Auto repair invalid Provider JSON, PowerPlatform 3.1 tenant isolation hotfix, Fix AAD crash when no tenant licenses

[tkol2022]

🗣 Description

Based on recent troubleshooting with a large agency and historical crashes this PR address the following core problems:

• Enhances Invoke-Scuba and Invoke-ScubaCached to automatically repair invalid JSON created from the ScubaGear providers. Every so often one of the providers encountered a coding mishap or condition which produces JSON that is syntactically wrong causing ScubaGear to crash. This is a major problem for agencies, particularly when they are gearing up for BOD submissions.
• Prevents the AAD provider from either crashing or producing unexpected results when there are no licenses in the tenant. In version 1.8.0 this condition caused a type inconsistency with the $PrivilegedServicePrincipals hashtable.
• Ensures that PowerPlatform produces a Rego output for policy 3.1 tenant isolation, when the tenant has never had this configuration modified. This was fixed in a prior release but based on recent troubleshooting the Rego code was slightly off when I examined a provider JSON from a real world tenant.

Closes #2247
Closes #2246

💭 Motivation and context

Helps reduce trouble tickets and debugging sessions for agencies and Scuba developers. Helps agencies get a version of ScubaGear that is more resilient to uncommon condition faults.

🧪 Testing

I have prepared a spreadsheet with explicit testing scenarios and instructions, along with some screenshots to help reviewers. See comment. Please feel free to come up with your own test cases based on your understanding of the changes.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• PR/feature branch passes functional tests for relevant products, if applicable.

• Feature branch has been rebased against changes from parent branch, as needed.

  Use Update branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch.

• Squash all commits into one PR level commit using the Squash and merge button.

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Close issues resolved by this PR if the closing keywords did not activate.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[tkol2022]

Testing

Please reference this spreadsheet for the testing scenarios. Note that some of the tests are centered on changed to Invoke-ScubaCached whereas others are centered on Invoke-Scuba.

JSONRepairTestCases.xlsx

Here is what the message looks like when Invoke-Scuba auto repairs JSON output from a provider.

Here is how to simulate invalid provider JSON produced by Invoke-Scuba. Notice that there is variable after the field name.

Here is how to simulate no licenses in the tenant by modifying ExportAADprovider.

Here is what a JSON file looks like with invalid data in it (the field name is there but there is no associated data) (this is what you will be using for the Invoke-ScubaCached tests).

[tkol2022]

FYI, I had to comment out some Pester tests in Invoke-ScubaCached.Tests.ps1 that were failing. All the Invoke-ScubaCached pester tests will need to be rewritten once we merge that cmdlet with Invoke-Scuba via #2217.

[tkol2022]

I added a message about the 2.0.0 release and the need to pass -M365Environment for interactive logins against non-commercial tenants until we enhance that in the next release.

[JosephRWalter]

I went through all the tests in the testcase file, they all performed as expected. Looks good.

[mitchelbaker-cisa]

Went through all test scenarios and received the expected output. For test scenario 16 (putting invalid JSON in the providers), I tested with invalid JSON keys in one, two, and three different providers. They were all repaired for each case.

Left a few small comments for you to review below but looks good otherwise.

[tkol2022]

@mitchelbaker-cisa I made your suggested updates. Kindly approve if sastifactory.

[mitchelbaker-cisa]

Thanks for resolving the comments, Ted!

[tkol2022]

Smoke test was successful.

Functional tests failed for SS, EXO tenant 1 and Teams tenant 7.

EXO tenant 1 failed due to a random error fetching the tenant name from Get-OrganizationConfig so unrelated to my code.

Teams failed due to Get-TeamsTenantDetail: [0] : Request cancelled so unrelated to my code.

Security Suite failures seem to be the same ones on main so unrelated to my code.