Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
  marcoandClaude Opus 4.8
|
c1fc6f8b94 | ||
|
marcoandClaude Opus 4.8
|
4efc71376b | ||
|
marcoandClaude Opus 4.8
|
450428e7f7 |
@@ -119,10 +119,8 @@ jobs:
|
|||||||
MSI_NAME: ${{ steps.build.outputs.MSI_NAME }}
|
MSI_NAME: ${{ steps.build.outputs.MSI_NAME }}
|
||||||
COMMIT_SHA: ${{ github.sha }}
|
COMMIT_SHA: ${{ github.sha }}
|
||||||
run: |
|
run: |
|
||||||
$tokLen = if ([string]::IsNullOrEmpty($env:GITEA_TOKEN)) { 0 } else { $env:GITEA_TOKEN.Length }
|
|
||||||
Write-Host "Diagnose: GITEA_TOKEN Laenge = $tokLen (0 = Secret erreicht den Lauf nicht)"
|
|
||||||
if ([string]::IsNullOrWhiteSpace($env:GITEA_TOKEN)) {
|
if ([string]::IsNullOrWhiteSpace($env:GITEA_TOKEN)) {
|
||||||
Write-Host "::warning::GITEA_TOKEN leer (Laenge=$tokLen) — Gitea-Upload uebersprungen. Muss ein REPOSITORY-Secret sein unter Settings > Secrets and variables > Actions (Tab 'Secrets', NICHT 'Variables'), Name exakt GITEA_TOKEN, im Repo mwende/Intune-Manager."
|
Write-Host "::notice::GITEA_TOKEN nicht gesetzt — Gitea-Upload uebersprungen."
|
||||||
exit 0
|
exit 0
|
||||||
}
|
}
|
||||||
$headers = @{ Authorization = "token $env:GITEA_TOKEN" }
|
$headers = @{ Authorization = "token $env:GITEA_TOKEN" }
|
||||||
|
|||||||
@@ -5,6 +5,27 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
## [0.1.27] - 2026-08-23
|
||||||
|
|
||||||
|
Policy-Import härter, Administrative Vorlagen, Zuweisung nach Import, Git-Snapshot, App-Registrierungs-Doku.
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Administrative Vorlagen (ADMX / `groupPolicyConfigurations`)** als vierter Policy-Typ für Export und Import. Beim Import wird die Konfigurations-Hülle angelegt und jede Einstellung einzeln über `definition@odata.bind` / `presentation@odata.bind` angehängt (eingebaute ADMX-Definitionen sind tenantübergreifend gültig). Neuer Endpoint `GET /api/policies/administrativetemplate`.
|
||||||
|
- **Zuweisung direkt nach Import**: Dialog listet die neu angelegten Policies und lässt **pro Policy Include-/Exclude-Gruppen** im Ziel-Tenant zuweisen (Typeahead über die vorhandene Gruppensuche). Neuer Endpoint `POST /api/policies/assign` (nutzt die typ-spezifische `/assign`-Action für alle vier Typen).
|
||||||
|
- **Git-Snapshot (versioniertes Policy-Backup)**: Button „Git-Snapshot" schreibt alle Policies aller Typen als JSON in einen konfigurierten lokalen Git-Ordner und committet sie (optional `git push` über den vorhandenen Credential-Helper). Stabile Dateinamen + deterministische, zeitstempel-freie Ausgabe → saubere Diffs. Neue Settings-Sektion `policyBackup` (`gitRepoPath`, `push`).
|
||||||
|
- Import akzeptiert jetzt auch **Git-Snapshot-Dateien** (Feld `policyType` zusätzlich zu `exportType`).
|
||||||
|
- **Doku + Provisioning-Skript für die App-Registrierung**: [`docs/App-Registration.md`](docs/App-Registration.md) listet alle benötigten delegierten Graph-Berechtigungen (Kern, Geräte-Tab, Read-Only) samt Auth-Konfiguration; [`docs/Setup-AppRegistration.ps1`](docs/Setup-AppRegistration.ps1) legt die Registrierung automatisch an bzw. aktualisiert sie (Rechte, Public-Client-Flow, Redirect-URIs, optional Admin-Consent) — Berechtigungs-IDs werden live aufgelöst, keine fest verdrahteten GUIDs.
|
||||||
|
|
||||||
|
### Behoben
|
||||||
|
|
||||||
|
- **Settings-Catalog-Import** war gegen Graph-Schema-Fehler anfällig: verschachtelte Collection-Properties (`children`, `*SettingCollectionValue`) werden jetzt konsequent als Arrays serialisiert (repariert PowerShell-5.1-JSON-Roundtrip-Schäden), `null`-Collections werden zu `[]` (Graph verlangt `Nullable=False`), der Wrapper-`@odata.type` wird je Setting gesetzt und das read-only `id`-Feld entfernt.
|
||||||
|
- **Phantom-Fehler beim Import**: ein fehlendes `fileNames`-Feld erzeugte über `@($null)` einen Geisterdurchlauf im Archiv-Pfad und meldete fälschlich „1 fehlgeschlagen".
|
||||||
|
- **Tenant-Wechsel**: das Frontend zeigte weiter die Apps/Gruppen des vorherigen Tenants, weil die Lade-Guards nicht zurückgesetzt wurden. Alle datentragenden Caches werden jetzt beim Wechsel verworfen (`resetClientState`).
|
||||||
|
- **WAM-Anmeldefenster** kommt beim Login/Tenant-Wechsel zuverlässig in den Vordergrund (AttachThreadInput + kurzer ALT-Tap zum Lösen des Windows-Foreground-Locks).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## [0.1.26] - 2026-08-21
|
## [0.1.26] - 2026-08-21
|
||||||
|
|
||||||
Multi-Tenant, Pro-Tenant-Vorgaben, RPA entfernt.
|
Multi-Tenant, Pro-Tenant-Vorgaben, RPA entfernt.
|
||||||
|
|||||||
@@ -120,6 +120,11 @@ Settings → Verbindung
|
|||||||
> ⚠ Ohne `DeviceManagementManagedDevices.Read.All` zeigt der App-Report nur
|
> ⚠ Ohne `DeviceManagementManagedDevices.Read.All` zeigt der App-Report nur
|
||||||
> Zaehler = 0 und der Geraete-Export liefert keine Eintraege.
|
> Zaehler = 0 und der Geraete-Export liefert keine Eintraege.
|
||||||
|
|
||||||
|
**Vollstaendige Berechtigungsliste, Redirect-URIs und ein Skript, das die
|
||||||
|
App-Registrierung automatisch anlegt/konfiguriert:**
|
||||||
|
[docs/App-Registration.md](docs/App-Registration.md) — inkl.
|
||||||
|
[`Setup-AppRegistration.ps1`](docs/Setup-AppRegistration.ps1).
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Navigation (Tabs)
|
## Navigation (Tabs)
|
||||||
@@ -237,6 +242,21 @@ neu an. Unterstuetzte Typen:
|
|||||||
automatisch zur Verbindung ergaenzt — in der Azure-App-Registration muss die
|
automatisch zur Verbindung ergaenzt — in der Azure-App-Registration muss die
|
||||||
Berechtigung aber vorhanden und (Admin-)zugestimmt sein.
|
Berechtigung aber vorhanden und (Admin-)zugestimmt sein.
|
||||||
|
|
||||||
|
### Git-Snapshot (versioniertes Backup)
|
||||||
|
|
||||||
|
Button **„Git-Snapshot"** im Policies-Tab schreibt **alle** Policies aller Typen
|
||||||
|
als JSON in einen konfigurierten **lokalen Git-Ordner** und committet sie
|
||||||
|
automatisch — ideal als versioniertes Backup mit nachvollziehbarer History.
|
||||||
|
|
||||||
|
- Konfiguration: **Settings → Policy-Backup (Git)** — lokaler Repo-Pfad (wird bei
|
||||||
|
Bedarf angelegt und `git init`-isiert) + optional **automatischer `git push`**
|
||||||
|
(nutzt den vorhandenen Git-Credential-Helper; **kein Token in der App**).
|
||||||
|
- **Stabile Dateinamen** (`<tenant>/<typ>/<name>__<id8>.json`) und deterministische,
|
||||||
|
zeitstempel-freie JSON-Ausgabe → saubere Git-Diffs zwischen Snapshots. Entfernte
|
||||||
|
Policies verschwinden aus dem Snapshot.
|
||||||
|
- Multi-Tenant: je Mandant ein eigener Unterordner (nach Profil-Label bzw. Tenant-ID).
|
||||||
|
- Gibt es keine Aenderungen seit dem letzten Snapshot, wird nichts committet.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Architektur
|
## Architektur
|
||||||
|
|||||||
@@ -188,7 +188,7 @@ $script:State = [pscustomobject]@{
|
|||||||
Session = @() # geplante Zuweisungen
|
Session = @() # geplante Zuweisungen
|
||||||
}
|
}
|
||||||
|
|
||||||
$script:ToolVersion = "0.1.26"
|
$script:ToolVersion = "0.1.27"
|
||||||
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
||||||
|
|
||||||
Write-Host ""
|
Write-Host ""
|
||||||
|
|||||||
@@ -0,0 +1,130 @@
|
|||||||
|
# App-Registrierung & Berechtigungen
|
||||||
|
|
||||||
|
Der Intune Manager meldet sich als **delegierte** Anwendung an (Device-Code- bzw.
|
||||||
|
WAM-Login) — er handelt also immer **im Namen des angemeldeten Admins**, nie mit
|
||||||
|
Anwendungsrechten. Die App-Registrierung braucht daher **delegierte
|
||||||
|
Microsoft-Graph-Berechtigungen** plus die passende Authentifizierungs-Konfiguration.
|
||||||
|
|
||||||
|
> **Schnellweg:** Statt alles von Hand zu klicken, legt das Skript
|
||||||
|
> [`Setup-AppRegistration.ps1`](Setup-AppRegistration.ps1) die Registrierung
|
||||||
|
> komplett an (Rechte + Public-Client-Flow + Redirect-URIs + optional Consent).
|
||||||
|
> Siehe [Automatische Einrichtung](#automatische-einrichtung).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Benötigte Berechtigungen
|
||||||
|
|
||||||
|
Alle Berechtigungen sind vom Typ **Delegiert** (Microsoft Graph).
|
||||||
|
|
||||||
|
### Kern (immer erforderlich)
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `Group.ReadWrite.All` | Gruppen anlegen, App-/Policy-Zuweisungen setzen |
|
||||||
|
| `GroupMember.ReadWrite.All` | Gruppenmitglieder lesen/hinzufügen/entfernen, CSV-Import |
|
||||||
|
| `User.Read.All` | Benutzersuche, UPN-Auflösung |
|
||||||
|
| `DeviceManagementApps.ReadWrite.All` | Apps auflisten, zuweisen, umbenennen, löschen, Setup-Datei aktualisieren, App-Report |
|
||||||
|
| `DeviceManagementConfiguration.ReadWrite.All` | Policies (Settings Catalog, Compliance, Konfigurationsprofile, Administrative Vorlagen) lesen, exportieren, importieren, zuweisen |
|
||||||
|
| `offline_access` | Refresh-Token (Device-Code-Flow) |
|
||||||
|
|
||||||
|
> `DeviceManagementConfiguration.ReadWrite.All` wird vom Tool automatisch zur
|
||||||
|
> Verbindung ergänzt — die App-Registrierung muss die Berechtigung aber besitzen
|
||||||
|
> und (Admin-)zugestimmt bekommen haben, sonst schlägt der Policy-Import mit
|
||||||
|
> `403 Forbidden` fehl.
|
||||||
|
|
||||||
|
### Geräte-Tab (optional)
|
||||||
|
|
||||||
|
Nur nötig, wenn der **Geräte-Tab** (Sync/Reboot/Lock/Diagnose/Wipe/Retire) genutzt wird:
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `DeviceManagementManagedDevices.Read.All` | Geräte auflisten und Details anzeigen |
|
||||||
|
| `DeviceManagementManagedDevices.ReadWrite.All` | Sync, Neustart, Remote-Lock, Diagnose, BitLocker-Key-Rotation |
|
||||||
|
| `DeviceManagementManagedDevices.PrivilegedOperations.All` | Wipe, Retire, Autopilot-Reset |
|
||||||
|
|
||||||
|
### Read-Only-Variante
|
||||||
|
|
||||||
|
Für eine reine Anzeige-App (im Tool als `clientIdRo` hinterlegbar) genügen die
|
||||||
|
`*.Read.All`-Pendants:
|
||||||
|
|
||||||
|
`Group.Read.All`, `GroupMember.Read.All`, `User.Read.All`,
|
||||||
|
`DeviceManagementApps.Read.All`, `DeviceManagementConfiguration.Read.All`,
|
||||||
|
`offline_access` (+ optional `DeviceManagementManagedDevices.Read.All`).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Authentifizierungs-Konfiguration
|
||||||
|
|
||||||
|
Zusätzlich zu den Berechtigungen muss die App als **öffentlicher Client** nutzbar
|
||||||
|
sein — sonst scheitert der erste Login (`AADSTS500113` bzw. `AADSTS50011`):
|
||||||
|
|
||||||
|
1. **Öffentliche Clientflows zulassen** → **Ja**
|
||||||
|
(Entra → App-Registrierung → *Authentifizierung* → ganz unten;
|
||||||
|
im Manifest `isFallbackPublicClient = true`).
|
||||||
|
2. **Redirect-URIs** unter *Mobilgerät- und Desktopanwendungen*:
|
||||||
|
```
|
||||||
|
https://login.microsoftonline.com/common/oauth2/nativeclient
|
||||||
|
ms-appx-web://Microsoft.AAD.BrokerPlugin/<CLIENT-ID>
|
||||||
|
```
|
||||||
|
- Zeile 1 → **Device-Code-Flow**
|
||||||
|
- Zeile 2 → **WAM-Broker** (Windows-Anmeldefenster); `<CLIENT-ID>` ist die
|
||||||
|
AppId der Registrierung selbst.
|
||||||
|
3. **Multi-Tenant:** Wird dieselbe App gegen fremde Tenants genutzt, muss
|
||||||
|
`signInAudience` auf *Accounts in any organizational directory*
|
||||||
|
(`AzureADMultipleOrgs`) stehen und im Ziel-Tenant per Admin-Consent
|
||||||
|
bereitgestellt werden. Bei einer eigenen App **pro** Tenant ist Single-Tenant
|
||||||
|
ausreichend.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Automatische Einrichtung
|
||||||
|
|
||||||
|
Das Skript [`Setup-AppRegistration.ps1`](Setup-AppRegistration.ps1) erledigt alles
|
||||||
|
oben Genannte über Microsoft Graph. Es braucht nur das Modul
|
||||||
|
`Microsoft.Graph.Authentication` (dieselbe Abhängigkeit wie das Tool) und löst die
|
||||||
|
Berechtigungs-IDs **live** aus dem Graph-Service-Principal auf — keine fest
|
||||||
|
verdrahteten GUIDs.
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
# Einmalig:
|
||||||
|
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
|
||||||
|
|
||||||
|
# Neue Single-Tenant-App inkl. Admin-Consent:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -GrantAdminConsent
|
||||||
|
|
||||||
|
# Mit Geräte-Rechten:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -IncludeDeviceActions -GrantAdminConsent
|
||||||
|
|
||||||
|
# Multi-Tenant-App:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -MultiTenant -GrantAdminConsent
|
||||||
|
|
||||||
|
# Bestehende App nur um Rechte/Redirect-URIs ergänzen:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -ClientId "<APP-ID>" -GrantAdminConsent
|
||||||
|
|
||||||
|
# Nur das Manifest-Snippet ausgeben (ohne etwas anzulegen wäre -WhatIf-artig —
|
||||||
|
# hier zusätzlich zum Anlegen):
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -EmitManifest
|
||||||
|
```
|
||||||
|
|
||||||
|
Am Ende gibt das Skript **Tenant ID** und **Client ID** aus — diese Werte im
|
||||||
|
Intune Manager unter *Einstellungen → Verbindung* (bzw. im Tenant-Profil)
|
||||||
|
eintragen.
|
||||||
|
|
||||||
|
Die zum Anlegen/Ändern nötigen Admin-Rechte (`Application.ReadWrite.All`, für
|
||||||
|
Consent zusätzlich `DelegatedPermissionGrant.ReadWrite.All`) werden beim
|
||||||
|
`Connect-MgGraph`-Aufruf des Skripts einmalig abgefragt.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Manuelle Einrichtung (Portal)
|
||||||
|
|
||||||
|
1. **Entra** → *App-Registrierungen* → *Neue Registrierung* → Name vergeben,
|
||||||
|
Kontotyp wählen (Single- oder Multi-Tenant) → **Registrieren**.
|
||||||
|
2. *API-Berechtigungen* → *Berechtigung hinzufügen* → **Microsoft Graph** →
|
||||||
|
**Delegierte Berechtigungen** → die [Kern-Berechtigungen](#kern-immer-erforderlich)
|
||||||
|
(und bei Bedarf die [Geräte-Berechtigungen](#geräte-tab-optional)) auswählen →
|
||||||
|
**Administratorzustimmung erteilen**.
|
||||||
|
3. *Authentifizierung* → [Authentifizierungs-Konfiguration](#authentifizierungs-konfiguration)
|
||||||
|
wie oben setzen (Public-Client-Flow + beide Redirect-URIs).
|
||||||
|
4. **Übersichtsseite**: *Anwendungs-(Client-)ID* und *Verzeichnis-(Mandanten-)ID*
|
||||||
|
in den Intune Manager übernehmen.
|
||||||
@@ -0,0 +1,214 @@
|
|||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
Legt die App-Registrierung fuer den Intune Manager an (oder aktualisiert sie)
|
||||||
|
inkl. Graph-Berechtigungen, Public-Client-Flow und Redirect-URIs.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
Deckt genau die Punkte ab, an denen der erste Login sonst mit
|
||||||
|
AADSTS500113 / AADSTS50011 scheitert:
|
||||||
|
* Delegierte Microsoft-Graph-Berechtigungen (nach Bedarf: RW, RO, Geraete)
|
||||||
|
* "Oeffentliche Clientflows zulassen" (isFallbackPublicClient = true)
|
||||||
|
* Redirect-URIs fuer Device-Code (nativeclient) und WAM-Broker
|
||||||
|
* optional Admin-Consent
|
||||||
|
|
||||||
|
Nutzt nur Microsoft.Graph.Authentication (Invoke-MgGraphRequest) — dieselbe
|
||||||
|
Abhaengigkeit wie das Tool selbst. Berechtigungs-IDs werden LIVE aus dem
|
||||||
|
Graph-Service-Principal aufgeloest, es sind also keine fest verdrahteten
|
||||||
|
GUIDs noetig (die sonst leicht veralten).
|
||||||
|
|
||||||
|
.PARAMETER DisplayName
|
||||||
|
Anzeigename der App-Registrierung. Default: "Intune Manager".
|
||||||
|
|
||||||
|
.PARAMETER ClientId
|
||||||
|
AppId einer BESTEHENDEN Registrierung, die aktualisiert werden soll.
|
||||||
|
Ohne diesen Parameter wird eine NEUE App angelegt.
|
||||||
|
|
||||||
|
.PARAMETER MultiTenant
|
||||||
|
App fuer mehrere Tenants (signInAudience = AzureADMultipleOrgs).
|
||||||
|
Default: nur der aktuelle Tenant (AzureADMyOrg).
|
||||||
|
|
||||||
|
.PARAMETER ReadOnly
|
||||||
|
Verwendet die Read-Only-Berechtigungen (fuer eine reine Anzeige-/RO-App,
|
||||||
|
passend zu clientIdRo im Tool).
|
||||||
|
|
||||||
|
.PARAMETER IncludeDeviceActions
|
||||||
|
Nimmt zusaetzlich die Berechtigungen fuer den Geraete-Tab auf
|
||||||
|
(Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire).
|
||||||
|
|
||||||
|
.PARAMETER GrantAdminConsent
|
||||||
|
Erteilt direkt tenantweiten Admin-Consent fuer die gesetzten Scopes.
|
||||||
|
Benoetigt entsprechend privilegierte Anmeldung.
|
||||||
|
|
||||||
|
.PARAMETER EmitManifest
|
||||||
|
Gibt zusaetzlich den requiredResourceAccess-Block als JSON aus (zum manuellen
|
||||||
|
Einfuegen in das App-Manifest im Portal).
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
# Neue Single-Tenant-App inkl. Consent:
|
||||||
|
.\Setup-AppRegistration.ps1 -GrantAdminConsent
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
# Bestehende App um Geraete-Rechte erweitern:
|
||||||
|
.\Setup-AppRegistration.ps1 -ClientId "51477347-...." -IncludeDeviceActions -GrantAdminConsent
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Vorher einmalig: Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
|
||||||
|
#>
|
||||||
|
[CmdletBinding()]
|
||||||
|
param(
|
||||||
|
[string]$DisplayName = 'Intune Manager',
|
||||||
|
[string]$ClientId,
|
||||||
|
[switch]$MultiTenant,
|
||||||
|
[switch]$ReadOnly,
|
||||||
|
[switch]$IncludeDeviceActions,
|
||||||
|
[switch]$GrantAdminConsent,
|
||||||
|
[switch]$EmitManifest
|
||||||
|
)
|
||||||
|
|
||||||
|
$ErrorActionPreference = 'Stop'
|
||||||
|
$GraphAppId = '00000003-0000-0000-c000-000000000000' # Microsoft Graph
|
||||||
|
|
||||||
|
# --- Benoetigte delegierte Berechtigungen zusammenstellen ---------------------
|
||||||
|
$perms = if ($ReadOnly) {
|
||||||
|
@('Group.Read.All','GroupMember.Read.All','User.Read.All',
|
||||||
|
'DeviceManagementApps.Read.All','DeviceManagementConfiguration.Read.All','offline_access')
|
||||||
|
} else {
|
||||||
|
@('Group.ReadWrite.All','GroupMember.ReadWrite.All','User.Read.All',
|
||||||
|
'DeviceManagementApps.ReadWrite.All','DeviceManagementConfiguration.ReadWrite.All','offline_access')
|
||||||
|
}
|
||||||
|
if ($IncludeDeviceActions) {
|
||||||
|
$perms += if ($ReadOnly) {
|
||||||
|
@('DeviceManagementManagedDevices.Read.All')
|
||||||
|
} else {
|
||||||
|
@('DeviceManagementManagedDevices.Read.All',
|
||||||
|
'DeviceManagementManagedDevices.ReadWrite.All',
|
||||||
|
'DeviceManagementManagedDevices.PrivilegedOperations.All')
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$perms = $perms | Select-Object -Unique
|
||||||
|
|
||||||
|
# --- Verbinden ----------------------------------------------------------------
|
||||||
|
Write-Host "[1/6] Mit Microsoft Graph verbinden (Admin noetig)..." -ForegroundColor Cyan
|
||||||
|
$connectScopes = @('Application.ReadWrite.All')
|
||||||
|
if ($GrantAdminConsent) { $connectScopes += 'DelegatedPermissionGrant.ReadWrite.All' }
|
||||||
|
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
|
||||||
|
Connect-MgGraph -Scopes $connectScopes -NoWelcome
|
||||||
|
$ctx = Get-MgContext
|
||||||
|
if (-not $ctx) { throw 'Keine Graph-Verbindung.' }
|
||||||
|
Write-Host " verbunden mit Tenant $($ctx.TenantId) als $($ctx.Account)" -ForegroundColor DarkGray
|
||||||
|
|
||||||
|
# --- Graph-Service-Principal + Berechtigungs-IDs aufloesen --------------------
|
||||||
|
Write-Host "[2/6] Graph-Berechtigungen aufloesen..." -ForegroundColor Cyan
|
||||||
|
$graphSp = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$GraphAppId'&`$select=id,oauth2PermissionScopes").value | Select-Object -First 1
|
||||||
|
if (-not $graphSp) { throw 'Graph-Service-Principal nicht gefunden.' }
|
||||||
|
$graphSpId = $graphSp.id
|
||||||
|
|
||||||
|
$scopeMap = @{}
|
||||||
|
foreach ($s in $graphSp.oauth2PermissionScopes) { $scopeMap[$s.value] = $s.id }
|
||||||
|
|
||||||
|
$resourceAccess = @()
|
||||||
|
foreach ($p in $perms) {
|
||||||
|
if (-not $scopeMap.ContainsKey($p)) { throw "Delegierte Berechtigung '$p' nicht im Graph-SP gefunden." }
|
||||||
|
$resourceAccess += @{ id = $scopeMap[$p]; type = 'Scope' }
|
||||||
|
}
|
||||||
|
$requiredResourceAccess = @(@{ resourceAppId = $GraphAppId; resourceAccess = $resourceAccess })
|
||||||
|
|
||||||
|
if ($EmitManifest) {
|
||||||
|
Write-Host "`n--- requiredResourceAccess (Manifest) ---" -ForegroundColor Yellow
|
||||||
|
($requiredResourceAccess | ConvertTo-Json -Depth 6)
|
||||||
|
Write-Host "-----------------------------------------`n" -ForegroundColor Yellow
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- App anlegen oder aktualisieren -------------------------------------------
|
||||||
|
$signInAudience = if ($MultiTenant) { 'AzureADMultipleOrgs' } else { 'AzureADMyOrg' }
|
||||||
|
|
||||||
|
if ($ClientId) {
|
||||||
|
Write-Host "[3/6] Bestehende App $ClientId laden..." -ForegroundColor Cyan
|
||||||
|
$app = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/applications?`$filter=appId eq '$ClientId'&`$select=id,appId").value | Select-Object -First 1
|
||||||
|
if (-not $app) { throw "App mit appId $ClientId nicht gefunden." }
|
||||||
|
$objId = $app.id
|
||||||
|
$appId = $ClientId
|
||||||
|
$patch = @{
|
||||||
|
signInAudience = $signInAudience
|
||||||
|
isFallbackPublicClient = $true
|
||||||
|
requiredResourceAccess = $requiredResourceAccess
|
||||||
|
publicClient = @{ redirectUris = @(
|
||||||
|
'https://login.microsoftonline.com/common/oauth2/nativeclient'
|
||||||
|
"ms-appx-web://Microsoft.AAD.BrokerPlugin/$appId"
|
||||||
|
) }
|
||||||
|
}
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/applications/$objId" `
|
||||||
|
-Body ($patch | ConvertTo-Json -Depth 8) -ContentType 'application/json' | Out-Null
|
||||||
|
Write-Host " App aktualisiert." -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host "[3/6] Neue App '$DisplayName' anlegen..." -ForegroundColor Cyan
|
||||||
|
# Broker-Redirect-URI braucht die appId -> erst mit nativeclient anlegen,
|
||||||
|
# danach die Broker-URI per PATCH ergaenzen.
|
||||||
|
$create = @{
|
||||||
|
displayName = $DisplayName
|
||||||
|
signInAudience = $signInAudience
|
||||||
|
isFallbackPublicClient = $true
|
||||||
|
requiredResourceAccess = $requiredResourceAccess
|
||||||
|
publicClient = @{ redirectUris = @('https://login.microsoftonline.com/common/oauth2/nativeclient') }
|
||||||
|
}
|
||||||
|
$app = Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/applications' `
|
||||||
|
-Body ($create | ConvertTo-Json -Depth 8) -ContentType 'application/json'
|
||||||
|
$objId = $app.id
|
||||||
|
$appId = $app.appId
|
||||||
|
|
||||||
|
$patch = @{ publicClient = @{ redirectUris = @(
|
||||||
|
'https://login.microsoftonline.com/common/oauth2/nativeclient'
|
||||||
|
"ms-appx-web://Microsoft.AAD.BrokerPlugin/$appId"
|
||||||
|
) } }
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/applications/$objId" `
|
||||||
|
-Body ($patch | ConvertTo-Json -Depth 6) -ContentType 'application/json' | Out-Null
|
||||||
|
Write-Host " App angelegt: appId $appId" -ForegroundColor Green
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Service-Principal (Enterprise-App) sicherstellen -------------------------
|
||||||
|
Write-Host "[4/6] Service-Principal sicherstellen..." -ForegroundColor Cyan
|
||||||
|
$sp = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$appId'&`$select=id").value | Select-Object -First 1
|
||||||
|
if (-not $sp) {
|
||||||
|
$sp = Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/servicePrincipals' `
|
||||||
|
-Body (@{ appId = $appId } | ConvertTo-Json) -ContentType 'application/json'
|
||||||
|
}
|
||||||
|
$spId = $sp.id
|
||||||
|
|
||||||
|
# --- Optional: Admin-Consent --------------------------------------------------
|
||||||
|
Write-Host "[5/6] Admin-Consent..." -ForegroundColor Cyan
|
||||||
|
if ($GrantAdminConsent) {
|
||||||
|
$scopeString = ($perms -join ' ')
|
||||||
|
# Bestehenden Grant fuer (Client -> Graph) suchen und ersetzen, sonst neu.
|
||||||
|
$existing = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants?`$filter=clientId eq '$spId' and resourceId eq '$graphSpId'").value | Select-Object -First 1
|
||||||
|
$grantBody = @{
|
||||||
|
clientId = $spId
|
||||||
|
consentType = 'AllPrincipals'
|
||||||
|
resourceId = $graphSpId
|
||||||
|
scope = $scopeString
|
||||||
|
}
|
||||||
|
if ($existing) {
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/$($existing.id)" `
|
||||||
|
-Body (@{ scope = $scopeString } | ConvertTo-Json) -ContentType 'application/json' | Out-Null
|
||||||
|
} else {
|
||||||
|
Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants' `
|
||||||
|
-Body ($grantBody | ConvertTo-Json) -ContentType 'application/json' | Out-Null
|
||||||
|
}
|
||||||
|
Write-Host " Admin-Consent erteilt fuer: $scopeString" -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host " uebersprungen (-GrantAdminConsent nicht gesetzt)." -ForegroundColor DarkGray
|
||||||
|
Write-Host " Consent im Portal: Entra -> App-Registrierungen -> $DisplayName -> API-Berechtigungen -> Administratorzustimmung erteilen" -ForegroundColor DarkGray
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Ergebnis -----------------------------------------------------------------
|
||||||
|
Write-Host "[6/6] Fertig." -ForegroundColor Cyan
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host " Im Intune Manager eintragen:" -ForegroundColor White
|
||||||
|
Write-Host " Tenant ID : $($ctx.TenantId)"
|
||||||
|
Write-Host " Client ID : $appId"
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host " Gesetzte delegierte Berechtigungen:" -ForegroundColor White
|
||||||
|
$perms | ForEach-Object { Write-Host " - $_" }
|
||||||
@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
|
|||||||
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
||||||
}
|
}
|
||||||
|
|
||||||
$version = "0.1.26"
|
$version = "0.1.27"
|
||||||
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
||||||
$stage = "$env:TEMP\IntuneManagerStage"
|
$stage = "$env:TEMP\IntuneManagerStage"
|
||||||
$installerDir = "$src\installer"
|
$installerDir = "$src\installer"
|
||||||
|
|||||||
+75
-3
@@ -53,9 +53,13 @@ function Invoke-ApiHandler {
|
|||||||
"GET /api/policies/compliance" { return Get-CompliancePoliciesEndpoint }
|
"GET /api/policies/compliance" { return Get-CompliancePoliciesEndpoint }
|
||||||
"GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
|
"GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
|
||||||
"GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
|
"GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
|
||||||
|
"GET /api/policies/administrativetemplate" { return Get-AdministrativeTemplatesEndpoint }
|
||||||
"POST /api/policies/export" { return Export-PoliciesEndpoint -Body $Body }
|
"POST /api/policies/export" { return Export-PoliciesEndpoint -Body $Body }
|
||||||
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
||||||
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
||||||
|
"POST /api/policies/assign" { return Invoke-PolicyAssignEndpoint -Body $Body }
|
||||||
|
"POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
|
||||||
|
"POST /api/pickfolder" { return Invoke-FolderPickerEndpoint -Body $Body }
|
||||||
}
|
}
|
||||||
|
|
||||||
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
||||||
@@ -928,7 +932,30 @@ public class WinFocusHelper2 {
|
|||||||
[DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc lpEnumFunc, IntPtr lParam);
|
[DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc lpEnumFunc, IntPtr lParam);
|
||||||
[DllImport("user32.dll", CharSet = CharSet.Auto)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
|
[DllImport("user32.dll", CharSet = CharSet.Auto)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
|
||||||
[DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
|
[DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
|
||||||
|
[DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
|
||||||
|
[DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, IntPtr lpdwProcessId);
|
||||||
|
[DllImport("user32.dll")] public static extern bool AttachThreadInput(uint idAttach, uint idAttachTo, bool fAttach);
|
||||||
|
[DllImport("kernel32.dll")] public static extern uint GetCurrentThreadId();
|
||||||
|
[DllImport("user32.dll")] public static extern void keybd_event(byte bVk, byte bScan, uint dwFlags, UIntPtr dwExtraInfo);
|
||||||
public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
|
public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
|
||||||
|
// Holt ein Fenster zuverlaessig in den Vordergrund und umgeht den Windows-
|
||||||
|
// Foreground-Lock: kurzer ALT-Tap (entsperrt SetForegroundWindow) + Anhaengen
|
||||||
|
// an den Input-Thread des aktuellen Vordergrundfensters (AttachThreadInput).
|
||||||
|
public static void ForceForeground(IntPtr hWnd) {
|
||||||
|
keybd_event(0x12, 0, 0, UIntPtr.Zero); // ALT down -> Foreground-Lock loesen
|
||||||
|
keybd_event(0x12, 0, 2, UIntPtr.Zero); // ALT up (KEYEVENTF_KEYUP = 2)
|
||||||
|
IntPtr fore = GetForegroundWindow();
|
||||||
|
uint foreThread = GetWindowThreadProcessId(fore, IntPtr.Zero);
|
||||||
|
uint thisThread = GetCurrentThreadId();
|
||||||
|
bool attached = false;
|
||||||
|
if (foreThread != 0 && foreThread != thisThread) {
|
||||||
|
attached = AttachThreadInput(foreThread, thisThread, true);
|
||||||
|
}
|
||||||
|
ShowWindow(hWnd, 9); // SW_RESTORE
|
||||||
|
BringWindowToTop(hWnd);
|
||||||
|
SetForegroundWindow(hWnd);
|
||||||
|
if (attached) { AttachThreadInput(foreThread, thisThread, false); }
|
||||||
|
}
|
||||||
}
|
}
|
||||||
'@ -ErrorAction SilentlyContinue
|
'@ -ErrorAction SilentlyContinue
|
||||||
$deadline = (Get-Date).AddSeconds(30)
|
$deadline = (Get-Date).AddSeconds(30)
|
||||||
@@ -950,9 +977,7 @@ public class WinFocusHelper2 {
|
|||||||
return $true
|
return $true
|
||||||
}, [IntPtr]::Zero) | Out-Null
|
}, [IntPtr]::Zero) | Out-Null
|
||||||
if ($script:found -ne [IntPtr]::Zero) {
|
if ($script:found -ne [IntPtr]::Zero) {
|
||||||
[WinFocusHelper2]::ShowWindow($script:found, 9) | Out-Null # SW_RESTORE
|
[WinFocusHelper2]::ForceForeground($script:found)
|
||||||
[WinFocusHelper2]::BringWindowToTop($script:found) | Out-Null
|
|
||||||
[WinFocusHelper2]::SetForegroundWindow($script:found) | Out-Null
|
|
||||||
Start-Sleep -Milliseconds 800
|
Start-Sleep -Milliseconds 800
|
||||||
}
|
}
|
||||||
Start-Sleep -Milliseconds 400
|
Start-Sleep -Milliseconds 400
|
||||||
@@ -2597,6 +2622,53 @@ function Invoke-FilePickerEndpoint {
|
|||||||
return @{ ok = $true; path = $path }
|
return @{ ok = $true; path = $path }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Show-OpenFolderDialog {
|
||||||
|
# Wie Show-OpenFileDialog, aber FolderBrowserDialog in einem STA-Prozess.
|
||||||
|
param([string]$Title = "Ordner auswaehlen")
|
||||||
|
$tEsc = $Title -replace "'", "''"
|
||||||
|
$inner = @"
|
||||||
|
`$ProgressPreference = 'SilentlyContinue'
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
`$dlg = New-Object System.Windows.Forms.FolderBrowserDialog
|
||||||
|
`$dlg.Description = '$tEsc'
|
||||||
|
`$owner = New-Object System.Windows.Forms.Form
|
||||||
|
`$owner.TopMost = `$true
|
||||||
|
`$owner.ShowInTaskbar = `$false
|
||||||
|
`$owner.WindowState = 'Minimized'
|
||||||
|
`$owner.Show(); `$owner.Activate()
|
||||||
|
`$r = `$dlg.ShowDialog(`$owner)
|
||||||
|
`$owner.Dispose()
|
||||||
|
if (`$r -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write(`$dlg.SelectedPath) }
|
||||||
|
"@
|
||||||
|
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($inner))
|
||||||
|
$psi = New-Object System.Diagnostics.ProcessStartInfo
|
||||||
|
$psi.FileName = "powershell.exe"
|
||||||
|
$psi.Arguments = "-NoProfile -STA -ExecutionPolicy Bypass -EncodedCommand $encoded"
|
||||||
|
$psi.UseShellExecute = $false
|
||||||
|
$psi.RedirectStandardOutput = $true
|
||||||
|
$psi.CreateNoWindow = $true
|
||||||
|
try {
|
||||||
|
$proc = [System.Diagnostics.Process]::Start($psi)
|
||||||
|
$path = $proc.StandardOutput.ReadToEnd()
|
||||||
|
$proc.WaitForExit()
|
||||||
|
} catch {
|
||||||
|
throw "Ordner-Dialog-Prozess konnte nicht gestartet werden: $($_.Exception.Message)"
|
||||||
|
}
|
||||||
|
return ([string]$path).Trim()
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-FolderPickerEndpoint {
|
||||||
|
param($Body)
|
||||||
|
$title = if ($Body -and $Body.title) { [string]$Body.title } else { "Git-Repo-Ordner auswaehlen" }
|
||||||
|
try {
|
||||||
|
$path = Show-OpenFolderDialog -Title $title
|
||||||
|
} catch {
|
||||||
|
return @{ __status = 500; error = "Ordner-Dialog fehlgeschlagen: $($_.Exception.Message)" }
|
||||||
|
}
|
||||||
|
if (-not $path) { return @{ ok = $true; cancelled = $true } }
|
||||||
|
return @{ ok = $true; path = $path }
|
||||||
|
}
|
||||||
|
|
||||||
# App-Typ (@odata.type) -> unterstuetzter Content-Update-Pfad + erlaubte Endung.
|
# App-Typ (@odata.type) -> unterstuetzter Content-Update-Pfad + erlaubte Endung.
|
||||||
# Phase 1: nur win32LobApp/.intunewin aktiv; MSI/MSIX kommen in Phase 2/3.
|
# Phase 1: nur win32LobApp/.intunewin aktiv; MSI/MSIX kommen in Phase 2/3.
|
||||||
function Get-AppContentTypeMap {
|
function Get-AppContentTypeMap {
|
||||||
|
|||||||
@@ -74,6 +74,13 @@ function Get-DefaultSettings {
|
|||||||
# Explizite Liste der RPA-Gruppen. Leer = RPA-Tab zeigt Hinweis.
|
# Explizite Liste der RPA-Gruppen. Leer = RPA-Tab zeigt Hinweis.
|
||||||
groupNames = @()
|
groupNames = @()
|
||||||
}
|
}
|
||||||
|
policyBackup = [pscustomobject]@{
|
||||||
|
# Lokaler Git-Repo-Ordner fuer Policy-Snapshots. Leer = Funktion aus.
|
||||||
|
gitRepoPath = ""
|
||||||
|
# Nach dem Commit automatisch 'git push' ausfuehren (nutzt den
|
||||||
|
# vorhandenen Git-Credential-Helper; kein Token in der App).
|
||||||
|
push = $false
|
||||||
|
}
|
||||||
userSearch = [pscustomobject]@{
|
userSearch = [pscustomobject]@{
|
||||||
# In welchen Feldern bei der Benutzersuche gesucht wird.
|
# In welchen Feldern bei der Benutzersuche gesucht wird.
|
||||||
# Erlaubt: displayName, userPrincipalName, mail, department.
|
# Erlaubt: displayName, userPrincipalName, mail, department.
|
||||||
|
|||||||
+366
-13
@@ -1,7 +1,7 @@
|
|||||||
# Import/Export von Intune-Policies.
|
# Import/Export von Intune-Policies.
|
||||||
# Unterstuetzte Typen: Compliance Policies, Configuration Profiles (Templates)
|
# Unterstuetzte Typen: Compliance Policies, Configuration Profiles (Templates),
|
||||||
# und Settings Catalog. Nutzt die bestehende Microsoft-Graph-Verbindung
|
# Settings Catalog und Administrative Vorlagen (ADMX / groupPolicyConfigurations).
|
||||||
# (Connect-MgGraph via Api.ps1).
|
# Nutzt die bestehende Microsoft-Graph-Verbindung (Connect-MgGraph via Api.ps1).
|
||||||
#
|
#
|
||||||
# Zwei Export-Wege, beide aus derselben Aktion:
|
# Zwei Export-Wege, beide aus derselben Aktion:
|
||||||
# 1. Browser-Download — der Endpoint liefert die Export-Objekte im Response,
|
# 1. Browser-Download — der Endpoint liefert die Export-Objekte im Response,
|
||||||
@@ -73,6 +73,20 @@ function Get-PolicyTypeConfig {
|
|||||||
Label = 'Settings Catalog'
|
Label = 'Settings Catalog'
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
'administrativetemplate' {
|
||||||
|
return @{
|
||||||
|
Key = 'administrativetemplate'
|
||||||
|
Collection = 'groupPolicyConfigurations'
|
||||||
|
NameField = 'displayName'
|
||||||
|
# Sonderfall: die konfigurierten Werte liegen nicht inline in der
|
||||||
|
# Policy, sondern in der definitionValues-Subcollection. Deshalb
|
||||||
|
# kein simples $expand -> eigene Behandlung in Get-GraphPolicyDetail.
|
||||||
|
ExportExpand = $null
|
||||||
|
ExportType = 'AdministrativeTemplate'
|
||||||
|
FilePrefix = 'AdminTemplate'
|
||||||
|
Label = 'Administrative Vorlage'
|
||||||
|
}
|
||||||
|
}
|
||||||
default { return $null }
|
default { return $null }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -80,7 +94,7 @@ function Get-PolicyTypeConfig {
|
|||||||
# ExportType (aus Datei/Envelope) -> Typ-Config. Reverse-Lookup fuer den Import.
|
# ExportType (aus Datei/Envelope) -> Typ-Config. Reverse-Lookup fuer den Import.
|
||||||
function Get-PolicyTypeConfigByExportType {
|
function Get-PolicyTypeConfigByExportType {
|
||||||
param([string]$ExportType)
|
param([string]$ExportType)
|
||||||
foreach ($key in @('compliance','configuration','settingscatalog')) {
|
foreach ($key in @('compliance','configuration','settingscatalog','administrativetemplate')) {
|
||||||
$cfg = Get-PolicyTypeConfig $key
|
$cfg = Get-PolicyTypeConfig $key
|
||||||
if ($cfg.ExportType -eq $ExportType) { return $cfg }
|
if ($cfg.ExportType -eq $ExportType) { return $cfg }
|
||||||
}
|
}
|
||||||
@@ -112,6 +126,8 @@ function Get-PolicyPlatformLabel {
|
|||||||
$p = Get-PolicyProp $Raw 'platforms'
|
$p = Get-PolicyProp $Raw 'platforms'
|
||||||
return [string]$p
|
return [string]$p
|
||||||
}
|
}
|
||||||
|
# Administrative Vorlagen (groupPolicyConfigurations) sind reine Windows-Policies.
|
||||||
|
if (([string]$Type).ToLower() -eq 'administrativetemplate') { return 'Windows' }
|
||||||
$t = [string](Get-PolicyProp $Raw '@odata.type')
|
$t = [string](Get-PolicyProp $Raw '@odata.type')
|
||||||
switch -Regex ($t) {
|
switch -Regex ($t) {
|
||||||
'windows' { return 'Windows' }
|
'windows' { return 'Windows' }
|
||||||
@@ -158,6 +174,18 @@ function Get-GraphPolicyDetail {
|
|||||||
)
|
)
|
||||||
$cfg = Get-PolicyTypeConfig $Type
|
$cfg = Get-PolicyTypeConfig $Type
|
||||||
if (-not $cfg) { throw "Unbekannter Policy-Typ: $Type" }
|
if (-not $cfg) { throw "Unbekannter Policy-Typ: $Type" }
|
||||||
|
|
||||||
|
# Administrative Vorlagen: Basis-Objekt holen und die konfigurierten Werte
|
||||||
|
# (definitionValues inkl. Definition + Presentation-Werten) separat expandieren.
|
||||||
|
if ($cfg.Key -eq 'administrativetemplate') {
|
||||||
|
$base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET
|
||||||
|
$dvUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version),presentationValues(`$expand=presentation)"
|
||||||
|
$dvs = @(Get-GraphPaged -Uri $dvUri)
|
||||||
|
if ($base -is [System.Collections.IDictionary]) { $base['definitionValues'] = $dvs }
|
||||||
|
else { $base | Add-Member -NotePropertyName definitionValues -NotePropertyValue $dvs -Force }
|
||||||
|
return $base
|
||||||
|
}
|
||||||
|
|
||||||
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
||||||
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
||||||
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
||||||
@@ -183,6 +211,53 @@ function ConvertTo-ImportBody {
|
|||||||
return $body
|
return $body
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Settings-Catalog-Payloads haben verschachtelte Properties, die laut Graph-
|
||||||
|
# Schema Arrays sein MUESSEN (settings, children, *SettingCollectionValue, values).
|
||||||
|
# Ein JSON-Roundtrip unter Windows PowerShell 5.1 entpackt Ein-Element-Arrays zu
|
||||||
|
# Einzelobjekten -> Graph antwortet mit 400 "... does not match schema". Diese
|
||||||
|
# Funktion baut den Baum rekursiv neu auf und packt betroffene Felder wieder in
|
||||||
|
# Arrays. Idempotent: bereits korrekte Arrays bleiben unveraendert.
|
||||||
|
function Repair-SettingsCatalogArrays {
|
||||||
|
param($Node)
|
||||||
|
$arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','values')
|
||||||
|
|
||||||
|
# Array-Property normalisieren: $null -> @() (Graph-Schema: Collections sind
|
||||||
|
# Nullable=False, ein 'children': null wird abgelehnt), Einzelobjekt -> @(obj).
|
||||||
|
# Inline (nicht als Funktion), sonst entpackt der Return ein Ein-Element-Array.
|
||||||
|
if ($Node -is [System.Collections.IDictionary]) {
|
||||||
|
$out = [ordered]@{}
|
||||||
|
foreach ($k in @($Node.Keys)) {
|
||||||
|
$fixed = Repair-SettingsCatalogArrays $Node[$k]
|
||||||
|
if ($k -in $arrayKeys) {
|
||||||
|
if ($null -eq $fixed) { $fixed = @() }
|
||||||
|
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||||
|
}
|
||||||
|
$out[$k] = $fixed
|
||||||
|
}
|
||||||
|
return $out
|
||||||
|
}
|
||||||
|
if ($Node -is [System.Management.Automation.PSCustomObject]) {
|
||||||
|
$out = [ordered]@{}
|
||||||
|
foreach ($p in $Node.PSObject.Properties) {
|
||||||
|
$fixed = Repair-SettingsCatalogArrays $p.Value
|
||||||
|
if ($p.Name -in $arrayKeys) {
|
||||||
|
if ($null -eq $fixed) { $fixed = @() }
|
||||||
|
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||||
|
}
|
||||||
|
$out[$p.Name] = $fixed
|
||||||
|
}
|
||||||
|
return $out
|
||||||
|
}
|
||||||
|
if (($Node -is [System.Collections.IEnumerable]) -and -not ($Node -is [string])) {
|
||||||
|
# Kein Komma-Operator: ein Ein-Element-Array wird beim Return zwar zum
|
||||||
|
# Skalar entpackt, aber jede Array-Property wird vom Parent ohnehin wieder
|
||||||
|
# in @(...) gewrappt. Ein fuehrendes ',' wuerde das Top-Level-settings-
|
||||||
|
# Array faelschlich in ein Extra-Array verschachteln.
|
||||||
|
return @($Node | ForEach-Object { Repair-SettingsCatalogArrays $_ })
|
||||||
|
}
|
||||||
|
return $Node
|
||||||
|
}
|
||||||
|
|
||||||
function New-DefaultComplianceScheduledActions {
|
function New-DefaultComplianceScheduledActions {
|
||||||
# Compliance Policies verlangen beim Anlegen mindestens einen
|
# Compliance Policies verlangen beim Anlegen mindestens einen
|
||||||
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
||||||
@@ -247,18 +322,106 @@ function Import-GraphSettingsCatalogPolicy {
|
|||||||
throw 'Settings-Catalog-Policy benoetigt ein "name"-Feld fuer den Import.'
|
throw 'Settings-Catalog-Policy benoetigt ein "name"-Feld fuer den Import.'
|
||||||
}
|
}
|
||||||
# 'settings' MUSS mitgeschickt werden — kommt aus dem $expand=settings-Export.
|
# 'settings' MUSS mitgeschickt werden — kommt aus dem $expand=settings-Export.
|
||||||
if (-not $body.ContainsKey('settings')) { $body['settings'] = @() }
|
# Zusaetzlich Array-Properties reparieren (PS-5.1-Roundtrip-Schaden), sonst
|
||||||
|
# 400 "Property children ... does not match schema".
|
||||||
|
if ($body.ContainsKey('settings') -and $null -ne $body['settings']) {
|
||||||
|
$body['settings'] = @(Repair-SettingsCatalogArrays $body['settings'])
|
||||||
|
# Beim GET liefert Graph die Setting-Wrapper ohne '@odata.type' und mit
|
||||||
|
# read-only 'id'. Der POST verlangt aber den Wrapper-Typ; die 'id' muss
|
||||||
|
# weg -> sonst 400 "Property settings ... does not match schema".
|
||||||
|
foreach ($s in $body['settings']) {
|
||||||
|
if ($s -is [System.Collections.IDictionary]) {
|
||||||
|
if ($s.Contains('id')) { [void]$s.Remove('id') }
|
||||||
|
if (-not $s.Contains('@odata.type')) {
|
||||||
|
$s['@odata.type'] = '#microsoft.graph.deviceManagementConfigurationSetting'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
$body['settings'] = @()
|
||||||
|
}
|
||||||
$json = $body | ConvertTo-Json -Depth 50
|
$json = $body | ConvertTo-Json -Depth 50
|
||||||
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Import-GraphAdministrativeTemplate {
|
||||||
|
param([Parameter(Mandatory=$true)]$Policy)
|
||||||
|
|
||||||
|
$displayName = [string](Get-PolicyProp $Policy 'displayName')
|
||||||
|
if (-not $displayName) { throw 'Administrative Vorlage benoetigt "displayName" fuer den Import.' }
|
||||||
|
|
||||||
|
$defRoot = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions'
|
||||||
|
$cfgRoot = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations'
|
||||||
|
|
||||||
|
# 1) Leere Konfigurations-Huelle anlegen (definitionValues folgen einzeln).
|
||||||
|
$shell = @{
|
||||||
|
displayName = $displayName
|
||||||
|
description = [string](Get-PolicyProp $Policy 'description')
|
||||||
|
roleScopeTagIds = @('0')
|
||||||
|
}
|
||||||
|
$created = Invoke-MgGraphRequestRetry -Uri $cfgRoot -Method POST -Body ($shell | ConvertTo-Json -Depth 10) -ContentType 'application/json'
|
||||||
|
$newId = [string](Get-PolicyProp $created 'id')
|
||||||
|
if (-not $newId) { throw 'Anlegen der Administrative-Vorlage-Huelle lieferte keine Id.' }
|
||||||
|
|
||||||
|
# 2) Jeden definitionValue einzeln anhaengen. Definition + Presentations werden
|
||||||
|
# per @odata.bind referenziert — die IDs eingebauter ADMX-Vorlagen sind
|
||||||
|
# tenantuebergreifend identisch, daher tenantunabhaengig einsetzbar.
|
||||||
|
$errors = @()
|
||||||
|
foreach ($dv in @(Get-PolicyProp $Policy 'definitionValues')) {
|
||||||
|
if (-not $dv) { continue }
|
||||||
|
$def = Get-PolicyProp $dv 'definition'
|
||||||
|
$defId = [string](Get-PolicyProp $def 'id')
|
||||||
|
if (-not $defId) {
|
||||||
|
$errors += 'definitionValue ohne Definition-Id uebersprungen'
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
$presVals = @()
|
||||||
|
foreach ($pv in @(Get-PolicyProp $dv 'presentationValues')) {
|
||||||
|
if (-not $pv) { continue }
|
||||||
|
$pres = Get-PolicyProp $pv 'presentation'
|
||||||
|
$presId = [string](Get-PolicyProp $pres 'id')
|
||||||
|
$entry = [ordered]@{
|
||||||
|
'@odata.type' = [string](Get-PolicyProp $pv '@odata.type')
|
||||||
|
'presentation@odata.bind' = "$defRoot('$defId')/presentations('$presId')"
|
||||||
|
}
|
||||||
|
# Je nach Presentation-Typ traegt der Wert in 'value' ODER 'values'.
|
||||||
|
foreach ($vk in @('value','values')) {
|
||||||
|
$vv = Get-PolicyProp $pv $vk
|
||||||
|
if ($null -ne $vv) { $entry[$vk] = $vv }
|
||||||
|
}
|
||||||
|
$presVals += $entry
|
||||||
|
}
|
||||||
|
|
||||||
|
$body = [ordered]@{
|
||||||
|
enabled = [bool](Get-PolicyProp $dv 'enabled')
|
||||||
|
'definition@odata.bind' = "$defRoot('$defId')"
|
||||||
|
presentationValues = @($presVals)
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
Invoke-MgGraphRequestRetry -Uri "$cfgRoot/$newId/definitionValues" -Method POST -Body ($body | ConvertTo-Json -Depth 50) -ContentType 'application/json' | Out-Null
|
||||||
|
} catch {
|
||||||
|
$m = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $m = $_.ErrorDetails.Message } } catch {}
|
||||||
|
$dn = [string](Get-PolicyProp $def 'displayName'); if (-not $dn) { $dn = $defId }
|
||||||
|
$errors += "${dn}: $m"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($errors.Count -gt 0) {
|
||||||
|
throw ("Huelle angelegt (Id $newId), aber $($errors.Count) Einstellung(en) fehlgeschlagen: " + ($errors -join ' | '))
|
||||||
|
}
|
||||||
|
return $created
|
||||||
|
}
|
||||||
|
|
||||||
# Dispatcht anhand des ExportType auf den passenden Import.
|
# Dispatcht anhand des ExportType auf den passenden Import.
|
||||||
function Import-GraphPolicyByExportType {
|
function Import-GraphPolicyByExportType {
|
||||||
param([string]$ExportType, $Policy)
|
param([string]$ExportType, $Policy)
|
||||||
switch ($ExportType) {
|
switch ($ExportType) {
|
||||||
'CompliancePolicy' { return Import-GraphCompliancePolicy -Policy $Policy }
|
'CompliancePolicy' { return Import-GraphCompliancePolicy -Policy $Policy }
|
||||||
'ConfigurationProfile' { return Import-GraphConfigurationProfile -Policy $Policy }
|
'ConfigurationProfile' { return Import-GraphConfigurationProfile -Policy $Policy }
|
||||||
'SettingsCatalog' { return Import-GraphSettingsCatalogPolicy -Policy $Policy }
|
'SettingsCatalog' { return Import-GraphSettingsCatalogPolicy -Policy $Policy }
|
||||||
|
'AdministrativeTemplate' { return Import-GraphAdministrativeTemplate -Policy $Policy }
|
||||||
default { throw "Unbekannter exportType: $ExportType" }
|
default { throw "Unbekannter exportType: $ExportType" }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -288,6 +451,11 @@ function Get-SettingsCatalogPoliciesEndpoint {
|
|||||||
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'settingscatalog') }
|
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'settingscatalog') }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Get-AdministrativeTemplatesEndpoint {
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'administrativetemplate') }
|
||||||
|
}
|
||||||
|
|
||||||
# Export: liefert die Export-Objekte im Response (Browser-Download) UND legt sie
|
# Export: liefert die Export-Objekte im Response (Browser-Download) UND legt sie
|
||||||
# zusaetzlich als JSON im Server-Archiv ab. Body: { type, ids }.
|
# zusaetzlich als JSON im Server-Archiv ab. Body: { type, ids }.
|
||||||
function Export-PoliciesEndpoint {
|
function Export-PoliciesEndpoint {
|
||||||
@@ -368,10 +536,14 @@ function Import-PoliciesEndpoint {
|
|||||||
param($Body)
|
param($Body)
|
||||||
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
$uploaded = @(Get-PolicyProp $Body 'policies')
|
# @(Get-PolicyProp ...) auf ein fehlendes Feld liefert $null -> @($null) hat
|
||||||
$fileNames = @(Get-PolicyProp $Body 'fileNames')
|
# Count 1 (ein Null-Element), kein leeres Array. Ohne Filter wuerde die
|
||||||
|
# Archiv-Schleife einmal mit $fileName = $null laufen und auf das Verzeichnis
|
||||||
|
# selbst zugreifen (DirectoryNotFoundException). Daher Null/Leer rausfiltern.
|
||||||
|
$uploaded = @(Get-PolicyProp $Body 'policies') | Where-Object { $_ }
|
||||||
|
$fileNames = @(Get-PolicyProp $Body 'fileNames') | Where-Object { $_ }
|
||||||
|
|
||||||
if ($uploaded.Count -eq 0 -and $fileNames.Count -eq 0) {
|
if (@($uploaded).Count -eq 0 -and @($fileNames).Count -eq 0) {
|
||||||
return @{ __status = 400; error = 'Keine Policies zum Importieren uebergeben' }
|
return @{ __status = 400; error = 'Keine Policies zum Importieren uebergeben' }
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -380,7 +552,10 @@ function Import-PoliciesEndpoint {
|
|||||||
# 1) Hochgeladene Envelopes
|
# 1) Hochgeladene Envelopes
|
||||||
foreach ($env in $uploaded) {
|
foreach ($env in $uploaded) {
|
||||||
if (-not $env) { continue }
|
if (-not $env) { continue }
|
||||||
|
# Envelope-Formate akzeptieren beide Typ-Felder: 'exportType' (Export-
|
||||||
|
# Download) und 'policyType' (Git-Snapshot).
|
||||||
$exportType = [string](Get-PolicyProp $env 'exportType')
|
$exportType = [string](Get-PolicyProp $env 'exportType')
|
||||||
|
if (-not $exportType) { $exportType = [string](Get-PolicyProp $env 'policyType') }
|
||||||
$policy = Get-PolicyProp $env 'policy'
|
$policy = Get-PolicyProp $env 'policy'
|
||||||
$policyName = Get-PolicyProp $env 'policyName'
|
$policyName = Get-PolicyProp $env 'policyName'
|
||||||
if (-not $policyName) { $policyName = Get-PolicyDisplayName $policy }
|
if (-not $policyName) { $policyName = Get-PolicyDisplayName $policy }
|
||||||
@@ -401,9 +576,10 @@ function Import-PoliciesEndpoint {
|
|||||||
# 2) Dateien aus dem Server-Archiv
|
# 2) Dateien aus dem Server-Archiv
|
||||||
$exportDir = Get-PolicyExportDir
|
$exportDir = Get-PolicyExportDir
|
||||||
foreach ($fileName in $fileNames) {
|
foreach ($fileName in $fileNames) {
|
||||||
$safe = ($fileName -replace '[\\/]', '')
|
if ([string]::IsNullOrWhiteSpace([string]$fileName)) { continue }
|
||||||
|
$safe = ([string]$fileName -replace '[\\/]', '')
|
||||||
$filePath = Join-Path $exportDir $safe
|
$filePath = Join-Path $exportDir $safe
|
||||||
if (-not (Test-Path $filePath)) {
|
if ([string]::IsNullOrWhiteSpace($safe) -or -not (Test-Path $filePath -PathType Leaf)) {
|
||||||
$results += @{ fileName = $fileName; success = $false; error = 'Datei nicht gefunden' }
|
$results += @{ fileName = $fileName; success = $false; error = 'Datei nicht gefunden' }
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
@@ -411,6 +587,7 @@ function Import-PoliciesEndpoint {
|
|||||||
try {
|
try {
|
||||||
$content = Get-Content $filePath -Raw | ConvertFrom-Json
|
$content = Get-Content $filePath -Raw | ConvertFrom-Json
|
||||||
$exportType = [string](Get-PolicyProp $content 'exportType')
|
$exportType = [string](Get-PolicyProp $content 'exportType')
|
||||||
|
if (-not $exportType) { $exportType = [string](Get-PolicyProp $content 'policyType') }
|
||||||
$policy = Get-PolicyProp $content 'policy'
|
$policy = Get-PolicyProp $content 'policy'
|
||||||
$policyName = Get-PolicyDisplayName $policy
|
$policyName = Get-PolicyDisplayName $policy
|
||||||
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
||||||
@@ -425,3 +602,179 @@ function Import-PoliciesEndpoint {
|
|||||||
$ok = @($results | Where-Object { $_.success }).Count
|
$ok = @($results | Where-Object { $_.success }).Count
|
||||||
return @{ ok = $true; importedCount = $ok; results = @($results) }
|
return @{ ok = $true; importedCount = $ok; results = @($results) }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Weist importierten Policies Gruppen zu (Include + Exclude). Body:
|
||||||
|
# items = [ { exportType, id, policyName, include:[groupId], exclude:[groupId] } ]
|
||||||
|
# Nutzt die typ-spezifische /assign-Action. Zuweisungen sind pro Policy.
|
||||||
|
function Invoke-PolicyAssignEndpoint {
|
||||||
|
param($Body)
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
|
$items = @(Get-PolicyProp $Body 'items') | Where-Object { $_ }
|
||||||
|
if (@($items).Count -eq 0) { return @{ __status = 400; error = 'Keine Zuweisungen uebergeben' } }
|
||||||
|
|
||||||
|
$results = @()
|
||||||
|
foreach ($it in $items) {
|
||||||
|
$exportType = [string](Get-PolicyProp $it 'exportType')
|
||||||
|
$id = [string](Get-PolicyProp $it 'id')
|
||||||
|
$name = [string](Get-PolicyProp $it 'policyName')
|
||||||
|
$include = @(Get-PolicyProp $it 'include') | Where-Object { $_ }
|
||||||
|
$exclude = @(Get-PolicyProp $it 'exclude') | Where-Object { $_ }
|
||||||
|
$cfg = Get-PolicyTypeConfigByExportType $exportType
|
||||||
|
|
||||||
|
if (-not $cfg) { $results += @{ id = $id; policyName = $name; success = $false; error = "Unbekannter exportType: $exportType" }; continue }
|
||||||
|
if (-not $id) { $results += @{ policyName = $name; success = $false; error = 'Policy-Id fehlt' }; continue }
|
||||||
|
if (@($include).Count -eq 0 -and @($exclude).Count -eq 0) {
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $true; skipped = $true }
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
$assignments = @()
|
||||||
|
foreach ($g in $include) {
|
||||||
|
$assignments += @{ target = @{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = [string]$g } }
|
||||||
|
}
|
||||||
|
foreach ($g in $exclude) {
|
||||||
|
$assignments += @{ target = @{ '@odata.type' = '#microsoft.graph.exclusionGroupAssignmentTarget'; groupId = [string]$g } }
|
||||||
|
}
|
||||||
|
$json = @{ assignments = @($assignments) } | ConvertTo-Json -Depth 10
|
||||||
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$id/assign"
|
||||||
|
try {
|
||||||
|
Invoke-MgGraphRequestRetry -Uri $uri -Method POST -Body $json -ContentType 'application/json' | Out-Null
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $true; includeCount = @($include).Count; excludeCount = @($exclude).Count }
|
||||||
|
} catch {
|
||||||
|
$m = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $m = $_.ErrorDetails.Message } } catch {}
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $false; error = $m }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$ok = @($results | Where-Object { $_.success -and -not $_.skipped }).Count
|
||||||
|
return @{ ok = $true; assignedCount = $ok; results = @($results) }
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
# Policy-Snapshot nach Git (voller Export, stabile Dateinamen)
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
# Rekursiv nach Schluesseln sortieren -> deterministische JSON-Ausgabe, damit
|
||||||
|
# unveraenderte Policies keine Diff-Noise durch wechselnde Key-Reihenfolge
|
||||||
|
# erzeugen (Invoke-MgGraphRequest liefert ungeordnete Hashtables).
|
||||||
|
function ConvertTo-StableObject {
|
||||||
|
param($InputObject)
|
||||||
|
if ($InputObject -is [System.Collections.IDictionary]) {
|
||||||
|
$ordered = [ordered]@{}
|
||||||
|
foreach ($k in ($InputObject.Keys | Sort-Object)) {
|
||||||
|
$ordered[$k] = ConvertTo-StableObject $InputObject[$k]
|
||||||
|
}
|
||||||
|
return $ordered
|
||||||
|
}
|
||||||
|
if (($InputObject -is [System.Collections.IEnumerable]) -and -not ($InputObject -is [string])) {
|
||||||
|
# Array-Reihenfolge bleibt erhalten (ist bei Policies bedeutungstragend).
|
||||||
|
return @($InputObject | ForEach-Object { ConvertTo-StableObject $_ })
|
||||||
|
}
|
||||||
|
return $InputObject
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-Git {
|
||||||
|
param([Parameter(Mandatory=$true)][string]$RepoPath, [Parameter(Mandatory=$true)][string[]]$GitArgs)
|
||||||
|
$out = & git -C $RepoPath @GitArgs 2>&1
|
||||||
|
return @{ exit = $LASTEXITCODE; out = (@($out) -join "`n").Trim() }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-PolicySnapshotFolderName {
|
||||||
|
# Tenant-Unterordner im Repo: Label (Multi-Tenant) sonst TenantId sonst 'default'.
|
||||||
|
$active = Get-ActiveConnection -Settings $script:Settings
|
||||||
|
$name = if ($active.label) { $active.label } elseif ($script:State.TenantId) { [string]$script:State.TenantId } else { 'default' }
|
||||||
|
$safe = ($name -replace '[^\w\-\.]', '_')
|
||||||
|
if ([string]::IsNullOrWhiteSpace($safe)) { $safe = 'default' }
|
||||||
|
return $safe
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-PolicyGitSnapshotEndpoint {
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
|
$cfg = $script:Settings.policyBackup
|
||||||
|
$repo = if ($cfg -and $cfg.gitRepoPath) { [string]$cfg.gitRepoPath } else { '' }
|
||||||
|
$doPush = if ($cfg -and $cfg.push) { [bool]$cfg.push } else { $false }
|
||||||
|
if ([string]::IsNullOrWhiteSpace($repo)) {
|
||||||
|
return @{ __status = 400; error = 'Kein Git-Repo-Pfad konfiguriert (Einstellungen -> Policy-Backup).' }
|
||||||
|
}
|
||||||
|
|
||||||
|
# git verfuegbar?
|
||||||
|
try { $null = & git --version 2>&1; if ($LASTEXITCODE -ne 0) { throw 'x' } }
|
||||||
|
catch { return @{ __status = 500; error = 'git ist nicht installiert oder nicht im PATH.' } }
|
||||||
|
|
||||||
|
# Repo-Ordner + .git sicherstellen
|
||||||
|
if (-not (Test-Path $repo)) { New-Item -ItemType Directory -Path $repo -Force | Out-Null }
|
||||||
|
if (-not (Test-Path (Join-Path $repo '.git'))) {
|
||||||
|
$r = Invoke-Git -RepoPath $repo -GitArgs @('init')
|
||||||
|
if ($r.exit -ne 0) { return @{ __status = 500; error = "git init fehlgeschlagen: $($r.out)" } }
|
||||||
|
}
|
||||||
|
# Commit-Identitaet sicherstellen (frisches Repo hat evtl. keine).
|
||||||
|
if ([string]::IsNullOrWhiteSpace((Invoke-Git -RepoPath $repo -GitArgs @('config','user.email')).out)) {
|
||||||
|
Invoke-Git -RepoPath $repo -GitArgs @('config','user.email','intune-manager@localhost') | Out-Null
|
||||||
|
Invoke-Git -RepoPath $repo -GitArgs @('config','user.name','Intune Manager') | Out-Null
|
||||||
|
}
|
||||||
|
|
||||||
|
$tenantFolder = Get-PolicySnapshotFolderName
|
||||||
|
$tenantDir = Join-Path $repo $tenantFolder
|
||||||
|
# Tenant-Ordner komplett neu aufbauen -> entfernte Policies verschwinden (Diff).
|
||||||
|
if (Test-Path $tenantDir) { Remove-Item $tenantDir -Recurse -Force }
|
||||||
|
New-Item -ItemType Directory -Path $tenantDir -Force | Out-Null
|
||||||
|
|
||||||
|
$types = @('settingscatalog','compliance','configuration','administrativetemplate')
|
||||||
|
$total = 0
|
||||||
|
$perType = [ordered]@{}
|
||||||
|
foreach ($type in $types) {
|
||||||
|
$tcfg = Get-PolicyTypeConfig $type
|
||||||
|
$list = @(Get-GraphPolicyList -Type $type)
|
||||||
|
$perType[$tcfg.ExportType] = $list.Count
|
||||||
|
if ($list.Count -eq 0) { continue }
|
||||||
|
$typeDir = Join-Path $tenantDir $type
|
||||||
|
New-Item -ItemType Directory -Path $typeDir -Force | Out-Null
|
||||||
|
foreach ($item in $list) {
|
||||||
|
$id = [string]$item.id
|
||||||
|
$detail = $null
|
||||||
|
try { $detail = Get-GraphPolicyDetail -Type $type -Id $id } catch { continue }
|
||||||
|
$name = [string]$item.name
|
||||||
|
$safe = ($name -replace '[^\w\-\.]', '_'); if (-not $safe) { $safe = $id }
|
||||||
|
$short = if ($id.Length -ge 8) { $id.Substring(0,8) } else { $id }
|
||||||
|
$fname = "$($safe)__$($short).json"
|
||||||
|
$envelope = [ordered]@{
|
||||||
|
policyType = $tcfg.ExportType
|
||||||
|
policyName = $name
|
||||||
|
policy = $detail
|
||||||
|
}
|
||||||
|
# stabile (sortierte) Ausgabe, ohne Zeitstempel -> saubere Diffs
|
||||||
|
(ConvertTo-StableObject $envelope) | ConvertTo-Json -Depth 50 | Set-Content -Path (Join-Path $typeDir $fname) -Encoding UTF8
|
||||||
|
$total++
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$add = Invoke-Git -RepoPath $repo -GitArgs @('add','-A')
|
||||||
|
if ($add.exit -ne 0) { return @{ __status = 500; error = "git add fehlgeschlagen: $($add.out)" } }
|
||||||
|
|
||||||
|
if ([string]::IsNullOrWhiteSpace((Invoke-Git -RepoPath $repo -GitArgs @('status','--porcelain')).out)) {
|
||||||
|
return @{ ok = $true; changed = $false; committed = $false; total = $total; perType = $perType; tenant = $tenantFolder; message = 'Keine Aenderungen seit dem letzten Snapshot.' }
|
||||||
|
}
|
||||||
|
|
||||||
|
$msg = "Policy-Snapshot $tenantFolder $(Get-Date -Format 'yyyy-MM-dd HH:mm')"
|
||||||
|
$commit = Invoke-Git -RepoPath $repo -GitArgs @('commit','-m',$msg)
|
||||||
|
if ($commit.exit -ne 0) { return @{ __status = 500; error = "git commit fehlgeschlagen: $($commit.out)" } }
|
||||||
|
$hash = (Invoke-Git -RepoPath $repo -GitArgs @('rev-parse','--short','HEAD')).out
|
||||||
|
|
||||||
|
$pushed = $false; $pushError = $null
|
||||||
|
if ($doPush) {
|
||||||
|
$push = Invoke-Git -RepoPath $repo -GitArgs @('push')
|
||||||
|
if ($push.exit -eq 0) { $pushed = $true } else { $pushError = $push.out }
|
||||||
|
}
|
||||||
|
|
||||||
|
$summary = "Snapshot committet: $total Policies ($hash)"
|
||||||
|
if ($doPush) { $summary += if ($pushed) { ', gepusht' } else { ', Push fehlgeschlagen' } }
|
||||||
|
return @{
|
||||||
|
ok = $true; changed = $true; committed = $true
|
||||||
|
total = $total; perType = $perType; tenant = $tenantFolder
|
||||||
|
commit = $hash; pushed = $pushed; pushError = $pushError
|
||||||
|
message = $summary
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|||||||
+237
-15
@@ -194,9 +194,11 @@ document.getElementById('tenantSwitch')?.addEventListener('change', async e => {
|
|||||||
State.readOnly = !!s.readOnly;
|
State.readOnly = !!s.readOnly;
|
||||||
applyReadOnlyMode();
|
applyReadOnlyMode();
|
||||||
renderConnection();
|
renderConnection();
|
||||||
// Frontend-Caches anderer Tabs verwerfen (anderer Tenant = andere Daten).
|
// Anderer Tenant = andere Daten: ALLE datentragenden Frontend-Caches
|
||||||
if (typeof ReportState !== 'undefined') ReportState.items = [];
|
// verwerfen, sonst ueberspringen die Load-Guards (appsLoaded/loadedModes)
|
||||||
if (typeof PolState !== 'undefined') { PolState.items = []; PolState.selected?.clear?.(); }
|
// das Neuladen und die UI zeigt weiter den vorherigen Tenant.
|
||||||
|
if (typeof stopDevicePolling === 'function') stopDevicePolling();
|
||||||
|
resetClientState();
|
||||||
switchMainView('apps');
|
switchMainView('apps');
|
||||||
if (s.connected) {
|
if (s.connected) {
|
||||||
toast('Verbunden mit ' + (s.tenantLabel || s.account || 'Mandant'), 'ok', 'Mandant gewechselt');
|
toast('Verbunden mit ' + (s.tenantLabel || s.account || 'Mandant'), 'ok', 'Mandant gewechselt');
|
||||||
@@ -345,17 +347,8 @@ document.getElementById('btnDisconnect').addEventListener('click', async () => {
|
|||||||
connectInFlight = false;
|
connectInFlight = false;
|
||||||
try {
|
try {
|
||||||
await api('/api/disconnect', { method: 'POST' });
|
await api('/api/disconnect', { method: 'POST' });
|
||||||
Object.assign(State, {
|
Object.assign(State, { connected: false, account: null });
|
||||||
connected: false, account: null,
|
resetClientState();
|
||||||
targets: [], apps: [], session: [],
|
|
||||||
appsLoaded: false,
|
|
||||||
});
|
|
||||||
State.selectedTargetIds.clear();
|
|
||||||
State.membershipCache.clear();
|
|
||||||
State.loadedModes.clear();
|
|
||||||
State.appDetails.clear();
|
|
||||||
State.expandedApps.clear();
|
|
||||||
State.modeCache.clear();
|
|
||||||
renderConnection();
|
renderConnection();
|
||||||
renderTargets();
|
renderTargets();
|
||||||
renderPinnedTargets();
|
renderPinnedTargets();
|
||||||
@@ -368,6 +361,25 @@ document.getElementById('btnDisconnect').addEventListener('click', async () => {
|
|||||||
}
|
}
|
||||||
});
|
});
|
||||||
|
|
||||||
|
// Alle datentragenden Frontend-Caches verwerfen (Apps, Targets, Gruppen-
|
||||||
|
// Mitglieder, Report, Policies, Devices). Beruehrt NICHT connected/account —
|
||||||
|
// das setzt der jeweilige Aufrufer (Disconnect vs. Tenant-Wechsel) selbst.
|
||||||
|
// Wird beim Tenant-Wechsel benoetigt, sonst zeigen die Load-Guards
|
||||||
|
// (appsLoaded / loadedModes) noch die Daten des vorherigen Tenants.
|
||||||
|
function resetClientState() {
|
||||||
|
Object.assign(State, { targets: [], apps: [], session: [], appsLoaded: false });
|
||||||
|
State.selectedTargetIds.clear();
|
||||||
|
State.membershipCache.clear();
|
||||||
|
State.loadedModes.clear();
|
||||||
|
State.appDetails.clear();
|
||||||
|
State.expandedApps.clear();
|
||||||
|
State.modeCache.clear();
|
||||||
|
State.expandedGroups = new Map();
|
||||||
|
if (typeof ReportState !== 'undefined') ReportState.items = [];
|
||||||
|
if (typeof PolState !== 'undefined') { PolState.items = []; PolState.selected?.clear?.(); }
|
||||||
|
if (typeof DevState !== 'undefined') { DevState.items = []; DevState.filtered = []; DevState.selected = null; }
|
||||||
|
}
|
||||||
|
|
||||||
async function autoLoadAfterConnect() {
|
async function autoLoadAfterConnect() {
|
||||||
// Load default mode targets + apps in parallel
|
// Load default mode targets + apps in parallel
|
||||||
const tasks = [];
|
const tasks = [];
|
||||||
@@ -4119,6 +4131,11 @@ function fillSettingsForm(s) {
|
|||||||
document.getElementById('setAvailSuffix').value = av.suffix || '';
|
document.getElementById('setAvailSuffix').value = av.suffix || '';
|
||||||
updateAvailPreview();
|
updateAvailPreview();
|
||||||
|
|
||||||
|
// Policy-Backup (Git)
|
||||||
|
const pb = s.policyBackup || {};
|
||||||
|
document.getElementById('setPolicyGitPath').value = pb.gitRepoPath || '';
|
||||||
|
document.getElementById('setPolicyGitPush').checked = !!pb.push;
|
||||||
|
|
||||||
// Branding-Logo Preview
|
// Branding-Logo Preview
|
||||||
fillLogoPreview(s.branding);
|
fillLogoPreview(s.branding);
|
||||||
|
|
||||||
@@ -4219,6 +4236,10 @@ function readSettingsForm() {
|
|||||||
detailPanel: document.getElementById('setColDetailPanelHex').value.trim() || ThemeDefaults.detailPanel,
|
detailPanel: document.getElementById('setColDetailPanelHex').value.trim() || ThemeDefaults.detailPanel,
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
policyBackup: {
|
||||||
|
gitRepoPath: document.getElementById('setPolicyGitPath').value.trim(),
|
||||||
|
push: document.getElementById('setPolicyGitPush').checked,
|
||||||
|
},
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -5751,6 +5772,7 @@ async function loadPolicies() {
|
|||||||
['/api/policies/settingscatalog', 'Settings Catalog'],
|
['/api/policies/settingscatalog', 'Settings Catalog'],
|
||||||
['/api/policies/compliance', 'Compliance'],
|
['/api/policies/compliance', 'Compliance'],
|
||||||
['/api/policies/configuration', 'Konfigurationsprofile'],
|
['/api/policies/configuration', 'Konfigurationsprofile'],
|
||||||
|
['/api/policies/administrativetemplate', 'Administrative Vorlagen'],
|
||||||
];
|
];
|
||||||
const settled = await Promise.allSettled(endpoints.map(([url]) => api(url)));
|
const settled = await Promise.allSettled(endpoints.map(([url]) => api(url)));
|
||||||
let items = [];
|
let items = [];
|
||||||
@@ -5891,7 +5913,8 @@ async function polExportSelected() {
|
|||||||
// Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
|
// Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
|
||||||
function polExtractEnvelopes(parsed, fileName) {
|
function polExtractEnvelopes(parsed, fileName) {
|
||||||
if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
|
if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
|
||||||
if (parsed && parsed.exportType && parsed.policy) return [parsed];
|
// Beide Typ-Felder akzeptieren: exportType (Export-Download) + policyType (Git-Snapshot).
|
||||||
|
if (parsed && (parsed.exportType || parsed.policyType) && parsed.policy) return [parsed];
|
||||||
if (parsed && parsed.policy) return [parsed]; // nachsichtig
|
if (parsed && parsed.policy) return [parsed]; // nachsichtig
|
||||||
toast(`${fileName}: unbekanntes Policy-Format.`, 'err');
|
toast(`${fileName}: unbekanntes Policy-Format.`, 'err');
|
||||||
return [];
|
return [];
|
||||||
@@ -5922,6 +5945,9 @@ async function polHandleImportFiles(fileList) {
|
|||||||
toast(`${ok.length} Policy(s) importiert.`, 'ok', 'Import');
|
toast(`${ok.length} Policy(s) importiert.`, 'ok', 'Import');
|
||||||
}
|
}
|
||||||
await loadPolicies();
|
await loadPolicies();
|
||||||
|
// Nach erfolgreichem Import optional Gruppen zuweisen (pro Policy).
|
||||||
|
const assignable = ok.filter(r => r.newId);
|
||||||
|
if (assignable.length && !State.readOnly) openPolAssignModal(assignable);
|
||||||
} catch (e) {
|
} catch (e) {
|
||||||
toast('Import fehlgeschlagen: ' + e.message, 'err');
|
toast('Import fehlgeschlagen: ' + e.message, 'err');
|
||||||
} finally {
|
} finally {
|
||||||
@@ -5929,8 +5955,204 @@ async function polHandleImportFiles(fileList) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// =============================================================
|
||||||
|
// Post-Import: Policies pro Stück Include-/Exclude-Gruppen zuweisen
|
||||||
|
// =============================================================
|
||||||
|
const PolAssignState = { policies: [] };
|
||||||
|
const POL_TYPE_LABELS = {
|
||||||
|
SettingsCatalog: 'Settings Catalog',
|
||||||
|
CompliancePolicy: 'Compliance',
|
||||||
|
ConfigurationProfile: 'Konfigurationsprofil',
|
||||||
|
AdministrativeTemplate: 'Administrative Vorlage',
|
||||||
|
};
|
||||||
|
|
||||||
|
function openPolAssignModal(assignable) {
|
||||||
|
PolAssignState.policies = assignable.map(r => ({
|
||||||
|
id: r.newId,
|
||||||
|
name: r.policyName || '(ohne Name)',
|
||||||
|
exportType: r.exportType || '',
|
||||||
|
include: [],
|
||||||
|
exclude: [],
|
||||||
|
}));
|
||||||
|
renderPolAssignList();
|
||||||
|
openModal('modalPolAssign');
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolAssignList() {
|
||||||
|
const list = document.getElementById('polAssignList');
|
||||||
|
if (!list) return;
|
||||||
|
list.innerHTML = PolAssignState.policies.map((p, i) => `
|
||||||
|
<div class="pol-assign-row" data-idx="${i}">
|
||||||
|
<div class="pol-assign-head">
|
||||||
|
<span class="pol-name">${escapeHtml(p.name)}</span>
|
||||||
|
<span class="pol-type-badge">${escapeHtml(POL_TYPE_LABELS[p.exportType] || p.exportType || 'Policy')}</span>
|
||||||
|
</div>
|
||||||
|
<div class="pol-assign-pickers">
|
||||||
|
${['include', 'exclude'].map(kind => `
|
||||||
|
<div class="pol-assign-picker" data-kind="${kind}">
|
||||||
|
<label class="lbl">${kind === 'include' ? 'Include-Gruppen' : 'Exclude-Gruppen'}</label>
|
||||||
|
<div class="pol-assign-chips" data-idx="${i}" data-kind="${kind}"></div>
|
||||||
|
<div class="pol-assign-search-wrap">
|
||||||
|
<input type="text" class="input pol-assign-search" data-idx="${i}" data-kind="${kind}" placeholder="Gruppe suchen…" autocomplete="off">
|
||||||
|
<div class="pol-assign-dropdown hidden" data-idx="${i}" data-kind="${kind}"></div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
`).join('')}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
`).join('');
|
||||||
|
PolAssignState.policies.forEach((_, i) => {
|
||||||
|
renderPolAssignChips(i, 'include');
|
||||||
|
renderPolAssignChips(i, 'exclude');
|
||||||
|
});
|
||||||
|
updatePolAssignInfo();
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolAssignChips(idx, kind) {
|
||||||
|
const box = document.querySelector(`.pol-assign-chips[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
if (!box) return;
|
||||||
|
const arr = PolAssignState.policies[idx][kind];
|
||||||
|
box.innerHTML = arr.map((g, j) => `
|
||||||
|
<span class="pol-assign-chip ${kind === 'exclude' ? 'exclude' : ''}">
|
||||||
|
${escapeHtml(g.name)}
|
||||||
|
<button type="button" data-idx="${idx}" data-kind="${kind}" data-j="${j}" title="Entfernen">×</button>
|
||||||
|
</span>
|
||||||
|
`).join('');
|
||||||
|
updatePolAssignInfo();
|
||||||
|
}
|
||||||
|
|
||||||
|
function updatePolAssignInfo() {
|
||||||
|
const info = document.getElementById('polAssignInfo');
|
||||||
|
if (!info) return;
|
||||||
|
const n = PolAssignState.policies.filter(p => p.include.length || p.exclude.length).length;
|
||||||
|
info.textContent = n ? `${n} Policy(s) mit Zuweisung` : 'Keine Zuweisung gewählt';
|
||||||
|
}
|
||||||
|
|
||||||
|
let _polAssignSearchTimer = null;
|
||||||
|
function polAssignHideDropdowns() {
|
||||||
|
document.querySelectorAll('.pol-assign-dropdown').forEach(d => { d.classList.add('hidden'); d.innerHTML = ''; });
|
||||||
|
}
|
||||||
|
|
||||||
|
// Suche (debounced) — Event-Delegation auf der Liste.
|
||||||
|
document.getElementById('polAssignList')?.addEventListener('input', e => {
|
||||||
|
const input = e.target.closest('.pol-assign-search');
|
||||||
|
if (!input) return;
|
||||||
|
const idx = input.dataset.idx, kind = input.dataset.kind;
|
||||||
|
const dd = document.querySelector(`.pol-assign-dropdown[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
const q = input.value.trim();
|
||||||
|
clearTimeout(_polAssignSearchTimer);
|
||||||
|
if (q.length < 2) { if (dd) { dd.classList.add('hidden'); dd.innerHTML = ''; } return; }
|
||||||
|
if (dd) { dd.classList.remove('hidden'); dd.innerHTML = '<div class="msg">Suche…</div>'; }
|
||||||
|
_polAssignSearchTimer = setTimeout(async () => {
|
||||||
|
try {
|
||||||
|
const data = await api(`/api/groups/search?q=${encodeURIComponent(q)}`);
|
||||||
|
const items = (data.items || []).slice(0, 25);
|
||||||
|
if (!dd) return;
|
||||||
|
if (!items.length) { dd.innerHTML = '<div class="msg">Keine Gruppen gefunden.</div>'; return; }
|
||||||
|
dd.innerHTML = items.map(g => `
|
||||||
|
<div class="opt" data-id="${escapeHtml(g.Id)}" data-name="${escapeHtml(g.DisplayName)}">
|
||||||
|
<div>${escapeHtml(g.DisplayName)}</div>
|
||||||
|
${g.Description ? `<div class="desc">${escapeHtml(g.Description)}</div>` : ''}
|
||||||
|
</div>`).join('');
|
||||||
|
} catch (err) {
|
||||||
|
if (dd) dd.innerHTML = `<div class="msg">Suche fehlgeschlagen: ${escapeHtml(err.message)}</div>`;
|
||||||
|
}
|
||||||
|
}, 300);
|
||||||
|
});
|
||||||
|
|
||||||
|
// Klick auf ein Suchergebnis -> als Chip hinzufügen. Klick auf Chip-× -> entfernen.
|
||||||
|
document.getElementById('polAssignList')?.addEventListener('click', e => {
|
||||||
|
const opt = e.target.closest('.pol-assign-dropdown .opt');
|
||||||
|
if (opt) {
|
||||||
|
const dd = opt.closest('.pol-assign-dropdown');
|
||||||
|
const idx = +dd.dataset.idx, kind = dd.dataset.kind;
|
||||||
|
const id = opt.dataset.id, name = opt.dataset.name;
|
||||||
|
const p = PolAssignState.policies[idx];
|
||||||
|
const other = kind === 'include' ? 'exclude' : 'include';
|
||||||
|
// Nicht doppelt, und nicht gleichzeitig include+exclude derselben Gruppe.
|
||||||
|
if (!p[kind].some(g => g.id === id) && !p[other].some(g => g.id === id)) {
|
||||||
|
p[kind].push({ id, name });
|
||||||
|
renderPolAssignChips(idx, kind);
|
||||||
|
}
|
||||||
|
const input = document.querySelector(`.pol-assign-search[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
if (input) input.value = '';
|
||||||
|
dd.classList.add('hidden'); dd.innerHTML = '';
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
const rm = e.target.closest('.pol-assign-chip button');
|
||||||
|
if (rm) {
|
||||||
|
const idx = +rm.dataset.idx, kind = rm.dataset.kind, j = +rm.dataset.j;
|
||||||
|
PolAssignState.policies[idx][kind].splice(j, 1);
|
||||||
|
renderPolAssignChips(idx, kind);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
document.addEventListener('click', e => {
|
||||||
|
if (!e.target.closest('.pol-assign-search-wrap')) polAssignHideDropdowns();
|
||||||
|
});
|
||||||
|
|
||||||
|
document.getElementById('polAssignApply')?.addEventListener('click', async () => {
|
||||||
|
const items = PolAssignState.policies
|
||||||
|
.filter(p => p.include.length || p.exclude.length)
|
||||||
|
.map(p => ({
|
||||||
|
exportType: p.exportType,
|
||||||
|
id: p.id,
|
||||||
|
policyName: p.name,
|
||||||
|
include: p.include.map(g => g.id),
|
||||||
|
exclude: p.exclude.map(g => g.id),
|
||||||
|
}));
|
||||||
|
if (!items.length) { closeModal('modalPolAssign'); return; }
|
||||||
|
setLoading('Weise Gruppen zu…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/policies/assign', { method: 'POST', body: { items }, timeoutMs: 120000 });
|
||||||
|
const results = res.results || [];
|
||||||
|
const fail = results.filter(r => !r.success);
|
||||||
|
if (fail.length) {
|
||||||
|
const first = fail[0];
|
||||||
|
toast(`${res.assignedCount || 0} zugewiesen, ${fail.length} fehlgeschlagen. z.B. "${first.policyName || '?'}": ${first.error || 'Fehler'}`, 'err', 'Zuweisung');
|
||||||
|
} else {
|
||||||
|
toast(`${res.assignedCount || 0} Policy(s) zugewiesen.`, 'ok', 'Zuweisung');
|
||||||
|
}
|
||||||
|
closeModal('modalPolAssign');
|
||||||
|
} catch (e) {
|
||||||
|
toast('Zuweisung fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
// Alle Policies als Snapshot in den konfigurierten Git-Ordner schreiben + committen.
|
||||||
|
async function polGitSnapshot() {
|
||||||
|
setLoading('Erstelle Policy-Snapshot & committe…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/policies/git-snapshot', { method: 'POST', timeoutMs: 300000 });
|
||||||
|
if (res.changed === false) {
|
||||||
|
toast(res.message || 'Keine Änderungen seit dem letzten Snapshot.', 'info', 'Git-Snapshot');
|
||||||
|
} else {
|
||||||
|
let msg = res.message || `Snapshot committet (${res.total} Policies).`;
|
||||||
|
if (res.pushError) msg += ` — Push-Fehler: ${res.pushError}`;
|
||||||
|
toast(msg, res.pushError ? 'warn' : 'ok', 'Git-Snapshot');
|
||||||
|
}
|
||||||
|
} catch (e) {
|
||||||
|
toast('Snapshot fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Ordner-Auswahl für den Git-Repo-Pfad (Einstellungen).
|
||||||
|
async function pickPolicyGitFolder() {
|
||||||
|
try {
|
||||||
|
const res = await api('/api/pickfolder', { method: 'POST', body: { title: 'Git-Repo-Ordner für Policy-Backup wählen' } });
|
||||||
|
if (res && res.path) document.getElementById('setPolicyGitPath').value = res.path;
|
||||||
|
} catch (e) {
|
||||||
|
toast('Ordner-Auswahl fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
document.getElementById('btnPickPolicyGit')?.addEventListener('click', pickPolicyGitFolder);
|
||||||
|
|
||||||
// --- Policies: Event-Wiring ---
|
// --- Policies: Event-Wiring ---
|
||||||
document.getElementById('btnPolRefresh')?.addEventListener('click', loadPolicies);
|
document.getElementById('btnPolRefresh')?.addEventListener('click', loadPolicies);
|
||||||
|
document.getElementById('btnPolGitSnapshot')?.addEventListener('click', polGitSnapshot);
|
||||||
document.getElementById('btnPolExport')?.addEventListener('click', polExportSelected);
|
document.getElementById('btnPolExport')?.addEventListener('click', polExportSelected);
|
||||||
document.getElementById('btnPolImport')?.addEventListener('click', () => document.getElementById('polImportFile').click());
|
document.getElementById('btnPolImport')?.addEventListener('click', () => document.getElementById('polImportFile').click());
|
||||||
document.getElementById('polImportFile')?.addEventListener('change', e => {
|
document.getElementById('polImportFile')?.addEventListener('change', e => {
|
||||||
|
|||||||
@@ -572,6 +572,7 @@
|
|||||||
<option value="settingscatalog">Settings Catalog</option>
|
<option value="settingscatalog">Settings Catalog</option>
|
||||||
<option value="compliance">Compliance</option>
|
<option value="compliance">Compliance</option>
|
||||||
<option value="configuration">Konfigurationsprofil</option>
|
<option value="configuration">Konfigurationsprofil</option>
|
||||||
|
<option value="administrativetemplate">Administrative Vorlage</option>
|
||||||
</select>
|
</select>
|
||||||
<span class="pol-toolbar-spacer" style="flex:1;"></span>
|
<span class="pol-toolbar-spacer" style="flex:1;"></span>
|
||||||
<button class="btn btn-secondary btn-sm" id="btnPolRefresh" title="Policies neu laden">
|
<button class="btn btn-secondary btn-sm" id="btnPolRefresh" title="Policies neu laden">
|
||||||
@@ -583,6 +584,10 @@
|
|||||||
Import…
|
Import…
|
||||||
</button>
|
</button>
|
||||||
<input type="file" id="polImportFile" accept=".json,application/json" multiple style="display:none;">
|
<input type="file" id="polImportFile" accept=".json,application/json" multiple style="display:none;">
|
||||||
|
<button class="btn btn-secondary btn-sm" id="btnPolGitSnapshot" title="Alle Policies als Snapshot in den konfigurierten Git-Ordner schreiben und committen">
|
||||||
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><line x1="12" y1="3" x2="12" y2="9"/><line x1="12" y1="15" x2="12" y2="21"/><circle cx="12" cy="3" r="1"/><circle cx="12" cy="21" r="1"/></svg>
|
||||||
|
Git-Snapshot
|
||||||
|
</button>
|
||||||
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
||||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
||||||
Export (<span id="polSelCount">0</span>)
|
Export (<span id="polSelCount">0</span>)
|
||||||
@@ -808,6 +813,52 @@
|
|||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
<!-- MODAL: Policy-Zuweisung nach Import -->
|
||||||
|
<div id="modalPolAssign" class="modal hidden">
|
||||||
|
<div class="modal-backdrop" data-close></div>
|
||||||
|
<div class="modal-box modal-lg">
|
||||||
|
<div class="modal-head">
|
||||||
|
<h3>Importierte Policies zuweisen</h3>
|
||||||
|
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||||
|
</div>
|
||||||
|
<div class="modal-body">
|
||||||
|
<div class="form-hint" style="margin-bottom:12px;">
|
||||||
|
Optional: jeder importierten Policy Include- und/oder Exclude-Gruppen im aktuellen Tenant zuweisen.
|
||||||
|
Felder leer lassen = keine Zuweisung. Original-Zuweisungen des Quell-Tenants werden nicht übernommen.
|
||||||
|
</div>
|
||||||
|
<div id="polAssignList"></div>
|
||||||
|
</div>
|
||||||
|
<div class="modal-foot">
|
||||||
|
<span id="polAssignInfo" class="muted" style="margin-right:auto;"></span>
|
||||||
|
<button class="btn btn-secondary" data-close>Überspringen</button>
|
||||||
|
<button class="btn btn-primary" id="polAssignApply">Zuweisen</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<style>
|
||||||
|
.pol-assign-row { border:1px solid var(--border, #d9dce3); border-radius:8px; padding:12px 14px; margin-bottom:12px; }
|
||||||
|
.pol-assign-head { display:flex; align-items:center; gap:8px; margin-bottom:10px; }
|
||||||
|
.pol-assign-head .pol-name { font-weight:600; }
|
||||||
|
.pol-assign-pickers { display:flex; gap:16px; flex-wrap:wrap; }
|
||||||
|
.pol-assign-picker { flex:1; min-width:220px; }
|
||||||
|
.pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; opacity:.85; }
|
||||||
|
.pol-assign-picker[data-kind="exclude"] > .lbl { color:#cb2a7a; }
|
||||||
|
.pol-assign-chips { display:flex; flex-wrap:wrap; gap:6px; margin-bottom:6px; }
|
||||||
|
.pol-assign-chip { display:inline-flex; align-items:center; gap:6px; padding:2px 8px; border-radius:12px;
|
||||||
|
background:var(--chip-bg, #eef0f5); font-size:12px; }
|
||||||
|
.pol-assign-chip.exclude { background:#fbe3ef; }
|
||||||
|
.pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; opacity:.6; }
|
||||||
|
.pol-assign-chip button:hover { opacity:1; }
|
||||||
|
.pol-assign-search-wrap { position:relative; }
|
||||||
|
.pol-assign-dropdown { position:absolute; z-index:20; left:0; right:0; top:100%; margin-top:2px;
|
||||||
|
background:var(--panel, #fff); border:1px solid var(--border, #d9dce3); border-radius:6px;
|
||||||
|
max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.12); }
|
||||||
|
.pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; }
|
||||||
|
.pol-assign-dropdown .opt:hover { background:var(--chip-bg, #eef0f5); }
|
||||||
|
.pol-assign-dropdown .opt .desc { font-size:11px; opacity:.6; }
|
||||||
|
.pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; opacity:.6; }
|
||||||
|
</style>
|
||||||
|
|
||||||
<!-- MODAL: Hilfe -->
|
<!-- MODAL: Hilfe -->
|
||||||
<div id="modalHelp" class="modal hidden">
|
<div id="modalHelp" class="modal hidden">
|
||||||
<div class="modal-backdrop" data-close></div>
|
<div class="modal-backdrop" data-close></div>
|
||||||
@@ -1033,6 +1084,25 @@
|
|||||||
<div class="form-hint">Vorschau: <code id="setAvailPreview" class="set-preview"></code></div>
|
<div class="form-hint">Vorschau: <code id="setAvailPreview" class="set-preview"></code></div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<section class="settings-sec">
|
||||||
|
<div class="settings-sec-head">
|
||||||
|
<h4>Policy-Backup (Git)</h4>
|
||||||
|
<div class="settings-sec-sub">Lokaler Git-Ordner für Policy-Snapshots. Der „Git-Snapshot"-Button im Policies-Tab schreibt alle Policies als JSON dorthin und committet sie (optional Push).</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="lbl" for="setPolicyGitPath">Git-Repo-Ordner (lokal)</label>
|
||||||
|
<div class="form-row" style="gap:8px;align-items:center;">
|
||||||
|
<input type="text" id="setPolicyGitPath" class="input mono" placeholder="z. B. C:\Intune-Backup" spellcheck="false" autocomplete="off" style="flex:1;">
|
||||||
|
<button type="button" class="btn btn-secondary btn-sm" id="btnPickPolicyGit">Ordner…</button>
|
||||||
|
</div>
|
||||||
|
<div class="form-hint">Wird bei Bedarf angelegt und als Git-Repo initialisiert. Leer = Funktion deaktiviert.</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="check-chip"><input type="checkbox" id="setPolicyGitPush"><span>Nach dem Commit automatisch <code>git push</code></span></label>
|
||||||
|
<div class="form-hint">Nutzt deinen vorhandenen Git-Credential-Helper (Remote muss im Repo konfiguriert sein). Kein Token in der App.</div>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
<section class="settings-sec">
|
<section class="settings-sec">
|
||||||
<div class="settings-sec-head">
|
<div class="settings-sec-head">
|
||||||
<h4>Branding — Logo</h4>
|
<h4>Branding — Logo</h4>
|
||||||
|
|||||||
Reference in New Issue
Block a user