[pull] master from KelvinTegelaar:master

.github/scripts/validate-json.mjs

@@ -0,0 +1,73 @@
+import { readFile, readdir, writeFile, appendFile } from "node:fs/promises";
+import path from "node:path";
+
+// Usage: node validate-json.mjs [--strip <prefix>] <dir> [dir...]
+// --strip removes a leading path prefix from reported filenames, so a PR checked
+// out into a subdirectory still reports repo-relative paths.
+const argv = process.argv.slice(2);
+let strip = "";
+const roots = [];
+for (let i = 0; i < argv.length; i++) {
+  if (argv[i] === "--strip") {
+    strip = argv[++i] ?? "";
+  } else {
+    roots.push(argv[i]);
+  }
+}
+
+async function collect(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules") continue;
+      files.push(...(await collect(full)));
+    } else if (entry.name.endsWith(".json")) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+const report = (file) => {
+  const normalised = file.split(path.sep).join("/");
+  return strip && normalised.startsWith(strip) ? normalised.slice(strip.length) : normalised;
+};
+
+const failures = [];
+let checked = 0;
+
+for (const root of roots) {
+  for (const file of await collect(root)) {
+    checked++;
+    // Strip a leading UTF-8 BOM: it's tolerated by PowerShell's ConvertFrom-Json
+    // (how the API loads these files) but rejected by Node's JSON.parse.
+    const contents = (await readFile(file, "utf8")).replace(/^\uFEFF/, "");
+    try {
+      JSON.parse(contents);
+    } catch (error) {
+      failures.push({ file: report(file), message: error.message.replace(/\r?\n/g, " ") });
+    }
+  }
+}
+
+for (const { file, message } of failures) {
+  // Annotate the PR diff via a GitHub Actions error command.
+  console.log(`::error file=${file}::${message}`);
+}
+console.log(`Checked ${checked} JSON file(s), ${failures.length} invalid.`);
+
+// Hand the results to the workflow so it can comment on the PR.
+if (process.env.GITHUB_OUTPUT) {
+  await appendFile(process.env.GITHUB_OUTPUT, `invalid_count=${failures.length}\n`);
+}
+await writeFile("json-validation-results.json", JSON.stringify(failures, null, 2));
+
+process.exit(failures.length > 0 ? 1 : 0);

.github/workflows/Validate_JSON.yml

@@ -0,0 +1,121 @@
+---
+name: Validate JSON
+on:
+  # pull_request_target (not pull_request) so the token can comment on fork PRs.
+  # The PR's own code is never executed: it is checked out into ./pr as data only,
+  # and parsed by the validator script from the trusted base checkout.
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+      - dev
+    paths:
+      - "Config/**/*.json"
+      - "Tools/**/*.json"
+      - "AddMSPApp/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+  push:
+    branches:
+      - dev
+    paths:
+      - "Config/**/*.json"
+      - "Tools/**/*.json"
+      - "AddMSPApp/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  validate:
+    name: Parse JSON in Config, Tools and AddMSPApp
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base (trusted validator script)
+        uses: actions/checkout@v6
+
+      - name: Checkout PR head (untrusted, data only)
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: pr
+          persist-credentials: false
+
+      - name: Validate JSON files
+        id: validate
+        continue-on-error: true
+        env:
+          ROOT: ${{ github.event_name == 'pull_request_target' && 'pr/' || '' }}
+        run: >-
+          node .github/scripts/validate-json.mjs --strip "$ROOT"
+          "${ROOT}Config" "${ROOT}Tools" "${ROOT}AddMSPApp"
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request_target'
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- validate-json -->';
+            const resultsFile = 'json-validation-results.json';
+            if (!fs.existsSync(resultsFile)) {
+              // The validator crashed before reporting; let its own error stand.
+              core.warning('No validation results found — skipping PR comment.');
+              return;
+            }
+            const failures = JSON.parse(fs.readFileSync(resultsFile, 'utf8'));
+
+            // Find a previous comment from this workflow so we update instead of piling up.
+            const { data: comments } = await github.rest.issues.listComments({
+              ...context.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (c) => c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            let body;
+            if (failures.length > 0) {
+              const list = failures
+                .map(({ file, message }) => `- \`${file}\`\n  > ${message}`)
+                .join('\n');
+              body =
+                `${marker}\n### ⚠️ Invalid JSON detected\n\n` +
+                `${failures.length} JSON file(s) in this PR could not be parsed. ` +
+                `These files are loaded directly by CIPP, so a syntax error here breaks the app at runtime.\n\n` +
+                `${list}\n\n` +
+                `Please fix the syntax and push again — this comment will update automatically.`;
+            } else if (existing) {
+              body = `${marker}\n### ✅ JSON is valid\n\nAll JSON files in \`Config\`, \`Tools\` and \`AddMSPApp\` parse correctly. Thanks for fixing it!`;
+            } else {
+              // Nothing was ever broken — stay quiet.
+              return;
+            }
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                ...context.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if any JSON is invalid
+        if: steps.validate.outputs.invalid_count != '0'
+        run: |
+          echo "::error::${{ steps.validate.outputs.invalid_count }} invalid JSON file(s). See annotations above."
+          exit 1

AddMSPApp/datto.app.xml

@@ -1,15 +1,15 @@
-<ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
-  <Name>install.ps1</Name>
-  <UnencryptedContentSize>693</UnencryptedContentSize>
-  <FileName>datto.intunewin</FileName>
-  <SetupFile>install.ps1</SetupFile>
-  <EncryptionInfo>
-    <EncryptionKey>jobB9Ga7J3CbO6acWJyvBRE56nFXwqGfcnGfZRMsJC4=</EncryptionKey>
-    <MacKey>53SOzs0l6Po2btsGFSMZgkV8vwhH+PxTN8BZDUcfWfg=</MacKey>
-    <InitializationVector>VjM/osrvPElbu79J+mdXuw==</InitializationVector>
-    <Mac>UZZXO53Np/tG6Ms+qvwLcNOeD1GRH6NRPFg/TuMz39M=</Mac>
-    <ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
-    <FileDigest>KtAWAl29064LG0eyDinbDs0JUbK+EK7GsJovu8obBM4=</FileDigest>
-    <FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
-  </EncryptionInfo>
+<ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
+  <Name>install.ps1</Name>
+  <UnencryptedContentSize>693</UnencryptedContentSize>
+  <FileName>datto.intunewin</FileName>
+  <SetupFile>install.ps1</SetupFile>
+  <EncryptionInfo>
+    <EncryptionKey>jobB9Ga7J3CbO6acWJyvBRE56nFXwqGfcnGfZRMsJC4=</EncryptionKey>
+    <MacKey>53SOzs0l6Po2btsGFSMZgkV8vwhH+PxTN8BZDUcfWfg=</MacKey>
+    <InitializationVector>VjM/osrvPElbu79J+mdXuw==</InitializationVector>
+    <Mac>UZZXO53Np/tG6Ms+qvwLcNOeD1GRH6NRPFg/TuMz39M=</Mac>
+    <ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
+    <FileDigest>KtAWAl29064LG0eyDinbDs0JUbK+EK7GsJovu8obBM4=</FileDigest>
+    <FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
+  </EncryptionInfo>
 </ApplicationInfo>

Config/CIPPDBCacheTypes.json

@@ -294,11 +294,21 @@
     "friendlyName": "SharePoint Site Usage",
     "description": "SharePoint site usage statistics"
   },
+  {
+    "type": "SiteActivity",
+    "friendlyName": "Site Activity",
+    "description": "Per-site activity with siteType classification (SharePoint, SharePointAndTeams, OneDrive) and separate workload activity columns"
+  },
   {
     "type": "SharePointSharingLinks",
     "friendlyName": "SharePoint & OneDrive Sharing Links",
     "description": "Sharing links and external grants on SharePoint and OneDrive files and folders"
   },
+  {
+    "type": "SharePointPermissions",
+    "friendlyName": "SharePoint Permissions",
+    "description": "Site and document library permission assignments, including libraries that no longer inherit and grants to tenant-wide claims such as Everyone except external users"
+  },
   {
     "type": "OfficeActivations",
     "friendlyName": "Office Activations",