and `Remove-CIPPGroupMember` functions to improve identity resolution and error handling. - Implemented `Resolve-CIPPDirectoryId` for resolving directory identities to Graph object IDs. - Created `Invoke-ExecGroupMembers` as an entry point for managing group members and owners through a unified API. These changes enhance the overall functionality and usability of group management within the CIPP module.
- Improved `Invoke-EditGroup` function to better handle owner additions and removals with enhanced identity resolution. - Updated `CippApiDialog` to integrate CSV field handling and nested value resolution. - Introduced `CippDataTableButton` and `CippTableCardButton` components for improved action handling in data tables. - Added sub-table functionality in `CippDataTable` for displaying members and owners with dynamic API integration. - Refactored `CIPPTableToptoolbar` to support parent row attachment for bulk actions. These changes enhance the usability and functionality of group management and data display within the CIPP module.
Keep the built-in Outlook report-button state separate from the optional custom destination rule in the comparison payload, and cover enabled, custom-destination, and disabled configurations. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
fix(standards): clarify UserSubmissions drift rule state
Signed-off-by: KelvinTegelaar <49186168+KelvinTegelaar@users.noreply.github.com>
Feat: Quarantine overhaul with enhanced message details and actions
The Settings hint named only Microsoft 365 and Entra as the portal links always written to the Magic Dash card. Exchange, Intune, Teams and Azure were already always included, and SharePoint was added in 86c7aaf. Name each one as it renders on the card. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The Show Members and Show Owners buttons were replaced by Members and Owners columns that open the group's list in a dialog, so the Action Buttons section documented two buttons that no longer exist. - Rewrite Action Buttons to cover Add Group and Deploy Group Template - Add Members and Owners rows to Table Details, and drop the stale paragraph about expansion columns and the centrally covered Tenant and Cache Timestamp columns - Add a Members and Owners section covering both dialogs: their columns, row actions with bulk availability, and the Add Members and Add Owners buttons Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add drive-level requeue handling with a persisted RequeueCount so mid-scan throttling resumes from the saved checkpoint instead of restarting or incorrectly completing a drive; stop requeuing after 6 attempts and then fail normally. Also switch principal-mode baseline detection to the dominant PrincipalCount from the first items page (instead of root permissions), preventing inflated root ACL counts from flagging entire libraries; extend resume tests to cover both baseline derivation and throttle requeue/budget behavior.
The quarantine route gained child routes for the Files and Teams Messages tabs, so the flat page has moved to a section README and each tab now has its own page, matching the route path the in-app documentation link is built from. - move quarantine.md to quarantine/README.md and cover the Email tab - add quarantine/files.md and quarantine/teams.md for the reduced action set those tabs offer - correct the flyout section: it opens from More Info, not a row click, and it now lists the URLs and Attachments sections - reorder Table Actions to match the row menu, and document Block Sender, Download Message, View Message Headers and Submit to Microsoft - add the three SUMMARY.md nav entries Renaming quarantine.md changes its published URL, so existing links and bookmarks to /user-documentation/email/administration/quarantine.md will need to follow the new path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The Status action now returns the 50 most recent version transitions instead of 25, and the Update History card renders them in a CippDataTable (sortable, searchable, exportable) rather than a property list. RecordedAt is registered as a datetime column so it renders as relative time like other tables.
A logical queue operation can span several orchestrator runs carrying the same QueueId suffix: activities re-queue continuation runs (the sharing scan's timebox and throttle resumes) and dispatch child orchestrations. Get-CIPPQueueData returned one entry per run and callers took the first, so a progress tracker read Completed the moment the original run's own tasks finished and stopped polling while resumed work was still running. Queue and reference lookups now roll the whole chain up: task counts sum across runs, and the status stays Running while any chained run is active.
The job queue stats row now shows the Skipped count (stale queue entries whose task was gone by dispatch time - benign, so never flagged red) and the status filter gains a Skipped toggle. Each job row gets a More Info off-canvas with the fields the table does not show: id, started and completed times, and the last error. QueuedUtc/StartedUtc/CompletedUtc are registered as absolute-date columns, and the absolute-date formatter now returns a rendered string instead of a raw Date when the caller accepts nodes - an off-canvas containing any absolute-date field crashed React before this.
…/github/codeql-action-4.37.7 chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7
…end/dev/react-dropzone-20.0.0 chore(deps): bump react-dropzone from 15.0.0 to 20.0.0 in /frontend
…end/dev/storybook-10.5.7 chore(deps-dev): bump storybook from 10.3.5 to 10.5.7 in /frontend
…end/dev/tiptap/starter-kit-3.29.2 chore(deps): bump @tiptap/starter-kit from 3.20.5 to 3.29.2 in /frontend
feat(standards): add TAP lifetime and length configuration
Add a new `ExecScheduleAuditExclusionVacation` endpoint and wire the vacation wizard to schedule location-based audit alert exclusions independently of Conditional Access. The UI now presents this as its own action, includes confirmation/results handling, updates vacation-mode filtering, and documents the new fifth action. Also harden SharePoint sharing-links cache scans by removing the stale PrincipalCount pre-filter path, always using full/incremental delta ground truth, and preserving existing rows when permission batch reads are dropped. Related backend and frontend tests were updated accordingly.
Adds ExecRequirePasswordChange so admins can set forceChangePasswordNextSignIn without resetting the password, including multi-select support. Directory-synced accounts are rejected.
- Introduced logic to resolve Out of Office (OOO) messages only if they are not empty, preventing automatic replies from being set with empty HTML. - Updated offboarding job to use the resolved OOO message instead of the raw input. - Adjusted tests to verify that OOO messages are correctly passed into job options. - Enhanced documentation to clarify the handling of OOO messages and their configuration in user settings.
rvdwegen
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.