[pull] master from KelvinTegelaar:master

Config/BaselineStandards/Templates/ConditionalAccessTemplatePackage.json

@@ -0,0 +1,67 @@
+{
+  "name": "ConditionalAccessTemplatePackage",
+  "label": "Conditional Access Template Package",
+  "cat": "Templates",
+  "tag": ["HighImpact"],
+  "impact": "High Impact",
+  "helpText": "Deploys and drift-checks EVERY Conditional Access template tagged with the selected package. Membership is resolved fresh on every run: tag a new template with the package and it joins this baseline automatically, untag it and it leaves. All templates in the package share the deployment state configured here - add a template individually instead when it needs a different state.",
+  "executiveText": "Deploys a complete, named bundle of sign-in security policies in one step - for example a full zero-trust Conditional Access set - and keeps every policy in the bundle enforced as the bundle evolves.",
+  "recommendedBy": ["CIPP"],
+  "requiredCapabilities": ["AAD_PREMIUM", "AAD_PREMIUM_P2"],
+  "secureScoreImpact": 30,
+  "instanceIdentity": "caTemplatePackage",
+  "multiple": true,
+  "package": {
+    "memberStandard": "ConditionalAccessTemplate",
+    "memberVariable": "caTemplate",
+    "variable": "caTemplatePackage",
+    "templatePartition": "CATemplate"
+  },
+  "variables": {
+    "caTemplatePackage": {
+      "type": "autoComplete",
+      "label": "Select a package of Conditional Access Templates",
+      "api": {
+        "url": "/api/ListCATemplates?mode=Tag",
+        "labelField": "label",
+        "valueField": "value",
+        "queryKey": "ListCATemplates-tags",
+        "showRefresh": true
+      }
+    },
+    "state": {
+      "type": "autoComplete",
+      "label": "What state should we deploy these templates in?",
+      "options": [
+        {
+          "label": "Do not change state",
+          "value": "donotchange"
+        },
+        {
+          "label": "Report only",
+          "value": "enabledForReportingButNotEnforced"
+        },
+        {
+          "label": "Enabled",
+          "value": "enabled"
+        },
+        {
+          "label": "Disabled",
+          "value": "disabled"
+        }
+      ],
+      "default": "enabledForReportingButNotEnforced",
+      "recommended": "enabled"
+    },
+    "disableSD": {
+      "type": "switch",
+      "label": "Disable Security Defaults when deploying policy",
+      "default": false
+    },
+    "createGroups": {
+      "type": "switch",
+      "label": "Create groups if they do not exist",
+      "default": false
+    }
+  }
+}

Config/BaselineStandards/Templates/IntuneTemplatePackage.json

@@ -0,0 +1,106 @@
+{
+  "name": "IntuneTemplatePackage",
+  "label": "Intune Template Package",
+  "cat": "Templates",
+  "tag": ["HighImpact"],
+  "impact": "High Impact",
+  "helpText": "Deploys and drift-checks EVERY Intune template tagged with the selected package. Membership is resolved fresh on every run: tag a new template with the package and it joins this baseline automatically, untag it and it leaves. All templates in the package share the assignment options configured here - add a template individually instead when it needs different options.",
+  "executiveText": "Deploys a complete, named bundle of device management configurations in one step - for example an entire Windows security baseline - and keeps every policy in the bundle enforced as the bundle evolves.",
+  "recommendedBy": ["CIPP"],
+  "requiredCapabilities": [
+    "INTUNE_A",
+    "MDM_Services",
+    "EMS",
+    "SCCM",
+    "MICROSOFTINTUNEPLAN1"
+  ],
+  "secureScoreImpact": 20,
+  "instanceIdentity": "intuneTemplatePackage",
+  "multiple": true,
+  "package": {
+    "memberStandard": "IntuneTemplate",
+    "memberVariable": "intuneTemplate",
+    "variable": "intuneTemplatePackage",
+    "templatePartition": "IntuneTemplate"
+  },
+  "variables": {
+    "intuneTemplatePackage": {
+      "type": "autoComplete",
+      "label": "Select a package of Intune Templates",
+      "api": {
+        "url": "/api/ListIntuneTemplates?mode=Tag",
+        "labelField": "label",
+        "valueField": "value",
+        "queryKey": "ListIntuneTemplates-tags",
+        "showRefresh": true
+      }
+    },
+    "assignTo": {
+      "type": "autoComplete",
+      "label": "Who should these templates be assigned to?",
+      "options": [
+        {
+          "label": "Do not assign",
+          "value": "On"
+        },
+        {
+          "label": "Assign to all users",
+          "value": "allLicensedUsers"
+        },
+        {
+          "label": "Assign to all devices",
+          "value": "AllDevices"
+        },
+        {
+          "label": "Assign to all users and devices",
+          "value": "AllDevicesAndUsers"
+        },
+        {
+          "label": "Assign to Custom Group",
+          "value": "customGroup"
+        }
+      ],
+      "default": "On"
+    },
+    "customGroup": {
+      "type": "textField",
+      "label": "Custom group name (if assigning to a custom group; wildcards allowed)",
+      "default": ""
+    },
+    "excludeGroup": {
+      "type": "textField",
+      "label": "Exclude groups (comma-separated, wildcards allowed)",
+      "default": ""
+    },
+    "assignmentFilter": {
+      "type": "textField",
+      "label": "Assignment filter name (optional, wildcards allowed)",
+      "default": ""
+    },
+    "assignmentFilterType": {
+      "type": "autoComplete",
+      "label": "Assignment filter mode",
+      "options": [
+        {
+          "label": "Include - assign to devices matching the filter",
+          "value": "include"
+        },
+        {
+          "label": "Exclude - assign to devices NOT matching the filter",
+          "value": "exclude"
+        }
+      ],
+      "default": "include"
+    },
+    "verifyAssignments": {
+      "type": "switch",
+      "label": "Verify policy assignments",
+      "default": false
+    },
+    "levenshteinDistance": {
+      "type": "number",
+      "label": "Fuzzy match distance (0 = exact name match only; values above 5 can match unrelated policies)",
+      "default": 0
+    }
+  }
+}

Config/openapi.json

@@ -667,9 +667,9 @@
         "tags": [
           "Tenant > Standards"
         ],
-        "description": "Creates or updates a baseline. There is no baseline blob: the Baselines\ndelta rows (design doc §4.1) are the editable source of truth for every standard's\nconfiguration, and the BaselineRollouts row (§12.2) holds the baseline-level data -\nname, description, exclusions, alert destinations, and the ordered stage definitions.\nBaselines are reconstructed from those rows on read.",
+        "description": "Creates or updates a baseline. There is no baseline blob: the Baselines\ndelta rows (design doc §4.1) are the editable source of truth for every standard's\nconfiguration, and the BaselineRollouts row (§12.2) holds the baseline-level data -\nname, description, exclusions, alert destinations, and the ordered stage definitions.\nBaselines are reconstructed from those rows on read. The actual write lives in\nNew-CIPPBaseline, shared with the community-repo import.",
         "requestBody": {
-          "required": true,
+          "required": false,
           "content": {
             "application/json": {
               "schema": {
@@ -722,9 +722,9 @@
                     "type": "string"
                   }
                 },
-                "required": [
-                  "templateName"
-                ]
+                "additionalProperties": true,
+                "x-cipp-passthrough": true,
+                "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted."
               }
             }
           }
@@ -764,7 +764,10 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.ReadWrite"
+        "x-cipp-role": "Tenant.Standards.ReadWrite",
+        "x-cipp-reads-via": [
+          "New-CIPPBaseline"
+        ]
       }
     },
     "/api/AddBPATemplate": {
@@ -15079,7 +15082,8 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.AppSettings.ReadWrite"
+        "x-cipp-role": "CIPP.AppSettings.ReadWrite",
+        "x-cipp-any-tenant": true
       }
     },
     "/api/ExecBreachSearch": {
@@ -16301,6 +16305,7 @@
                       "SetBranch",
                       "SetTemplateTypes",
                       "Update",
+                      "UploadBaseline",
                       "UploadScript",
                       "UploadTemplate"
                     ]
@@ -16315,7 +16320,8 @@
                     "type": "string"
                   },
                   "GUID": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "A baseline is not a templates-table row: Export-CIPPBaselineTemplate assembles the portable set - the BaselineTemplate file plus one standard template file per referenced CA/Intune template (packages expanded to their current members). Related templates are separate files, exactly the shape UploadTemplate writes, so they import through the untouched path."
                   },
                   "Id": {
                     "type": "string"
@@ -18595,6 +18601,9 @@
               }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
@@ -30165,6 +30174,53 @@
         "x-cipp-role": "CIPP.SuperAdmin.ReadWrite"
       }
     },
+    "/api/ExecSamSecretStatus": {
+      "post": {
+        "summary": "Reports whether the stored SAM application secret is usable yet.",
+        "operationId": "ExecSamSecretStatus",
+        "tags": [
+          "CIPP > Setup"
+        ],
+        "description": "The setup wizard creates a client secret on one step and uses it on the next, but Entra\ncan take several minutes to replicate a newly created secret. Until it has, every token\nrequest fails with AADSTS7000215 even though the value CIPP holds is correct. This lets\nthe wizard wait on that instead of failing the user after they have already signed in.",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.AppSettings.ReadWrite",
+        "x-cipp-any-tenant": true
+      }
+    },
     "/api/ExecScheduleForwardingVacation": {
       "post": {
         "summary": "ExecScheduleForwardingVacation",
@@ -38369,7 +38425,7 @@
         "tags": [
           "CIPP > Settings"
         ],
-        "description": "Returns the report branding: colours, logo and cover images, footer and watermark text.\n\nThis used to ride along inside ListUserSettings, which meant every page load carried every\nuploaded cover as an inline data URL — megabytes of images fetched to render a settings\nmenu. Worse, hydrating branding also ran the legacy-image migration, so a GET issued on\nevery page load wrote the BrandingSettings row back from a snapshot it had read moments\nearlier, and any upload that landed in between was overwritten.\n\nBranding therefore has its own endpoint, fetched by the things that actually draw it, and\nthis read never writes. Migration belongs to ExecBrandingSettings -Action Get: the settings\npage opening is a deliberate, infrequent, single-user action, which is the one place where\nrewriting the row is safe.\n\nIts role matches ListUserSettings rather than the branding write role — every user who\nrenders a report needs the branding on it, and that is exactly who could read it before.",
+        "description": "Returns the report branding: colours, logo and cover images, footer and watermark text.\n\nBranding was previously returned by ListUserSettings, which put every uploaded cover\ninline on every page load and ran the legacy-image migration - a write - on that read\npath. This read never writes; migration belongs to ExecBrandingSettings -Action Get.\n\nThe role matches ListUserSettings rather than the branding write role, since every user\nwho renders a report needs the branding on it.",
         "parameters": [
           {
             "name": "includeGallery",
@@ -44396,7 +44452,7 @@
         "tags": [
           "Tools > GitHub"
         ],
-        "description": "Returns release metadata for the provided repository and semantic version. Hotfix\nversions (e.g. v8.5.2) map back to the base release tag (v8.5.0).",
+        "description": "Returns release metadata for the provided repository. Results are cached and refreshed\nwhen the cache has no entry for the running version - hotfix releases (e.g. v8.5.2)\npublish their own notes, so a v8.5.0 entry no longer counts as current.",
         "responses": {
           "200": {
             "description": "Success",