Skip to content

Commit 384e9d0

Browse files
jonathanweinbergjonathanweinberg
committed
fix: preserve startup ACL export mode (#423)
1 parent 8c78aca commit 384e9d0

5 files changed

Lines changed: 67 additions & 2 deletions

File tree

‎Start-ShareSurfer.ps1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ param(
1818
[ValidateSet('MailTo', 'Mail', 'UserPrincipalName', 'SamAccountName', 'DistinguishedName')]
1919
[string] $ManagerIdentityFormat = 'MailTo',
2020

21+
[ValidateSet('FullEffective', 'Compact')]
22+
[string] $AclExportMode = 'Compact',
23+
2124
[ValidateSet('Auto', 'Enhanced', 'Plain')]
2225
[string] $ConsoleMode = 'Auto',
2326

@@ -156,6 +159,7 @@ if ([string]::IsNullOrWhiteSpace($ConfigPath) -and [string]::IsNullOrWhiteSpace(
156159
ObsAttribute = $ObsAttribute
157160
AdLookupMode = $AdLookupMode
158161
ManagerIdentityFormat = $ManagerIdentityFormat
162+
AclExportMode = $AclExportMode
159163
ConsoleMode = $ConsoleMode
160164
}
161165
return
@@ -169,6 +173,7 @@ $startupParams = @{
169173
ObsAttribute = $ObsAttribute
170174
AdLookupMode = $AdLookupMode
171175
ManagerIdentityFormat = $ManagerIdentityFormat
176+
AclExportMode = $AclExportMode
172177
ConsoleMode = $ConsoleMode
173178
}
174179

‎src/ShareSurfer/Public/Start-ShareSurfer.ps1‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,9 @@ function Get-ShareSurferMenuEntries {
123123
[ValidateSet('MailTo', 'Mail', 'UserPrincipalName', 'SamAccountName', 'DistinguishedName')]
124124
[string] $ManagerIdentityFormat = 'MailTo',
125125

126+
[ValidateSet('FullEffective', 'Compact')]
127+
[string] $AclExportMode = 'Compact',
128+
126129
[ValidateSet('Auto', 'Enhanced', 'Plain')]
127130
[string] $ConsoleMode = 'Auto'
128131
)
@@ -212,6 +215,7 @@ function Get-ShareSurferMenuEntries {
212215
[pscustomobject]@{ Name = 'ObsAttribute'; Value = (Format-ShareSurferMenuLiteral -Value $ObsAttribute) },
213216
[pscustomobject]@{ Name = 'AdLookupMode'; Value = (Format-ShareSurferMenuLiteral -Value $AdLookupMode) },
214217
[pscustomobject]@{ Name = 'ManagerIdentityFormat'; Value = (Format-ShareSurferMenuLiteral -Value $ManagerIdentityFormat) },
218+
[pscustomobject]@{ Name = 'AclExportMode'; Value = (Format-ShareSurferMenuLiteral -Value $AclExportMode) },
215219
[pscustomobject]@{ Name = 'ConsoleMode'; Value = (Format-ShareSurferMenuLiteral -Value $ConsoleMode) }
216220
)) {
217221
if (-not [string]::IsNullOrWhiteSpace([string]$parameter.Value)) {
@@ -334,12 +338,15 @@ function Start-ShareSurfer {
334338
[ValidateSet('MailTo', 'Mail', 'UserPrincipalName', 'SamAccountName', 'DistinguishedName')]
335339
[string] $ManagerIdentityFormat = 'MailTo',
336340

341+
[ValidateSet('FullEffective', 'Compact')]
342+
[string] $AclExportMode = 'Compact',
343+
337344
[ValidateSet('Auto', 'Enhanced', 'Plain')]
338345
[string] $ConsoleMode = 'Auto'
339346
)
340347

341348
while ($true) {
342-
$entries = Get-ShareSurferMenuEntries -InputRoot $InputRoot -ExportPath $ExportPath -StandaloneDashboardPath $StandaloneDashboardPath -ReleaseRoot $ReleaseRoot -ObsAttribute $ObsAttribute -AdLookupMode $AdLookupMode -ManagerIdentityFormat $ManagerIdentityFormat -ConsoleMode $ConsoleMode
349+
$entries = Get-ShareSurferMenuEntries -InputRoot $InputRoot -ExportPath $ExportPath -StandaloneDashboardPath $StandaloneDashboardPath -ReleaseRoot $ReleaseRoot -ObsAttribute $ObsAttribute -AdLookupMode $AdLookupMode -ManagerIdentityFormat $ManagerIdentityFormat -AclExportMode $AclExportMode -ConsoleMode $ConsoleMode
343350
Write-ShareSurferConsoleLines -Lines (Get-ShareSurferMenuScreen -Entries $entries -InputRoot $InputRoot -ExportPath $ExportPath)
344351

345352
$options = @($entries | ForEach-Object { New-ShareSurferConsoleChoiceOption -Value ([string]$_.Key) -Label ([string]$_.Label) })
@@ -398,6 +405,7 @@ function Start-ShareSurfer {
398405
if (-not [string]::IsNullOrWhiteSpace($ObsAttribute)) { $startupParameters.ObsAttribute = $ObsAttribute }
399406
if (-not [string]::IsNullOrWhiteSpace($AdLookupMode)) { $startupParameters.AdLookupMode = $AdLookupMode }
400407
if (-not [string]::IsNullOrWhiteSpace($ManagerIdentityFormat)) { $startupParameters.ManagerIdentityFormat = $ManagerIdentityFormat }
408+
if (-not [string]::IsNullOrWhiteSpace($AclExportMode)) { $startupParameters.AclExportMode = $AclExportMode }
401409
if (-not [string]::IsNullOrWhiteSpace($ConsoleMode)) { $startupParameters.ConsoleMode = $ConsoleMode }
402410
Start-ShareSurferStartup @startupParameters | Out-Host
403411
}

‎src/ShareSurfer/Public/Start-ShareSurferOperatorAssistant.ps1‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ function Start-ShareSurferOperatorAssistant {
1919
[ValidateSet('MailTo', 'Mail', 'UserPrincipalName', 'SamAccountName', 'DistinguishedName')]
2020
[string] $ManagerIdentityFormat = 'MailTo',
2121

22+
[ValidateSet('FullEffective', 'Compact')]
23+
[string] $AclExportMode = 'Compact',
24+
2225
[string] $OwnerMappingPath = '',
2326

2427
[string] $OwnershipEnrichmentPath = '',
@@ -76,6 +79,10 @@ function Start-ShareSurferOperatorAssistant {
7679
$ObsAttribute = Read-ShareSurferAssistantText -Prompt 'OBS attribute' -Value $ObsAttribute
7780
$AdLookupMode = Read-ShareSurferAssistantText -Prompt 'AD lookup mode' -Value $AdLookupMode
7881
$ManagerIdentityFormat = Read-ShareSurferAssistantText -Prompt 'Manager identity format' -Value $ManagerIdentityFormat
82+
$AclExportMode = Read-ShareSurferStartupChoice -Prompt 'ACL export mode' -Value $AclExportMode -Options @(
83+
New-ShareSurferConsoleChoiceOption -Value 'Compact' -Label 'Compact' -Description 'Recommended for large reviews; suppresses repeated inherited rows in exported ACL evidence.'
84+
New-ShareSurferConsoleChoiceOption -Value 'FullEffective' -Label 'FullEffective' -Description 'Writes every effective ACL row at every path.'
85+
)
7986
Write-ShareSurferOptionalInputDiscoverySummary -InputRoot $InputRoot
8087
$OwnerMappingPath = Read-ShareSurferOptionalInputPath -Prompt 'Owner mapping CSV path' -InputRoot $InputRoot -FileName 'owner-mapping.csv' -Value $OwnerMappingPath
8188
$OwnershipEnrichmentPath = Read-ShareSurferOptionalInputPath -Prompt 'Ownership enrichment CSV path' -InputRoot $InputRoot -FileName 'ownership-enrichment.csv' -Value $OwnershipEnrichmentPath
@@ -157,6 +164,7 @@ function Start-ShareSurferOperatorAssistant {
157164
-ObsAttribute $ObsAttribute `
158165
-AdLookupMode $AdLookupMode `
159166
-ManagerIdentityFormat $ManagerIdentityFormat `
167+
-AclExportMode $AclExportMode `
160168
-OwnerMappingPath $OwnerMappingPath `
161169
-OwnershipEnrichmentPath $OwnershipEnrichmentPath `
162170
-OwnershipContextPath $OwnershipContextPath `
@@ -183,6 +191,7 @@ function Start-ShareSurferOperatorAssistant {
183191
obsAttribute = $ObsAttribute
184192
adLookupMode = $AdLookupMode
185193
managerIdentityFormat = $ManagerIdentityFormat
194+
aclExportMode = $AclExportMode
186195
includeFiles = [bool]$IncludeFiles
187196
includeSharePermissionDiagnostics = [bool]$IncludeSharePermissionDiagnostics
188197
skipIdentityEnrichment = [bool]$SkipIdentityEnrichment
@@ -242,6 +251,7 @@ function Start-ShareSurferOperatorAssistant {
242251
ObsAttribute = $ObsAttribute
243252
AdLookupMode = $AdLookupMode
244253
ManagerIdentityFormat = $ManagerIdentityFormat
254+
AclExportMode = $AclExportMode
245255
OwnerMappingPath = $OwnerMappingPath
246256
OwnershipEnrichmentPath = $OwnershipEnrichmentPath
247257
OwnershipContextPath = $OwnershipContextPath
@@ -482,6 +492,9 @@ function New-ShareSurferOperatorAssistantCommandSet {
482492
[Parameter(Mandatory = $true)]
483493
[string] $ManagerIdentityFormat,
484494

495+
[ValidateSet('FullEffective', 'Compact')]
496+
[string] $AclExportMode = 'Compact',
497+
485498
[string] $OwnerMappingPath = '',
486499

487500
[string] $OwnershipEnrichmentPath = '',
@@ -523,6 +536,7 @@ function New-ShareSurferOperatorAssistantCommandSet {
523536
$lines.Add(('$obsAttribute = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $ObsAttribute)))
524537
$lines.Add(('$adLookupMode = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $AdLookupMode)))
525538
$lines.Add(('$managerIdentityFormat = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $ManagerIdentityFormat)))
539+
$lines.Add(('$aclExportMode = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $AclExportMode)))
526540
$lines.Add(('$ownerMappingPath = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $OwnerMappingPath)))
527541
$lines.Add(('$ownershipEnrichmentPath = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $OwnershipEnrichmentPath)))
528542
$lines.Add(('$ownershipContextPath = {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $OwnershipContextPath)))
@@ -550,6 +564,7 @@ function New-ShareSurferOperatorAssistantCommandSet {
550564
$lines.Add(' ObsAttribute = $obsAttribute')
551565
$lines.Add(' AdLookupMode = $adLookupMode')
552566
$lines.Add(' ManagerIdentityFormat = $managerIdentityFormat')
567+
$lines.Add(' AclExportMode = $aclExportMode')
553568
$lines.Add('}')
554569
if ($IncludeFiles) {
555570
$lines.Add('$scanParams.IncludeFiles = $true')
@@ -607,6 +622,7 @@ function New-ShareSurferOperatorAssistantCommandSet {
607622
$scanPreviewParts.Add(('-ObsAttribute {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $ObsAttribute)))
608623
$scanPreviewParts.Add(('-AdLookupMode {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $AdLookupMode)))
609624
$scanPreviewParts.Add(('-ManagerIdentityFormat {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $ManagerIdentityFormat)))
625+
$scanPreviewParts.Add(('-AclExportMode {0}' -f (ConvertTo-ShareSurferPowerShellLiteral -Value $AclExportMode)))
610626
if ($IncludeFiles) {
611627
$scanPreviewParts.Add('-IncludeFiles')
612628
}

‎src/ShareSurfer/Public/Start-ShareSurferStartup.ps1‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ function Start-ShareSurferStartup {
2626
[ValidateSet('MailTo', 'Mail', 'UserPrincipalName', 'SamAccountName', 'DistinguishedName')]
2727
[string] $ManagerIdentityFormat = 'MailTo',
2828

29+
[ValidateSet('FullEffective', 'Compact')]
30+
[string] $AclExportMode = 'Compact',
31+
2932
[ValidateSet('Auto', 'Enhanced', 'Plain')]
3033
[string] $ConsoleMode = 'Auto',
3134

@@ -85,6 +88,7 @@ function Start-ShareSurferStartup {
8588
if ($null -ne $definition.PSObject.Properties['obsAttribute'] -and -not $boundParameters.ContainsKey('ObsAttribute')) { $ObsAttribute = [string]$definition.obsAttribute }
8689
if ($null -ne $definition.PSObject.Properties['adLookupMode'] -and -not $boundParameters.ContainsKey('AdLookupMode')) { $AdLookupMode = [string]$definition.adLookupMode }
8790
if ($null -ne $definition.PSObject.Properties['managerIdentityFormat'] -and -not $boundParameters.ContainsKey('ManagerIdentityFormat')) { $ManagerIdentityFormat = [string]$definition.managerIdentityFormat }
91+
if ($null -ne $definition.PSObject.Properties['aclExportMode'] -and -not $boundParameters.ContainsKey('AclExportMode')) { $AclExportMode = [string]$definition.aclExportMode }
8892
if ($null -ne $definition.PSObject.Properties['consoleMode'] -and -not $boundParameters.ContainsKey('ConsoleMode')) { $ConsoleMode = [string]$definition.consoleMode }
8993
if ($null -ne $definition.PSObject.Properties['includeFiles'] -and -not $boundParameters.ContainsKey('IncludeFiles')) { $IncludeFiles = [bool]$definition.includeFiles }
9094
if ($null -ne $definition.PSObject.Properties['includeSharePermissionDiagnostics'] -and -not $boundParameters.ContainsKey('IncludeSharePermissionDiagnostics')) { $IncludeSharePermissionDiagnostics = [bool]$definition.includeSharePermissionDiagnostics }
@@ -259,6 +263,10 @@ function Start-ShareSurferStartup {
259263
$HandoffPath = Read-ShareSurferAssistantText -Prompt 'Validated export handoff ZIP path' -Value $HandoffPath
260264
}
261265
Write-ShareSurferStartupStepHeader -Step 4 -Total 4 -Title 'Scan options and config save'
266+
$AclExportMode = Read-ShareSurferStartupChoice -Prompt 'ACL export mode' -Value $AclExportMode -Options @(
267+
New-ShareSurferConsoleChoiceOption -Value 'Compact' -Label 'Compact' -Description 'Recommended for large reviews; keeps explicit and boundary ACEs while suppressing repeated inherited export rows.'
268+
New-ShareSurferConsoleChoiceOption -Value 'FullEffective' -Label 'FullEffective' -Description 'Writes every effective ACL row at every path for deep forensic review.'
269+
) -ConsoleMode $ConsoleMode
262270
$IncludeFiles = Read-ShareSurferStartupBoolean -Prompt 'Include file rows as well as folders?' -Value ([bool]$IncludeFiles) -ConsoleMode $ConsoleMode
263271
$IncludeSharePermissionDiagnostics = Read-ShareSurferStartupBoolean -Prompt 'Run intensive share-permission diagnostics before the scan?' -Value ([bool]$IncludeSharePermissionDiagnostics) -ConsoleMode $ConsoleMode
264272
$SkipIdentityEnrichment = Read-ShareSurferStartupBoolean -Prompt 'Skip identity enrichment?' -Value ([bool]$SkipIdentityEnrichment) -ConsoleMode $ConsoleMode
@@ -273,6 +281,7 @@ function Start-ShareSurferStartup {
273281
-ObsAttribute $ObsAttribute `
274282
-AdLookupMode $AdLookupMode `
275283
-ManagerIdentityFormat $ManagerIdentityFormat `
284+
-AclExportMode $AclExportMode `
276285
-OwnerMappingPath $OwnerMappingPath `
277286
-OwnershipEnrichmentPath $OwnershipEnrichmentPath `
278287
-DiscountedPrincipalPath $DiscountedPrincipalPath `
@@ -301,6 +310,7 @@ function Start-ShareSurferStartup {
301310
ObsAttribute = $ObsAttribute
302311
AdLookupMode = $AdLookupMode
303312
ManagerIdentityFormat = $ManagerIdentityFormat
313+
AclExportMode = $AclExportMode
304314
}
305315
}
306316
if ($reviewAction -eq 'EditCore') {
@@ -325,6 +335,10 @@ function Start-ShareSurferStartup {
325335
}
326336
if ($reviewAction -eq 'EditScanOptions') {
327337
Write-ShareSurferStartupStepHeader -Step 4 -Total 4 -Title 'Edit scan options and config save'
338+
$AclExportMode = Read-ShareSurferStartupChoice -Prompt 'ACL export mode' -Value $AclExportMode -Options @(
339+
New-ShareSurferConsoleChoiceOption -Value 'Compact' -Label 'Compact' -Description 'Recommended for large reviews; keeps explicit and boundary ACEs while suppressing repeated inherited export rows.'
340+
New-ShareSurferConsoleChoiceOption -Value 'FullEffective' -Label 'FullEffective' -Description 'Writes every effective ACL row at every path for deep forensic review.'
341+
) -ConsoleMode $ConsoleMode
328342
$IncludeFiles = Read-ShareSurferStartupBoolean -Prompt 'Include file rows as well as folders?' -Value ([bool]$IncludeFiles) -ConsoleMode $ConsoleMode
329343
$IncludeSharePermissionDiagnostics = Read-ShareSurferStartupBoolean -Prompt 'Run intensive share-permission diagnostics before the scan?' -Value ([bool]$IncludeSharePermissionDiagnostics) -ConsoleMode $ConsoleMode
330344
$SkipIdentityEnrichment = Read-ShareSurferStartupBoolean -Prompt 'Skip identity enrichment?' -Value ([bool]$SkipIdentityEnrichment) -ConsoleMode $ConsoleMode
@@ -388,6 +402,7 @@ function Start-ShareSurferStartup {
388402
-ObsAttribute $ObsAttribute `
389403
-AdLookupMode $AdLookupMode `
390404
-ManagerIdentityFormat $ManagerIdentityFormat `
405+
-AclExportMode $AclExportMode `
391406
-OwnerMappingPath $OwnerMappingPath `
392407
-OwnershipEnrichmentPath $OwnershipEnrichmentPath `
393408
-OwnershipContextPath $OwnershipContextPath `
@@ -430,6 +445,7 @@ function Start-ShareSurferStartup {
430445
obsAttribute = $ObsAttribute
431446
adLookupMode = $AdLookupMode
432447
managerIdentityFormat = $ManagerIdentityFormat
448+
aclExportMode = $AclExportMode
433449
consoleMode = $ConsoleMode
434450
includeFiles = [bool]$IncludeFiles
435451
includeSharePermissionDiagnostics = [bool]$IncludeSharePermissionDiagnostics
@@ -498,6 +514,7 @@ function Start-ShareSurferStartup {
498514
ObsAttribute = $ObsAttribute
499515
AdLookupMode = $AdLookupMode
500516
ManagerIdentityFormat = $ManagerIdentityFormat
517+
AclExportMode = $AclExportMode
501518
ConsoleMode = $ConsoleMode
502519
OwnerMappingPath = $OwnerMappingPath
503520
OwnershipEnrichmentPath = $OwnershipEnrichmentPath
@@ -929,6 +946,8 @@ function Get-ShareSurferStartupSelectionsScreen {
929946

930947
[string] $ManagerIdentityFormat = '',
931948

949+
[string] $AclExportMode = '',
950+
932951
[string] $OwnerMappingPath = '',
933952

934953
[string] $OwnershipEnrichmentPath = '',
@@ -961,6 +980,7 @@ function Get-ShareSurferStartupSelectionsScreen {
961980
$lines.Add((' Export folder: {0}' -f $ExportPath))
962981
$lines.Add((' Dashboard folder: {0}' -f $StandaloneDashboardPath))
963982
$lines.Add((' OBS attribute: {0}; AD lookup: {1}; manager format: {2}' -f $ObsAttribute, $AdLookupMode, $ManagerIdentityFormat))
983+
$lines.Add((' ACL export mode: {0}' -f $(if ([string]::IsNullOrWhiteSpace($AclExportMode)) { '(default)' } else { $AclExportMode })))
964984
$lines.Add((' Owner mapping CSV: {0}' -f (& $optionalLabel $OwnerMappingPath)))
965985
$lines.Add((' Ownership enrichment CSV: {0}' -f (& $optionalLabel $OwnershipEnrichmentPath)))
966986
$lines.Add((' Discounted principals CSV: {0}' -f (& $optionalLabel $DiscountedPrincipalPath)))

0 commit comments

Comments
 (0)