fix(pwpush): stop stale settings from silently breaking every push

A saved AccountId with bearer auth off, or an out-of-range expiry value,
made New-Push throw at parameter binding. New-PwPushLink swallowed the
exception into $false, so the extension test reported "PWPush is not
enabled" while password flows fell back to plain text passwords in
notifications.

- Only pass AccountId to New-Push when bearer auth is on and the saved
  value is non-empty; a placeholder or stale selection no longer kills
  the push.
- Drop ExpireAfterDays/ExpireAfterViews values outside PassPushPosh's
  accepted ranges (1-90 / 1-100) with a logged warning instead of
  letting validation throw.
- ExecExtensionTest now checks Enabled explicitly and surfaces the real
  exception via a new -ThrowOnError switch instead of collapsing every
  failure into "PWPush is not enabled".
- Make placeholder dropdown rows with an empty id unselectable in
  integration settings so the poison value cannot be saved again.

Synced from CyberDrain/CIPP@07e0415

Author: github-actions[bot]

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionTest.ps1

@@ -50,12 +50,23 @@ Function Invoke-ExecExtensionTest {
                 }
             }
             'PWPush' {
+                if ($Configuration.PWPush.Enabled -ne $true) {
+                    $Results = [pscustomobject]@{'Results' = 'PWPush is not enabled. Enable the integration and save the configuration, then test again.' }
+                    break
+                }
                 $Payload = 'This is a test from CIPP'
-                $PasswordLink = New-PwPushLink -Payload $Payload
+                # ThrowOnError: the silent $false fallback exists for the password flows; the
+                # test's whole job is to show why a push fails, so let the real exception through.
+                try {
+                    $PasswordLink = New-PwPushLink -Payload $Payload -ThrowOnError
+                } catch {
+                    $Results = [pscustomobject]@{'Results' = "PWPush is enabled but creating a test push failed: $($_.Exception.Message)" }
+                    break
+                }
                 if ($PasswordLink) {
                     $Results = [pscustomobject]@{Results = @(@{'resultText' = 'Successfully generated PWPush, hit the Copy to Clipboard button to retrieve the test.'; 'copyField' = $PasswordLink; 'state' = 'success' }) }
                 } else {
-                    $Results = [pscustomobject]@{'Results' = 'PWPush is not enabled' }
+                    $Results = [pscustomobject]@{'Results' = 'PWPush did not return a link. Check the CIPP logbook (API: PwPush) for details.' }
                 }
             }
             'Hudu' {

Modules/CippExtensions/Public/PwPush/New-PwPushLink.ps1

@@ -1,7 +1,10 @@
 function New-PwPushLink {
     [CmdletBinding(SupportsShouldProcess)]
     Param(
-        $Payload
+        $Payload,
+        # Rethrow creation failures instead of collapsing them into $false. The password flows
+        # rely on the silent fallback; the extension test uses this to show the real error.
+        [switch]$ThrowOnError
     )
 
     try {
@@ -37,10 +40,31 @@ function New-PwPushLink {
             $PushParams = @{
                 Payload = $Payload
             }
-            if ($Configuration.ExpireAfterDays) { $PushParams.ExpireAfterDays = $Configuration.ExpireAfterDays }
-            if ($Configuration.ExpireAfterViews) { $PushParams.ExpireAfterViews = $Configuration.ExpireAfterViews }
+            # New-Push validates ExpireAfterDays as 1-90 and ExpireAfterViews as 1-100 at bind
+            # time; an out-of-range saved value would throw here and downgrade every caller to
+            # plain text passwords, so drop the setting and warn instead.
+            $ExpireAfterDays = $Configuration.ExpireAfterDays -as [int]
+            if ($ExpireAfterDays) {
+                if ($ExpireAfterDays -ge 1 -and $ExpireAfterDays -le 90) {
+                    $PushParams.ExpireAfterDays = $ExpireAfterDays
+                } else {
+                    Write-LogMessage -API PwPush -Message "Ignoring ExpireAfterDays '$($Configuration.ExpireAfterDays)': PWPush accepts 1 to 90 days" -Sev 'Warning'
+                }
+            }
+            $ExpireAfterViews = $Configuration.ExpireAfterViews -as [int]
+            if ($ExpireAfterViews) {
+                if ($ExpireAfterViews -ge 1 -and $ExpireAfterViews -le 100) {
+                    $PushParams.ExpireAfterViews = $ExpireAfterViews
+                } else {
+                    Write-LogMessage -API PwPush -Message "Ignoring ExpireAfterViews '$($Configuration.ExpireAfterViews)': PWPush accepts 1 to 100 views" -Sev 'Warning'
+                }
+            }
             if ($Configuration.DeletableByViewer) { $PushParams.DeletableByViewer = $Configuration.DeletableByViewer }
-            if ($Configuration.AccountId) { $PushParams.AccountId = $Configuration.AccountId.value }
+            # New-Push rejects an account id at bind time when no Authorization header is set, so
+            # a stale or placeholder selection saved with bearer auth off must not be passed on.
+            if ($Configuration.UseBearerAuth -eq $true -and -not [string]::IsNullOrEmpty($Configuration.AccountId.value)) {
+                $PushParams.AccountId = $Configuration.AccountId.value
+            }
             if (![string]::IsNullOrEmpty($Configuration.DefaultPassphrase)) { $PushParams.Passphrase = $Configuration.DefaultPassphrase }
 
             if ($PSCmdlet.ShouldProcess('Create a new PwPush link')) {
@@ -56,11 +80,13 @@ function New-PwPushLink {
                 'Exception' = Get-CippException -Exception $_
             }
             Write-LogMessage -API PwPush -Message "Failed to create a new PwPush link: $($_.Exception.Message)" -Sev 'Error' -LogData $LogData
+            if ($ThrowOnError) { throw }
             Write-LogMessage -API PwPush -Message "Continuing without PwPush link due to error" -sev 'Warning'
             return $false
         }
     } catch {
         Write-LogMessage -API PwPush -Message "Unexpected error in PwPush configuration handling: $($_.Exception.Message)" -Sev 'Error'
+        if ($ThrowOnError) { throw }
         return $false
     }
 }