Dev to release#58
Merged
Merged
Conversation
chore: Update repository links to new owner
Guard the forced SSO migration prompt behind initial setup completion. The setup wizard must run first and the SAM app must be configured before ExecSSOSetup can create the CIPP-SSO registration. Backend checks ApplicationID env var; frontend passes setupCompleted prop to ForcedSsoMigrationDialog.
Adds Azure deployment artifacts for migrating self-hosted CIPP instances from the Static Web App + Function App architecture to a containerized Linux web app: - `cipp-deploy.bicep` / `.json`: full fresh-deployment ARM template - `cipp-migration.bicep` / `.json`: migration-only template (reuses existing storage/KV) - `Invoke-CippMigration.ps1`: PowerShell migration script that validates SSO readiness, migrates SWA role assignments to the allowedUsers table, removes old function apps/app service plans/App Insights, deploys the migration template, and tears down the Static Web App Also excludes `deployment/` and `graphify*/` from the Docker build context.
chore: secure pipeline config
Add a new Super Admin custom domains experience for the CIPP App Service. This includes a backend endpoint to list, validate, add, secure, and remove hostname bindings, plus a frontend wizard and tab entry to guide DNS setup and managed certificate provisioning.
Standardize OCI image description labels across dev, nightly, and release workflows by replacing "CIPP-NG" with "CIPP" to match current project branding.
…lection Add functionality to fetch the host tenant organization and determine partner status. Implement logic to clear tenant type selection if a non-partner is confirmed and a partner-only option was previously selected. Update option cards to disable selection based on partner status.
Add '*/organization' to the list of URIs that bypass tenant authorization checks, allowing organization-level Graph API calls to proceed without tenant filtering.
…and Docker daemon verification
Updated the layout of the setup completion alert by removing unnecessary container elements and adjusting padding for improved styling and responsiveness.
…anagement Updated the Invoke-CIPPSharePointTemplateDeploy function to support site type differentiation (SharePoint or Teams) and added an override option for site types. Enhanced the UI components to reflect these changes, including site type selection in the template builder.
Added functions to check for save blockers in site templates, including validation for display names, root permissions, and library names. Updated UI components to reflect these validations, providing tooltips for users to identify issues before saving. Enhanced the overall user experience by clearly indicating what needs to be fixed for successful template saving.
… deployment Enhanced the Invoke-CIPPSharePointTemplateDeploy function to track and log failures during permission setting for sites and libraries. Introduced a mechanism to summarize failures and update deployment status accordingly. Updated UI text for clarity in permission management options.
Fresh deployments carry template placeholder values (e.g. LongApplicationId, AppSecret) until the setup wizard completes. Previously these were treated as valid credentials, causing EasyAuth issuer reconciliation to rewrite a correctly configured issuer and break sign-in. Now placeholder values are detected and the instance is treated as unconfigured.
Fix: Move queryKey placement in SignInLogsDialog component
Resolves two issues when migrating SWA users to the allowedUsers table: - Invalid/non-existent roles (e.g. stale or display-name variants like 'full editor') are dropped instead of being migrated, preventing polluted permission checks. - superadmin users are migrated with only the superadmin role, avoiding interference with high-privilege permission checks. Custom roles from the CustomRoles table are also included in the valid-role set.
Adds a full SharePoint Permissions report with cached data collection, PDF export, and oversharing signal detection (tenant-wide grants, external grants, direct Full Control, detached libraries). Key additions: - Backend: SharePointPermissions cache type, batched site collection via activity triggers, REST API endpoints for listing/setting/removing library permissions, role definitions, site user access, and multi-queue status - Frontend: Permissions Report page with charts and filters, Library Permissions dialog (add/change/remove/inheritance control), Check User Access dialog, multi-queue progress tracker, query refresh button, reusable PDF primitives - Sharing report enhancements: sprawl signals (anonymous editable links, never-expiring links, folder shares, external recipients), top libraries/recipients charts, PDF export, queue progress tracking
Clean up the CIPP_SSO_RESET app setting when EasyAuth is already active (setup completed externally), and skip auto-configuration when the flag is set without EasyAuth — directing users to the setup wizard instead. Also remove the flag at the end of successful SSO setup flows (both migration and manual credential paths) so warmup's auto-configure can proceed on the next restart.
fix: side-nav scroll desync
- Updated backend logic to handle TemplateId more robustly, ensuring proper GUID generation and existing template retrieval. - Improved frontend logic to differentiate between edit and copy modes, ensuring accurate template data fetching and form hydration. - Adjusted API calls to prevent stale data from being displayed during template editing and copying.
- Updated backend to require a single tenant for template deployment, enhancing clarity and reducing complexity. - Adjusted frontend to reflect the change from multiple tenant selection to a single tenant context, ensuring the Site/Team Owner picker is appropriately scoped. - Improved logging and messaging to accurately represent the deployment status for the selected tenant.
…ation - Enhanced backend logic to determine the SharePoint template type (Team or Communication) based on the provided site template data, defaulting to Team for older templates. - Updated frontend to include a SharePoint template selection dialog, allowing users to choose between Team and Communication site templates during site creation. - Introduced constants for SharePoint template options and integrated them into the site template card for better user experience.
Build a case-insensitive lookup of test markdown files once instead of scanning the test directory for every result. This reduces repeated filesystem work when listing tests and keeps the markdown match tied to the `Invoke-CippTest<RowKey>` naming convention.
… instead of 'sharePointTemplate' - Modified backend logic to utilize 'createAs' for determining site template type, defaulting to Team. - Updated frontend components to reflect the change from 'sharePointTemplate' to 'createAs', including adjustments to dialog labels and options. - Enhanced user experience by clarifying the distinction between Team and Communication sites during site creation.
…template handling - Added a 'templateEngineVersion' property to the SharePoint template object in the backend to ensure compatibility with the API. - Stamped the current provisioning engine version in the frontend, allowing for better tracking of template versions during save operations. - Updated the template initialization and submission logic to include the engine version, enhancing consistency across the application.
JohnDuprey
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.