[pull] main from KelvinTegelaar:main

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cipp",
-  "version": "10.5.4",
+  "version": "10.5.5",
   "author": "CIPP Contributors",
   "homepage": "https://cipp.app/",
   "bugs": {
@@ -116,4 +116,4 @@
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.8.1"
   }
-}
+}

public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "10.5.4"
-}
+  "version": "10.5.5"
+}

src/components/CippComponents/AuthMethodCard.jsx

@@ -16,8 +16,23 @@ export const AuthMethodCard = ({ data, isLoading }) => {
       return null;
     }
 
-    const phishableMethods = ["mobilePhone", "email", "microsoftAuthenticatorPush"];
-    const phishResistantMethods = ["fido2", "windowsHelloForBusiness", "x509Certificate"];
+    const phishableMethods = [
+      "mobilePhone",
+      "alternateMobilePhone",
+      "officePhone",
+      "email",
+      "microsoftAuthenticatorPush",
+      "softwareOneTimePasscode",
+      "hardwareOneTimePasscode",
+    ];
+    const passkeyMethods = [
+      "fido2SecurityKey",
+      "passKeyDeviceBound",
+      "passKeyDeviceBoundAuthenticator",
+      "passKeyDeviceBoundWindowsHello",
+      "x509Certificate",
+    ];
+    const phishResistantMethods = [...passkeyMethods, "windowsHelloForBusiness"];
 
     let singleFactor = 0;
     let phishableCount = 0;
@@ -48,20 +63,26 @@ export const AuthMethodCard = ({ data, isLoading }) => {
 
       if (hasPhishResistant) {
         phishResistantCount++;
-        if (methods.includes("fido2") || methods.includes("x509Certificate")) {
+        if (methods.some((m) => passkeyMethods.includes(m))) {
           passkeyCount++;
         }
         if (methods.includes("windowsHelloForBusiness")) {
           whfbCount++;
         }
       } else if (hasPhishable) {
         phishableCount++;
-        if (methods.includes("mobilePhone") || methods.includes("email")) {
+        if (
+          methods.includes("mobilePhone") ||
+          methods.includes("alternateMobilePhone") ||
+          methods.includes("officePhone") ||
+          methods.includes("email")
+        ) {
           phoneCount++;
         }
         if (
           methods.includes("microsoftAuthenticatorPush") ||
-          methods.includes("softwareOneTimePasscode")
+          methods.includes("softwareOneTimePasscode") ||
+          methods.includes("hardwareOneTimePasscode")
         ) {
           authenticatorCount++;
         }

src/components/CippComponents/AuthMethodSankey.jsx

@@ -13,9 +13,23 @@ export const AuthMethodSankey = ({ data }) => {
     return null;
   }
 
-  // Categorize MFA methods as phishable or phish-resistant
-  const phishableMethods = ["mobilePhone", "email", "microsoftAuthenticatorPush"];
-  const phishResistantMethods = ["fido2", "windowsHelloForBusiness", "x509Certificate"];
+  const phishableMethods = [
+    "mobilePhone",
+    "alternateMobilePhone",
+    "officePhone",
+    "email",
+    "microsoftAuthenticatorPush",
+    "softwareOneTimePasscode",
+    "hardwareOneTimePasscode",
+  ];
+  const passkeyMethods = [
+    "fido2SecurityKey",
+    "passKeyDeviceBound",
+    "passKeyDeviceBoundAuthenticator",
+    "passKeyDeviceBoundWindowsHello",
+    "x509Certificate",
+  ];
+  const phishResistantMethods = [...passkeyMethods, "windowsHelloForBusiness"];
 
   let singleFactor = 0;
   let phishableCount = 0;
@@ -54,21 +68,26 @@ export const AuthMethodSankey = ({ data }) => {
     if (hasPhishResistant) {
       phishResistantCount++;
       // Count specific phish-resistant methods
-      if (methods.includes("fido2") || methods.includes("x509Certificate")) {
+      if (methods.some((m) => passkeyMethods.includes(m))) {
         passkeyCount++;
       }
       if (methods.includes("windowsHelloForBusiness")) {
         whfbCount++;
       }
     } else if (hasPhishable) {
       phishableCount++;
-      // Count specific phishable methods
-      if (methods.includes("mobilePhone") || methods.includes("email")) {
+      if (
+        methods.includes("mobilePhone") ||
+        methods.includes("alternateMobilePhone") ||
+        methods.includes("officePhone") ||
+        methods.includes("email")
+      ) {
         phoneCount++;
       }
       if (
         methods.includes("microsoftAuthenticatorPush") ||
-        methods.includes("softwareOneTimePasscode")
+        methods.includes("softwareOneTimePasscode") ||
+        methods.includes("hardwareOneTimePasscode")
       ) {
         authenticatorCount++;
       }

src/components/CippComponents/CippAppPermissionBuilder.jsx

@@ -462,10 +462,11 @@ const CippAppPermissionBuilder = ({
         if (appTable !== undefined && appTable?.length === 0) {
           setAppTable(
             spPermissions?.applicationPermissions
-              ?.sort((a, b) => a.value.localeCompare(b.value))
+              ?.sort((a, b) => (a.value ?? "").localeCompare(b.value ?? ""))
               ?.map((perm) => ({
                 id: perm.id,
                 value: perm.value,
+                required: perm.required ?? false,
                 description: spInfo?.Results?.appRoles.find((role) => role.id === perm.id)
                   ?.description,
               })),
@@ -474,10 +475,11 @@ const CippAppPermissionBuilder = ({
         if (delegatedTable !== undefined && delegatedTable.length === 0) {
           setDelegatedTable(
             spPermissions?.delegatedPermissions
-              ?.sort((a, b) => a.value.localeCompare(b.value))
+              ?.sort((a, b) => (a.value ?? "").localeCompare(b.value ?? ""))
               ?.map((perm) => ({
                 id: perm.id,
                 value: perm.value,
+                required: perm.required ?? false,
                 description:
                   spInfo?.Results?.publishedPermissionScopes.find((scope) => scope.id === perm.id)
                     ?.userConsentDescription ?? "Manually added",
@@ -625,6 +627,7 @@ const CippAppPermissionBuilder = ({
                         label: "Delete Permission",
                         icon: <Delete />,
                         noConfirm: true,
+                        condition: (row) => !row.required,
                         customFunction: (row) => handleRemoveRow("applicationPermissions", row),
                       },
                     ]}
@@ -690,6 +693,7 @@ const CippAppPermissionBuilder = ({
                     label: "Delete Permission",
                     icon: <Delete />,
                     noConfirm: true,
+                    condition: (row) => !row.required,
                     customFunction: (row) => handleRemoveRow("delegatedPermissions", row),
                   },
                 ]}
@@ -788,7 +792,7 @@ const CippAppPermissionBuilder = ({
                       </div>
                     </Tooltip>
 
-                    <Tooltip title="Reset to Default">
+                    <Tooltip title="Reset to Current Defaults (discard unsaved changes)">
                       <Button
                         onClick={() => {
                           confirmReset();
@@ -929,79 +933,74 @@ const CippAppPermissionBuilder = ({
                 </Grid>
               )}
 
-              {newPermissions?.MissingPermissions &&
-                newPermissions?.Type === "Table" &&
-                Object.keys(newPermissions?.MissingPermissions).length > 0 && (
-                  <Grid container sx={{ width: "100%", mt: 3 }}>
-                    <Grid size={{ xl: 8, xs: 12 }}>
-                      <Alert
-                        color="warning"
-                        icon={<WarningAmberOutlined />}
-                        action={
-                          <Tooltip title="Add Missing Permissions">
-                            <IconButton
-                              onClick={() => {
-                                var updatedPermissions = JSON.parse(JSON.stringify(newPermissions));
-                                Object.keys(newPermissions?.MissingPermissions).map((perm) => {
-                                  Object.keys(newPermissions?.MissingPermissions[perm]).map(
-                                    (type) => {
-                                      if (!updatedPermissions.Permissions[perm][type]) {
-                                        updatedPermissions.Permissions[perm][type] = [];
-                                      }
-                                      newPermissions?.MissingPermissions[perm][type].map((p) => {
-                                        updatedPermissions.Permissions[perm][type].push(p);
-                                      });
-                                    },
-                                  );
-                                });
-                                updatedPermissions.MissingPermissions = {};
-                                setNewPermissions(updatedPermissions);
-                              }}
-                            >
-                              <SvgIcon fontSize="small">
-                                <WrenchIcon />
-                              </SvgIcon>
-                            </IconButton>
-                          </Tooltip>
-                        }
-                      >
-                        <b>New Permissions Available</b>
-                        {Object.keys(newPermissions?.MissingPermissions).map((perm) => {
-                          // translate appid to display name
-                          var sp = servicePrincipals?.Results?.find((sp) => sp.appId === perm);
-                          return (
-                            <Typography
-                              variant="body2"
-                              textColor="secondary"
-                              key={`missing-${perm}`}
-                            >
-                              {sp?.displayName}:{" "}
-                              {Object.keys(newPermissions?.MissingPermissions[perm]).map((type) => {
-                                return (
-                                  <>
-                                    {newPermissions?.MissingPermissions[perm][type].length > 0 && (
-                                      <React.Fragment key={`missing-${perm}-${type}`}>
-                                        {type == "applicationPermissions"
-                                          ? "Application"
-                                          : "Delegated"}{" "}
-                                        -{" "}
-                                        {newPermissions?.MissingPermissions[perm][type]
-                                          .map((p) => {
-                                            return p.value;
-                                          })
-                                          .join(", ")}
-                                      </React.Fragment>
-                                    )}
-                                  </>
-                                );
-                              })}
-                            </Typography>
-                          );
-                        })}
-                      </Alert>
+              {newPermissions?.PartnerAppDiff &&
+                Object.keys(newPermissions?.PartnerAppDiff).length > 0 &&
+                (() => {
+                  const diff = newPermissions.PartnerAppDiff;
+                  const appIds = Object.keys(diff);
+                  const hasMissing = appIds.some(
+                    (perm) =>
+                      (diff[perm].missingApplicationPermissions?.length ?? 0) > 0 ||
+                      (diff[perm].missingDelegatedPermissions?.length ?? 0) > 0,
+                  );
+                  const hasExtra = appIds.some(
+                    (perm) =>
+                      (diff[perm].extraApplicationPermissions?.length ?? 0) > 0 ||
+                      (diff[perm].extraDelegatedPermissions?.length ?? 0) > 0,
+                  );
+                  const renderList = (perm, appKey, delKey) => {
+                    const sp = servicePrincipals?.Results?.find((sp) => sp.appId === perm);
+                    const app = diff[perm][appKey] ?? [];
+                    const del = diff[perm][delKey] ?? [];
+                    if (app.length === 0 && del.length === 0) return null;
+                    return (
+                      <Typography variant="body2" key={`${appKey}-${perm}`}>
+                        {sp?.displayName ?? perm}:{" "}
+                        {app.length > 0 && <>Application - {app.map((p) => p.value).join(", ")} </>}
+                        {del.length > 0 && <>Delegated - {del.map((p) => p.value).join(", ")}</>}
+                      </Typography>
+                    );
+                  };
+                  return (
+                    <Grid container sx={{ width: "100%", mt: 3 }} spacing={2}>
+                      {hasMissing && (
+                        <Grid size={{ xl: 8, xs: 12 }}>
+                          <Alert color="warning" icon={<WarningAmberOutlined />}>
+                            <b>
+                              Permissions missing from the {appDisplayName} app registration (run
+                              Repair Permissions to add, then a CPV refresh to apply to tenants)
+                            </b>
+                            {appIds.map((perm) =>
+                              renderList(
+                                perm,
+                                "missingApplicationPermissions",
+                                "missingDelegatedPermissions",
+                              ),
+                            )}
+                          </Alert>
+                        </Grid>
+                      )}
+                      {hasExtra && (
+                        <Grid size={{ xl: 8, xs: 12 }}>
+                          <Alert color="info" icon={<WarningAmberOutlined />}>
+                            <b>
+                              Extra permissions present on the {appDisplayName} app registration that
+                              are not part of the CIPP defaults or your additional permissions
+                              (review and remove manually if not required)
+                            </b>
+                            {appIds.map((perm) =>
+                              renderList(
+                                perm,
+                                "extraApplicationPermissions",
+                                "extraDelegatedPermissions",
+                              ),
+                            )}
+                          </Alert>
+                        </Grid>
+                      )}
                     </Grid>
-                  </Grid>
-                )}
+                  );
+                })()}
 
               <Box sx={{ mt: 3 }}>
                 {selectedApp &&

src/components/CippComponents/CippAutocomplete.jsx

@@ -265,7 +265,7 @@ export const CippAutoComplete = React.forwardRef((props, ref) => {
       finalOptions = finalOptions.filter((o) => !removeOptions.includes(o.value))
     }
     if (sortOptions) {
-      finalOptions.sort((a, b) => a.label?.localeCompare(b.label))
+      finalOptions.sort((a, b) => String(a.label ?? "").localeCompare(String(b.label ?? "")))
     }
     return finalOptions
   }, [api, usedOptions, options, removeOptions, sortOptions])