Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
  marcoandClaude Opus 4.8
|
830dddd15a | ||
|
marcoandClaude Opus 4.8
|
c1fc6f8b94 | ||
|
marcoandClaude Opus 4.8
|
4efc71376b | ||
|
marcoandClaude Opus 4.8
|
450428e7f7 | ||
|
marcoandClaude Opus 4.8
|
9a61cad54b | ||
|
marcoandClaude Opus 4.8
|
18e6a597cc | ||
|
marcoandClaude Opus 4.8
|
30d605703b | ||
|
marcoandClaude Opus 4.8
|
37ae32bb94 | ||
|
marcoandClaude Opus 4.8
|
f36e9c5ba0 |
@@ -107,3 +107,50 @@ jobs:
|
|||||||
- `Microsoft.Graph.Authentication` Modul (wird beim ersten Start automatisch angeboten)
|
- `Microsoft.Graph.Authentication` Modul (wird beim ersten Start automatisch angeboten)
|
||||||
files: "IntuneManager-${{ steps.ver.outputs.TAG }}.msi"
|
files: "IntuneManager-${{ steps.ver.outputs.TAG }}.msi"
|
||||||
generate_release_notes: false
|
generate_release_notes: false
|
||||||
|
|
||||||
|
- name: Mirror MSI to Gitea release
|
||||||
|
shell: pwsh
|
||||||
|
env:
|
||||||
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||||
|
GITEA_BASE: https://git.wende.it/api/v1
|
||||||
|
GITEA_OWNER: marco
|
||||||
|
GITEA_REPO: Intune-Manager
|
||||||
|
TAG: ${{ steps.ver.outputs.TAG }}
|
||||||
|
MSI_NAME: ${{ steps.build.outputs.MSI_NAME }}
|
||||||
|
COMMIT_SHA: ${{ github.sha }}
|
||||||
|
run: |
|
||||||
|
if ([string]::IsNullOrWhiteSpace($env:GITEA_TOKEN)) {
|
||||||
|
Write-Host "::notice::GITEA_TOKEN nicht gesetzt — Gitea-Upload uebersprungen."
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
$headers = @{ Authorization = "token $env:GITEA_TOKEN" }
|
||||||
|
$repoUrl = "$($env:GITEA_BASE)/repos/$($env:GITEA_OWNER)/$($env:GITEA_REPO)"
|
||||||
|
|
||||||
|
# Release per Tag suchen; sonst anlegen (Tag wird bei Bedarf am Commit erzeugt).
|
||||||
|
$rel = $null
|
||||||
|
try { $rel = Invoke-RestMethod -Headers $headers -Uri "$repoUrl/releases/tags/$($env:TAG)" -Method GET } catch { $rel = $null }
|
||||||
|
if (-not $rel) {
|
||||||
|
$body = @{
|
||||||
|
tag_name = $env:TAG
|
||||||
|
target_commitish = $env:COMMIT_SHA
|
||||||
|
name = "Intune Manager $($env:TAG)"
|
||||||
|
body = "Automatisch aus der GitHub-CI gespiegelt."
|
||||||
|
} | ConvertTo-Json
|
||||||
|
$rel = Invoke-RestMethod -Headers $headers -Uri "$repoUrl/releases" -Method POST -ContentType 'application/json' -Body $body
|
||||||
|
}
|
||||||
|
$relId = $rel.id
|
||||||
|
|
||||||
|
# Vorhandenes Asset gleichen Namens entfernen (idempotent bei Re-Runs).
|
||||||
|
try {
|
||||||
|
$assets = Invoke-RestMethod -Headers $headers -Uri "$repoUrl/releases/$relId/assets" -Method GET
|
||||||
|
foreach ($a in @($assets)) {
|
||||||
|
if ($a.name -eq $env:MSI_NAME) {
|
||||||
|
Invoke-RestMethod -Headers $headers -Uri "$repoUrl/releases/$relId/assets/$($a.id)" -Method DELETE | Out-Null
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch {}
|
||||||
|
|
||||||
|
# MSI als Attachment hochladen (multipart, Feldname 'attachment').
|
||||||
|
$assetUri = "$repoUrl/releases/$relId/assets?name=$([uri]::EscapeDataString($env:MSI_NAME))"
|
||||||
|
Invoke-RestMethod -Headers $headers -Uri $assetUri -Method POST -Form @{ attachment = Get-Item -LiteralPath $env:MSI_NAME } | Out-Null
|
||||||
|
Write-Host "MSI '$($env:MSI_NAME)' -> Gitea-Release '$($env:TAG)' hochgeladen."
|
||||||
|
|||||||
@@ -5,6 +5,63 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
## [0.1.28] - 2026-08-24
|
||||||
|
|
||||||
|
Umbenennen beim Import, UI-Fixes, Geräte-Export repariert.
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Umbenennen beim Import**: Vor dem Anlegen kann jeder importierten Policy im neuen Dialog „Policies importieren" ein anderer Name gegeben werden (das richtige Namensfeld je Typ — `name`/`displayName` — wird gesetzt).
|
||||||
|
|
||||||
|
### Behoben
|
||||||
|
|
||||||
|
- **Geräte-Export im App Report**: Der von Graph entfernte synchrone Endpoint `getDeviceInstallStatusReport` (400 „Resource not found for the segment") ist durch den asynchronen Export-Job **`DeviceInstallStatusByApp`** ersetzt (ZIP/CSV-Auswertung, tolerantes Spalten-Mapping). ZIP/CSV-Logik in `Get-IntuneReportRows` ausgelagert.
|
||||||
|
- **Darkmode-Kontrast** im Zuweisungs-Dialog: Gruppen-Chips nutzen jetzt die Theme-Variablen (`--surface-strong`/`--ink` statt fester heller Farben) — heller Text auf hellem Chip behoben.
|
||||||
|
- **Dialog-Breite**: Lange Policy-Namen im Zuweisungs-/Import-Dialog brechen jetzt um (`overflow-wrap`/`flex-wrap`) statt horizontal zu scrollen; das Fenster passt sich der Breite an.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## [0.1.27] - 2026-08-23
|
||||||
|
|
||||||
|
Policy-Import härter, Administrative Vorlagen, Zuweisung nach Import, Git-Snapshot, App-Registrierungs-Doku.
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Administrative Vorlagen (ADMX / `groupPolicyConfigurations`)** als vierter Policy-Typ für Export und Import. Beim Import wird die Konfigurations-Hülle angelegt und jede Einstellung einzeln über `definition@odata.bind` / `presentation@odata.bind` angehängt (eingebaute ADMX-Definitionen sind tenantübergreifend gültig). Neuer Endpoint `GET /api/policies/administrativetemplate`.
|
||||||
|
- **Zuweisung direkt nach Import**: Dialog listet die neu angelegten Policies und lässt **pro Policy Include-/Exclude-Gruppen** im Ziel-Tenant zuweisen (Typeahead über die vorhandene Gruppensuche). Neuer Endpoint `POST /api/policies/assign` (nutzt die typ-spezifische `/assign`-Action für alle vier Typen).
|
||||||
|
- **Git-Snapshot (versioniertes Policy-Backup)**: Button „Git-Snapshot" schreibt alle Policies aller Typen als JSON in einen konfigurierten lokalen Git-Ordner und committet sie (optional `git push` über den vorhandenen Credential-Helper). Stabile Dateinamen + deterministische, zeitstempel-freie Ausgabe → saubere Diffs. Neue Settings-Sektion `policyBackup` (`gitRepoPath`, `push`).
|
||||||
|
- Import akzeptiert jetzt auch **Git-Snapshot-Dateien** (Feld `policyType` zusätzlich zu `exportType`).
|
||||||
|
- **Doku + Provisioning-Skript für die App-Registrierung**: [`docs/App-Registration.md`](docs/App-Registration.md) listet alle benötigten delegierten Graph-Berechtigungen (Kern, Geräte-Tab, Read-Only) samt Auth-Konfiguration; [`docs/Setup-AppRegistration.ps1`](docs/Setup-AppRegistration.ps1) legt die Registrierung automatisch an bzw. aktualisiert sie (Rechte, Public-Client-Flow, Redirect-URIs, optional Admin-Consent) — Berechtigungs-IDs werden live aufgelöst, keine fest verdrahteten GUIDs.
|
||||||
|
|
||||||
|
### Behoben
|
||||||
|
|
||||||
|
- **Settings-Catalog-Import** war gegen Graph-Schema-Fehler anfällig: verschachtelte Collection-Properties (`children`, `*SettingCollectionValue`) werden jetzt konsequent als Arrays serialisiert (repariert PowerShell-5.1-JSON-Roundtrip-Schäden), `null`-Collections werden zu `[]` (Graph verlangt `Nullable=False`), der Wrapper-`@odata.type` wird je Setting gesetzt und das read-only `id`-Feld entfernt.
|
||||||
|
- **Phantom-Fehler beim Import**: ein fehlendes `fileNames`-Feld erzeugte über `@($null)` einen Geisterdurchlauf im Archiv-Pfad und meldete fälschlich „1 fehlgeschlagen".
|
||||||
|
- **Tenant-Wechsel**: das Frontend zeigte weiter die Apps/Gruppen des vorherigen Tenants, weil die Lade-Guards nicht zurückgesetzt wurden. Alle datentragenden Caches werden jetzt beim Wechsel verworfen (`resetClientState`).
|
||||||
|
- **WAM-Anmeldefenster** kommt beim Login/Tenant-Wechsel zuverlässig in den Vordergrund (AttachThreadInput + kurzer ALT-Tap zum Lösen des Windows-Foreground-Locks).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## [0.1.26] - 2026-08-21
|
||||||
|
|
||||||
|
Multi-Tenant, Pro-Tenant-Vorgaben, RPA entfernt.
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Multi-Tenant-Modus** (umschaltbar in den Einstellungen, Single/Multi): mehrere Mandanten mit **je eigener App-Registrierung**; Umschalter in der Topbar mit **Sofort-Reconnect**. Bestehende Single-Tenant-Konfiguration wird verlustfrei übernommen.
|
||||||
|
- **Pro-Tenant-Vorgaben** mit globalem Fallback: **Abteilungs-Präfixe** sowie **Required-/Available-Gruppen-Naming** je Profil überschreibbar (leer = globale Vorgabe).
|
||||||
|
- **Policy-Export als Einzeldateien** bei Mehrfachauswahl (statt Bundle).
|
||||||
|
- **CI**: gebaute MSI wird zusätzlich als **Gitea-Release-Asset** gespiegelt (Secret `GITEA_TOKEN`).
|
||||||
|
- Hilfe-Fenster: Hinweis „Entwickelt von WendeIT – Marco Wende".
|
||||||
|
|
||||||
|
### Geändert / Entfernt
|
||||||
|
|
||||||
|
- **RPA-Funktion entfernt**: RPA-Tab, RPA-Einstellungen und RPA-Test-Anzeige sind nicht mehr vorhanden.
|
||||||
|
- Setup-Zwang gelockert: nur **Tenant ID + Client ID** sind Pflicht; Abteilungs-Präfixe sind optional.
|
||||||
|
- Klarere Fehlermeldung bei nicht erreichbarem lokalen Server (statt „Failed to fetch").
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## [0.1.25] - 2026-08-19
|
## [0.1.25] - 2026-08-19
|
||||||
|
|
||||||
Policy Export/Import und Geräte-Tab.
|
Policy Export/Import und Geräte-Tab.
|
||||||
|
|||||||
@@ -39,6 +39,43 @@ Beenden: `Ctrl+C` im Terminal.
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
## Single- vs. Multi-Tenant
|
||||||
|
|
||||||
|
Unter **Settings → Verbindung → Verbindungsmodus** wählst du zwischen:
|
||||||
|
|
||||||
|
| Modus | Verhalten |
|
||||||
|
|---------------|---------------------------------------------------------------------------|
|
||||||
|
| Single-Tenant | Klassisch: ein Mandant (Tenant ID + App-Registrierung). Standard. |
|
||||||
|
| Multi-Tenant | Mehrere Mandanten mit **je eigener App-Registrierung**; Umschalten oben rechts |
|
||||||
|
|
||||||
|
Im Multi-Tenant-Modus legst du pro Mandant ein Profil an (Bezeichnung, Tenant ID,
|
||||||
|
Client-ID Read/Write, optional Client-ID Read-Only). Der **aktive** Mandant ist
|
||||||
|
markiert. Über das **Dropdown in der Topbar** wechselst du zwischen den Mandanten —
|
||||||
|
der Wechsel trennt die aktuelle Verbindung und verbindet **sofort neu** mit dem
|
||||||
|
gewählten Tenant (Login-Prompt erscheint). Alle Caches werden beim Wechsel geleert.
|
||||||
|
|
||||||
|
> Die Scopes (RW/RO) gelten **global** für alle Profile. Jeder Mandant benötigt
|
||||||
|
> eine eigene App-Registrierung mit denselben delegierten Berechtigungen und
|
||||||
|
> (Admin-)Consent im jeweiligen Tenant. Bestehende Single-Tenant-Konfigurationen
|
||||||
|
> werden verlustfrei übernommen (Umschalten auf Multi bietet an, das vorhandene
|
||||||
|
> Setup als erstes Profil zu übernehmen).
|
||||||
|
|
||||||
|
### Pro-Tenant-Vorgaben
|
||||||
|
|
||||||
|
Jedes Tenant-Profil kann **eigene Vorgaben** hinterlegen (z. B. Kunde A → `abt-hm-*`,
|
||||||
|
Kunde B → `dept-*`):
|
||||||
|
|
||||||
|
- **Abteilungs-Präfixe**
|
||||||
|
- **Required-Gruppen-Naming** (Präfix/Suffix)
|
||||||
|
- **Available-Gruppen-Naming** (Präfix/Suffix)
|
||||||
|
|
||||||
|
Bleibt ein Feld **leer, gilt die globale Vorgabe** aus den entsprechenden
|
||||||
|
Einstellungs-Abschnitten (bei Naming greift der Fallback pro Feld einzeln). Beim
|
||||||
|
Mandantenwechsel werden die Caches geleert, sodass die passenden Vorgaben gegen
|
||||||
|
den aktiven Tenant wirken.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Verbindungsmodus (Read/Write vs. Read-Only)
|
## Verbindungsmodus (Read/Write vs. Read-Only)
|
||||||
|
|
||||||
Der Server probiert beim Verbinden **zuerst die Read/Write-App-ID** (`clientId`).
|
Der Server probiert beim Verbinden **zuerst die Read/Write-App-ID** (`clientId`).
|
||||||
@@ -83,6 +120,11 @@ Settings → Verbindung
|
|||||||
> ⚠ Ohne `DeviceManagementManagedDevices.Read.All` zeigt der App-Report nur
|
> ⚠ Ohne `DeviceManagementManagedDevices.Read.All` zeigt der App-Report nur
|
||||||
> Zaehler = 0 und der Geraete-Export liefert keine Eintraege.
|
> Zaehler = 0 und der Geraete-Export liefert keine Eintraege.
|
||||||
|
|
||||||
|
**Vollstaendige Berechtigungsliste, Redirect-URIs und ein Skript, das die
|
||||||
|
App-Registrierung automatisch anlegt/konfiguriert:**
|
||||||
|
[docs/App-Registration.md](docs/App-Registration.md) — inkl.
|
||||||
|
[`Setup-AppRegistration.ps1`](docs/Setup-AppRegistration.ps1).
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Navigation (Tabs)
|
## Navigation (Tabs)
|
||||||
@@ -200,6 +242,21 @@ neu an. Unterstuetzte Typen:
|
|||||||
automatisch zur Verbindung ergaenzt — in der Azure-App-Registration muss die
|
automatisch zur Verbindung ergaenzt — in der Azure-App-Registration muss die
|
||||||
Berechtigung aber vorhanden und (Admin-)zugestimmt sein.
|
Berechtigung aber vorhanden und (Admin-)zugestimmt sein.
|
||||||
|
|
||||||
|
### Git-Snapshot (versioniertes Backup)
|
||||||
|
|
||||||
|
Button **„Git-Snapshot"** im Policies-Tab schreibt **alle** Policies aller Typen
|
||||||
|
als JSON in einen konfigurierten **lokalen Git-Ordner** und committet sie
|
||||||
|
automatisch — ideal als versioniertes Backup mit nachvollziehbarer History.
|
||||||
|
|
||||||
|
- Konfiguration: **Settings → Policy-Backup (Git)** — lokaler Repo-Pfad (wird bei
|
||||||
|
Bedarf angelegt und `git init`-isiert) + optional **automatischer `git push`**
|
||||||
|
(nutzt den vorhandenen Git-Credential-Helper; **kein Token in der App**).
|
||||||
|
- **Stabile Dateinamen** (`<tenant>/<typ>/<name>__<id8>.json`) und deterministische,
|
||||||
|
zeitstempel-freie JSON-Ausgabe → saubere Git-Diffs zwischen Snapshots. Entfernte
|
||||||
|
Policies verschwinden aus dem Snapshot.
|
||||||
|
- Multi-Tenant: je Mandant ein eigener Unterordner (nach Profil-Label bzw. Tenant-ID).
|
||||||
|
- Gibt es keine Aenderungen seit dem letzten Snapshot, wird nichts committet.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Architektur
|
## Architektur
|
||||||
|
|||||||
@@ -148,10 +148,12 @@ if ($ClientId) { $script:Settings.connection.clientId = $ClientId }
|
|||||||
# Globale Konfiguration. TenantId/ClientId/Scopes spiegeln die Settings �
|
# Globale Konfiguration. TenantId/ClientId/Scopes spiegeln die Settings �
|
||||||
# Connect-Endpoint und Co. lesen weiterhin $script:Config, das nach jedem
|
# Connect-Endpoint und Co. lesen weiterhin $script:Config, das nach jedem
|
||||||
# Settings-Save aktualisiert wird.
|
# Settings-Save aktualisiert wird.
|
||||||
|
# Im Multi-Tenant-Modus kommen TenantId/ClientId aus dem aktiven Profil.
|
||||||
|
$script:StartupConn = Get-ActiveConnection -Settings $script:Settings
|
||||||
$script:Config = @{
|
$script:Config = @{
|
||||||
TenantId = $script:Settings.connection.tenantId
|
TenantId = $script:StartupConn.tenantId
|
||||||
ClientId = $script:Settings.connection.clientId
|
ClientId = $script:StartupConn.clientId
|
||||||
ClientIdRo = $script:Settings.connection.clientIdRo
|
ClientIdRo = $script:StartupConn.clientIdRo
|
||||||
Scopes = @($script:Settings.connection.scopes)
|
Scopes = @($script:Settings.connection.scopes)
|
||||||
ScopesRo = @($script:Settings.connection.scopesRo)
|
ScopesRo = @($script:Settings.connection.scopesRo)
|
||||||
WebRoot = (Join-Path $root "www")
|
WebRoot = (Join-Path $root "www")
|
||||||
@@ -186,7 +188,7 @@ $script:State = [pscustomobject]@{
|
|||||||
Session = @() # geplante Zuweisungen
|
Session = @() # geplante Zuweisungen
|
||||||
}
|
}
|
||||||
|
|
||||||
$script:ToolVersion = "0.1.25"
|
$script:ToolVersion = "0.1.28"
|
||||||
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
||||||
|
|
||||||
Write-Host ""
|
Write-Host ""
|
||||||
|
|||||||
@@ -0,0 +1,130 @@
|
|||||||
|
# App-Registrierung & Berechtigungen
|
||||||
|
|
||||||
|
Der Intune Manager meldet sich als **delegierte** Anwendung an (Device-Code- bzw.
|
||||||
|
WAM-Login) — er handelt also immer **im Namen des angemeldeten Admins**, nie mit
|
||||||
|
Anwendungsrechten. Die App-Registrierung braucht daher **delegierte
|
||||||
|
Microsoft-Graph-Berechtigungen** plus die passende Authentifizierungs-Konfiguration.
|
||||||
|
|
||||||
|
> **Schnellweg:** Statt alles von Hand zu klicken, legt das Skript
|
||||||
|
> [`Setup-AppRegistration.ps1`](Setup-AppRegistration.ps1) die Registrierung
|
||||||
|
> komplett an (Rechte + Public-Client-Flow + Redirect-URIs + optional Consent).
|
||||||
|
> Siehe [Automatische Einrichtung](#automatische-einrichtung).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Benötigte Berechtigungen
|
||||||
|
|
||||||
|
Alle Berechtigungen sind vom Typ **Delegiert** (Microsoft Graph).
|
||||||
|
|
||||||
|
### Kern (immer erforderlich)
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `Group.ReadWrite.All` | Gruppen anlegen, App-/Policy-Zuweisungen setzen |
|
||||||
|
| `GroupMember.ReadWrite.All` | Gruppenmitglieder lesen/hinzufügen/entfernen, CSV-Import |
|
||||||
|
| `User.Read.All` | Benutzersuche, UPN-Auflösung |
|
||||||
|
| `DeviceManagementApps.ReadWrite.All` | Apps auflisten, zuweisen, umbenennen, löschen, Setup-Datei aktualisieren, App-Report |
|
||||||
|
| `DeviceManagementConfiguration.ReadWrite.All` | Policies (Settings Catalog, Compliance, Konfigurationsprofile, Administrative Vorlagen) lesen, exportieren, importieren, zuweisen |
|
||||||
|
| `offline_access` | Refresh-Token (Device-Code-Flow) |
|
||||||
|
|
||||||
|
> `DeviceManagementConfiguration.ReadWrite.All` wird vom Tool automatisch zur
|
||||||
|
> Verbindung ergänzt — die App-Registrierung muss die Berechtigung aber besitzen
|
||||||
|
> und (Admin-)zugestimmt bekommen haben, sonst schlägt der Policy-Import mit
|
||||||
|
> `403 Forbidden` fehl.
|
||||||
|
|
||||||
|
### Geräte-Tab (optional)
|
||||||
|
|
||||||
|
Nur nötig, wenn der **Geräte-Tab** (Sync/Reboot/Lock/Diagnose/Wipe/Retire) genutzt wird:
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `DeviceManagementManagedDevices.Read.All` | Geräte auflisten und Details anzeigen |
|
||||||
|
| `DeviceManagementManagedDevices.ReadWrite.All` | Sync, Neustart, Remote-Lock, Diagnose, BitLocker-Key-Rotation |
|
||||||
|
| `DeviceManagementManagedDevices.PrivilegedOperations.All` | Wipe, Retire, Autopilot-Reset |
|
||||||
|
|
||||||
|
### Read-Only-Variante
|
||||||
|
|
||||||
|
Für eine reine Anzeige-App (im Tool als `clientIdRo` hinterlegbar) genügen die
|
||||||
|
`*.Read.All`-Pendants:
|
||||||
|
|
||||||
|
`Group.Read.All`, `GroupMember.Read.All`, `User.Read.All`,
|
||||||
|
`DeviceManagementApps.Read.All`, `DeviceManagementConfiguration.Read.All`,
|
||||||
|
`offline_access` (+ optional `DeviceManagementManagedDevices.Read.All`).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Authentifizierungs-Konfiguration
|
||||||
|
|
||||||
|
Zusätzlich zu den Berechtigungen muss die App als **öffentlicher Client** nutzbar
|
||||||
|
sein — sonst scheitert der erste Login (`AADSTS500113` bzw. `AADSTS50011`):
|
||||||
|
|
||||||
|
1. **Öffentliche Clientflows zulassen** → **Ja**
|
||||||
|
(Entra → App-Registrierung → *Authentifizierung* → ganz unten;
|
||||||
|
im Manifest `isFallbackPublicClient = true`).
|
||||||
|
2. **Redirect-URIs** unter *Mobilgerät- und Desktopanwendungen*:
|
||||||
|
```
|
||||||
|
https://login.microsoftonline.com/common/oauth2/nativeclient
|
||||||
|
ms-appx-web://Microsoft.AAD.BrokerPlugin/<CLIENT-ID>
|
||||||
|
```
|
||||||
|
- Zeile 1 → **Device-Code-Flow**
|
||||||
|
- Zeile 2 → **WAM-Broker** (Windows-Anmeldefenster); `<CLIENT-ID>` ist die
|
||||||
|
AppId der Registrierung selbst.
|
||||||
|
3. **Multi-Tenant:** Wird dieselbe App gegen fremde Tenants genutzt, muss
|
||||||
|
`signInAudience` auf *Accounts in any organizational directory*
|
||||||
|
(`AzureADMultipleOrgs`) stehen und im Ziel-Tenant per Admin-Consent
|
||||||
|
bereitgestellt werden. Bei einer eigenen App **pro** Tenant ist Single-Tenant
|
||||||
|
ausreichend.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Automatische Einrichtung
|
||||||
|
|
||||||
|
Das Skript [`Setup-AppRegistration.ps1`](Setup-AppRegistration.ps1) erledigt alles
|
||||||
|
oben Genannte über Microsoft Graph. Es braucht nur das Modul
|
||||||
|
`Microsoft.Graph.Authentication` (dieselbe Abhängigkeit wie das Tool) und löst die
|
||||||
|
Berechtigungs-IDs **live** aus dem Graph-Service-Principal auf — keine fest
|
||||||
|
verdrahteten GUIDs.
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
# Einmalig:
|
||||||
|
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
|
||||||
|
|
||||||
|
# Neue Single-Tenant-App inkl. Admin-Consent:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -GrantAdminConsent
|
||||||
|
|
||||||
|
# Mit Geräte-Rechten:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -IncludeDeviceActions -GrantAdminConsent
|
||||||
|
|
||||||
|
# Multi-Tenant-App:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -MultiTenant -GrantAdminConsent
|
||||||
|
|
||||||
|
# Bestehende App nur um Rechte/Redirect-URIs ergänzen:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -ClientId "<APP-ID>" -GrantAdminConsent
|
||||||
|
|
||||||
|
# Nur das Manifest-Snippet ausgeben (ohne etwas anzulegen wäre -WhatIf-artig —
|
||||||
|
# hier zusätzlich zum Anlegen):
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -EmitManifest
|
||||||
|
```
|
||||||
|
|
||||||
|
Am Ende gibt das Skript **Tenant ID** und **Client ID** aus — diese Werte im
|
||||||
|
Intune Manager unter *Einstellungen → Verbindung* (bzw. im Tenant-Profil)
|
||||||
|
eintragen.
|
||||||
|
|
||||||
|
Die zum Anlegen/Ändern nötigen Admin-Rechte (`Application.ReadWrite.All`, für
|
||||||
|
Consent zusätzlich `DelegatedPermissionGrant.ReadWrite.All`) werden beim
|
||||||
|
`Connect-MgGraph`-Aufruf des Skripts einmalig abgefragt.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Manuelle Einrichtung (Portal)
|
||||||
|
|
||||||
|
1. **Entra** → *App-Registrierungen* → *Neue Registrierung* → Name vergeben,
|
||||||
|
Kontotyp wählen (Single- oder Multi-Tenant) → **Registrieren**.
|
||||||
|
2. *API-Berechtigungen* → *Berechtigung hinzufügen* → **Microsoft Graph** →
|
||||||
|
**Delegierte Berechtigungen** → die [Kern-Berechtigungen](#kern-immer-erforderlich)
|
||||||
|
(und bei Bedarf die [Geräte-Berechtigungen](#geräte-tab-optional)) auswählen →
|
||||||
|
**Administratorzustimmung erteilen**.
|
||||||
|
3. *Authentifizierung* → [Authentifizierungs-Konfiguration](#authentifizierungs-konfiguration)
|
||||||
|
wie oben setzen (Public-Client-Flow + beide Redirect-URIs).
|
||||||
|
4. **Übersichtsseite**: *Anwendungs-(Client-)ID* und *Verzeichnis-(Mandanten-)ID*
|
||||||
|
in den Intune Manager übernehmen.
|
||||||
@@ -0,0 +1,214 @@
|
|||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
Legt die App-Registrierung fuer den Intune Manager an (oder aktualisiert sie)
|
||||||
|
inkl. Graph-Berechtigungen, Public-Client-Flow und Redirect-URIs.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
Deckt genau die Punkte ab, an denen der erste Login sonst mit
|
||||||
|
AADSTS500113 / AADSTS50011 scheitert:
|
||||||
|
* Delegierte Microsoft-Graph-Berechtigungen (nach Bedarf: RW, RO, Geraete)
|
||||||
|
* "Oeffentliche Clientflows zulassen" (isFallbackPublicClient = true)
|
||||||
|
* Redirect-URIs fuer Device-Code (nativeclient) und WAM-Broker
|
||||||
|
* optional Admin-Consent
|
||||||
|
|
||||||
|
Nutzt nur Microsoft.Graph.Authentication (Invoke-MgGraphRequest) — dieselbe
|
||||||
|
Abhaengigkeit wie das Tool selbst. Berechtigungs-IDs werden LIVE aus dem
|
||||||
|
Graph-Service-Principal aufgeloest, es sind also keine fest verdrahteten
|
||||||
|
GUIDs noetig (die sonst leicht veralten).
|
||||||
|
|
||||||
|
.PARAMETER DisplayName
|
||||||
|
Anzeigename der App-Registrierung. Default: "Intune Manager".
|
||||||
|
|
||||||
|
.PARAMETER ClientId
|
||||||
|
AppId einer BESTEHENDEN Registrierung, die aktualisiert werden soll.
|
||||||
|
Ohne diesen Parameter wird eine NEUE App angelegt.
|
||||||
|
|
||||||
|
.PARAMETER MultiTenant
|
||||||
|
App fuer mehrere Tenants (signInAudience = AzureADMultipleOrgs).
|
||||||
|
Default: nur der aktuelle Tenant (AzureADMyOrg).
|
||||||
|
|
||||||
|
.PARAMETER ReadOnly
|
||||||
|
Verwendet die Read-Only-Berechtigungen (fuer eine reine Anzeige-/RO-App,
|
||||||
|
passend zu clientIdRo im Tool).
|
||||||
|
|
||||||
|
.PARAMETER IncludeDeviceActions
|
||||||
|
Nimmt zusaetzlich die Berechtigungen fuer den Geraete-Tab auf
|
||||||
|
(Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire).
|
||||||
|
|
||||||
|
.PARAMETER GrantAdminConsent
|
||||||
|
Erteilt direkt tenantweiten Admin-Consent fuer die gesetzten Scopes.
|
||||||
|
Benoetigt entsprechend privilegierte Anmeldung.
|
||||||
|
|
||||||
|
.PARAMETER EmitManifest
|
||||||
|
Gibt zusaetzlich den requiredResourceAccess-Block als JSON aus (zum manuellen
|
||||||
|
Einfuegen in das App-Manifest im Portal).
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
# Neue Single-Tenant-App inkl. Consent:
|
||||||
|
.\Setup-AppRegistration.ps1 -GrantAdminConsent
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
# Bestehende App um Geraete-Rechte erweitern:
|
||||||
|
.\Setup-AppRegistration.ps1 -ClientId "51477347-...." -IncludeDeviceActions -GrantAdminConsent
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Vorher einmalig: Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
|
||||||
|
#>
|
||||||
|
[CmdletBinding()]
|
||||||
|
param(
|
||||||
|
[string]$DisplayName = 'Intune Manager',
|
||||||
|
[string]$ClientId,
|
||||||
|
[switch]$MultiTenant,
|
||||||
|
[switch]$ReadOnly,
|
||||||
|
[switch]$IncludeDeviceActions,
|
||||||
|
[switch]$GrantAdminConsent,
|
||||||
|
[switch]$EmitManifest
|
||||||
|
)
|
||||||
|
|
||||||
|
$ErrorActionPreference = 'Stop'
|
||||||
|
$GraphAppId = '00000003-0000-0000-c000-000000000000' # Microsoft Graph
|
||||||
|
|
||||||
|
# --- Benoetigte delegierte Berechtigungen zusammenstellen ---------------------
|
||||||
|
$perms = if ($ReadOnly) {
|
||||||
|
@('Group.Read.All','GroupMember.Read.All','User.Read.All',
|
||||||
|
'DeviceManagementApps.Read.All','DeviceManagementConfiguration.Read.All','offline_access')
|
||||||
|
} else {
|
||||||
|
@('Group.ReadWrite.All','GroupMember.ReadWrite.All','User.Read.All',
|
||||||
|
'DeviceManagementApps.ReadWrite.All','DeviceManagementConfiguration.ReadWrite.All','offline_access')
|
||||||
|
}
|
||||||
|
if ($IncludeDeviceActions) {
|
||||||
|
$perms += if ($ReadOnly) {
|
||||||
|
@('DeviceManagementManagedDevices.Read.All')
|
||||||
|
} else {
|
||||||
|
@('DeviceManagementManagedDevices.Read.All',
|
||||||
|
'DeviceManagementManagedDevices.ReadWrite.All',
|
||||||
|
'DeviceManagementManagedDevices.PrivilegedOperations.All')
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$perms = $perms | Select-Object -Unique
|
||||||
|
|
||||||
|
# --- Verbinden ----------------------------------------------------------------
|
||||||
|
Write-Host "[1/6] Mit Microsoft Graph verbinden (Admin noetig)..." -ForegroundColor Cyan
|
||||||
|
$connectScopes = @('Application.ReadWrite.All')
|
||||||
|
if ($GrantAdminConsent) { $connectScopes += 'DelegatedPermissionGrant.ReadWrite.All' }
|
||||||
|
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
|
||||||
|
Connect-MgGraph -Scopes $connectScopes -NoWelcome
|
||||||
|
$ctx = Get-MgContext
|
||||||
|
if (-not $ctx) { throw 'Keine Graph-Verbindung.' }
|
||||||
|
Write-Host " verbunden mit Tenant $($ctx.TenantId) als $($ctx.Account)" -ForegroundColor DarkGray
|
||||||
|
|
||||||
|
# --- Graph-Service-Principal + Berechtigungs-IDs aufloesen --------------------
|
||||||
|
Write-Host "[2/6] Graph-Berechtigungen aufloesen..." -ForegroundColor Cyan
|
||||||
|
$graphSp = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$GraphAppId'&`$select=id,oauth2PermissionScopes").value | Select-Object -First 1
|
||||||
|
if (-not $graphSp) { throw 'Graph-Service-Principal nicht gefunden.' }
|
||||||
|
$graphSpId = $graphSp.id
|
||||||
|
|
||||||
|
$scopeMap = @{}
|
||||||
|
foreach ($s in $graphSp.oauth2PermissionScopes) { $scopeMap[$s.value] = $s.id }
|
||||||
|
|
||||||
|
$resourceAccess = @()
|
||||||
|
foreach ($p in $perms) {
|
||||||
|
if (-not $scopeMap.ContainsKey($p)) { throw "Delegierte Berechtigung '$p' nicht im Graph-SP gefunden." }
|
||||||
|
$resourceAccess += @{ id = $scopeMap[$p]; type = 'Scope' }
|
||||||
|
}
|
||||||
|
$requiredResourceAccess = @(@{ resourceAppId = $GraphAppId; resourceAccess = $resourceAccess })
|
||||||
|
|
||||||
|
if ($EmitManifest) {
|
||||||
|
Write-Host "`n--- requiredResourceAccess (Manifest) ---" -ForegroundColor Yellow
|
||||||
|
($requiredResourceAccess | ConvertTo-Json -Depth 6)
|
||||||
|
Write-Host "-----------------------------------------`n" -ForegroundColor Yellow
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- App anlegen oder aktualisieren -------------------------------------------
|
||||||
|
$signInAudience = if ($MultiTenant) { 'AzureADMultipleOrgs' } else { 'AzureADMyOrg' }
|
||||||
|
|
||||||
|
if ($ClientId) {
|
||||||
|
Write-Host "[3/6] Bestehende App $ClientId laden..." -ForegroundColor Cyan
|
||||||
|
$app = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/applications?`$filter=appId eq '$ClientId'&`$select=id,appId").value | Select-Object -First 1
|
||||||
|
if (-not $app) { throw "App mit appId $ClientId nicht gefunden." }
|
||||||
|
$objId = $app.id
|
||||||
|
$appId = $ClientId
|
||||||
|
$patch = @{
|
||||||
|
signInAudience = $signInAudience
|
||||||
|
isFallbackPublicClient = $true
|
||||||
|
requiredResourceAccess = $requiredResourceAccess
|
||||||
|
publicClient = @{ redirectUris = @(
|
||||||
|
'https://login.microsoftonline.com/common/oauth2/nativeclient'
|
||||||
|
"ms-appx-web://Microsoft.AAD.BrokerPlugin/$appId"
|
||||||
|
) }
|
||||||
|
}
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/applications/$objId" `
|
||||||
|
-Body ($patch | ConvertTo-Json -Depth 8) -ContentType 'application/json' | Out-Null
|
||||||
|
Write-Host " App aktualisiert." -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host "[3/6] Neue App '$DisplayName' anlegen..." -ForegroundColor Cyan
|
||||||
|
# Broker-Redirect-URI braucht die appId -> erst mit nativeclient anlegen,
|
||||||
|
# danach die Broker-URI per PATCH ergaenzen.
|
||||||
|
$create = @{
|
||||||
|
displayName = $DisplayName
|
||||||
|
signInAudience = $signInAudience
|
||||||
|
isFallbackPublicClient = $true
|
||||||
|
requiredResourceAccess = $requiredResourceAccess
|
||||||
|
publicClient = @{ redirectUris = @('https://login.microsoftonline.com/common/oauth2/nativeclient') }
|
||||||
|
}
|
||||||
|
$app = Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/applications' `
|
||||||
|
-Body ($create | ConvertTo-Json -Depth 8) -ContentType 'application/json'
|
||||||
|
$objId = $app.id
|
||||||
|
$appId = $app.appId
|
||||||
|
|
||||||
|
$patch = @{ publicClient = @{ redirectUris = @(
|
||||||
|
'https://login.microsoftonline.com/common/oauth2/nativeclient'
|
||||||
|
"ms-appx-web://Microsoft.AAD.BrokerPlugin/$appId"
|
||||||
|
) } }
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/applications/$objId" `
|
||||||
|
-Body ($patch | ConvertTo-Json -Depth 6) -ContentType 'application/json' | Out-Null
|
||||||
|
Write-Host " App angelegt: appId $appId" -ForegroundColor Green
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Service-Principal (Enterprise-App) sicherstellen -------------------------
|
||||||
|
Write-Host "[4/6] Service-Principal sicherstellen..." -ForegroundColor Cyan
|
||||||
|
$sp = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$appId'&`$select=id").value | Select-Object -First 1
|
||||||
|
if (-not $sp) {
|
||||||
|
$sp = Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/servicePrincipals' `
|
||||||
|
-Body (@{ appId = $appId } | ConvertTo-Json) -ContentType 'application/json'
|
||||||
|
}
|
||||||
|
$spId = $sp.id
|
||||||
|
|
||||||
|
# --- Optional: Admin-Consent --------------------------------------------------
|
||||||
|
Write-Host "[5/6] Admin-Consent..." -ForegroundColor Cyan
|
||||||
|
if ($GrantAdminConsent) {
|
||||||
|
$scopeString = ($perms -join ' ')
|
||||||
|
# Bestehenden Grant fuer (Client -> Graph) suchen und ersetzen, sonst neu.
|
||||||
|
$existing = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants?`$filter=clientId eq '$spId' and resourceId eq '$graphSpId'").value | Select-Object -First 1
|
||||||
|
$grantBody = @{
|
||||||
|
clientId = $spId
|
||||||
|
consentType = 'AllPrincipals'
|
||||||
|
resourceId = $graphSpId
|
||||||
|
scope = $scopeString
|
||||||
|
}
|
||||||
|
if ($existing) {
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/$($existing.id)" `
|
||||||
|
-Body (@{ scope = $scopeString } | ConvertTo-Json) -ContentType 'application/json' | Out-Null
|
||||||
|
} else {
|
||||||
|
Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants' `
|
||||||
|
-Body ($grantBody | ConvertTo-Json) -ContentType 'application/json' | Out-Null
|
||||||
|
}
|
||||||
|
Write-Host " Admin-Consent erteilt fuer: $scopeString" -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host " uebersprungen (-GrantAdminConsent nicht gesetzt)." -ForegroundColor DarkGray
|
||||||
|
Write-Host " Consent im Portal: Entra -> App-Registrierungen -> $DisplayName -> API-Berechtigungen -> Administratorzustimmung erteilen" -ForegroundColor DarkGray
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Ergebnis -----------------------------------------------------------------
|
||||||
|
Write-Host "[6/6] Fertig." -ForegroundColor Cyan
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host " Im Intune Manager eintragen:" -ForegroundColor White
|
||||||
|
Write-Host " Tenant ID : $($ctx.TenantId)"
|
||||||
|
Write-Host " Client ID : $appId"
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host " Gesetzte delegierte Berechtigungen:" -ForegroundColor White
|
||||||
|
$perms | ForEach-Object { Write-Host " - $_" }
|
||||||
@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
|
|||||||
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
||||||
}
|
}
|
||||||
|
|
||||||
$version = "0.1.25"
|
$version = "0.1.28"
|
||||||
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
||||||
$stage = "$env:TEMP\IntuneManagerStage"
|
$stage = "$env:TEMP\IntuneManagerStage"
|
||||||
$installerDir = "$src\installer"
|
$installerDir = "$src\installer"
|
||||||
|
|||||||
+248
-72
@@ -47,12 +47,19 @@ function Invoke-ApiHandler {
|
|||||||
|
|
||||||
"POST /api/assignments/apply" { return Invoke-ApplyEndpoint -Body $Body }
|
"POST /api/assignments/apply" { return Invoke-ApplyEndpoint -Body $Body }
|
||||||
|
|
||||||
|
"GET /api/tenants" { return Get-TenantsEndpoint }
|
||||||
|
"POST /api/tenants/switch" { return Switch-TenantEndpoint -Body $Body }
|
||||||
|
|
||||||
"GET /api/policies/compliance" { return Get-CompliancePoliciesEndpoint }
|
"GET /api/policies/compliance" { return Get-CompliancePoliciesEndpoint }
|
||||||
"GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
|
"GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
|
||||||
"GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
|
"GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
|
||||||
|
"GET /api/policies/administrativetemplate" { return Get-AdministrativeTemplatesEndpoint }
|
||||||
"POST /api/policies/export" { return Export-PoliciesEndpoint -Body $Body }
|
"POST /api/policies/export" { return Export-PoliciesEndpoint -Body $Body }
|
||||||
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
||||||
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
||||||
|
"POST /api/policies/assign" { return Invoke-PolicyAssignEndpoint -Body $Body }
|
||||||
|
"POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
|
||||||
|
"POST /api/pickfolder" { return Invoke-FolderPickerEndpoint -Body $Body }
|
||||||
}
|
}
|
||||||
|
|
||||||
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
||||||
@@ -167,9 +174,11 @@ function Get-SettingsEndpoint {
|
|||||||
function Sync-ConfigFromSettings {
|
function Sync-ConfigFromSettings {
|
||||||
# $script:Config spiegelt die settings.connection-Werte. Wird nach jedem
|
# $script:Config spiegelt die settings.connection-Werte. Wird nach jedem
|
||||||
# Save aufgerufen damit Connect-Aufrufe sofort die neuen IDs verwenden.
|
# Save aufgerufen damit Connect-Aufrufe sofort die neuen IDs verwenden.
|
||||||
$script:Config.TenantId = $script:Settings.connection.tenantId
|
# Im Multi-Tenant-Modus kommen TenantId/ClientId aus dem aktiven Profil.
|
||||||
$script:Config.ClientId = $script:Settings.connection.clientId
|
$active = Get-ActiveConnection -Settings $script:Settings
|
||||||
$script:Config.ClientIdRo = $script:Settings.connection.clientIdRo
|
$script:Config.TenantId = $active.tenantId
|
||||||
|
$script:Config.ClientId = $active.clientId
|
||||||
|
$script:Config.ClientIdRo = $active.clientIdRo
|
||||||
$script:Config.Scopes = @($script:Settings.connection.scopes)
|
$script:Config.Scopes = @($script:Settings.connection.scopes)
|
||||||
$script:Config.ScopesRo = @($script:Settings.connection.scopesRo)
|
$script:Config.ScopesRo = @($script:Settings.connection.scopesRo)
|
||||||
# Policy Export/Import braucht den Configuration-Scope. Immer sicherstellen —
|
# Policy Export/Import braucht den Configuration-Scope. Immer sicherstellen —
|
||||||
@@ -207,17 +216,26 @@ function Save-SettingsEndpoint {
|
|||||||
# Vergleich altes vs. neues Setting — Cache nur leeren wo wirklich noetig.
|
# Vergleich altes vs. neues Setting — Cache nur leeren wo wirklich noetig.
|
||||||
$old = $script:Settings
|
$old = $script:Settings
|
||||||
|
|
||||||
|
# Aktive Verbindung vergleichen (deckt Single-Felder UND das aktive
|
||||||
|
# Multi-Tenant-Profil ab), plus Moduswechsel Single<->Multi.
|
||||||
|
$activeOld = Get-ActiveConnection -Settings $old
|
||||||
|
$activeNew = Get-ActiveConnection -Settings $merged
|
||||||
|
$multiOld = ($old.connection.PSObject.Properties['multiTenant'] -and [bool]$old.connection.multiTenant)
|
||||||
|
$multiNew = ($merged.connection.PSObject.Properties['multiTenant'] -and [bool]$merged.connection.multiTenant)
|
||||||
$connectionChanged = (
|
$connectionChanged = (
|
||||||
$merged.connection.tenantId -ne $old.connection.tenantId -or
|
$activeNew.tenantId -ne $activeOld.tenantId -or
|
||||||
$merged.connection.clientId -ne $old.connection.clientId -or
|
$activeNew.clientId -ne $activeOld.clientId -or
|
||||||
(($merged.connection.scopes -join "|") -ne ($old.connection.scopes -join "|"))
|
$activeNew.clientIdRo -ne $activeOld.clientIdRo -or
|
||||||
|
(($merged.connection.scopes -join "|") -ne ($old.connection.scopes -join "|")) -or
|
||||||
|
($multiNew -ne $multiOld)
|
||||||
)
|
)
|
||||||
# Normalisierte Praefix-Listen vergleichen (deckt sowohl 'prefixes' als auch
|
# Normalisierte Praefix-Listen vergleichen (deckt sowohl 'prefixes' als auch
|
||||||
# den alten Single-String 'prefix' ab; Reihenfolge ignoriert, Case ignoriert).
|
# den alten Single-String 'prefix' ab; Reihenfolge ignoriert, Case ignoriert).
|
||||||
$deptOld = @(Get-DepartmentPrefixes -Settings $old) | Sort-Object -Property { $_.ToLowerInvariant() }
|
$deptOld = @(Get-DepartmentPrefixes -Settings $old) | Sort-Object -Property { $_.ToLowerInvariant() }
|
||||||
$deptNew = @(Get-DepartmentPrefixes -Settings $merged) | Sort-Object -Property { $_.ToLowerInvariant() }
|
$deptNew = @(Get-DepartmentPrefixes -Settings $merged) | Sort-Object -Property { $_.ToLowerInvariant() }
|
||||||
$deptChanged = (($deptOld -join '|') -ne ($deptNew -join '|'))
|
$deptChanged = (($deptOld -join '|') -ne ($deptNew -join '|'))
|
||||||
$rpaChanged = (($merged.rpa.groupNames -join "|") -ne ($old.rpa.groupNames -join "|"))
|
# Tenant-bewusst: vergleicht die aufgeloesten RPA-Namen (Profil-Override oder global).
|
||||||
|
$rpaChanged = ((@(Get-RpaGroupNames -Settings $merged) -join "|") -ne (@(Get-RpaGroupNames -Settings $old) -join "|"))
|
||||||
$userSearchChanged = (
|
$userSearchChanged = (
|
||||||
(($merged.userSearch.fields -join "|") -ne ($old.userSearch.fields -join "|"))
|
(($merged.userSearch.fields -join "|") -ne ($old.userSearch.fields -join "|"))
|
||||||
)
|
)
|
||||||
@@ -573,16 +591,24 @@ function Get-StatusEndpoint {
|
|||||||
error = $cs.Error
|
error = $cs.Error
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
$activeConn = Get-ActiveConnection -Settings $script:Settings
|
||||||
|
$activeId = ""
|
||||||
|
if ($script:Settings.connection.PSObject.Properties['activeTenantId']) {
|
||||||
|
$activeId = [string]$script:Settings.connection.activeTenantId
|
||||||
|
}
|
||||||
return @{
|
return @{
|
||||||
connected = $script:State.Connected
|
connected = $script:State.Connected
|
||||||
account = $script:State.Account
|
account = $script:State.Account
|
||||||
tenantId = $script:State.TenantId
|
tenantId = $script:State.TenantId
|
||||||
readOnly = [bool]$script:State.ReadOnly
|
readOnly = [bool]$script:State.ReadOnly
|
||||||
groupsLoaded = $script:State.Groups.Count
|
groupsLoaded = $script:State.Groups.Count
|
||||||
rpaLoaded = $script:State.RpaGroups.Count
|
rpaLoaded = $script:State.RpaGroups.Count
|
||||||
appsLoaded = $script:State.Apps.Count
|
appsLoaded = $script:State.Apps.Count
|
||||||
sessionCount = $script:State.Session.Count
|
sessionCount = $script:State.Session.Count
|
||||||
connect = $connect
|
connect = $connect
|
||||||
|
multiTenant = (Test-ConnectionMultiTenant)
|
||||||
|
tenantLabel = $activeConn.label
|
||||||
|
activeTenantId = $activeId
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -906,7 +932,30 @@ public class WinFocusHelper2 {
|
|||||||
[DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc lpEnumFunc, IntPtr lParam);
|
[DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc lpEnumFunc, IntPtr lParam);
|
||||||
[DllImport("user32.dll", CharSet = CharSet.Auto)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
|
[DllImport("user32.dll", CharSet = CharSet.Auto)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
|
||||||
[DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
|
[DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
|
||||||
|
[DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
|
||||||
|
[DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, IntPtr lpdwProcessId);
|
||||||
|
[DllImport("user32.dll")] public static extern bool AttachThreadInput(uint idAttach, uint idAttachTo, bool fAttach);
|
||||||
|
[DllImport("kernel32.dll")] public static extern uint GetCurrentThreadId();
|
||||||
|
[DllImport("user32.dll")] public static extern void keybd_event(byte bVk, byte bScan, uint dwFlags, UIntPtr dwExtraInfo);
|
||||||
public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
|
public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
|
||||||
|
// Holt ein Fenster zuverlaessig in den Vordergrund und umgeht den Windows-
|
||||||
|
// Foreground-Lock: kurzer ALT-Tap (entsperrt SetForegroundWindow) + Anhaengen
|
||||||
|
// an den Input-Thread des aktuellen Vordergrundfensters (AttachThreadInput).
|
||||||
|
public static void ForceForeground(IntPtr hWnd) {
|
||||||
|
keybd_event(0x12, 0, 0, UIntPtr.Zero); // ALT down -> Foreground-Lock loesen
|
||||||
|
keybd_event(0x12, 0, 2, UIntPtr.Zero); // ALT up (KEYEVENTF_KEYUP = 2)
|
||||||
|
IntPtr fore = GetForegroundWindow();
|
||||||
|
uint foreThread = GetWindowThreadProcessId(fore, IntPtr.Zero);
|
||||||
|
uint thisThread = GetCurrentThreadId();
|
||||||
|
bool attached = false;
|
||||||
|
if (foreThread != 0 && foreThread != thisThread) {
|
||||||
|
attached = AttachThreadInput(foreThread, thisThread, true);
|
||||||
|
}
|
||||||
|
ShowWindow(hWnd, 9); // SW_RESTORE
|
||||||
|
BringWindowToTop(hWnd);
|
||||||
|
SetForegroundWindow(hWnd);
|
||||||
|
if (attached) { AttachThreadInput(foreThread, thisThread, false); }
|
||||||
|
}
|
||||||
}
|
}
|
||||||
'@ -ErrorAction SilentlyContinue
|
'@ -ErrorAction SilentlyContinue
|
||||||
$deadline = (Get-Date).AddSeconds(30)
|
$deadline = (Get-Date).AddSeconds(30)
|
||||||
@@ -928,9 +977,7 @@ public class WinFocusHelper2 {
|
|||||||
return $true
|
return $true
|
||||||
}, [IntPtr]::Zero) | Out-Null
|
}, [IntPtr]::Zero) | Out-Null
|
||||||
if ($script:found -ne [IntPtr]::Zero) {
|
if ($script:found -ne [IntPtr]::Zero) {
|
||||||
[WinFocusHelper2]::ShowWindow($script:found, 9) | Out-Null # SW_RESTORE
|
[WinFocusHelper2]::ForceForeground($script:found)
|
||||||
[WinFocusHelper2]::BringWindowToTop($script:found) | Out-Null
|
|
||||||
[WinFocusHelper2]::SetForegroundWindow($script:found) | Out-Null
|
|
||||||
Start-Sleep -Milliseconds 800
|
Start-Sleep -Milliseconds 800
|
||||||
}
|
}
|
||||||
Start-Sleep -Milliseconds 400
|
Start-Sleep -Milliseconds 400
|
||||||
@@ -1021,6 +1068,66 @@ function Test-Connected {
|
|||||||
return $null
|
return $null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
# Multi-Tenant
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
function Test-ConnectionMultiTenant {
|
||||||
|
$c = $script:Settings.connection
|
||||||
|
return ($c -and $c.PSObject.Properties['multiTenant'] -and [bool]$c.multiTenant)
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-TenantsEndpoint {
|
||||||
|
# Liste der Tenant-Profile fuer den Topbar-Umschalter. Client-IDs werden
|
||||||
|
# nicht mitgeliefert (fuer die Anzeige nicht noetig).
|
||||||
|
$c = $script:Settings.connection
|
||||||
|
$isMulti = Test-ConnectionMultiTenant
|
||||||
|
$items = @()
|
||||||
|
if ($isMulti -and $c.PSObject.Properties['tenants']) {
|
||||||
|
foreach ($t in @($c.tenants | Where-Object { $_ })) {
|
||||||
|
$items += @{
|
||||||
|
id = [string]$t.id
|
||||||
|
label = [string]$t.label
|
||||||
|
tenantId = [string]$t.tenantId
|
||||||
|
hasRo = [bool]($t.clientIdRo -and ([string]$t.clientIdRo).Trim())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$activeId = if ($c.PSObject.Properties['activeTenantId']) { [string]$c.activeTenantId } else { "" }
|
||||||
|
if ($isMulti -and $items.Count -gt 0 -and -not (@($items | Where-Object { $_.id -eq $activeId }).Count)) {
|
||||||
|
$activeId = $items[0].id
|
||||||
|
}
|
||||||
|
return @{ multiTenant = $isMulti; activeId = $activeId; items = @($items) }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Switch-TenantEndpoint {
|
||||||
|
param($Body)
|
||||||
|
if (-not (Test-ConnectionMultiTenant)) {
|
||||||
|
return @{ __status = 400; error = "Multi-Tenant-Modus ist nicht aktiv." }
|
||||||
|
}
|
||||||
|
$id = if ($Body) { [string]$Body.id } else { "" }
|
||||||
|
if ([string]::IsNullOrWhiteSpace($id)) { return @{ __status = 400; error = "Tenant-id fehlt." } }
|
||||||
|
|
||||||
|
$c = $script:Settings.connection
|
||||||
|
$tenants = @()
|
||||||
|
if ($c.PSObject.Properties['tenants']) { $tenants = @($c.tenants | Where-Object { $_ }) }
|
||||||
|
$profile = $tenants | Where-Object { [string]$_.id -eq $id } | Select-Object -First 1
|
||||||
|
if (-not $profile) { return @{ __status = 404; error = "Tenant-Profil nicht gefunden." } }
|
||||||
|
|
||||||
|
# Aktives Profil setzen + persistieren, Config spiegeln.
|
||||||
|
$script:Settings.connection.activeTenantId = $id
|
||||||
|
try { Write-Settings -Settings $script:Settings } catch {
|
||||||
|
Write-Host "[TENANT] Speichern des aktiven Profils fehlgeschlagen: $($_.Exception.Message)" -ForegroundColor Yellow
|
||||||
|
}
|
||||||
|
Sync-ConfigFromSettings
|
||||||
|
|
||||||
|
# Bestehende Verbindung trennen (raeumt alle Tenant-Caches ab), dann sofort
|
||||||
|
# mit dem neuen Tenant neu verbinden.
|
||||||
|
Invoke-DisconnectEndpoint | Out-Null
|
||||||
|
Write-Host "[TENANT] Wechsel zu '$([string]$profile.label)' ($($profile.tenantId))" -ForegroundColor Cyan
|
||||||
|
return Invoke-ConnectEndpoint
|
||||||
|
}
|
||||||
|
|
||||||
function Get-AppCategoryNames {
|
function Get-AppCategoryNames {
|
||||||
# Extrahiert die Kategorie-Namen aus dem rohen Graph-Categories-Feld.
|
# Extrahiert die Kategorie-Namen aus dem rohen Graph-Categories-Feld.
|
||||||
# Robust gegen alle Source-Types die MgGraph/Invoke-MgGraphRequest in
|
# Robust gegen alle Source-Types die MgGraph/Invoke-MgGraphRequest in
|
||||||
@@ -1152,7 +1259,8 @@ function Get-RpaGroupsEndpoint {
|
|||||||
$err = Test-Connected
|
$err = Test-Connected
|
||||||
if ($err) { return $err }
|
if ($err) { return $err }
|
||||||
|
|
||||||
$rpaNames = @($script:Settings.rpa.groupNames | Where-Object { $_ })
|
# Tenant-bewusst: aktives Profil kann eigene RPA-Gruppen definieren, sonst global.
|
||||||
|
$rpaNames = @(Get-RpaGroupNames -Settings $script:Settings)
|
||||||
if ($rpaNames.Count -eq 0) {
|
if ($rpaNames.Count -eq 0) {
|
||||||
# Settings leer -> ehrlich melden, das Frontend zeigt einen Konfig-Hinweis.
|
# Settings leer -> ehrlich melden, das Frontend zeigt einen Konfig-Hinweis.
|
||||||
return @{ items = @(); count = 0; notConfigured = $true }
|
return @{ items = @(); count = 0; notConfigured = $true }
|
||||||
@@ -1211,10 +1319,10 @@ function New-GroupEndpoint {
|
|||||||
return @{ __status = 400; error = "Intent muss 'required' oder 'available' sein" }
|
return @{ __status = 400; error = "Intent muss 'required' oder 'available' sein" }
|
||||||
}
|
}
|
||||||
|
|
||||||
$namingObj = if ($intent -eq "available") { $script:Settings.availableGroupNaming } else { $script:Settings.requiredGroupNaming }
|
# Naming tenant-bewusst aufloesen (aktives Profil kann ueberschreiben).
|
||||||
$defaultSuffix = if ($intent -eq "available") { "-available" } else { "-required" }
|
$naming = Get-GroupNaming -Settings $script:Settings -Intent $intent
|
||||||
$namingPrefix = if ($namingObj -and $namingObj.prefix) { $namingObj.prefix } else { "intune-win-app-" }
|
$namingPrefix = $naming.prefix
|
||||||
$namingSuffix = if ($namingObj -and $namingObj.suffix) { $namingObj.suffix } else { $defaultSuffix }
|
$namingSuffix = $naming.suffix
|
||||||
|
|
||||||
$cleaned = if ($customName) { Format-GroupNameSlug -Name $customName } else { Format-GroupNameSlug -Name $appName }
|
$cleaned = if ($customName) { Format-GroupNameSlug -Name $customName } else { Format-GroupNameSlug -Name $appName }
|
||||||
$displayName = "$namingPrefix$cleaned$namingSuffix".ToLower()
|
$displayName = "$namingPrefix$cleaned$namingSuffix".ToLower()
|
||||||
@@ -1887,8 +1995,49 @@ function Get-AppInstallReportEndpoint {
|
|||||||
return @{ items = $items; count = $items.Count }
|
return @{ items = $items; count = $items.Count }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Intune-Report via asynchronem Export-Job (exportJobs) -> CSV-Zeilen.
|
||||||
|
# Kein 'select' (unbekannte Spalten wuerden 400 ausloesen) — der Aufrufer
|
||||||
|
# greift tolerant auf die tatsaechlich gelieferten Spalten zu.
|
||||||
|
function Get-IntuneReportRows {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory=$true)][string]$ReportName,
|
||||||
|
[string]$Filter = '',
|
||||||
|
[int]$TimeoutSec = 120
|
||||||
|
)
|
||||||
|
$jobBody = @{ reportName = $ReportName; filter = $Filter } | ConvertTo-Json -Compress
|
||||||
|
$job = Invoke-MgGraphRequestRetry `
|
||||||
|
-Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs' `
|
||||||
|
-Method POST -Body $jobBody -ContentType 'application/json'
|
||||||
|
$jobId = $job.id
|
||||||
|
$status = $job.status
|
||||||
|
$waited = 0
|
||||||
|
while ($status -ne 'completed' -and $status -ne 'failed' -and $waited -lt $TimeoutSec) {
|
||||||
|
Start-Sleep -Seconds 3
|
||||||
|
$waited += 3
|
||||||
|
$job = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs/$jobId"
|
||||||
|
$status = $job.status
|
||||||
|
}
|
||||||
|
if ($status -ne 'completed') { throw "Export-Job '$ReportName' nicht abgeschlossen (Status: $status nach $waited s)" }
|
||||||
|
|
||||||
|
$tmpZip = [System.IO.Path]::GetTempFileName() + '.zip'
|
||||||
|
$tmpDir = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "IntuneReport_$jobId")
|
||||||
|
try {
|
||||||
|
Invoke-WebRequest -Uri $job.url -OutFile $tmpZip -UseBasicParsing
|
||||||
|
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
||||||
|
[System.IO.Compression.ZipFile]::ExtractToDirectory($tmpZip, $tmpDir)
|
||||||
|
$csv = Get-ChildItem -Path $tmpDir -Filter '*.csv' | Select-Object -First 1
|
||||||
|
if (-not $csv) { throw "Keine CSV im Export-ZIP gefunden" }
|
||||||
|
return @(Import-Csv -Path $csv.FullName -Encoding UTF8)
|
||||||
|
} finally {
|
||||||
|
Remove-Item -Path $tmpZip -Force -ErrorAction SilentlyContinue
|
||||||
|
Remove-Item -Path $tmpDir -Recurse -Force -ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
function Get-AppDeviceStatusEndpoint {
|
function Get-AppDeviceStatusEndpoint {
|
||||||
# Verwendet getDeviceInstallStatusReport (synchron, paginiert) statt deviceStatuses.
|
# Per-Device-Installationsstatus einer App via Export-Job 'DeviceInstallStatusByApp'.
|
||||||
|
# (Der frueher genutzte synchrone Endpoint getDeviceInstallStatusReport existiert
|
||||||
|
# nicht mehr -> 400 "Resource not found for the segment".)
|
||||||
param([hashtable]$Query)
|
param([hashtable]$Query)
|
||||||
$err = Test-Connected
|
$err = Test-Connected
|
||||||
if ($err) { return $err }
|
if ($err) { return $err }
|
||||||
@@ -1898,58 +2047,38 @@ function Get-AppDeviceStatusEndpoint {
|
|||||||
return @{ __status = 400; error = "appId fehlt" }
|
return @{ __status = 400; error = "appId fehlt" }
|
||||||
}
|
}
|
||||||
|
|
||||||
Write-Host "[DEVSTATUS] Lade Install-Status fuer App $appId via Reports-API..." -ForegroundColor DarkCyan
|
Write-Host "[DEVSTATUS] Export-Job (DeviceInstallStatusByApp) fuer App $appId..." -ForegroundColor DarkCyan
|
||||||
$pageSize = 50
|
try {
|
||||||
$skip = 0
|
$rows = @(Get-IntuneReportRows -ReportName 'DeviceInstallStatusByApp' -Filter "(ApplicationId eq '$appId')")
|
||||||
$allRows = @()
|
} catch {
|
||||||
$cols = $null
|
$msg = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $msg = $_.ErrorDetails.Message } } catch {}
|
||||||
do {
|
return @{ __status = 500; error = "Graph-Fehler: $msg" }
|
||||||
$bodyJson = "{""filter"":""(ApplicationId eq '$appId')"",""select"":[],""skip"":$skip,""top"":$pageSize,""orderBy"":[]}"
|
|
||||||
try {
|
|
||||||
$resp = Invoke-MgGraphRequestRetry `
|
|
||||||
-Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/getDeviceInstallStatusReport' `
|
|
||||||
-Method POST -Body $bodyJson -ContentType 'application/json'
|
|
||||||
} catch {
|
|
||||||
return @{ __status = 500; error = "Graph-Fehler: $($_.Exception.Message)" }
|
|
||||||
}
|
|
||||||
|
|
||||||
if (-not $cols) {
|
|
||||||
$cols = @($resp.Schema | ForEach-Object { $_.Column })
|
|
||||||
Write-Host " [DEVSTATUS] Spalten: $($cols -join ',')" -ForegroundColor DarkGray
|
|
||||||
}
|
|
||||||
$rows = @($resp.Values)
|
|
||||||
$allRows += $rows
|
|
||||||
$skip += $pageSize
|
|
||||||
} while ($rows.Count -eq $pageSize)
|
|
||||||
|
|
||||||
Write-Host " -> $($allRows.Count) Eintraege" -ForegroundColor DarkGray
|
|
||||||
|
|
||||||
if (-not $cols -or $allRows.Count -eq 0) {
|
|
||||||
return @{ items = @(); count = 0 }
|
|
||||||
}
|
}
|
||||||
|
Write-Host " -> $($rows.Count) Eintraege" -ForegroundColor DarkGray
|
||||||
|
if ($rows.Count -eq 0) { return @{ items = @(); count = 0 } }
|
||||||
|
|
||||||
function ColIdx($name) { [Array]::IndexOf($cols, $name) }
|
Write-Host " [DEVSTATUS] Spalten: $(($rows[0].PSObject.Properties.Name) -join ',')" -ForegroundColor DarkGray
|
||||||
$iDevice = ColIdx 'DeviceName'
|
|
||||||
$iUser = ColIdx 'UserName'
|
|
||||||
$iState = ColIdx 'InstallState'
|
|
||||||
$iDetail = ColIdx 'InstallStateDetail'
|
|
||||||
$iErr = ColIdx 'ErrorCode'
|
|
||||||
$iOs = ColIdx 'OSVersion'
|
|
||||||
$iSync = ColIdx 'LastModifiedDateTime'
|
|
||||||
if ($iOs -lt 0) { $iOs = ColIdx 'OsVersion' }
|
|
||||||
if ($iSync -lt 0) { $iSync = ColIdx 'LastSyncDateTime' }
|
|
||||||
|
|
||||||
$result = @($allRows | ForEach-Object {
|
# Spaltennamen des Reports koennen variieren -> tolerant mit Fallbacks lesen.
|
||||||
|
$col = {
|
||||||
|
param($row, [string[]]$names)
|
||||||
|
foreach ($n in $names) {
|
||||||
|
$p = $row.PSObject.Properties[$n]
|
||||||
|
if ($p -and $null -ne $p.Value -and [string]$p.Value -ne '') { return [string]$p.Value }
|
||||||
|
}
|
||||||
|
return ''
|
||||||
|
}
|
||||||
|
$result = @($rows | ForEach-Object {
|
||||||
$r = $_
|
$r = $_
|
||||||
[pscustomobject]@{
|
[pscustomobject]@{
|
||||||
DeviceName = if ($iDevice -ge 0) { [string]$r[$iDevice] } else { '' }
|
DeviceName = & $col $r @('DeviceName')
|
||||||
UserName = if ($iUser -ge 0) { [string]$r[$iUser] } else { '' }
|
UserName = & $col $r @('UserName','UserPrincipalName')
|
||||||
InstallState = if ($iState -ge 0) { [string]$r[$iState] } else { '' }
|
InstallState = & $col $r @('InstallState_loc','InstallState','AppInstallState_loc','AppInstallState')
|
||||||
InstallStateDetail = if ($iDetail -ge 0) { [string]$r[$iDetail] } else { '' }
|
InstallStateDetail = & $col $r @('InstallStateDetail_loc','InstallStateDetail','AppInstallStateDetail_loc','AppInstallStateDetail')
|
||||||
ErrorCode = if ($iErr -ge 0) { [string]$r[$iErr] } else { '' }
|
ErrorCode = & $col $r @('ErrorCode','HexErrorCode')
|
||||||
OsVersion = if ($iOs -ge 0) { [string]$r[$iOs] } else { '' }
|
OsVersion = & $col $r @('OSVersion','OsVersion','Platform')
|
||||||
LastSyncDateTime = if ($iSync -ge 0) { [string]$r[$iSync] } else { '' }
|
LastSyncDateTime = & $col $r @('LastModifiedDateTime','LastSyncDateTime')
|
||||||
}
|
}
|
||||||
})
|
})
|
||||||
|
|
||||||
@@ -2514,6 +2643,53 @@ function Invoke-FilePickerEndpoint {
|
|||||||
return @{ ok = $true; path = $path }
|
return @{ ok = $true; path = $path }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Show-OpenFolderDialog {
|
||||||
|
# Wie Show-OpenFileDialog, aber FolderBrowserDialog in einem STA-Prozess.
|
||||||
|
param([string]$Title = "Ordner auswaehlen")
|
||||||
|
$tEsc = $Title -replace "'", "''"
|
||||||
|
$inner = @"
|
||||||
|
`$ProgressPreference = 'SilentlyContinue'
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
`$dlg = New-Object System.Windows.Forms.FolderBrowserDialog
|
||||||
|
`$dlg.Description = '$tEsc'
|
||||||
|
`$owner = New-Object System.Windows.Forms.Form
|
||||||
|
`$owner.TopMost = `$true
|
||||||
|
`$owner.ShowInTaskbar = `$false
|
||||||
|
`$owner.WindowState = 'Minimized'
|
||||||
|
`$owner.Show(); `$owner.Activate()
|
||||||
|
`$r = `$dlg.ShowDialog(`$owner)
|
||||||
|
`$owner.Dispose()
|
||||||
|
if (`$r -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write(`$dlg.SelectedPath) }
|
||||||
|
"@
|
||||||
|
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($inner))
|
||||||
|
$psi = New-Object System.Diagnostics.ProcessStartInfo
|
||||||
|
$psi.FileName = "powershell.exe"
|
||||||
|
$psi.Arguments = "-NoProfile -STA -ExecutionPolicy Bypass -EncodedCommand $encoded"
|
||||||
|
$psi.UseShellExecute = $false
|
||||||
|
$psi.RedirectStandardOutput = $true
|
||||||
|
$psi.CreateNoWindow = $true
|
||||||
|
try {
|
||||||
|
$proc = [System.Diagnostics.Process]::Start($psi)
|
||||||
|
$path = $proc.StandardOutput.ReadToEnd()
|
||||||
|
$proc.WaitForExit()
|
||||||
|
} catch {
|
||||||
|
throw "Ordner-Dialog-Prozess konnte nicht gestartet werden: $($_.Exception.Message)"
|
||||||
|
}
|
||||||
|
return ([string]$path).Trim()
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-FolderPickerEndpoint {
|
||||||
|
param($Body)
|
||||||
|
$title = if ($Body -and $Body.title) { [string]$Body.title } else { "Git-Repo-Ordner auswaehlen" }
|
||||||
|
try {
|
||||||
|
$path = Show-OpenFolderDialog -Title $title
|
||||||
|
} catch {
|
||||||
|
return @{ __status = 500; error = "Ordner-Dialog fehlgeschlagen: $($_.Exception.Message)" }
|
||||||
|
}
|
||||||
|
if (-not $path) { return @{ ok = $true; cancelled = $true } }
|
||||||
|
return @{ ok = $true; path = $path }
|
||||||
|
}
|
||||||
|
|
||||||
# App-Typ (@odata.type) -> unterstuetzter Content-Update-Pfad + erlaubte Endung.
|
# App-Typ (@odata.type) -> unterstuetzter Content-Update-Pfad + erlaubte Endung.
|
||||||
# Phase 1: nur win32LobApp/.intunewin aktiv; MSI/MSIX kommen in Phase 2/3.
|
# Phase 1: nur win32LobApp/.intunewin aktiv; MSI/MSIX kommen in Phase 2/3.
|
||||||
function Get-AppContentTypeMap {
|
function Get-AppContentTypeMap {
|
||||||
|
|||||||
+160
-17
@@ -44,6 +44,10 @@ function Get-DefaultSettings {
|
|||||||
# Theme) sind branchenuebliche Startpunkte und bleiben besetzt.
|
# Theme) sind branchenuebliche Startpunkte und bleiben besetzt.
|
||||||
return [pscustomobject]@{
|
return [pscustomobject]@{
|
||||||
connection = [pscustomobject]@{
|
connection = [pscustomobject]@{
|
||||||
|
# Verbindungsmodus:
|
||||||
|
# $false = Single-Tenant (klassisch: die flachen Felder unten)
|
||||||
|
# $true = Multi-Tenant (Liste 'tenants' + 'activeTenantId')
|
||||||
|
multiTenant = $false
|
||||||
tenantId = ""
|
tenantId = ""
|
||||||
clientId = ""
|
clientId = ""
|
||||||
clientIdRo = ""
|
clientIdRo = ""
|
||||||
@@ -53,6 +57,10 @@ function Get-DefaultSettings {
|
|||||||
# msgraph-Skill gegen den offiziellen Graph-Permission-Index.
|
# msgraph-Skill gegen den offiziellen Graph-Permission-Index.
|
||||||
scopes = @("Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.Read.All", "DeviceManagementApps.ReadWrite.All")
|
scopes = @("Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.Read.All", "DeviceManagementApps.ReadWrite.All")
|
||||||
scopesRo = @("Group.Read.All", "GroupMember.Read.All", "User.Read.All", "DeviceManagementApps.Read.All")
|
scopesRo = @("Group.Read.All", "GroupMember.Read.All", "User.Read.All", "DeviceManagementApps.Read.All")
|
||||||
|
# Multi-Tenant-Profile: je Tenant eigene App-Registrierung(en).
|
||||||
|
# [{ id, label, tenantId, clientId, clientIdRo }]. Scopes gelten global.
|
||||||
|
tenants = @()
|
||||||
|
activeTenantId = ""
|
||||||
}
|
}
|
||||||
departments = [pscustomobject]@{
|
departments = [pscustomobject]@{
|
||||||
# Ein oder mehrere Praefixe fuer den Abteilungs-Modus (linke Spalte).
|
# Ein oder mehrere Praefixe fuer den Abteilungs-Modus (linke Spalte).
|
||||||
@@ -66,6 +74,13 @@ function Get-DefaultSettings {
|
|||||||
# Explizite Liste der RPA-Gruppen. Leer = RPA-Tab zeigt Hinweis.
|
# Explizite Liste der RPA-Gruppen. Leer = RPA-Tab zeigt Hinweis.
|
||||||
groupNames = @()
|
groupNames = @()
|
||||||
}
|
}
|
||||||
|
policyBackup = [pscustomobject]@{
|
||||||
|
# Lokaler Git-Repo-Ordner fuer Policy-Snapshots. Leer = Funktion aus.
|
||||||
|
gitRepoPath = ""
|
||||||
|
# Nach dem Commit automatisch 'git push' ausfuehren (nutzt den
|
||||||
|
# vorhandenen Git-Credential-Helper; kein Token in der App).
|
||||||
|
push = $false
|
||||||
|
}
|
||||||
userSearch = [pscustomobject]@{
|
userSearch = [pscustomobject]@{
|
||||||
# In welchen Feldern bei der Benutzersuche gesucht wird.
|
# In welchen Feldern bei der Benutzersuche gesucht wird.
|
||||||
# Erlaubt: displayName, userPrincipalName, mail, department.
|
# Erlaubt: displayName, userPrincipalName, mail, department.
|
||||||
@@ -164,18 +179,27 @@ function Merge-Settings {
|
|||||||
}
|
}
|
||||||
|
|
||||||
function Get-DepartmentPrefixes {
|
function Get-DepartmentPrefixes {
|
||||||
# Zentrale Quelle fuer die Abteilungs-Praefixe. Bevorzugt das neue
|
# Zentrale Quelle fuer die Abteilungs-Praefixe. Multi-Tenant: hat das aktive
|
||||||
# 'prefixes'-Array; faellt sonst auf den alten Single-String 'prefix'
|
# Profil eigene 'prefixes', gelten diese (Override); sonst die globalen
|
||||||
# zurueck (Rueckwaerts-Kompatibilitaet mit existierenden settings.json).
|
# departments.prefixes / alter Single-String 'prefix' (Rueckwaerts-Kompat).
|
||||||
# Liefert immer ein String-Array (getrimmt, dedupliziert, ohne leere
|
# Liefert immer ein String-Array (getrimmt, dedupliziert, ohne leere).
|
||||||
# Eintraege), ggf. leer wenn nichts konfiguriert ist.
|
|
||||||
param($Settings)
|
param($Settings)
|
||||||
$out = [System.Collections.Generic.List[string]]::new()
|
$out = [System.Collections.Generic.List[string]]::new()
|
||||||
if ($null -eq $Settings -or $null -eq $Settings.departments) { return ,$out.ToArray() }
|
if ($null -eq $Settings) { return ,$out.ToArray() }
|
||||||
$d = $Settings.departments
|
|
||||||
$candidates = @()
|
$candidates = @()
|
||||||
if ($d.PSObject.Properties['prefixes']) { $candidates += @($d.prefixes) }
|
# 1) Tenant-Override (aktives Profil)
|
||||||
if ($d.PSObject.Properties['prefix'] -and $d.prefix) { $candidates += @([string]$d.prefix) }
|
$prof = Get-ActiveTenantProfile -Settings $Settings
|
||||||
|
if ($prof -and $prof.PSObject.Properties['prefixes']) {
|
||||||
|
$profPfx = @($prof.prefixes | Where-Object { $_ -and ([string]$_).Trim() })
|
||||||
|
if ($profPfx.Count -gt 0) { $candidates = $profPfx }
|
||||||
|
}
|
||||||
|
# 2) Globale Vorgabe (Fallback, wenn kein Profil-Override)
|
||||||
|
if ($candidates.Count -eq 0 -and $null -ne $Settings.departments) {
|
||||||
|
$d = $Settings.departments
|
||||||
|
if ($d.PSObject.Properties['prefixes']) { $candidates += @($d.prefixes) }
|
||||||
|
if ($d.PSObject.Properties['prefix'] -and $d.prefix) { $candidates += @([string]$d.prefix) }
|
||||||
|
}
|
||||||
$seen = @{}
|
$seen = @{}
|
||||||
foreach ($p in $candidates) {
|
foreach ($p in $candidates) {
|
||||||
if ($null -eq $p) { continue }
|
if ($null -eq $p) { continue }
|
||||||
@@ -189,6 +213,100 @@ function Get-DepartmentPrefixes {
|
|||||||
return $out.ToArray()
|
return $out.ToArray()
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Get-RpaGroupNames {
|
||||||
|
# RPA-Gruppennamen fuer den aktuell aktiven Kontext. Multi-Tenant: aktives
|
||||||
|
# Profil kann eigene 'rpaGroups' definieren (Override); sonst global.
|
||||||
|
param($Settings)
|
||||||
|
if ($null -eq $Settings) { return ,@() }
|
||||||
|
$prof = Get-ActiveTenantProfile -Settings $Settings
|
||||||
|
if ($prof -and $prof.PSObject.Properties['rpaGroups']) {
|
||||||
|
$names = @($prof.rpaGroups | Where-Object { $_ -and ([string]$_).Trim() })
|
||||||
|
if ($names.Count -gt 0) { return ,@($names | ForEach-Object { [string]$_ }) }
|
||||||
|
}
|
||||||
|
if ($Settings.rpa -and $Settings.rpa.PSObject.Properties['groupNames']) {
|
||||||
|
return ,@($Settings.rpa.groupNames | Where-Object { $_ -and ([string]$_).Trim() } | ForEach-Object { [string]$_ })
|
||||||
|
}
|
||||||
|
return ,@()
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-GroupNaming {
|
||||||
|
# Naming-Schema (prefix/suffix) fuer required/available. Multi-Tenant: das
|
||||||
|
# aktive Profil kann prefix und/oder suffix ueberschreiben (pro Feld: nicht-
|
||||||
|
# leerer Profilwert gewinnt, sonst globale Vorgabe, sonst Default).
|
||||||
|
param($Settings, [string]$Intent)
|
||||||
|
$isAvail = ($Intent -eq 'available')
|
||||||
|
$defPrefix = 'intune-win-app-'
|
||||||
|
$defSuffix = if ($isAvail) { '-available' } else { '-required' }
|
||||||
|
|
||||||
|
$globalObj = if ($Settings) { if ($isAvail) { $Settings.availableGroupNaming } else { $Settings.requiredGroupNaming } } else { $null }
|
||||||
|
$prefix = if ($globalObj -and $globalObj.prefix) { [string]$globalObj.prefix } else { $defPrefix }
|
||||||
|
$suffix = if ($globalObj -and $globalObj.suffix) { [string]$globalObj.suffix } else { $defSuffix }
|
||||||
|
|
||||||
|
$prof = Get-ActiveTenantProfile -Settings $Settings
|
||||||
|
if ($prof) {
|
||||||
|
$key = if ($isAvail) { 'availableGroupNaming' } else { 'requiredGroupNaming' }
|
||||||
|
$pObj = if ($prof.PSObject.Properties[$key]) { $prof.$key } else { $null }
|
||||||
|
if ($pObj) {
|
||||||
|
if ($pObj.PSObject.Properties['prefix'] -and ([string]$pObj.prefix).Trim()) { $prefix = [string]$pObj.prefix }
|
||||||
|
if ($pObj.PSObject.Properties['suffix'] -and ([string]$pObj.suffix).Trim()) { $suffix = [string]$pObj.suffix }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return @{ prefix = $prefix; suffix = $suffix }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-ActiveTenantProfile {
|
||||||
|
# Liefert das aktive Tenant-Profil-Objekt (Multi-Tenant) oder $null im
|
||||||
|
# Single-Tenant-Modus / wenn keine Profile existieren.
|
||||||
|
param($Settings)
|
||||||
|
if ($null -eq $Settings) { return $null }
|
||||||
|
$c = $Settings.connection
|
||||||
|
if ($null -eq $c) { return $null }
|
||||||
|
if (-not ($c.PSObject.Properties['multiTenant'] -and [bool]$c.multiTenant)) { return $null }
|
||||||
|
$tenants = @()
|
||||||
|
if ($c.PSObject.Properties['tenants']) { $tenants = @($c.tenants | Where-Object { $_ }) }
|
||||||
|
if ($tenants.Count -eq 0) { return $null }
|
||||||
|
$activeId = if ($c.PSObject.Properties['activeTenantId']) { [string]$c.activeTenantId } else { "" }
|
||||||
|
$p = $tenants | Where-Object { [string]$_.id -eq $activeId } | Select-Object -First 1
|
||||||
|
if (-not $p) { $p = $tenants[0] }
|
||||||
|
return $p
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-ActiveConnection {
|
||||||
|
# Liefert die aktuell zu verwendenden Verbindungswerte als PSCustomObject
|
||||||
|
# { tenantId; clientId; clientIdRo; label }. Im Multi-Tenant-Modus das
|
||||||
|
# aktive Profil (activeTenantId, sonst erstes Profil); sonst die flachen
|
||||||
|
# connection-Felder (Rueckwaerts-Kompatibilitaet / Single-Tenant).
|
||||||
|
param($Settings)
|
||||||
|
$c = $Settings.connection
|
||||||
|
$empty = [pscustomobject]@{ tenantId = ""; clientId = ""; clientIdRo = ""; label = "" }
|
||||||
|
if ($null -eq $c) { return $empty }
|
||||||
|
|
||||||
|
$isMulti = $false
|
||||||
|
if ($c.PSObject.Properties['multiTenant']) { $isMulti = [bool]$c.multiTenant }
|
||||||
|
|
||||||
|
if ($isMulti) {
|
||||||
|
$tenants = @()
|
||||||
|
if ($c.PSObject.Properties['tenants']) { $tenants = @($c.tenants | Where-Object { $_ }) }
|
||||||
|
if ($tenants.Count -eq 0) { return $empty }
|
||||||
|
$activeId = if ($c.PSObject.Properties['activeTenantId']) { [string]$c.activeTenantId } else { "" }
|
||||||
|
$profile = $tenants | Where-Object { [string]$_.id -eq $activeId } | Select-Object -First 1
|
||||||
|
if (-not $profile) { $profile = $tenants[0] }
|
||||||
|
return [pscustomobject]@{
|
||||||
|
tenantId = [string]$profile.tenantId
|
||||||
|
clientId = [string]$profile.clientId
|
||||||
|
clientIdRo = [string]$profile.clientIdRo
|
||||||
|
label = [string]$profile.label
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return [pscustomobject]@{
|
||||||
|
tenantId = [string]$c.tenantId
|
||||||
|
clientId = [string]$c.clientId
|
||||||
|
clientIdRo = [string]$c.clientIdRo
|
||||||
|
label = ""
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
function Read-Settings {
|
function Read-Settings {
|
||||||
$path = Get-SettingsPath
|
$path = Get-SettingsPath
|
||||||
$defaults = Get-DefaultSettings
|
$defaults = Get-DefaultSettings
|
||||||
@@ -216,14 +334,39 @@ function Get-SettingsValidationErrors {
|
|||||||
# Rudimentaere Validierung. Schwere Fehler -> Speichern ablehnen.
|
# Rudimentaere Validierung. Schwere Fehler -> Speichern ablehnen.
|
||||||
param($S)
|
param($S)
|
||||||
$errs = @()
|
$errs = @()
|
||||||
if (-not $S.connection.tenantId -or $S.connection.tenantId -notmatch '^[0-9a-fA-F-]{36}$') {
|
$isMulti = $false
|
||||||
$errs += "Tenant ID muss eine GUID sein."
|
if ($S.connection.PSObject.Properties['multiTenant']) { $isMulti = [bool]$S.connection.multiTenant }
|
||||||
}
|
|
||||||
if (-not $S.connection.clientId -or $S.connection.clientId -notmatch '^[0-9a-fA-F-]{36}$') {
|
if ($isMulti) {
|
||||||
$errs += "Client ID (Read/Write) muss eine GUID sein."
|
# Multi-Tenant: jedes Profil validieren; mindestens eines erforderlich.
|
||||||
}
|
$tenants = @()
|
||||||
if ($S.connection.clientIdRo -and $S.connection.clientIdRo.Trim() -and $S.connection.clientIdRo -notmatch '^[0-9a-fA-F-]{36}$') {
|
if ($S.connection.PSObject.Properties['tenants']) { $tenants = @($S.connection.tenants | Where-Object { $_ }) }
|
||||||
$errs += "Client ID (Read Only) muss eine GUID sein (oder leer lassen)."
|
if ($tenants.Count -eq 0) {
|
||||||
|
$errs += "Multi-Tenant aktiv, aber kein Tenant-Profil angelegt."
|
||||||
|
} else {
|
||||||
|
$seenIds = @{}
|
||||||
|
foreach ($t in $tenants) {
|
||||||
|
$lbl = if ($t.label) { [string]$t.label } else { [string]$t.tenantId }
|
||||||
|
if (-not $t.id -or [string]::IsNullOrWhiteSpace($t.id)) { $errs += "Tenant-Profil ohne interne id."; continue }
|
||||||
|
if ($seenIds.ContainsKey([string]$t.id)) { $errs += "Tenant-Profil-id nicht eindeutig: $($t.id)"; continue }
|
||||||
|
$seenIds[[string]$t.id] = $true
|
||||||
|
if (-not $t.label -or [string]::IsNullOrWhiteSpace($t.label)) { $errs += "Tenant-Profil '$lbl': Bezeichnung erforderlich." }
|
||||||
|
if (-not $t.tenantId -or $t.tenantId -notmatch '^[0-9a-fA-F-]{36}$') { $errs += "Tenant-Profil '$lbl': Tenant ID muss eine GUID sein." }
|
||||||
|
if (-not $t.clientId -or $t.clientId -notmatch '^[0-9a-fA-F-]{36}$') { $errs += "Tenant-Profil '$lbl': Client ID (Read/Write) muss eine GUID sein." }
|
||||||
|
if ($t.clientIdRo -and ([string]$t.clientIdRo).Trim() -and $t.clientIdRo -notmatch '^[0-9a-fA-F-]{36}$') { $errs += "Tenant-Profil '$lbl': Client ID (Read Only) muss eine GUID sein (oder leer)." }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
# Single-Tenant: klassische flache Felder.
|
||||||
|
if (-not $S.connection.tenantId -or $S.connection.tenantId -notmatch '^[0-9a-fA-F-]{36}$') {
|
||||||
|
$errs += "Tenant ID muss eine GUID sein."
|
||||||
|
}
|
||||||
|
if (-not $S.connection.clientId -or $S.connection.clientId -notmatch '^[0-9a-fA-F-]{36}$') {
|
||||||
|
$errs += "Client ID (Read/Write) muss eine GUID sein."
|
||||||
|
}
|
||||||
|
if ($S.connection.clientIdRo -and $S.connection.clientIdRo.Trim() -and $S.connection.clientIdRo -notmatch '^[0-9a-fA-F-]{36}$') {
|
||||||
|
$errs += "Client ID (Read Only) muss eine GUID sein (oder leer lassen)."
|
||||||
|
}
|
||||||
}
|
}
|
||||||
if (-not $S.connection.scopes -or @($S.connection.scopes).Count -eq 0) {
|
if (-not $S.connection.scopes -or @($S.connection.scopes).Count -eq 0) {
|
||||||
$errs += "Mindestens ein Scope erforderlich."
|
$errs += "Mindestens ein Scope erforderlich."
|
||||||
|
|||||||
+383
-13
@@ -1,7 +1,7 @@
|
|||||||
# Import/Export von Intune-Policies.
|
# Import/Export von Intune-Policies.
|
||||||
# Unterstuetzte Typen: Compliance Policies, Configuration Profiles (Templates)
|
# Unterstuetzte Typen: Compliance Policies, Configuration Profiles (Templates),
|
||||||
# und Settings Catalog. Nutzt die bestehende Microsoft-Graph-Verbindung
|
# Settings Catalog und Administrative Vorlagen (ADMX / groupPolicyConfigurations).
|
||||||
# (Connect-MgGraph via Api.ps1).
|
# Nutzt die bestehende Microsoft-Graph-Verbindung (Connect-MgGraph via Api.ps1).
|
||||||
#
|
#
|
||||||
# Zwei Export-Wege, beide aus derselben Aktion:
|
# Zwei Export-Wege, beide aus derselben Aktion:
|
||||||
# 1. Browser-Download — der Endpoint liefert die Export-Objekte im Response,
|
# 1. Browser-Download — der Endpoint liefert die Export-Objekte im Response,
|
||||||
@@ -73,6 +73,20 @@ function Get-PolicyTypeConfig {
|
|||||||
Label = 'Settings Catalog'
|
Label = 'Settings Catalog'
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
'administrativetemplate' {
|
||||||
|
return @{
|
||||||
|
Key = 'administrativetemplate'
|
||||||
|
Collection = 'groupPolicyConfigurations'
|
||||||
|
NameField = 'displayName'
|
||||||
|
# Sonderfall: die konfigurierten Werte liegen nicht inline in der
|
||||||
|
# Policy, sondern in der definitionValues-Subcollection. Deshalb
|
||||||
|
# kein simples $expand -> eigene Behandlung in Get-GraphPolicyDetail.
|
||||||
|
ExportExpand = $null
|
||||||
|
ExportType = 'AdministrativeTemplate'
|
||||||
|
FilePrefix = 'AdminTemplate'
|
||||||
|
Label = 'Administrative Vorlage'
|
||||||
|
}
|
||||||
|
}
|
||||||
default { return $null }
|
default { return $null }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -80,7 +94,7 @@ function Get-PolicyTypeConfig {
|
|||||||
# ExportType (aus Datei/Envelope) -> Typ-Config. Reverse-Lookup fuer den Import.
|
# ExportType (aus Datei/Envelope) -> Typ-Config. Reverse-Lookup fuer den Import.
|
||||||
function Get-PolicyTypeConfigByExportType {
|
function Get-PolicyTypeConfigByExportType {
|
||||||
param([string]$ExportType)
|
param([string]$ExportType)
|
||||||
foreach ($key in @('compliance','configuration','settingscatalog')) {
|
foreach ($key in @('compliance','configuration','settingscatalog','administrativetemplate')) {
|
||||||
$cfg = Get-PolicyTypeConfig $key
|
$cfg = Get-PolicyTypeConfig $key
|
||||||
if ($cfg.ExportType -eq $ExportType) { return $cfg }
|
if ($cfg.ExportType -eq $ExportType) { return $cfg }
|
||||||
}
|
}
|
||||||
@@ -105,6 +119,15 @@ function Get-PolicyProp {
|
|||||||
return $null
|
return $null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Property setzen — Hashtable ODER PSCustomObject (fuer Import-Umbenennung).
|
||||||
|
function Set-PolicyProp {
|
||||||
|
param($Obj, [string]$Name, $Value)
|
||||||
|
if ($null -eq $Obj) { return }
|
||||||
|
if ($Obj -is [System.Collections.IDictionary]) { $Obj[$Name] = $Value; return }
|
||||||
|
if ($Obj.PSObject.Properties[$Name]) { $Obj.$Name = $Value }
|
||||||
|
else { $Obj | Add-Member -NotePropertyName $Name -NotePropertyValue $Value -Force }
|
||||||
|
}
|
||||||
|
|
||||||
# Grobe Plattform-Bezeichnung fuer die Listenanzeige.
|
# Grobe Plattform-Bezeichnung fuer die Listenanzeige.
|
||||||
function Get-PolicyPlatformLabel {
|
function Get-PolicyPlatformLabel {
|
||||||
param($Raw, [string]$Type)
|
param($Raw, [string]$Type)
|
||||||
@@ -112,6 +135,8 @@ function Get-PolicyPlatformLabel {
|
|||||||
$p = Get-PolicyProp $Raw 'platforms'
|
$p = Get-PolicyProp $Raw 'platforms'
|
||||||
return [string]$p
|
return [string]$p
|
||||||
}
|
}
|
||||||
|
# Administrative Vorlagen (groupPolicyConfigurations) sind reine Windows-Policies.
|
||||||
|
if (([string]$Type).ToLower() -eq 'administrativetemplate') { return 'Windows' }
|
||||||
$t = [string](Get-PolicyProp $Raw '@odata.type')
|
$t = [string](Get-PolicyProp $Raw '@odata.type')
|
||||||
switch -Regex ($t) {
|
switch -Regex ($t) {
|
||||||
'windows' { return 'Windows' }
|
'windows' { return 'Windows' }
|
||||||
@@ -158,6 +183,18 @@ function Get-GraphPolicyDetail {
|
|||||||
)
|
)
|
||||||
$cfg = Get-PolicyTypeConfig $Type
|
$cfg = Get-PolicyTypeConfig $Type
|
||||||
if (-not $cfg) { throw "Unbekannter Policy-Typ: $Type" }
|
if (-not $cfg) { throw "Unbekannter Policy-Typ: $Type" }
|
||||||
|
|
||||||
|
# Administrative Vorlagen: Basis-Objekt holen und die konfigurierten Werte
|
||||||
|
# (definitionValues inkl. Definition + Presentation-Werten) separat expandieren.
|
||||||
|
if ($cfg.Key -eq 'administrativetemplate') {
|
||||||
|
$base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET
|
||||||
|
$dvUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version),presentationValues(`$expand=presentation)"
|
||||||
|
$dvs = @(Get-GraphPaged -Uri $dvUri)
|
||||||
|
if ($base -is [System.Collections.IDictionary]) { $base['definitionValues'] = $dvs }
|
||||||
|
else { $base | Add-Member -NotePropertyName definitionValues -NotePropertyValue $dvs -Force }
|
||||||
|
return $base
|
||||||
|
}
|
||||||
|
|
||||||
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
||||||
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
||||||
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
||||||
@@ -183,6 +220,53 @@ function ConvertTo-ImportBody {
|
|||||||
return $body
|
return $body
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Settings-Catalog-Payloads haben verschachtelte Properties, die laut Graph-
|
||||||
|
# Schema Arrays sein MUESSEN (settings, children, *SettingCollectionValue, values).
|
||||||
|
# Ein JSON-Roundtrip unter Windows PowerShell 5.1 entpackt Ein-Element-Arrays zu
|
||||||
|
# Einzelobjekten -> Graph antwortet mit 400 "... does not match schema". Diese
|
||||||
|
# Funktion baut den Baum rekursiv neu auf und packt betroffene Felder wieder in
|
||||||
|
# Arrays. Idempotent: bereits korrekte Arrays bleiben unveraendert.
|
||||||
|
function Repair-SettingsCatalogArrays {
|
||||||
|
param($Node)
|
||||||
|
$arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','values')
|
||||||
|
|
||||||
|
# Array-Property normalisieren: $null -> @() (Graph-Schema: Collections sind
|
||||||
|
# Nullable=False, ein 'children': null wird abgelehnt), Einzelobjekt -> @(obj).
|
||||||
|
# Inline (nicht als Funktion), sonst entpackt der Return ein Ein-Element-Array.
|
||||||
|
if ($Node -is [System.Collections.IDictionary]) {
|
||||||
|
$out = [ordered]@{}
|
||||||
|
foreach ($k in @($Node.Keys)) {
|
||||||
|
$fixed = Repair-SettingsCatalogArrays $Node[$k]
|
||||||
|
if ($k -in $arrayKeys) {
|
||||||
|
if ($null -eq $fixed) { $fixed = @() }
|
||||||
|
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||||
|
}
|
||||||
|
$out[$k] = $fixed
|
||||||
|
}
|
||||||
|
return $out
|
||||||
|
}
|
||||||
|
if ($Node -is [System.Management.Automation.PSCustomObject]) {
|
||||||
|
$out = [ordered]@{}
|
||||||
|
foreach ($p in $Node.PSObject.Properties) {
|
||||||
|
$fixed = Repair-SettingsCatalogArrays $p.Value
|
||||||
|
if ($p.Name -in $arrayKeys) {
|
||||||
|
if ($null -eq $fixed) { $fixed = @() }
|
||||||
|
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||||
|
}
|
||||||
|
$out[$p.Name] = $fixed
|
||||||
|
}
|
||||||
|
return $out
|
||||||
|
}
|
||||||
|
if (($Node -is [System.Collections.IEnumerable]) -and -not ($Node -is [string])) {
|
||||||
|
# Kein Komma-Operator: ein Ein-Element-Array wird beim Return zwar zum
|
||||||
|
# Skalar entpackt, aber jede Array-Property wird vom Parent ohnehin wieder
|
||||||
|
# in @(...) gewrappt. Ein fuehrendes ',' wuerde das Top-Level-settings-
|
||||||
|
# Array faelschlich in ein Extra-Array verschachteln.
|
||||||
|
return @($Node | ForEach-Object { Repair-SettingsCatalogArrays $_ })
|
||||||
|
}
|
||||||
|
return $Node
|
||||||
|
}
|
||||||
|
|
||||||
function New-DefaultComplianceScheduledActions {
|
function New-DefaultComplianceScheduledActions {
|
||||||
# Compliance Policies verlangen beim Anlegen mindestens einen
|
# Compliance Policies verlangen beim Anlegen mindestens einen
|
||||||
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
||||||
@@ -247,18 +331,106 @@ function Import-GraphSettingsCatalogPolicy {
|
|||||||
throw 'Settings-Catalog-Policy benoetigt ein "name"-Feld fuer den Import.'
|
throw 'Settings-Catalog-Policy benoetigt ein "name"-Feld fuer den Import.'
|
||||||
}
|
}
|
||||||
# 'settings' MUSS mitgeschickt werden — kommt aus dem $expand=settings-Export.
|
# 'settings' MUSS mitgeschickt werden — kommt aus dem $expand=settings-Export.
|
||||||
if (-not $body.ContainsKey('settings')) { $body['settings'] = @() }
|
# Zusaetzlich Array-Properties reparieren (PS-5.1-Roundtrip-Schaden), sonst
|
||||||
|
# 400 "Property children ... does not match schema".
|
||||||
|
if ($body.ContainsKey('settings') -and $null -ne $body['settings']) {
|
||||||
|
$body['settings'] = @(Repair-SettingsCatalogArrays $body['settings'])
|
||||||
|
# Beim GET liefert Graph die Setting-Wrapper ohne '@odata.type' und mit
|
||||||
|
# read-only 'id'. Der POST verlangt aber den Wrapper-Typ; die 'id' muss
|
||||||
|
# weg -> sonst 400 "Property settings ... does not match schema".
|
||||||
|
foreach ($s in $body['settings']) {
|
||||||
|
if ($s -is [System.Collections.IDictionary]) {
|
||||||
|
if ($s.Contains('id')) { [void]$s.Remove('id') }
|
||||||
|
if (-not $s.Contains('@odata.type')) {
|
||||||
|
$s['@odata.type'] = '#microsoft.graph.deviceManagementConfigurationSetting'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
$body['settings'] = @()
|
||||||
|
}
|
||||||
$json = $body | ConvertTo-Json -Depth 50
|
$json = $body | ConvertTo-Json -Depth 50
|
||||||
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Import-GraphAdministrativeTemplate {
|
||||||
|
param([Parameter(Mandatory=$true)]$Policy)
|
||||||
|
|
||||||
|
$displayName = [string](Get-PolicyProp $Policy 'displayName')
|
||||||
|
if (-not $displayName) { throw 'Administrative Vorlage benoetigt "displayName" fuer den Import.' }
|
||||||
|
|
||||||
|
$defRoot = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions'
|
||||||
|
$cfgRoot = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations'
|
||||||
|
|
||||||
|
# 1) Leere Konfigurations-Huelle anlegen (definitionValues folgen einzeln).
|
||||||
|
$shell = @{
|
||||||
|
displayName = $displayName
|
||||||
|
description = [string](Get-PolicyProp $Policy 'description')
|
||||||
|
roleScopeTagIds = @('0')
|
||||||
|
}
|
||||||
|
$created = Invoke-MgGraphRequestRetry -Uri $cfgRoot -Method POST -Body ($shell | ConvertTo-Json -Depth 10) -ContentType 'application/json'
|
||||||
|
$newId = [string](Get-PolicyProp $created 'id')
|
||||||
|
if (-not $newId) { throw 'Anlegen der Administrative-Vorlage-Huelle lieferte keine Id.' }
|
||||||
|
|
||||||
|
# 2) Jeden definitionValue einzeln anhaengen. Definition + Presentations werden
|
||||||
|
# per @odata.bind referenziert — die IDs eingebauter ADMX-Vorlagen sind
|
||||||
|
# tenantuebergreifend identisch, daher tenantunabhaengig einsetzbar.
|
||||||
|
$errors = @()
|
||||||
|
foreach ($dv in @(Get-PolicyProp $Policy 'definitionValues')) {
|
||||||
|
if (-not $dv) { continue }
|
||||||
|
$def = Get-PolicyProp $dv 'definition'
|
||||||
|
$defId = [string](Get-PolicyProp $def 'id')
|
||||||
|
if (-not $defId) {
|
||||||
|
$errors += 'definitionValue ohne Definition-Id uebersprungen'
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
$presVals = @()
|
||||||
|
foreach ($pv in @(Get-PolicyProp $dv 'presentationValues')) {
|
||||||
|
if (-not $pv) { continue }
|
||||||
|
$pres = Get-PolicyProp $pv 'presentation'
|
||||||
|
$presId = [string](Get-PolicyProp $pres 'id')
|
||||||
|
$entry = [ordered]@{
|
||||||
|
'@odata.type' = [string](Get-PolicyProp $pv '@odata.type')
|
||||||
|
'presentation@odata.bind' = "$defRoot('$defId')/presentations('$presId')"
|
||||||
|
}
|
||||||
|
# Je nach Presentation-Typ traegt der Wert in 'value' ODER 'values'.
|
||||||
|
foreach ($vk in @('value','values')) {
|
||||||
|
$vv = Get-PolicyProp $pv $vk
|
||||||
|
if ($null -ne $vv) { $entry[$vk] = $vv }
|
||||||
|
}
|
||||||
|
$presVals += $entry
|
||||||
|
}
|
||||||
|
|
||||||
|
$body = [ordered]@{
|
||||||
|
enabled = [bool](Get-PolicyProp $dv 'enabled')
|
||||||
|
'definition@odata.bind' = "$defRoot('$defId')"
|
||||||
|
presentationValues = @($presVals)
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
Invoke-MgGraphRequestRetry -Uri "$cfgRoot/$newId/definitionValues" -Method POST -Body ($body | ConvertTo-Json -Depth 50) -ContentType 'application/json' | Out-Null
|
||||||
|
} catch {
|
||||||
|
$m = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $m = $_.ErrorDetails.Message } } catch {}
|
||||||
|
$dn = [string](Get-PolicyProp $def 'displayName'); if (-not $dn) { $dn = $defId }
|
||||||
|
$errors += "${dn}: $m"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($errors.Count -gt 0) {
|
||||||
|
throw ("Huelle angelegt (Id $newId), aber $($errors.Count) Einstellung(en) fehlgeschlagen: " + ($errors -join ' | '))
|
||||||
|
}
|
||||||
|
return $created
|
||||||
|
}
|
||||||
|
|
||||||
# Dispatcht anhand des ExportType auf den passenden Import.
|
# Dispatcht anhand des ExportType auf den passenden Import.
|
||||||
function Import-GraphPolicyByExportType {
|
function Import-GraphPolicyByExportType {
|
||||||
param([string]$ExportType, $Policy)
|
param([string]$ExportType, $Policy)
|
||||||
switch ($ExportType) {
|
switch ($ExportType) {
|
||||||
'CompliancePolicy' { return Import-GraphCompliancePolicy -Policy $Policy }
|
'CompliancePolicy' { return Import-GraphCompliancePolicy -Policy $Policy }
|
||||||
'ConfigurationProfile' { return Import-GraphConfigurationProfile -Policy $Policy }
|
'ConfigurationProfile' { return Import-GraphConfigurationProfile -Policy $Policy }
|
||||||
'SettingsCatalog' { return Import-GraphSettingsCatalogPolicy -Policy $Policy }
|
'SettingsCatalog' { return Import-GraphSettingsCatalogPolicy -Policy $Policy }
|
||||||
|
'AdministrativeTemplate' { return Import-GraphAdministrativeTemplate -Policy $Policy }
|
||||||
default { throw "Unbekannter exportType: $ExportType" }
|
default { throw "Unbekannter exportType: $ExportType" }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -288,6 +460,11 @@ function Get-SettingsCatalogPoliciesEndpoint {
|
|||||||
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'settingscatalog') }
|
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'settingscatalog') }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Get-AdministrativeTemplatesEndpoint {
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'administrativetemplate') }
|
||||||
|
}
|
||||||
|
|
||||||
# Export: liefert die Export-Objekte im Response (Browser-Download) UND legt sie
|
# Export: liefert die Export-Objekte im Response (Browser-Download) UND legt sie
|
||||||
# zusaetzlich als JSON im Server-Archiv ab. Body: { type, ids }.
|
# zusaetzlich als JSON im Server-Archiv ab. Body: { type, ids }.
|
||||||
function Export-PoliciesEndpoint {
|
function Export-PoliciesEndpoint {
|
||||||
@@ -368,10 +545,14 @@ function Import-PoliciesEndpoint {
|
|||||||
param($Body)
|
param($Body)
|
||||||
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
$uploaded = @(Get-PolicyProp $Body 'policies')
|
# @(Get-PolicyProp ...) auf ein fehlendes Feld liefert $null -> @($null) hat
|
||||||
$fileNames = @(Get-PolicyProp $Body 'fileNames')
|
# Count 1 (ein Null-Element), kein leeres Array. Ohne Filter wuerde die
|
||||||
|
# Archiv-Schleife einmal mit $fileName = $null laufen und auf das Verzeichnis
|
||||||
|
# selbst zugreifen (DirectoryNotFoundException). Daher Null/Leer rausfiltern.
|
||||||
|
$uploaded = @(Get-PolicyProp $Body 'policies') | Where-Object { $_ }
|
||||||
|
$fileNames = @(Get-PolicyProp $Body 'fileNames') | Where-Object { $_ }
|
||||||
|
|
||||||
if ($uploaded.Count -eq 0 -and $fileNames.Count -eq 0) {
|
if (@($uploaded).Count -eq 0 -and @($fileNames).Count -eq 0) {
|
||||||
return @{ __status = 400; error = 'Keine Policies zum Importieren uebergeben' }
|
return @{ __status = 400; error = 'Keine Policies zum Importieren uebergeben' }
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -380,7 +561,10 @@ function Import-PoliciesEndpoint {
|
|||||||
# 1) Hochgeladene Envelopes
|
# 1) Hochgeladene Envelopes
|
||||||
foreach ($env in $uploaded) {
|
foreach ($env in $uploaded) {
|
||||||
if (-not $env) { continue }
|
if (-not $env) { continue }
|
||||||
|
# Envelope-Formate akzeptieren beide Typ-Felder: 'exportType' (Export-
|
||||||
|
# Download) und 'policyType' (Git-Snapshot).
|
||||||
$exportType = [string](Get-PolicyProp $env 'exportType')
|
$exportType = [string](Get-PolicyProp $env 'exportType')
|
||||||
|
if (-not $exportType) { $exportType = [string](Get-PolicyProp $env 'policyType') }
|
||||||
$policy = Get-PolicyProp $env 'policy'
|
$policy = Get-PolicyProp $env 'policy'
|
||||||
$policyName = Get-PolicyProp $env 'policyName'
|
$policyName = Get-PolicyProp $env 'policyName'
|
||||||
if (-not $policyName) { $policyName = Get-PolicyDisplayName $policy }
|
if (-not $policyName) { $policyName = Get-PolicyDisplayName $policy }
|
||||||
@@ -388,6 +572,14 @@ function Import-PoliciesEndpoint {
|
|||||||
$results += @{ policyName = [string]$policyName; success = $false; error = 'Envelope ohne "policy"-Feld' }
|
$results += @{ policyName = [string]$policyName; success = $false; error = 'Envelope ohne "policy"-Feld' }
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
# Optionale Umbenennung: das richtige Namensfeld je Typ setzen.
|
||||||
|
$newName = [string](Get-PolicyProp $env 'newName')
|
||||||
|
if ($newName -and $newName.Trim()) {
|
||||||
|
$cfg = Get-PolicyTypeConfigByExportType $exportType
|
||||||
|
$nameField = if ($cfg) { $cfg.NameField } else { 'displayName' }
|
||||||
|
Set-PolicyProp $policy $nameField $newName.Trim()
|
||||||
|
$policyName = $newName.Trim()
|
||||||
|
}
|
||||||
try {
|
try {
|
||||||
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
||||||
$results += @{ policyName = [string]$policyName; exportType = $exportType; success = $true; newId = [string](Get-PolicyProp $imported 'id') }
|
$results += @{ policyName = [string]$policyName; exportType = $exportType; success = $true; newId = [string](Get-PolicyProp $imported 'id') }
|
||||||
@@ -401,9 +593,10 @@ function Import-PoliciesEndpoint {
|
|||||||
# 2) Dateien aus dem Server-Archiv
|
# 2) Dateien aus dem Server-Archiv
|
||||||
$exportDir = Get-PolicyExportDir
|
$exportDir = Get-PolicyExportDir
|
||||||
foreach ($fileName in $fileNames) {
|
foreach ($fileName in $fileNames) {
|
||||||
$safe = ($fileName -replace '[\\/]', '')
|
if ([string]::IsNullOrWhiteSpace([string]$fileName)) { continue }
|
||||||
|
$safe = ([string]$fileName -replace '[\\/]', '')
|
||||||
$filePath = Join-Path $exportDir $safe
|
$filePath = Join-Path $exportDir $safe
|
||||||
if (-not (Test-Path $filePath)) {
|
if ([string]::IsNullOrWhiteSpace($safe) -or -not (Test-Path $filePath -PathType Leaf)) {
|
||||||
$results += @{ fileName = $fileName; success = $false; error = 'Datei nicht gefunden' }
|
$results += @{ fileName = $fileName; success = $false; error = 'Datei nicht gefunden' }
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
@@ -411,6 +604,7 @@ function Import-PoliciesEndpoint {
|
|||||||
try {
|
try {
|
||||||
$content = Get-Content $filePath -Raw | ConvertFrom-Json
|
$content = Get-Content $filePath -Raw | ConvertFrom-Json
|
||||||
$exportType = [string](Get-PolicyProp $content 'exportType')
|
$exportType = [string](Get-PolicyProp $content 'exportType')
|
||||||
|
if (-not $exportType) { $exportType = [string](Get-PolicyProp $content 'policyType') }
|
||||||
$policy = Get-PolicyProp $content 'policy'
|
$policy = Get-PolicyProp $content 'policy'
|
||||||
$policyName = Get-PolicyDisplayName $policy
|
$policyName = Get-PolicyDisplayName $policy
|
||||||
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
||||||
@@ -425,3 +619,179 @@ function Import-PoliciesEndpoint {
|
|||||||
$ok = @($results | Where-Object { $_.success }).Count
|
$ok = @($results | Where-Object { $_.success }).Count
|
||||||
return @{ ok = $true; importedCount = $ok; results = @($results) }
|
return @{ ok = $true; importedCount = $ok; results = @($results) }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Weist importierten Policies Gruppen zu (Include + Exclude). Body:
|
||||||
|
# items = [ { exportType, id, policyName, include:[groupId], exclude:[groupId] } ]
|
||||||
|
# Nutzt die typ-spezifische /assign-Action. Zuweisungen sind pro Policy.
|
||||||
|
function Invoke-PolicyAssignEndpoint {
|
||||||
|
param($Body)
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
|
$items = @(Get-PolicyProp $Body 'items') | Where-Object { $_ }
|
||||||
|
if (@($items).Count -eq 0) { return @{ __status = 400; error = 'Keine Zuweisungen uebergeben' } }
|
||||||
|
|
||||||
|
$results = @()
|
||||||
|
foreach ($it in $items) {
|
||||||
|
$exportType = [string](Get-PolicyProp $it 'exportType')
|
||||||
|
$id = [string](Get-PolicyProp $it 'id')
|
||||||
|
$name = [string](Get-PolicyProp $it 'policyName')
|
||||||
|
$include = @(Get-PolicyProp $it 'include') | Where-Object { $_ }
|
||||||
|
$exclude = @(Get-PolicyProp $it 'exclude') | Where-Object { $_ }
|
||||||
|
$cfg = Get-PolicyTypeConfigByExportType $exportType
|
||||||
|
|
||||||
|
if (-not $cfg) { $results += @{ id = $id; policyName = $name; success = $false; error = "Unbekannter exportType: $exportType" }; continue }
|
||||||
|
if (-not $id) { $results += @{ policyName = $name; success = $false; error = 'Policy-Id fehlt' }; continue }
|
||||||
|
if (@($include).Count -eq 0 -and @($exclude).Count -eq 0) {
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $true; skipped = $true }
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
$assignments = @()
|
||||||
|
foreach ($g in $include) {
|
||||||
|
$assignments += @{ target = @{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = [string]$g } }
|
||||||
|
}
|
||||||
|
foreach ($g in $exclude) {
|
||||||
|
$assignments += @{ target = @{ '@odata.type' = '#microsoft.graph.exclusionGroupAssignmentTarget'; groupId = [string]$g } }
|
||||||
|
}
|
||||||
|
$json = @{ assignments = @($assignments) } | ConvertTo-Json -Depth 10
|
||||||
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$id/assign"
|
||||||
|
try {
|
||||||
|
Invoke-MgGraphRequestRetry -Uri $uri -Method POST -Body $json -ContentType 'application/json' | Out-Null
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $true; includeCount = @($include).Count; excludeCount = @($exclude).Count }
|
||||||
|
} catch {
|
||||||
|
$m = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $m = $_.ErrorDetails.Message } } catch {}
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $false; error = $m }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$ok = @($results | Where-Object { $_.success -and -not $_.skipped }).Count
|
||||||
|
return @{ ok = $true; assignedCount = $ok; results = @($results) }
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
# Policy-Snapshot nach Git (voller Export, stabile Dateinamen)
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
# Rekursiv nach Schluesseln sortieren -> deterministische JSON-Ausgabe, damit
|
||||||
|
# unveraenderte Policies keine Diff-Noise durch wechselnde Key-Reihenfolge
|
||||||
|
# erzeugen (Invoke-MgGraphRequest liefert ungeordnete Hashtables).
|
||||||
|
function ConvertTo-StableObject {
|
||||||
|
param($InputObject)
|
||||||
|
if ($InputObject -is [System.Collections.IDictionary]) {
|
||||||
|
$ordered = [ordered]@{}
|
||||||
|
foreach ($k in ($InputObject.Keys | Sort-Object)) {
|
||||||
|
$ordered[$k] = ConvertTo-StableObject $InputObject[$k]
|
||||||
|
}
|
||||||
|
return $ordered
|
||||||
|
}
|
||||||
|
if (($InputObject -is [System.Collections.IEnumerable]) -and -not ($InputObject -is [string])) {
|
||||||
|
# Array-Reihenfolge bleibt erhalten (ist bei Policies bedeutungstragend).
|
||||||
|
return @($InputObject | ForEach-Object { ConvertTo-StableObject $_ })
|
||||||
|
}
|
||||||
|
return $InputObject
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-Git {
|
||||||
|
param([Parameter(Mandatory=$true)][string]$RepoPath, [Parameter(Mandatory=$true)][string[]]$GitArgs)
|
||||||
|
$out = & git -C $RepoPath @GitArgs 2>&1
|
||||||
|
return @{ exit = $LASTEXITCODE; out = (@($out) -join "`n").Trim() }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-PolicySnapshotFolderName {
|
||||||
|
# Tenant-Unterordner im Repo: Label (Multi-Tenant) sonst TenantId sonst 'default'.
|
||||||
|
$active = Get-ActiveConnection -Settings $script:Settings
|
||||||
|
$name = if ($active.label) { $active.label } elseif ($script:State.TenantId) { [string]$script:State.TenantId } else { 'default' }
|
||||||
|
$safe = ($name -replace '[^\w\-\.]', '_')
|
||||||
|
if ([string]::IsNullOrWhiteSpace($safe)) { $safe = 'default' }
|
||||||
|
return $safe
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-PolicyGitSnapshotEndpoint {
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
|
$cfg = $script:Settings.policyBackup
|
||||||
|
$repo = if ($cfg -and $cfg.gitRepoPath) { [string]$cfg.gitRepoPath } else { '' }
|
||||||
|
$doPush = if ($cfg -and $cfg.push) { [bool]$cfg.push } else { $false }
|
||||||
|
if ([string]::IsNullOrWhiteSpace($repo)) {
|
||||||
|
return @{ __status = 400; error = 'Kein Git-Repo-Pfad konfiguriert (Einstellungen -> Policy-Backup).' }
|
||||||
|
}
|
||||||
|
|
||||||
|
# git verfuegbar?
|
||||||
|
try { $null = & git --version 2>&1; if ($LASTEXITCODE -ne 0) { throw 'x' } }
|
||||||
|
catch { return @{ __status = 500; error = 'git ist nicht installiert oder nicht im PATH.' } }
|
||||||
|
|
||||||
|
# Repo-Ordner + .git sicherstellen
|
||||||
|
if (-not (Test-Path $repo)) { New-Item -ItemType Directory -Path $repo -Force | Out-Null }
|
||||||
|
if (-not (Test-Path (Join-Path $repo '.git'))) {
|
||||||
|
$r = Invoke-Git -RepoPath $repo -GitArgs @('init')
|
||||||
|
if ($r.exit -ne 0) { return @{ __status = 500; error = "git init fehlgeschlagen: $($r.out)" } }
|
||||||
|
}
|
||||||
|
# Commit-Identitaet sicherstellen (frisches Repo hat evtl. keine).
|
||||||
|
if ([string]::IsNullOrWhiteSpace((Invoke-Git -RepoPath $repo -GitArgs @('config','user.email')).out)) {
|
||||||
|
Invoke-Git -RepoPath $repo -GitArgs @('config','user.email','intune-manager@localhost') | Out-Null
|
||||||
|
Invoke-Git -RepoPath $repo -GitArgs @('config','user.name','Intune Manager') | Out-Null
|
||||||
|
}
|
||||||
|
|
||||||
|
$tenantFolder = Get-PolicySnapshotFolderName
|
||||||
|
$tenantDir = Join-Path $repo $tenantFolder
|
||||||
|
# Tenant-Ordner komplett neu aufbauen -> entfernte Policies verschwinden (Diff).
|
||||||
|
if (Test-Path $tenantDir) { Remove-Item $tenantDir -Recurse -Force }
|
||||||
|
New-Item -ItemType Directory -Path $tenantDir -Force | Out-Null
|
||||||
|
|
||||||
|
$types = @('settingscatalog','compliance','configuration','administrativetemplate')
|
||||||
|
$total = 0
|
||||||
|
$perType = [ordered]@{}
|
||||||
|
foreach ($type in $types) {
|
||||||
|
$tcfg = Get-PolicyTypeConfig $type
|
||||||
|
$list = @(Get-GraphPolicyList -Type $type)
|
||||||
|
$perType[$tcfg.ExportType] = $list.Count
|
||||||
|
if ($list.Count -eq 0) { continue }
|
||||||
|
$typeDir = Join-Path $tenantDir $type
|
||||||
|
New-Item -ItemType Directory -Path $typeDir -Force | Out-Null
|
||||||
|
foreach ($item in $list) {
|
||||||
|
$id = [string]$item.id
|
||||||
|
$detail = $null
|
||||||
|
try { $detail = Get-GraphPolicyDetail -Type $type -Id $id } catch { continue }
|
||||||
|
$name = [string]$item.name
|
||||||
|
$safe = ($name -replace '[^\w\-\.]', '_'); if (-not $safe) { $safe = $id }
|
||||||
|
$short = if ($id.Length -ge 8) { $id.Substring(0,8) } else { $id }
|
||||||
|
$fname = "$($safe)__$($short).json"
|
||||||
|
$envelope = [ordered]@{
|
||||||
|
policyType = $tcfg.ExportType
|
||||||
|
policyName = $name
|
||||||
|
policy = $detail
|
||||||
|
}
|
||||||
|
# stabile (sortierte) Ausgabe, ohne Zeitstempel -> saubere Diffs
|
||||||
|
(ConvertTo-StableObject $envelope) | ConvertTo-Json -Depth 50 | Set-Content -Path (Join-Path $typeDir $fname) -Encoding UTF8
|
||||||
|
$total++
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$add = Invoke-Git -RepoPath $repo -GitArgs @('add','-A')
|
||||||
|
if ($add.exit -ne 0) { return @{ __status = 500; error = "git add fehlgeschlagen: $($add.out)" } }
|
||||||
|
|
||||||
|
if ([string]::IsNullOrWhiteSpace((Invoke-Git -RepoPath $repo -GitArgs @('status','--porcelain')).out)) {
|
||||||
|
return @{ ok = $true; changed = $false; committed = $false; total = $total; perType = $perType; tenant = $tenantFolder; message = 'Keine Aenderungen seit dem letzten Snapshot.' }
|
||||||
|
}
|
||||||
|
|
||||||
|
$msg = "Policy-Snapshot $tenantFolder $(Get-Date -Format 'yyyy-MM-dd HH:mm')"
|
||||||
|
$commit = Invoke-Git -RepoPath $repo -GitArgs @('commit','-m',$msg)
|
||||||
|
if ($commit.exit -ne 0) { return @{ __status = 500; error = "git commit fehlgeschlagen: $($commit.out)" } }
|
||||||
|
$hash = (Invoke-Git -RepoPath $repo -GitArgs @('rev-parse','--short','HEAD')).out
|
||||||
|
|
||||||
|
$pushed = $false; $pushError = $null
|
||||||
|
if ($doPush) {
|
||||||
|
$push = Invoke-Git -RepoPath $repo -GitArgs @('push')
|
||||||
|
if ($push.exit -eq 0) { $pushed = $true } else { $pushError = $push.out }
|
||||||
|
}
|
||||||
|
|
||||||
|
$summary = "Snapshot committet: $total Policies ($hash)"
|
||||||
|
if ($doPush) { $summary += if ($pushed) { ', gepusht' } else { ', Push fehlgeschlagen' } }
|
||||||
|
return @{
|
||||||
|
ok = $true; changed = $true; committed = $true
|
||||||
|
total = $total; perType = $perType; tenant = $tenantFolder
|
||||||
|
commit = $hash; pushed = $pushed; pushError = $pushError
|
||||||
|
message = $summary
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|||||||
+528
-64
@@ -47,6 +47,11 @@ async function api(path, options = {}) {
|
|||||||
let res;
|
let res;
|
||||||
try {
|
try {
|
||||||
res = await fetch(path, opts);
|
res = await fetch(path, opts);
|
||||||
|
} catch (e) {
|
||||||
|
// "Failed to fetch" = der lokale Server hat nicht geantwortet (Prozess
|
||||||
|
// beendet/abgestürzt oder PowerShell-Fenster geschlossen). Klartext geben.
|
||||||
|
if (e && (e.name === 'AbortError')) throw e;
|
||||||
|
throw new Error('Server nicht erreichbar — läuft das PowerShell-Fenster (Run.cmd) noch? Bitte die App neu starten und erneut versuchen.');
|
||||||
} finally {
|
} finally {
|
||||||
if (timer) clearTimeout(timer);
|
if (timer) clearTimeout(timer);
|
||||||
}
|
}
|
||||||
@@ -158,6 +163,58 @@ async function refreshStatus() {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Topbar-Mandantenumschalter: nur im Multi-Tenant-Modus sichtbar.
|
||||||
|
async function refreshTenantSwitcher() {
|
||||||
|
const sel = document.getElementById('tenantSwitch');
|
||||||
|
if (!sel) return;
|
||||||
|
try {
|
||||||
|
const t = await api('/api/tenants');
|
||||||
|
if (!t.multiTenant || !(t.items || []).length) {
|
||||||
|
sel.classList.add('hidden');
|
||||||
|
sel.innerHTML = '';
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
sel.innerHTML = t.items.map(it =>
|
||||||
|
`<option value="${escapeHtml(it.id)}" ${it.id === t.activeId ? 'selected' : ''}>${escapeHtml(it.label || it.tenantId)}</option>`
|
||||||
|
).join('');
|
||||||
|
sel.classList.remove('hidden');
|
||||||
|
} catch {
|
||||||
|
sel.classList.add('hidden');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
document.getElementById('tenantSwitch')?.addEventListener('change', async e => {
|
||||||
|
const id = e.target.value;
|
||||||
|
setLoading('Wechsle Mandant…');
|
||||||
|
try {
|
||||||
|
// Löst server-seitig Disconnect + Reconnect mit dem neuen Tenant aus.
|
||||||
|
const s = await api('/api/tenants/switch', { method: 'POST', body: { id }, timeoutMs: 120000 });
|
||||||
|
State.connected = !!s.connected;
|
||||||
|
State.account = s.account;
|
||||||
|
State.readOnly = !!s.readOnly;
|
||||||
|
applyReadOnlyMode();
|
||||||
|
renderConnection();
|
||||||
|
// Anderer Tenant = andere Daten: ALLE datentragenden Frontend-Caches
|
||||||
|
// verwerfen, sonst ueberspringen die Load-Guards (appsLoaded/loadedModes)
|
||||||
|
// das Neuladen und die UI zeigt weiter den vorherigen Tenant.
|
||||||
|
if (typeof stopDevicePolling === 'function') stopDevicePolling();
|
||||||
|
resetClientState();
|
||||||
|
switchMainView('apps');
|
||||||
|
if (s.connected) {
|
||||||
|
toast('Verbunden mit ' + (s.tenantLabel || s.account || 'Mandant'), 'ok', 'Mandant gewechselt');
|
||||||
|
autoLoadAfterConnect();
|
||||||
|
} else {
|
||||||
|
toast('Umgestellt, aber nicht verbunden.', 'warn');
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
toast('Wechsel fehlgeschlagen: ' + err.message, 'err');
|
||||||
|
await refreshStatus();
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
refreshTenantSwitcher();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
function applyReadOnlyMode() {
|
function applyReadOnlyMode() {
|
||||||
document.body.classList.toggle('read-only', State.readOnly);
|
document.body.classList.toggle('read-only', State.readOnly);
|
||||||
// Falls ein Schreib-Tab aktiv ist beim Wechsel in Read-Only -> Export-Tab zeigen
|
// Falls ein Schreib-Tab aktiv ist beim Wechsel in Read-Only -> Export-Tab zeigen
|
||||||
@@ -290,17 +347,8 @@ document.getElementById('btnDisconnect').addEventListener('click', async () => {
|
|||||||
connectInFlight = false;
|
connectInFlight = false;
|
||||||
try {
|
try {
|
||||||
await api('/api/disconnect', { method: 'POST' });
|
await api('/api/disconnect', { method: 'POST' });
|
||||||
Object.assign(State, {
|
Object.assign(State, { connected: false, account: null });
|
||||||
connected: false, account: null,
|
resetClientState();
|
||||||
targets: [], apps: [], session: [],
|
|
||||||
appsLoaded: false,
|
|
||||||
});
|
|
||||||
State.selectedTargetIds.clear();
|
|
||||||
State.membershipCache.clear();
|
|
||||||
State.loadedModes.clear();
|
|
||||||
State.appDetails.clear();
|
|
||||||
State.expandedApps.clear();
|
|
||||||
State.modeCache.clear();
|
|
||||||
renderConnection();
|
renderConnection();
|
||||||
renderTargets();
|
renderTargets();
|
||||||
renderPinnedTargets();
|
renderPinnedTargets();
|
||||||
@@ -313,6 +361,25 @@ document.getElementById('btnDisconnect').addEventListener('click', async () => {
|
|||||||
}
|
}
|
||||||
});
|
});
|
||||||
|
|
||||||
|
// Alle datentragenden Frontend-Caches verwerfen (Apps, Targets, Gruppen-
|
||||||
|
// Mitglieder, Report, Policies, Devices). Beruehrt NICHT connected/account —
|
||||||
|
// das setzt der jeweilige Aufrufer (Disconnect vs. Tenant-Wechsel) selbst.
|
||||||
|
// Wird beim Tenant-Wechsel benoetigt, sonst zeigen die Load-Guards
|
||||||
|
// (appsLoaded / loadedModes) noch die Daten des vorherigen Tenants.
|
||||||
|
function resetClientState() {
|
||||||
|
Object.assign(State, { targets: [], apps: [], session: [], appsLoaded: false });
|
||||||
|
State.selectedTargetIds.clear();
|
||||||
|
State.membershipCache.clear();
|
||||||
|
State.loadedModes.clear();
|
||||||
|
State.appDetails.clear();
|
||||||
|
State.expandedApps.clear();
|
||||||
|
State.modeCache.clear();
|
||||||
|
State.expandedGroups = new Map();
|
||||||
|
if (typeof ReportState !== 'undefined') ReportState.items = [];
|
||||||
|
if (typeof PolState !== 'undefined') { PolState.items = []; PolState.selected?.clear?.(); }
|
||||||
|
if (typeof DevState !== 'undefined') { DevState.items = []; DevState.filtered = []; DevState.selected = null; }
|
||||||
|
}
|
||||||
|
|
||||||
async function autoLoadAfterConnect() {
|
async function autoLoadAfterConnect() {
|
||||||
// Load default mode targets + apps in parallel
|
// Load default mode targets + apps in parallel
|
||||||
const tasks = [];
|
const tasks = [];
|
||||||
@@ -2554,17 +2621,31 @@ let cgCheckTimer = null;
|
|||||||
|
|
||||||
// Naming-Schemas aus Settings holen. Fallback auf Defaults wenn Settings noch
|
// Naming-Schemas aus Settings holen. Fallback auf Defaults wenn Settings noch
|
||||||
// nicht geladen sind (z.B. waehrend des allerersten Init-Renders).
|
// nicht geladen sind (z.B. waehrend des allerersten Init-Renders).
|
||||||
|
// Aktives Tenant-Profil aus einem Settings-Objekt (oder null im Single-Modus).
|
||||||
|
function activeTenantProfileFromSettings(s) {
|
||||||
|
const c = s && s.connection;
|
||||||
|
if (!c || !c.multiTenant || !Array.isArray(c.tenants) || !c.tenants.length) return null;
|
||||||
|
return c.tenants.find(t => t.id === c.activeTenantId) || c.tenants[0];
|
||||||
|
}
|
||||||
|
|
||||||
function getNamingFor(intent) {
|
function getNamingFor(intent) {
|
||||||
const s = SettingsState && SettingsState.current;
|
const s = SettingsState && SettingsState.current;
|
||||||
const block = intent === 'available'
|
const isAvail = intent === 'available';
|
||||||
? (s && s.availableGroupNaming)
|
|
||||||
: (s && s.requiredGroupNaming);
|
|
||||||
const defPrefix = 'intune-win-app-';
|
const defPrefix = 'intune-win-app-';
|
||||||
const defSuffix = intent === 'available' ? '-available' : '-required';
|
const defSuffix = isAvail ? '-available' : '-required';
|
||||||
return {
|
const gBlock = s && (isAvail ? s.availableGroupNaming : s.requiredGroupNaming);
|
||||||
prefix: (block && block.prefix) || defPrefix,
|
let prefix = (gBlock && gBlock.prefix) || defPrefix;
|
||||||
suffix: (block && block.suffix) || defSuffix,
|
let suffix = (gBlock && gBlock.suffix) || defSuffix;
|
||||||
};
|
// Aktives Tenant-Profil kann pro Feld überschreiben (leer = globale Vorgabe).
|
||||||
|
const prof = activeTenantProfileFromSettings(s);
|
||||||
|
if (prof) {
|
||||||
|
const pBlock = isAvail ? prof.availableGroupNaming : prof.requiredGroupNaming;
|
||||||
|
if (pBlock) {
|
||||||
|
if (pBlock.prefix && String(pBlock.prefix).trim()) prefix = pBlock.prefix;
|
||||||
|
if (pBlock.suffix && String(pBlock.suffix).trim()) suffix = pBlock.suffix;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return { prefix, suffix };
|
||||||
}
|
}
|
||||||
|
|
||||||
function appSlug(appName) {
|
function appSlug(appName) {
|
||||||
@@ -3405,7 +3486,7 @@ async function openHelpModal() {
|
|||||||
try {
|
try {
|
||||||
const v = await api('/api/version');
|
const v = await api('/api/version');
|
||||||
const el = document.getElementById('helpVersion');
|
const el = document.getElementById('helpVersion');
|
||||||
if (el) el.textContent = `Version ${v.version} · Build ${v.build}`;
|
if (el) el.textContent = `Version ${v.version} · Build ${v.build} · Entwickelt von WendeIT – Marco Wende`;
|
||||||
} catch {}
|
} catch {}
|
||||||
if (helpLoaded) return;
|
if (helpLoaded) return;
|
||||||
const contentEl = document.getElementById('helpContent');
|
const contentEl = document.getElementById('helpContent');
|
||||||
@@ -3756,17 +3837,12 @@ function rebuildCategoryFilterOptions() {
|
|||||||
function isSetupIncomplete(s) {
|
function isSetupIncomplete(s) {
|
||||||
if (!s) return true;
|
if (!s) return true;
|
||||||
const c = s.connection || {};
|
const c = s.connection || {};
|
||||||
const d = s.departments || {};
|
|
||||||
const tenant = (c.tenantId || '').trim();
|
const tenant = (c.tenantId || '').trim();
|
||||||
const client = (c.clientId || '').trim();
|
const client = (c.clientId || '').trim();
|
||||||
// Praefixe: 'prefixes'-Array bevorzugt, sonst alter Single-String 'prefix'.
|
// Nur Tenant ID + Client ID sind Pflicht fuer eine Verbindung. Abteilungs-
|
||||||
// Setup ist komplett, wenn mind. ein nicht-leerer Praefix (>= 2 Zeichen) existiert.
|
// Praefixe und RPA-Gruppen sind optional — fehlen sie, zeigen die jeweiligen
|
||||||
let hasPrefix = false;
|
// Tabs lediglich einen Konfigurations-Hinweis (kein harter Setup-Blocker).
|
||||||
if (Array.isArray(d.prefixes)) {
|
return !tenant || !client;
|
||||||
for (const p of d.prefixes) { if (p && String(p).trim().length >= 2) { hasPrefix = true; break; } }
|
|
||||||
}
|
|
||||||
if (!hasPrefix && d.prefix && String(d.prefix).trim().length >= 2) { hasPrefix = true; }
|
|
||||||
return !tenant || !client || !hasPrefix;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
function applySetupNeededUI(needed) {
|
function applySetupNeededUI(needed) {
|
||||||
@@ -3856,15 +3932,7 @@ function renderSettingsTestResult(res) {
|
|||||||
} else {
|
} else {
|
||||||
lines.push(`<div class="set-test-line set-test-fail">${fail} Abteilungs-Gruppen-Lookup fehlgeschlagen: ${escapeHtml(d.error || '')}</div>`);
|
lines.push(`<div class="set-test-line set-test-fail">${fail} Abteilungs-Gruppen-Lookup fehlgeschlagen: ${escapeHtml(d.error || '')}</div>`);
|
||||||
}
|
}
|
||||||
const r = res.rpa || {};
|
// RPA-Funktion ist deaktiviert — Test-Ergebnis dazu wird nicht angezeigt.
|
||||||
if (r.ok) {
|
|
||||||
lines.push(`<div class="set-test-line">${ok} RPA-Gruppen: <strong>${(r.found || []).length}</strong> von <strong>${r.expected}</strong> gefunden</div>`);
|
|
||||||
} else if (r.reason === 'not_configured') {
|
|
||||||
lines.push(`<div class="set-test-line set-test-warn">${fail} Keine RPA-Gruppen konfiguriert (optional — der RPA-Tab bleibt dann leer).</div>`);
|
|
||||||
} else {
|
|
||||||
const miss = (r.missing || []).map(escapeHtml).join(', ');
|
|
||||||
lines.push(`<div class="set-test-line set-test-fail">${fail} RPA-Gruppen: ${(r.found || []).length} von ${r.expected} gefunden. Fehlt: <code>${miss}</code></div>`);
|
|
||||||
}
|
|
||||||
const u = res.userSearch || {};
|
const u = res.userSearch || {};
|
||||||
if (u.ok) {
|
if (u.ok) {
|
||||||
lines.push(`<div class="set-test-line">${ok} Benutzer-Suche: ok (${(u.fields || []).join(', ')})</div>`);
|
lines.push(`<div class="set-test-line">${ok} Benutzer-Suche: ok (${(u.fields || []).join(', ')})</div>`);
|
||||||
@@ -3887,6 +3955,136 @@ function renderSettingsTestResult(res) {
|
|||||||
return lines.join('');
|
return lines.join('');
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// --- Multi-Tenant Profil-Editor (Einstellungen) ---
|
||||||
|
function tenantNewId() {
|
||||||
|
return (window.crypto && crypto.randomUUID)
|
||||||
|
? crypto.randomUUID()
|
||||||
|
: 't-' + Date.now() + '-' + Math.random().toString(16).slice(2, 8);
|
||||||
|
}
|
||||||
|
|
||||||
|
function applyConnModeUI(mode) {
|
||||||
|
const multi = mode === 'multi';
|
||||||
|
document.getElementById('setSingleConn').classList.toggle('hidden', multi);
|
||||||
|
document.getElementById('setMultiConn').classList.toggle('hidden', !multi);
|
||||||
|
}
|
||||||
|
|
||||||
|
function tenantRowHtml(t, active) {
|
||||||
|
const id = t.id || tenantNewId();
|
||||||
|
return `<div class="tenant-row" data-id="${escapeHtml(id)}">
|
||||||
|
<div class="tenant-row-head">
|
||||||
|
<label class="tenant-active"><input type="radio" name="tenantActive" value="${escapeHtml(id)}" ${active ? 'checked' : ''}><span>Aktiv</span></label>
|
||||||
|
<input type="text" class="input tenant-label" placeholder="Bezeichnung (z.B. Kunde A)" value="${escapeHtml(t.label || '')}" autocomplete="off">
|
||||||
|
<button type="button" class="btn btn-danger btn-sm tenant-remove" title="Profil entfernen">✕</button>
|
||||||
|
</div>
|
||||||
|
<div class="tenant-row-grid">
|
||||||
|
<input type="text" class="input mono tenant-tid" placeholder="Tenant ID (GUID)" value="${escapeHtml(t.tenantId || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
<input type="text" class="input mono tenant-cid" placeholder="Client ID Read/Write (GUID)" value="${escapeHtml(t.clientId || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
<input type="text" class="input mono tenant-cidro" placeholder="Client ID Read-Only (optional)" value="${escapeHtml(t.clientIdRo || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
</div>
|
||||||
|
<div class="tenant-row-overrides">
|
||||||
|
<label class="tenant-sub-lbl">Abteilungs-Präfixe <span class="tenant-sub-hint">(leer = globale Vorgabe)</span></label>
|
||||||
|
<textarea class="input mono tenant-prefixes" rows="2" spellcheck="false" placeholder="eine pro Zeile, z.B. abt-hm">${escapeHtml((t.prefixes || []).join('\n'))}</textarea>
|
||||||
|
<label class="tenant-sub-lbl">Required-Gruppen-Naming <span class="tenant-sub-hint">(leer = globale Vorgabe)</span></label>
|
||||||
|
<div class="tenant-naming-grid">
|
||||||
|
<input type="text" class="input mono tenant-req-prefix" placeholder="Präfix" value="${escapeHtml((t.requiredGroupNaming && t.requiredGroupNaming.prefix) || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
<input type="text" class="input mono tenant-req-suffix" placeholder="Suffix" value="${escapeHtml((t.requiredGroupNaming && t.requiredGroupNaming.suffix) || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
</div>
|
||||||
|
<label class="tenant-sub-lbl">Available-Gruppen-Naming <span class="tenant-sub-hint">(leer = globale Vorgabe)</span></label>
|
||||||
|
<div class="tenant-naming-grid">
|
||||||
|
<input type="text" class="input mono tenant-avail-prefix" placeholder="Präfix" value="${escapeHtml((t.availableGroupNaming && t.availableGroupNaming.prefix) || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
<input type="text" class="input mono tenant-avail-suffix" placeholder="Suffix" value="${escapeHtml((t.availableGroupNaming && t.availableGroupNaming.suffix) || '')}" spellcheck="false" autocomplete="off">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>`;
|
||||||
|
}
|
||||||
|
|
||||||
|
const TENANT_EMPTY_HINT = '<div class="form-hint tenant-empty">Noch keine Tenants. Füge unten einen hinzu.</div>';
|
||||||
|
|
||||||
|
function renderTenantRows(tenants, activeId) {
|
||||||
|
const el = document.getElementById('setTenantList');
|
||||||
|
const list = Array.isArray(tenants) ? tenants.filter(Boolean) : [];
|
||||||
|
let active = activeId;
|
||||||
|
if (!list.some(t => t.id === active) && list.length) active = list[0].id;
|
||||||
|
el.innerHTML = list.length ? list.map(t => tenantRowHtml(t, t.id === active)).join('') : TENANT_EMPTY_HINT;
|
||||||
|
wireTenantRowEvents();
|
||||||
|
}
|
||||||
|
|
||||||
|
function wireTenantRowEvents() {
|
||||||
|
document.querySelectorAll('#setTenantList .tenant-remove').forEach(btn => {
|
||||||
|
btn.onclick = () => {
|
||||||
|
const row = btn.closest('.tenant-row');
|
||||||
|
const wasActive = row.querySelector('input[name="tenantActive"]').checked;
|
||||||
|
row.remove();
|
||||||
|
if (wasActive) {
|
||||||
|
const first = document.querySelector('#setTenantList input[name="tenantActive"]');
|
||||||
|
if (first) first.checked = true;
|
||||||
|
}
|
||||||
|
if (!document.querySelector('#setTenantList .tenant-row')) {
|
||||||
|
document.getElementById('setTenantList').innerHTML = TENANT_EMPTY_HINT;
|
||||||
|
}
|
||||||
|
};
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function addTenantRow() {
|
||||||
|
const el = document.getElementById('setTenantList');
|
||||||
|
if (!el.querySelector('.tenant-row')) el.innerHTML = '';
|
||||||
|
const id = tenantNewId();
|
||||||
|
const isFirst = !el.querySelector('.tenant-row');
|
||||||
|
el.insertAdjacentHTML('beforeend', tenantRowHtml({ id }, isFirst));
|
||||||
|
wireTenantRowEvents();
|
||||||
|
el.querySelector(`.tenant-row[data-id="${CSS.escape(id)}"] .tenant-label`)?.focus();
|
||||||
|
}
|
||||||
|
|
||||||
|
function tenantSplitLines(txt) {
|
||||||
|
return (txt || '').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
|
||||||
|
}
|
||||||
|
|
||||||
|
function readTenantRows() {
|
||||||
|
const tenants = [];
|
||||||
|
let activeTenantId = '';
|
||||||
|
document.querySelectorAll('#setTenantList .tenant-row').forEach(row => {
|
||||||
|
const id = row.dataset.id;
|
||||||
|
tenants.push({
|
||||||
|
id,
|
||||||
|
label: row.querySelector('.tenant-label').value.trim(),
|
||||||
|
tenantId: row.querySelector('.tenant-tid').value.trim(),
|
||||||
|
clientId: row.querySelector('.tenant-cid').value.trim(),
|
||||||
|
clientIdRo: row.querySelector('.tenant-cidro').value.trim(),
|
||||||
|
// Pro-Tenant-Overrides; leer = globale Vorgabe gilt.
|
||||||
|
prefixes: tenantSplitLines(row.querySelector('.tenant-prefixes').value),
|
||||||
|
requiredGroupNaming: {
|
||||||
|
prefix: row.querySelector('.tenant-req-prefix').value.trim(),
|
||||||
|
suffix: row.querySelector('.tenant-req-suffix').value.trim(),
|
||||||
|
},
|
||||||
|
availableGroupNaming: {
|
||||||
|
prefix: row.querySelector('.tenant-avail-prefix').value.trim(),
|
||||||
|
suffix: row.querySelector('.tenant-avail-suffix').value.trim(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
if (row.querySelector('input[name="tenantActive"]').checked) activeTenantId = id;
|
||||||
|
});
|
||||||
|
if (!activeTenantId && tenants.length) activeTenantId = tenants[0].id;
|
||||||
|
return { tenants, activeTenantId };
|
||||||
|
}
|
||||||
|
|
||||||
|
document.getElementById('setConnMode')?.addEventListener('change', e => {
|
||||||
|
applyConnModeUI(e.target.value);
|
||||||
|
// Beim erstmaligen Wechsel auf Multi ohne Profile: aus den Single-Feldern ein Profil vorbefüllen
|
||||||
|
if (e.target.value === 'multi' && !document.querySelector('#setTenantList .tenant-row')) {
|
||||||
|
const tid = document.getElementById('setTenantId').value.trim();
|
||||||
|
const cid = document.getElementById('setClientId').value.trim();
|
||||||
|
if (tid || cid) {
|
||||||
|
renderTenantRows([{
|
||||||
|
id: tenantNewId(), label: 'Standard',
|
||||||
|
tenantId: tid, clientId: cid,
|
||||||
|
clientIdRo: document.getElementById('setClientIdRo').value.trim(),
|
||||||
|
}], null);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
});
|
||||||
|
document.getElementById('btnAddTenant')?.addEventListener('click', addTenantRow);
|
||||||
|
|
||||||
function fillSettingsForm(s) {
|
function fillSettingsForm(s) {
|
||||||
const c = s.connection || {};
|
const c = s.connection || {};
|
||||||
document.getElementById('setTenantId').value = c.tenantId || '';
|
document.getElementById('setTenantId').value = c.tenantId || '';
|
||||||
@@ -3895,6 +4093,12 @@ function fillSettingsForm(s) {
|
|||||||
document.getElementById('setScopes').value = (c.scopes || []).join('\n');
|
document.getElementById('setScopes').value = (c.scopes || []).join('\n');
|
||||||
document.getElementById('setScopesRo').value = (c.scopesRo || []).join('\n');
|
document.getElementById('setScopesRo').value = (c.scopesRo || []).join('\n');
|
||||||
|
|
||||||
|
// Verbindungsmodus + Multi-Tenant-Profile
|
||||||
|
const mode = c.multiTenant ? 'multi' : 'single';
|
||||||
|
document.getElementById('setConnMode').value = mode;
|
||||||
|
renderTenantRows(Array.isArray(c.tenants) ? c.tenants : [], c.activeTenantId || '');
|
||||||
|
applyConnModeUI(mode);
|
||||||
|
|
||||||
// Backward-compat: lese 'prefixes' (Array) bevorzugt, falle sonst auf
|
// Backward-compat: lese 'prefixes' (Array) bevorzugt, falle sonst auf
|
||||||
// alten Single-String 'prefix' zurueck. Beide werden in die Textarea
|
// alten Single-String 'prefix' zurueck. Beide werden in die Textarea
|
||||||
// gemerged (gleiche Logik wie Get-DepartmentPrefixes im Backend).
|
// gemerged (gleiche Logik wie Get-DepartmentPrefixes im Backend).
|
||||||
@@ -3911,7 +4115,6 @@ function fillSettingsForm(s) {
|
|||||||
}
|
}
|
||||||
document.getElementById('setDeptPrefixes').value = out.join('\n');
|
document.getElementById('setDeptPrefixes').value = out.join('\n');
|
||||||
})();
|
})();
|
||||||
document.getElementById('setRpaGroups').value = ((s.rpa && s.rpa.groupNames) || []).join('\n');
|
|
||||||
|
|
||||||
const fields = (s.userSearch && s.userSearch.fields) || [];
|
const fields = (s.userSearch && s.userSearch.fields) || [];
|
||||||
document.getElementById('setUsfDisplayName').checked = fields.includes('displayName');
|
document.getElementById('setUsfDisplayName').checked = fields.includes('displayName');
|
||||||
@@ -3928,6 +4131,11 @@ function fillSettingsForm(s) {
|
|||||||
document.getElementById('setAvailSuffix').value = av.suffix || '';
|
document.getElementById('setAvailSuffix').value = av.suffix || '';
|
||||||
updateAvailPreview();
|
updateAvailPreview();
|
||||||
|
|
||||||
|
// Policy-Backup (Git)
|
||||||
|
const pb = s.policyBackup || {};
|
||||||
|
document.getElementById('setPolicyGitPath').value = pb.gitRepoPath || '';
|
||||||
|
document.getElementById('setPolicyGitPush').checked = !!pb.push;
|
||||||
|
|
||||||
// Branding-Logo Preview
|
// Branding-Logo Preview
|
||||||
fillLogoPreview(s.branding);
|
fillLogoPreview(s.branding);
|
||||||
|
|
||||||
@@ -3972,14 +4180,32 @@ function readSettingsForm() {
|
|||||||
if (document.getElementById('setUsfMail').checked) fields.push('mail');
|
if (document.getElementById('setUsfMail').checked) fields.push('mail');
|
||||||
if (document.getElementById('setUsfDepartment').checked) fields.push('department');
|
if (document.getElementById('setUsfDepartment').checked) fields.push('department');
|
||||||
|
|
||||||
|
const mode = document.getElementById('setConnMode').value;
|
||||||
|
const multiTenant = mode === 'multi';
|
||||||
|
const connection = {
|
||||||
|
multiTenant,
|
||||||
|
scopes: splitLines(document.getElementById('setScopes').value),
|
||||||
|
scopesRo: splitLines(document.getElementById('setScopesRo').value),
|
||||||
|
};
|
||||||
|
if (multiTenant) {
|
||||||
|
const { tenants, activeTenantId } = readTenantRows();
|
||||||
|
connection.tenants = tenants;
|
||||||
|
connection.activeTenantId = activeTenantId;
|
||||||
|
// Aktives Profil in die flachen Felder spiegeln (Rückwärts-Kompatibilität;
|
||||||
|
// Status-Anzeige und evtl. Alt-Code lesen weiter connection.tenantId/clientId).
|
||||||
|
const active = tenants.find(t => t.id === activeTenantId) || tenants[0] || {};
|
||||||
|
connection.tenantId = active.tenantId || '';
|
||||||
|
connection.clientId = active.clientId || '';
|
||||||
|
connection.clientIdRo = active.clientIdRo || '';
|
||||||
|
} else {
|
||||||
|
connection.tenantId = document.getElementById('setTenantId').value.trim();
|
||||||
|
connection.clientId = document.getElementById('setClientId').value.trim();
|
||||||
|
connection.clientIdRo = document.getElementById('setClientIdRo').value.trim();
|
||||||
|
// tenants/activeTenantId nicht mitschicken -> Merge behält vorhandene Profile.
|
||||||
|
}
|
||||||
|
|
||||||
return {
|
return {
|
||||||
connection: {
|
connection,
|
||||||
tenantId: document.getElementById('setTenantId').value.trim(),
|
|
||||||
clientId: document.getElementById('setClientId').value.trim(),
|
|
||||||
clientIdRo: document.getElementById('setClientIdRo').value.trim(),
|
|
||||||
scopes: splitLines(document.getElementById('setScopes').value),
|
|
||||||
scopesRo: splitLines(document.getElementById('setScopesRo').value),
|
|
||||||
},
|
|
||||||
departments: {
|
departments: {
|
||||||
// Neuer Listen-Form: Praefixe aus Textarea. Alten Single-String 'prefix'
|
// Neuer Listen-Form: Praefixe aus Textarea. Alten Single-String 'prefix'
|
||||||
// beim Save auf leer setzen, damit nicht beide Quellen divergieren —
|
// beim Save auf leer setzen, damit nicht beide Quellen divergieren —
|
||||||
@@ -3987,9 +4213,6 @@ function readSettingsForm() {
|
|||||||
prefixes: splitLines(document.getElementById('setDeptPrefixes').value),
|
prefixes: splitLines(document.getElementById('setDeptPrefixes').value),
|
||||||
prefix: '',
|
prefix: '',
|
||||||
},
|
},
|
||||||
rpa: {
|
|
||||||
groupNames: splitLines(document.getElementById('setRpaGroups').value),
|
|
||||||
},
|
|
||||||
userSearch: {
|
userSearch: {
|
||||||
fields,
|
fields,
|
||||||
},
|
},
|
||||||
@@ -4013,6 +4236,10 @@ function readSettingsForm() {
|
|||||||
detailPanel: document.getElementById('setColDetailPanelHex').value.trim() || ThemeDefaults.detailPanel,
|
detailPanel: document.getElementById('setColDetailPanelHex').value.trim() || ThemeDefaults.detailPanel,
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
policyBackup: {
|
||||||
|
gitRepoPath: document.getElementById('setPolicyGitPath').value.trim(),
|
||||||
|
push: document.getElementById('setPolicyGitPush').checked,
|
||||||
|
},
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -4036,6 +4263,7 @@ async function saveSettings() {
|
|||||||
try {
|
try {
|
||||||
const res = await api('/api/settings', { method: 'PUT', body: payload });
|
const res = await api('/api/settings', { method: 'PUT', body: payload });
|
||||||
SettingsState.current = res.settings;
|
SettingsState.current = res.settings;
|
||||||
|
refreshTenantSwitcher(); // Modus/Profil-Änderungen im Topbar-Umschalter spiegeln
|
||||||
// Theme + Branding sofort live anwenden (kein Reload noetig)
|
// Theme + Branding sofort live anwenden (kein Reload noetig)
|
||||||
if (res.settings) {
|
if (res.settings) {
|
||||||
applyThemeColors(res.settings.theme && res.settings.theme.colors);
|
applyThemeColors(res.settings.theme && res.settings.theme.colors);
|
||||||
@@ -4317,6 +4545,7 @@ document.getElementById('btnRestoreColors')?.addEventListener('click', () => {
|
|||||||
console.warn('Settings konnten beim Init nicht geladen werden:', e.message);
|
console.warn('Settings konnten beim Init nicht geladen werden:', e.message);
|
||||||
}
|
}
|
||||||
await refreshStatus();
|
await refreshStatus();
|
||||||
|
refreshTenantSwitcher();
|
||||||
if (State.connected) autoLoadAfterConnect();
|
if (State.connected) autoLoadAfterConnect();
|
||||||
// First-Run: wenn kritische Felder leer sind, Settings-Modal automatisch oeffnen.
|
// First-Run: wenn kritische Felder leer sind, Settings-Modal automatisch oeffnen.
|
||||||
if (setupNeeded) {
|
if (setupNeeded) {
|
||||||
@@ -5543,6 +5772,7 @@ async function loadPolicies() {
|
|||||||
['/api/policies/settingscatalog', 'Settings Catalog'],
|
['/api/policies/settingscatalog', 'Settings Catalog'],
|
||||||
['/api/policies/compliance', 'Compliance'],
|
['/api/policies/compliance', 'Compliance'],
|
||||||
['/api/policies/configuration', 'Konfigurationsprofile'],
|
['/api/policies/configuration', 'Konfigurationsprofile'],
|
||||||
|
['/api/policies/administrativetemplate', 'Administrative Vorlagen'],
|
||||||
];
|
];
|
||||||
const settled = await Promise.allSettled(endpoints.map(([url]) => api(url)));
|
const settled = await Promise.allSettled(endpoints.map(([url]) => api(url)));
|
||||||
let items = [];
|
let items = [];
|
||||||
@@ -5660,19 +5890,19 @@ async function polExportSelected() {
|
|||||||
if (res.exports) allExports = allExports.concat(res.exports);
|
if (res.exports) allExports = allExports.concat(res.exports);
|
||||||
}
|
}
|
||||||
if (!allExports.length) { toast('Nichts exportiert.', 'warn'); return; }
|
if (!allExports.length) { toast('Nichts exportiert.', 'warn'); return; }
|
||||||
if (allExports.length === 1) {
|
// Jede ausgewählte Policy als eigene JSON-Datei herunterladen.
|
||||||
polDownloadJson(allExports[0].data, allExports[0].fileName || 'policy.json');
|
const usedNames = new Set();
|
||||||
} else {
|
for (let i = 0; i < allExports.length; i++) {
|
||||||
const stamp = new Date().toISOString().slice(0, 19).replace(/[:T]/g, '').replace(/-/g, '');
|
const e = allExports[i];
|
||||||
const bundle = {
|
let fn = e.fileName || `policy_${i + 1}.json`;
|
||||||
type: 'IntuneManagerPolicyBundle',
|
// Dateinamens-Kollisionen (z.B. gleicher Anzeigename) eindeutig machen.
|
||||||
exportDate: new Date().toISOString(),
|
if (usedNames.has(fn)) fn = fn.replace(/\.json$/i, '') + `_${i + 1}.json`;
|
||||||
count: allExports.length,
|
usedNames.add(fn);
|
||||||
policies: allExports.map(e => e.data),
|
polDownloadJson(e.data, fn);
|
||||||
};
|
// Kurze Pause, damit der Browser mehrere aufeinanderfolgende Downloads nicht verwirft.
|
||||||
polDownloadJson(bundle, `intune-policies_${stamp}.json`);
|
if (i < allExports.length - 1) await new Promise(r => setTimeout(r, 150));
|
||||||
}
|
}
|
||||||
toast(`${allExports.length} Policy(s) exportiert (auch im Server-Archiv abgelegt).`, 'ok');
|
toast(`${allExports.length} Policy(s) als Einzeldatei(en) exportiert (auch im Server-Archiv abgelegt).`, 'ok');
|
||||||
} catch (e) {
|
} catch (e) {
|
||||||
toast('Export fehlgeschlagen: ' + e.message, 'err');
|
toast('Export fehlgeschlagen: ' + e.message, 'err');
|
||||||
} finally {
|
} finally {
|
||||||
@@ -5683,12 +5913,20 @@ async function polExportSelected() {
|
|||||||
// Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
|
// Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
|
||||||
function polExtractEnvelopes(parsed, fileName) {
|
function polExtractEnvelopes(parsed, fileName) {
|
||||||
if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
|
if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
|
||||||
if (parsed && parsed.exportType && parsed.policy) return [parsed];
|
// Beide Typ-Felder akzeptieren: exportType (Export-Download) + policyType (Git-Snapshot).
|
||||||
|
if (parsed && (parsed.exportType || parsed.policyType) && parsed.policy) return [parsed];
|
||||||
if (parsed && parsed.policy) return [parsed]; // nachsichtig
|
if (parsed && parsed.policy) return [parsed]; // nachsichtig
|
||||||
toast(`${fileName}: unbekanntes Policy-Format.`, 'err');
|
toast(`${fileName}: unbekanntes Policy-Format.`, 'err');
|
||||||
return [];
|
return [];
|
||||||
}
|
}
|
||||||
|
|
||||||
|
let _polImportEnvelopes = [];
|
||||||
|
|
||||||
|
function polEnvName(env) {
|
||||||
|
return env.policyName || (env.policy && (env.policy.name || env.policy.displayName)) || '(ohne Name)';
|
||||||
|
}
|
||||||
|
|
||||||
|
// Dateien einlesen -> Rename-Dialog oeffnen (der eigentliche Import folgt dort).
|
||||||
async function polHandleImportFiles(fileList) {
|
async function polHandleImportFiles(fileList) {
|
||||||
const files = [...fileList];
|
const files = [...fileList];
|
||||||
if (!files.length) return;
|
if (!files.length) return;
|
||||||
@@ -5700,10 +5938,36 @@ async function polHandleImportFiles(fileList) {
|
|||||||
envelopes = envelopes.concat(polExtractEnvelopes(parsed, f.name));
|
envelopes = envelopes.concat(polExtractEnvelopes(parsed, f.name));
|
||||||
}
|
}
|
||||||
if (!envelopes.length) return;
|
if (!envelopes.length) return;
|
||||||
if (!window.confirm(`${envelopes.length} Policy(s) als NEUE Policies im verbundenen Tenant anlegen?\n\nBestehende Policies werden dabei nicht verändert.`)) return;
|
_polImportEnvelopes = envelopes;
|
||||||
|
renderPolImportList();
|
||||||
|
openModal('modalPolImport');
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolImportList() {
|
||||||
|
const list = document.getElementById('polImportList');
|
||||||
|
if (!list) return;
|
||||||
|
list.innerHTML = _polImportEnvelopes.map((env, i) => {
|
||||||
|
const type = env.exportType || env.policyType || '';
|
||||||
|
return `<div class="pol-import-row">
|
||||||
|
<input class="input pol-import-name" data-idx="${i}" value="${escapeHtml(polEnvName(env))}" placeholder="Policy-Name">
|
||||||
|
<span class="pol-type-badge">${escapeHtml(POL_TYPE_LABELS[type] || type || 'Policy')}</span>
|
||||||
|
</div>`;
|
||||||
|
}).join('');
|
||||||
|
const info = document.getElementById('polImportInfo');
|
||||||
|
if (info) info.textContent = `${_polImportEnvelopes.length} Policy(s)`;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function polDoImport() {
|
||||||
|
// Geänderte Namen übernehmen (nur wenn nicht leer und wirklich anders).
|
||||||
|
_polImportEnvelopes.forEach((env, i) => {
|
||||||
|
const input = document.querySelector(`.pol-import-name[data-idx="${i}"]`);
|
||||||
|
const nn = input ? input.value.trim() : '';
|
||||||
|
if (nn && nn !== polEnvName(env)) env.newName = nn; else delete env.newName;
|
||||||
|
});
|
||||||
|
closeModal('modalPolImport');
|
||||||
setLoading('Importiere Policies…');
|
setLoading('Importiere Policies…');
|
||||||
try {
|
try {
|
||||||
const res = await api('/api/policies/import', { method: 'POST', body: { policies: envelopes }, timeoutMs: 180000 });
|
const res = await api('/api/policies/import', { method: 'POST', body: { policies: _polImportEnvelopes }, timeoutMs: 180000 });
|
||||||
const results = res.results || [];
|
const results = res.results || [];
|
||||||
const ok = results.filter(r => r.success);
|
const ok = results.filter(r => r.success);
|
||||||
const fail = results.filter(r => !r.success);
|
const fail = results.filter(r => !r.success);
|
||||||
@@ -5714,15 +5978,215 @@ async function polHandleImportFiles(fileList) {
|
|||||||
toast(`${ok.length} Policy(s) importiert.`, 'ok', 'Import');
|
toast(`${ok.length} Policy(s) importiert.`, 'ok', 'Import');
|
||||||
}
|
}
|
||||||
await loadPolicies();
|
await loadPolicies();
|
||||||
|
// Nach erfolgreichem Import optional Gruppen zuweisen (pro Policy).
|
||||||
|
const assignable = ok.filter(r => r.newId);
|
||||||
|
if (assignable.length && !State.readOnly) openPolAssignModal(assignable);
|
||||||
} catch (e) {
|
} catch (e) {
|
||||||
toast('Import fehlgeschlagen: ' + e.message, 'err');
|
toast('Import fehlgeschlagen: ' + e.message, 'err');
|
||||||
} finally {
|
} finally {
|
||||||
clearLoading();
|
clearLoading();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
document.getElementById('polImportConfirm')?.addEventListener('click', polDoImport);
|
||||||
|
|
||||||
|
// =============================================================
|
||||||
|
// Post-Import: Policies pro Stück Include-/Exclude-Gruppen zuweisen
|
||||||
|
// =============================================================
|
||||||
|
const PolAssignState = { policies: [] };
|
||||||
|
const POL_TYPE_LABELS = {
|
||||||
|
SettingsCatalog: 'Settings Catalog',
|
||||||
|
CompliancePolicy: 'Compliance',
|
||||||
|
ConfigurationProfile: 'Konfigurationsprofil',
|
||||||
|
AdministrativeTemplate: 'Administrative Vorlage',
|
||||||
|
};
|
||||||
|
|
||||||
|
function openPolAssignModal(assignable) {
|
||||||
|
PolAssignState.policies = assignable.map(r => ({
|
||||||
|
id: r.newId,
|
||||||
|
name: r.policyName || '(ohne Name)',
|
||||||
|
exportType: r.exportType || '',
|
||||||
|
include: [],
|
||||||
|
exclude: [],
|
||||||
|
}));
|
||||||
|
renderPolAssignList();
|
||||||
|
openModal('modalPolAssign');
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolAssignList() {
|
||||||
|
const list = document.getElementById('polAssignList');
|
||||||
|
if (!list) return;
|
||||||
|
list.innerHTML = PolAssignState.policies.map((p, i) => `
|
||||||
|
<div class="pol-assign-row" data-idx="${i}">
|
||||||
|
<div class="pol-assign-head">
|
||||||
|
<span class="pol-name">${escapeHtml(p.name)}</span>
|
||||||
|
<span class="pol-type-badge">${escapeHtml(POL_TYPE_LABELS[p.exportType] || p.exportType || 'Policy')}</span>
|
||||||
|
</div>
|
||||||
|
<div class="pol-assign-pickers">
|
||||||
|
${['include', 'exclude'].map(kind => `
|
||||||
|
<div class="pol-assign-picker" data-kind="${kind}">
|
||||||
|
<label class="lbl">${kind === 'include' ? 'Include-Gruppen' : 'Exclude-Gruppen'}</label>
|
||||||
|
<div class="pol-assign-chips" data-idx="${i}" data-kind="${kind}"></div>
|
||||||
|
<div class="pol-assign-search-wrap">
|
||||||
|
<input type="text" class="input pol-assign-search" data-idx="${i}" data-kind="${kind}" placeholder="Gruppe suchen…" autocomplete="off">
|
||||||
|
<div class="pol-assign-dropdown hidden" data-idx="${i}" data-kind="${kind}"></div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
`).join('')}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
`).join('');
|
||||||
|
PolAssignState.policies.forEach((_, i) => {
|
||||||
|
renderPolAssignChips(i, 'include');
|
||||||
|
renderPolAssignChips(i, 'exclude');
|
||||||
|
});
|
||||||
|
updatePolAssignInfo();
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolAssignChips(idx, kind) {
|
||||||
|
const box = document.querySelector(`.pol-assign-chips[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
if (!box) return;
|
||||||
|
const arr = PolAssignState.policies[idx][kind];
|
||||||
|
box.innerHTML = arr.map((g, j) => `
|
||||||
|
<span class="pol-assign-chip ${kind === 'exclude' ? 'exclude' : ''}">
|
||||||
|
${escapeHtml(g.name)}
|
||||||
|
<button type="button" data-idx="${idx}" data-kind="${kind}" data-j="${j}" title="Entfernen">×</button>
|
||||||
|
</span>
|
||||||
|
`).join('');
|
||||||
|
updatePolAssignInfo();
|
||||||
|
}
|
||||||
|
|
||||||
|
function updatePolAssignInfo() {
|
||||||
|
const info = document.getElementById('polAssignInfo');
|
||||||
|
if (!info) return;
|
||||||
|
const n = PolAssignState.policies.filter(p => p.include.length || p.exclude.length).length;
|
||||||
|
info.textContent = n ? `${n} Policy(s) mit Zuweisung` : 'Keine Zuweisung gewählt';
|
||||||
|
}
|
||||||
|
|
||||||
|
let _polAssignSearchTimer = null;
|
||||||
|
function polAssignHideDropdowns() {
|
||||||
|
document.querySelectorAll('.pol-assign-dropdown').forEach(d => { d.classList.add('hidden'); d.innerHTML = ''; });
|
||||||
|
}
|
||||||
|
|
||||||
|
// Suche (debounced) — Event-Delegation auf der Liste.
|
||||||
|
document.getElementById('polAssignList')?.addEventListener('input', e => {
|
||||||
|
const input = e.target.closest('.pol-assign-search');
|
||||||
|
if (!input) return;
|
||||||
|
const idx = input.dataset.idx, kind = input.dataset.kind;
|
||||||
|
const dd = document.querySelector(`.pol-assign-dropdown[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
const q = input.value.trim();
|
||||||
|
clearTimeout(_polAssignSearchTimer);
|
||||||
|
if (q.length < 2) { if (dd) { dd.classList.add('hidden'); dd.innerHTML = ''; } return; }
|
||||||
|
if (dd) { dd.classList.remove('hidden'); dd.innerHTML = '<div class="msg">Suche…</div>'; }
|
||||||
|
_polAssignSearchTimer = setTimeout(async () => {
|
||||||
|
try {
|
||||||
|
const data = await api(`/api/groups/search?q=${encodeURIComponent(q)}`);
|
||||||
|
const items = (data.items || []).slice(0, 25);
|
||||||
|
if (!dd) return;
|
||||||
|
if (!items.length) { dd.innerHTML = '<div class="msg">Keine Gruppen gefunden.</div>'; return; }
|
||||||
|
dd.innerHTML = items.map(g => `
|
||||||
|
<div class="opt" data-id="${escapeHtml(g.Id)}" data-name="${escapeHtml(g.DisplayName)}">
|
||||||
|
<div>${escapeHtml(g.DisplayName)}</div>
|
||||||
|
${g.Description ? `<div class="desc">${escapeHtml(g.Description)}</div>` : ''}
|
||||||
|
</div>`).join('');
|
||||||
|
} catch (err) {
|
||||||
|
if (dd) dd.innerHTML = `<div class="msg">Suche fehlgeschlagen: ${escapeHtml(err.message)}</div>`;
|
||||||
|
}
|
||||||
|
}, 300);
|
||||||
|
});
|
||||||
|
|
||||||
|
// Klick auf ein Suchergebnis -> als Chip hinzufügen. Klick auf Chip-× -> entfernen.
|
||||||
|
document.getElementById('polAssignList')?.addEventListener('click', e => {
|
||||||
|
const opt = e.target.closest('.pol-assign-dropdown .opt');
|
||||||
|
if (opt) {
|
||||||
|
const dd = opt.closest('.pol-assign-dropdown');
|
||||||
|
const idx = +dd.dataset.idx, kind = dd.dataset.kind;
|
||||||
|
const id = opt.dataset.id, name = opt.dataset.name;
|
||||||
|
const p = PolAssignState.policies[idx];
|
||||||
|
const other = kind === 'include' ? 'exclude' : 'include';
|
||||||
|
// Nicht doppelt, und nicht gleichzeitig include+exclude derselben Gruppe.
|
||||||
|
if (!p[kind].some(g => g.id === id) && !p[other].some(g => g.id === id)) {
|
||||||
|
p[kind].push({ id, name });
|
||||||
|
renderPolAssignChips(idx, kind);
|
||||||
|
}
|
||||||
|
const input = document.querySelector(`.pol-assign-search[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
if (input) input.value = '';
|
||||||
|
dd.classList.add('hidden'); dd.innerHTML = '';
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
const rm = e.target.closest('.pol-assign-chip button');
|
||||||
|
if (rm) {
|
||||||
|
const idx = +rm.dataset.idx, kind = rm.dataset.kind, j = +rm.dataset.j;
|
||||||
|
PolAssignState.policies[idx][kind].splice(j, 1);
|
||||||
|
renderPolAssignChips(idx, kind);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
document.addEventListener('click', e => {
|
||||||
|
if (!e.target.closest('.pol-assign-search-wrap')) polAssignHideDropdowns();
|
||||||
|
});
|
||||||
|
|
||||||
|
document.getElementById('polAssignApply')?.addEventListener('click', async () => {
|
||||||
|
const items = PolAssignState.policies
|
||||||
|
.filter(p => p.include.length || p.exclude.length)
|
||||||
|
.map(p => ({
|
||||||
|
exportType: p.exportType,
|
||||||
|
id: p.id,
|
||||||
|
policyName: p.name,
|
||||||
|
include: p.include.map(g => g.id),
|
||||||
|
exclude: p.exclude.map(g => g.id),
|
||||||
|
}));
|
||||||
|
if (!items.length) { closeModal('modalPolAssign'); return; }
|
||||||
|
setLoading('Weise Gruppen zu…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/policies/assign', { method: 'POST', body: { items }, timeoutMs: 120000 });
|
||||||
|
const results = res.results || [];
|
||||||
|
const fail = results.filter(r => !r.success);
|
||||||
|
if (fail.length) {
|
||||||
|
const first = fail[0];
|
||||||
|
toast(`${res.assignedCount || 0} zugewiesen, ${fail.length} fehlgeschlagen. z.B. "${first.policyName || '?'}": ${first.error || 'Fehler'}`, 'err', 'Zuweisung');
|
||||||
|
} else {
|
||||||
|
toast(`${res.assignedCount || 0} Policy(s) zugewiesen.`, 'ok', 'Zuweisung');
|
||||||
|
}
|
||||||
|
closeModal('modalPolAssign');
|
||||||
|
} catch (e) {
|
||||||
|
toast('Zuweisung fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
// Alle Policies als Snapshot in den konfigurierten Git-Ordner schreiben + committen.
|
||||||
|
async function polGitSnapshot() {
|
||||||
|
setLoading('Erstelle Policy-Snapshot & committe…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/policies/git-snapshot', { method: 'POST', timeoutMs: 300000 });
|
||||||
|
if (res.changed === false) {
|
||||||
|
toast(res.message || 'Keine Änderungen seit dem letzten Snapshot.', 'info', 'Git-Snapshot');
|
||||||
|
} else {
|
||||||
|
let msg = res.message || `Snapshot committet (${res.total} Policies).`;
|
||||||
|
if (res.pushError) msg += ` — Push-Fehler: ${res.pushError}`;
|
||||||
|
toast(msg, res.pushError ? 'warn' : 'ok', 'Git-Snapshot');
|
||||||
|
}
|
||||||
|
} catch (e) {
|
||||||
|
toast('Snapshot fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Ordner-Auswahl für den Git-Repo-Pfad (Einstellungen).
|
||||||
|
async function pickPolicyGitFolder() {
|
||||||
|
try {
|
||||||
|
const res = await api('/api/pickfolder', { method: 'POST', body: { title: 'Git-Repo-Ordner für Policy-Backup wählen' } });
|
||||||
|
if (res && res.path) document.getElementById('setPolicyGitPath').value = res.path;
|
||||||
|
} catch (e) {
|
||||||
|
toast('Ordner-Auswahl fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
document.getElementById('btnPickPolicyGit')?.addEventListener('click', pickPolicyGitFolder);
|
||||||
|
|
||||||
// --- Policies: Event-Wiring ---
|
// --- Policies: Event-Wiring ---
|
||||||
document.getElementById('btnPolRefresh')?.addEventListener('click', loadPolicies);
|
document.getElementById('btnPolRefresh')?.addEventListener('click', loadPolicies);
|
||||||
|
document.getElementById('btnPolGitSnapshot')?.addEventListener('click', polGitSnapshot);
|
||||||
document.getElementById('btnPolExport')?.addEventListener('click', polExportSelected);
|
document.getElementById('btnPolExport')?.addEventListener('click', polExportSelected);
|
||||||
document.getElementById('btnPolImport')?.addEventListener('click', () => document.getElementById('polImportFile').click());
|
document.getElementById('btnPolImport')?.addEventListener('click', () => document.getElementById('polImportFile').click());
|
||||||
document.getElementById('polImportFile')?.addEventListener('change', e => {
|
document.getElementById('polImportFile')?.addEventListener('change', e => {
|
||||||
|
|||||||
+140
-26
@@ -53,6 +53,7 @@
|
|||||||
<span class="theme-knob"></span>
|
<span class="theme-knob"></span>
|
||||||
</span>
|
</span>
|
||||||
</button>
|
</button>
|
||||||
|
<select id="tenantSwitch" class="tenant-switch hidden" title="Aktiven Mandanten wechseln"></select>
|
||||||
<div id="connStatus" class="conn-pill conn-off" title="Verbindungsstatus">
|
<div id="connStatus" class="conn-pill conn-off" title="Verbindungsstatus">
|
||||||
<span class="dot"></span>
|
<span class="dot"></span>
|
||||||
<span class="conn-text">Offline</span>
|
<span class="conn-text">Offline</span>
|
||||||
@@ -80,7 +81,7 @@
|
|||||||
Es öffnet sich ein Microsoft-Anmeldefenster. Wähle den gewünschten Account aus.
|
Es öffnet sich ein Microsoft-Anmeldefenster. Wähle den gewünschten Account aus.
|
||||||
</p>
|
</p>
|
||||||
<div id="onboardingSetupHint" class="banner-warning hidden">
|
<div id="onboardingSetupHint" class="banner-warning hidden">
|
||||||
Konfiguration unvollständig — bitte zuerst <a href="#" id="onboardingOpenSettings">Einstellungen</a> öffnen und Tenant ID, Client ID und Abteilungs-Präfix setzen.
|
Konfiguration unvollständig — bitte zuerst <a href="#" id="onboardingOpenSettings">Einstellungen</a> öffnen und Tenant ID und Client ID setzen.
|
||||||
</div>
|
</div>
|
||||||
<button id="btnConnect" class="btn btn-primary btn-lg">
|
<button id="btnConnect" class="btn btn-primary btn-lg">
|
||||||
<svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M11.4 2.4H2.4v9h9v-9zm10.2 0h-9v9h9v-9zm-10.2 10.2H2.4v9h9v-9zm10.2 0h-9v9h9v-9z"/></svg>
|
<svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M11.4 2.4H2.4v9h9v-9zm10.2 0h-9v9h9v-9zm-10.2 10.2H2.4v9h9v-9zm10.2 0h-9v9h9v-9z"/></svg>
|
||||||
@@ -134,7 +135,6 @@
|
|||||||
|
|
||||||
<div class="mode-segment" role="tablist">
|
<div class="mode-segment" role="tablist">
|
||||||
<button class="seg active" data-mode="dept" role="tab">Abteilung</button>
|
<button class="seg active" data-mode="dept" role="tab">Abteilung</button>
|
||||||
<button class="seg" data-mode="rpa" role="tab">RPA</button>
|
|
||||||
<button class="seg" data-mode="user" role="tab">Benutzer</button>
|
<button class="seg" data-mode="user" role="tab">Benutzer</button>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
@@ -572,6 +572,7 @@
|
|||||||
<option value="settingscatalog">Settings Catalog</option>
|
<option value="settingscatalog">Settings Catalog</option>
|
||||||
<option value="compliance">Compliance</option>
|
<option value="compliance">Compliance</option>
|
||||||
<option value="configuration">Konfigurationsprofil</option>
|
<option value="configuration">Konfigurationsprofil</option>
|
||||||
|
<option value="administrativetemplate">Administrative Vorlage</option>
|
||||||
</select>
|
</select>
|
||||||
<span class="pol-toolbar-spacer" style="flex:1;"></span>
|
<span class="pol-toolbar-spacer" style="flex:1;"></span>
|
||||||
<button class="btn btn-secondary btn-sm" id="btnPolRefresh" title="Policies neu laden">
|
<button class="btn btn-secondary btn-sm" id="btnPolRefresh" title="Policies neu laden">
|
||||||
@@ -583,6 +584,10 @@
|
|||||||
Import…
|
Import…
|
||||||
</button>
|
</button>
|
||||||
<input type="file" id="polImportFile" accept=".json,application/json" multiple style="display:none;">
|
<input type="file" id="polImportFile" accept=".json,application/json" multiple style="display:none;">
|
||||||
|
<button class="btn btn-secondary btn-sm" id="btnPolGitSnapshot" title="Alle Policies als Snapshot in den konfigurierten Git-Ordner schreiben und committen">
|
||||||
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><line x1="12" y1="3" x2="12" y2="9"/><line x1="12" y1="15" x2="12" y2="21"/><circle cx="12" cy="3" r="1"/><circle cx="12" cy="21" r="1"/></svg>
|
||||||
|
Git-Snapshot
|
||||||
|
</button>
|
||||||
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
||||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
||||||
Export (<span id="polSelCount">0</span>)
|
Export (<span id="polSelCount">0</span>)
|
||||||
@@ -808,6 +813,81 @@
|
|||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
<!-- MODAL: Policy-Import (optional umbenennen) -->
|
||||||
|
<div id="modalPolImport" class="modal hidden">
|
||||||
|
<div class="modal-backdrop" data-close></div>
|
||||||
|
<div class="modal-box modal-lg">
|
||||||
|
<div class="modal-head">
|
||||||
|
<h3>Policies importieren</h3>
|
||||||
|
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||||
|
</div>
|
||||||
|
<div class="modal-body">
|
||||||
|
<div class="form-hint" style="margin-bottom:12px;">
|
||||||
|
Namen können vor dem Import angepasst werden. Die Policies werden als
|
||||||
|
<b>Neuanlage</b> im verbundenen Tenant erstellt — bestehende bleiben unverändert.
|
||||||
|
</div>
|
||||||
|
<div id="polImportList"></div>
|
||||||
|
</div>
|
||||||
|
<div class="modal-foot">
|
||||||
|
<span id="polImportInfo" class="muted" style="margin-right:auto;"></span>
|
||||||
|
<button class="btn btn-secondary" data-close>Abbrechen</button>
|
||||||
|
<button class="btn btn-primary" id="polImportConfirm">Importieren</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- MODAL: Policy-Zuweisung nach Import -->
|
||||||
|
<div id="modalPolAssign" class="modal hidden">
|
||||||
|
<div class="modal-backdrop" data-close></div>
|
||||||
|
<div class="modal-box modal-lg">
|
||||||
|
<div class="modal-head">
|
||||||
|
<h3>Importierte Policies zuweisen</h3>
|
||||||
|
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||||
|
</div>
|
||||||
|
<div class="modal-body">
|
||||||
|
<div class="form-hint" style="margin-bottom:12px;">
|
||||||
|
Optional: jeder importierten Policy Include- und/oder Exclude-Gruppen im aktuellen Tenant zuweisen.
|
||||||
|
Felder leer lassen = keine Zuweisung. Original-Zuweisungen des Quell-Tenants werden nicht übernommen.
|
||||||
|
</div>
|
||||||
|
<div id="polAssignList"></div>
|
||||||
|
</div>
|
||||||
|
<div class="modal-foot">
|
||||||
|
<span id="polAssignInfo" class="muted" style="margin-right:auto;"></span>
|
||||||
|
<button class="btn btn-secondary" data-close>Überspringen</button>
|
||||||
|
<button class="btn btn-primary" id="polAssignApply">Zuweisen</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<style>
|
||||||
|
/* Nutzt die Theme-Variablen der App -> passt sich Light/Dark automatisch an. */
|
||||||
|
.pol-assign-row { border:1px solid var(--hairline); border-radius:8px; padding:12px 14px; margin-bottom:12px; overflow-wrap:anywhere; }
|
||||||
|
.pol-assign-head { display:flex; align-items:baseline; gap:8px; margin-bottom:10px; flex-wrap:wrap; }
|
||||||
|
.pol-assign-head .pol-name { font-weight:600; color:var(--ink); min-width:0; word-break:break-word; overflow-wrap:anywhere; }
|
||||||
|
.pol-assign-head .pol-type-badge { flex:0 0 auto; }
|
||||||
|
.pol-assign-pickers { display:flex; gap:16px; flex-wrap:wrap; }
|
||||||
|
.pol-assign-picker { flex:1; min-width:220px; }
|
||||||
|
.pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; color:var(--body); }
|
||||||
|
.pol-assign-picker[data-kind="exclude"] > .lbl { color:var(--pink); }
|
||||||
|
.pol-assign-chips { display:flex; flex-wrap:wrap; gap:6px; margin-bottom:6px; }
|
||||||
|
.pol-assign-chip { display:inline-flex; align-items:center; gap:6px; padding:2px 8px; border-radius:12px;
|
||||||
|
background:var(--surface-strong); color:var(--ink); font-size:12px; }
|
||||||
|
.pol-assign-chip.exclude { background:rgba(236,72,153,0.18); color:var(--ink); }
|
||||||
|
.pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; color:var(--muted); }
|
||||||
|
.pol-assign-chip button:hover { color:var(--ink); }
|
||||||
|
.pol-assign-search-wrap { position:relative; }
|
||||||
|
.pol-assign-dropdown { position:absolute; z-index:20; left:0; right:0; top:100%; margin-top:2px;
|
||||||
|
background:var(--canvas); border:1px solid var(--hairline); border-radius:6px;
|
||||||
|
max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.25); }
|
||||||
|
.pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; color:var(--body); }
|
||||||
|
.pol-assign-dropdown .opt:hover { background:var(--surface-soft); }
|
||||||
|
.pol-assign-dropdown .opt .desc { font-size:11px; color:var(--muted); }
|
||||||
|
.pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; color:var(--muted); }
|
||||||
|
.pol-import-row { display:flex; align-items:center; gap:10px; padding:8px 0; border-bottom:1px solid var(--hairline); }
|
||||||
|
.pol-import-row:last-child { border-bottom:none; }
|
||||||
|
.pol-import-name { flex:1; min-width:0; }
|
||||||
|
.pol-import-row .pol-type-badge { flex:0 0 auto; }
|
||||||
|
</style>
|
||||||
|
|
||||||
<!-- MODAL: Hilfe -->
|
<!-- MODAL: Hilfe -->
|
||||||
<div id="modalHelp" class="modal hidden">
|
<div id="modalHelp" class="modal hidden">
|
||||||
<div class="modal-backdrop" data-close></div>
|
<div class="modal-backdrop" data-close></div>
|
||||||
@@ -912,7 +992,7 @@
|
|||||||
|
|
||||||
<div id="setupBanner" class="banner-warning hidden">
|
<div id="setupBanner" class="banner-warning hidden">
|
||||||
<strong>Erste Konfiguration noetig.</strong>
|
<strong>Erste Konfiguration noetig.</strong>
|
||||||
Bitte mindestens Tenant ID, Client ID und Abteilungs-Praefix setzen. Danach <em>Verbindung + Lookups testen</em> ganz unten, dann speichern.
|
Bitte mindestens Tenant ID und Client ID setzen. Abteilungs-Präfixe sind optional. Danach <em>Verbindung + Lookups testen</em> ganz unten, dann speichern.
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<section class="settings-sec">
|
<section class="settings-sec">
|
||||||
@@ -921,20 +1001,46 @@
|
|||||||
<div class="settings-sec-sub">Tenant- und App-Registrierung. Änderungen erzwingen einen Disconnect.</div>
|
<div class="settings-sec-sub">Tenant- und App-Registrierung. Änderungen erzwingen einen Disconnect.</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label class="lbl" for="setTenantId">Tenant ID (GUID)</label>
|
<label class="lbl" for="setConnMode">Verbindungsmodus</label>
|
||||||
<input type="text" id="setTenantId" class="input mono" placeholder="00000000-0000-0000-0000-000000000000" spellcheck="false" autocomplete="off">
|
<select id="setConnMode" class="input">
|
||||||
<div class="form-hint">Findest du im Entra Admin Center → Übersicht → Tenant-Informationen.</div>
|
<option value="single">Single-Tenant (ein Mandant)</option>
|
||||||
|
<option value="multi">Multi-Tenant (mehrere Mandanten, Umschalten in der Topbar)</option>
|
||||||
|
</select>
|
||||||
|
<div class="form-hint">Im Multi-Tenant-Modus hinterlegst du mehrere Mandanten mit je eigener App-Registrierung und wechselst oben rechts zwischen ihnen.</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group">
|
|
||||||
<label class="lbl" for="setClientId">Client ID – Read/Write (GUID)</label>
|
<!-- Single-Tenant Felder -->
|
||||||
<input type="text" id="setClientId" class="input mono" placeholder="00000000-0000-0000-0000-000000000000" spellcheck="false" autocomplete="off">
|
<div id="setSingleConn">
|
||||||
<div class="form-hint">App-Registrierung mit Schreibrechten. Erforderlich: <em>Allow public client flows</em> = Ja, Redirect URI <code>http://localhost</code>.</div>
|
<div class="form-group">
|
||||||
|
<label class="lbl" for="setTenantId">Tenant ID (GUID)</label>
|
||||||
|
<input type="text" id="setTenantId" class="input mono" placeholder="00000000-0000-0000-0000-000000000000" spellcheck="false" autocomplete="off">
|
||||||
|
<div class="form-hint">Findest du im Entra Admin Center → Übersicht → Tenant-Informationen.</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="lbl" for="setClientId">Client ID – Read/Write (GUID)</label>
|
||||||
|
<input type="text" id="setClientId" class="input mono" placeholder="00000000-0000-0000-0000-000000000000" spellcheck="false" autocomplete="off">
|
||||||
|
<div class="form-hint">App-Registrierung mit Schreibrechten. Erforderlich: <em>Allow public client flows</em> = Ja, Redirect URI <code>http://localhost</code>.</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="lbl" for="setClientIdRo">Client ID – Read Only (GUID, optional)</label>
|
||||||
|
<input type="text" id="setClientIdRo" class="input mono" placeholder="00000000-0000-0000-0000-000000000000" spellcheck="false" autocomplete="off">
|
||||||
|
<div class="form-hint">Separate App-Registrierung ohne Schreibrechte. Nutzer dieser App sehen alle Daten, können aber nichts ändern. Leer lassen wenn nicht benötigt.</div>
|
||||||
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group">
|
|
||||||
<label class="lbl" for="setClientIdRo">Client ID – Read Only (GUID, optional)</label>
|
<!-- Multi-Tenant Profile -->
|
||||||
<input type="text" id="setClientIdRo" class="input mono" placeholder="00000000-0000-0000-0000-000000000000" spellcheck="false" autocomplete="off">
|
<div id="setMultiConn" class="hidden">
|
||||||
<div class="form-hint">Separate App-Registrierung ohne Schreibrechte. Nutzer dieser App sehen alle Daten, können aber nichts ändern. Leer lassen wenn nicht benötigt.</div>
|
<div class="form-group">
|
||||||
|
<label class="lbl">Tenant-Profile</label>
|
||||||
|
<div class="form-hint" style="margin-bottom:8px;">Pro Mandant eine eigene App-Registrierung. Der aktive Mandant ist markiert; umschalten geht auch über die Topbar.</div>
|
||||||
|
<div id="setTenantList" class="tenant-list"></div>
|
||||||
|
<button type="button" id="btnAddTenant" class="btn btn-secondary btn-sm" style="margin-top:8px;">
|
||||||
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><line x1="12" y1="5" x2="12" y2="19"/><line x1="5" y1="12" x2="19" y2="12"/></svg>
|
||||||
|
Tenant hinzufügen
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label class="lbl" for="setScopes">Scopes Read/Write (eine pro Zeile)</label>
|
<label class="lbl" for="setScopes">Scopes Read/Write (eine pro Zeile)</label>
|
||||||
<textarea id="setScopes" class="input mono" rows="4" spellcheck="false" placeholder="Group.ReadWrite.All GroupMember.ReadWrite.All User.Read.All DeviceManagementApps.ReadWrite.All"></textarea>
|
<textarea id="setScopes" class="input mono" rows="4" spellcheck="false" placeholder="Group.ReadWrite.All GroupMember.ReadWrite.All User.Read.All DeviceManagementApps.ReadWrite.All"></textarea>
|
||||||
@@ -958,17 +1064,6 @@
|
|||||||
</div>
|
</div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section class="settings-sec">
|
|
||||||
<div class="settings-sec-head">
|
|
||||||
<h4>RPA-Gruppen</h4>
|
|
||||||
<div class="settings-sec-sub">Genaue <code>displayName</code>-Werte der Gruppen, die im RPA-Tab angezeigt werden. Eine pro Zeile.</div>
|
|
||||||
</div>
|
|
||||||
<div class="form-group">
|
|
||||||
<label class="lbl" for="setRpaGroups">RPA-Gruppennamen</label>
|
|
||||||
<textarea id="setRpaGroups" class="input mono" rows="4" spellcheck="false" placeholder="intune-userrole-windowsclientuser-rpa intune-userrole-windowsclientuser-rpa-fbt intune-userrole-windowsclientuser-rpa-pro"></textarea>
|
|
||||||
</div>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="settings-sec">
|
<section class="settings-sec">
|
||||||
<div class="settings-sec-head">
|
<div class="settings-sec-head">
|
||||||
<h4>Benutzer-Suche</h4>
|
<h4>Benutzer-Suche</h4>
|
||||||
@@ -1018,6 +1113,25 @@
|
|||||||
<div class="form-hint">Vorschau: <code id="setAvailPreview" class="set-preview"></code></div>
|
<div class="form-hint">Vorschau: <code id="setAvailPreview" class="set-preview"></code></div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<section class="settings-sec">
|
||||||
|
<div class="settings-sec-head">
|
||||||
|
<h4>Policy-Backup (Git)</h4>
|
||||||
|
<div class="settings-sec-sub">Lokaler Git-Ordner für Policy-Snapshots. Der „Git-Snapshot"-Button im Policies-Tab schreibt alle Policies als JSON dorthin und committet sie (optional Push).</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="lbl" for="setPolicyGitPath">Git-Repo-Ordner (lokal)</label>
|
||||||
|
<div class="form-row" style="gap:8px;align-items:center;">
|
||||||
|
<input type="text" id="setPolicyGitPath" class="input mono" placeholder="z. B. C:\Intune-Backup" spellcheck="false" autocomplete="off" style="flex:1;">
|
||||||
|
<button type="button" class="btn btn-secondary btn-sm" id="btnPickPolicyGit">Ordner…</button>
|
||||||
|
</div>
|
||||||
|
<div class="form-hint">Wird bei Bedarf angelegt und als Git-Repo initialisiert. Leer = Funktion deaktiviert.</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="check-chip"><input type="checkbox" id="setPolicyGitPush"><span>Nach dem Commit automatisch <code>git push</code></span></label>
|
||||||
|
<div class="form-hint">Nutzt deinen vorhandenen Git-Credential-Helper (Remote muss im Repo konfiguriert sein). Kein Token in der App.</div>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
<section class="settings-sec">
|
<section class="settings-sec">
|
||||||
<div class="settings-sec-head">
|
<div class="settings-sec-head">
|
||||||
<h4>Branding — Logo</h4>
|
<h4>Branding — Logo</h4>
|
||||||
@@ -1131,7 +1245,7 @@
|
|||||||
<section class="settings-sec">
|
<section class="settings-sec">
|
||||||
<div class="settings-sec-head">
|
<div class="settings-sec-head">
|
||||||
<h4>Konfiguration pruefen</h4>
|
<h4>Konfiguration pruefen</h4>
|
||||||
<div class="settings-sec-sub">Prueft die aktuell eingetragenen Werte gegen Microsoft Graph: Abteilungs-Gruppen-Lookup, RPA-Gruppen und Benutzer-Suche. Voraussetzung: Verbindung steht.</div>
|
<div class="settings-sec-sub">Prueft die aktuell eingetragenen Werte gegen Microsoft Graph: Abteilungs-Gruppen-Lookup und Benutzer-Suche. Voraussetzung: Verbindung steht.</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-row">
|
<div class="form-row">
|
||||||
<button type="button" class="btn btn-secondary" id="btnSettingsTest">Verbindung + Lookups testen</button>
|
<button type="button" class="btn btn-secondary" id="btnSettingsTest">Verbindung + Lookups testen</button>
|
||||||
|
|||||||
@@ -5407,3 +5407,55 @@ body.read-only .app-row {
|
|||||||
color: var(--text-dim, #888);
|
color: var(--text-dim, #888);
|
||||||
font-size: 13px;
|
font-size: 13px;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* =============================================================
|
||||||
|
Multi-Tenant: Topbar-Umschalter + Profil-Editor
|
||||||
|
============================================================= */
|
||||||
|
.tenant-switch {
|
||||||
|
height: 30px;
|
||||||
|
max-width: 200px;
|
||||||
|
padding: 0 8px;
|
||||||
|
border: 1px solid var(--hairline, var(--border));
|
||||||
|
border-radius: 6px;
|
||||||
|
background: var(--canvas, var(--bg2));
|
||||||
|
color: var(--ink, var(--text));
|
||||||
|
font-size: 12.5px;
|
||||||
|
font-family: inherit;
|
||||||
|
cursor: pointer;
|
||||||
|
}
|
||||||
|
.tenant-switch:hover { border-color: var(--brand, var(--accent)); }
|
||||||
|
|
||||||
|
.tenant-list { display: flex; flex-direction: column; gap: 10px; }
|
||||||
|
.tenant-row {
|
||||||
|
border: 1px solid var(--border);
|
||||||
|
border-radius: 8px;
|
||||||
|
padding: 10px;
|
||||||
|
background: var(--bg2, transparent);
|
||||||
|
}
|
||||||
|
.tenant-row-head {
|
||||||
|
display: flex;
|
||||||
|
align-items: center;
|
||||||
|
gap: 10px;
|
||||||
|
margin-bottom: 8px;
|
||||||
|
}
|
||||||
|
.tenant-row-head .tenant-label { flex: 1; }
|
||||||
|
.tenant-active {
|
||||||
|
display: inline-flex;
|
||||||
|
align-items: center;
|
||||||
|
gap: 5px;
|
||||||
|
font-size: 12px;
|
||||||
|
color: var(--text-dim, #888);
|
||||||
|
white-space: nowrap;
|
||||||
|
cursor: pointer;
|
||||||
|
}
|
||||||
|
.tenant-active input { cursor: pointer; }
|
||||||
|
.tenant-remove { flex: 0 0 auto; line-height: 1; padding: 4px 8px; }
|
||||||
|
.tenant-row-grid { display: flex; flex-direction: column; gap: 6px; }
|
||||||
|
.tenant-empty { padding: 8px 0; }
|
||||||
|
|
||||||
|
/* Multi-Tenant: Pro-Profil Overrides (Präfixe/RPA) */
|
||||||
|
.tenant-row-overrides { margin-top: 8px; display: flex; flex-direction: column; gap: 3px; }
|
||||||
|
.tenant-sub-lbl { font-size: 11px; font-weight: 600; color: var(--text-dim, #888); margin-top: 4px; }
|
||||||
|
.tenant-sub-hint { font-weight: 400; opacity: 0.8; }
|
||||||
|
.tenant-row-overrides textarea { resize: vertical; }
|
||||||
|
.tenant-naming-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 6px; }
|
||||||
|
|||||||
Reference in New Issue
Block a user