fix(sharepoint): cache resolved admin portal url

Improve SharePoint admin link handling across backend and frontend. The API now requires `TenantFilter`, resolves and persists a valid admin URL, logs and returns clearer errors when resolution fails, and includes the URL in redirect responses. Tenant listing and portal UI now prefer the cached `SharepointAdminUrl` field (with fallback to the resolver endpoint), so portal links behave like other direct admin links after first resolution.

Synced from CyberDrain/CIPP@81a896f

Author: github-actions[bot]

Modules/CIPPCore/Public/GraphHelper/Get-SharePointAdminLink.ps1

@@ -56,7 +56,15 @@ function Get-SharePointAdminLink {
             throw "Failed to get SharePoint admin URL through autodiscover: $($_.Exception.Message)"
         }
     } else {
-        $tenantName = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/sites/root' -asApp $true -tenantid $TenantFilter).id.Split('.')[0]
+        # id looks like 'contoso.sharepoint.com,<guid>,<guid>' - the host's first label is the name.
+        $RootSite = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/sites/root' -asApp $true -tenantid $TenantFilter
+        $tenantName = ($RootSite.id -split '\.')[0]
+    }
+
+    # Without a name every URL below is a well-formed link to nowhere ('https://-admin.sharepoint.com').
+    # Callers cache what they get back, so a bad value here sticks around - fail instead.
+    if ([string]::IsNullOrWhiteSpace($tenantName)) {
+        throw "Could not determine the SharePoint tenant name for $TenantFilter. The tenant may not have SharePoint provisioned, or the Sites.Read.All permission may be missing."
     }
 
     # Return object with all needed properties

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointAdminUrl.ps1

@@ -5,48 +5,67 @@ function Invoke-ListSharepointAdminUrl {
     .ROLE
         CIPP.Core.Read
     .DESCRIPTION
-        Retrieves the SharePoint Admin Center URL for a tenant.
+        Retrieves the SharePoint Admin Center URL for a tenant and redirects to it. Pass ReturnUrl to
+        get the URL back as JSON instead of being redirected.
+
+        The URL cannot be derived from the tenant name - it has to be resolved through Graph - so the
+        result is cached on the tenant, which lets ListTenants hand out a direct link from then on.
     #>
     [CmdletBinding()]
     param(
         $Request,
         $TriggerMetadata
     )
 
-    if ($Request.Query.TenantFilter) {
-        $TenantFilter = $Request.Query.TenantFilter
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $TenantFilter = $Request.Query.TenantFilter
+
+    if (!$TenantFilter) {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ Results = 'TenantFilter is required' }
+            })
+    }
 
-        $Tenant = Get-Tenants -TenantFilter $TenantFilter
+    try {
+        $Tenant = Get-Tenants -TenantFilter $TenantFilter | Select-Object -First 1
+        if (!$Tenant) {
+            throw "Tenant '$TenantFilter' was not found."
+        }
 
         if ($Tenant.SharepointAdminUrl) {
             $AdminUrl = $Tenant.SharepointAdminUrl
         } else {
-            $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter
-            $Tenant | Add-Member -MemberType NoteProperty -Name SharepointAdminUrl -Value $SharePointInfo.AdminUrl
+            # Throws rather than returning a placeholder if the name can't be resolved, so we never
+            # cache a URL that points nowhere.
+            $AdminUrl = (Get-SharePointAdminLink -Public $false -TenantFilter $TenantFilter).AdminUrl
+
+            $Tenant | Add-Member -MemberType NoteProperty -Name 'SharepointAdminUrl' -Value $AdminUrl -Force
             $Table = Get-CIPPTable -TableName 'Tenants'
             Add-CIPPAzDataTableEntity @Table -Entity $Tenant -Force
-            $AdminUrl = $SharePointInfo.AdminUrl
         }
+    } catch {
+        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to resolve the SharePoint admin URL: $ErrorMessage" -Sev 'Error'
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::InternalServerError
+                Body       = @{ Results = "Could not resolve the SharePoint admin URL for $TenantFilter. $ErrorMessage" }
+            })
+    }
 
-        if ($Request.Query.ReturnUrl) {
-            return ([HttpResponseContext]@{
-                    StatusCode = [HttpStatusCode]::OK
-                    Body       = @{
-                        AdminUrl = $AdminUrl
-                    }
-                })
-        } else {
-            return ([HttpResponseContext]@{
-                    StatusCode = [HttpStatusCode]::Found
-                    Headers    = @{
-                        Location = $AdminUrl
-                    }
-                })
-        }
-    } else {
+    if ($Request.Query.ReturnUrl) {
         return ([HttpResponseContext]@{
-                StatusCode = [HttpStatusCode]::BadRequest
-                Body       = 'TenantFilter is required'
+                StatusCode = [HttpStatusCode]::OK
+                Body       = @{ AdminUrl = $AdminUrl }
             })
     }
+
+    # The body is not decoration: a browser that follows the redirect never sees it, but it means a
+    # caller whose runtime drops the Location header gets the URL instead of a bare 'null' page.
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::Found
+            Headers    = @{ Location = $AdminUrl }
+            Body       = @{ AdminUrl = $AdminUrl }
+        })
 }

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1

@@ -145,7 +145,14 @@ function Invoke-ListTenants {
                 @{Name = 'portal_intune'; Expression = { "https://intune.microsoft.com/$($_.defaultDomainName)" } },
                 @{Name = 'portal_security'; Expression = { "https://security.microsoft.com/?tid=$($_.customerId)" } },
                 @{Name = 'portal_compliance'; Expression = { "https://purview.microsoft.com/?tid=$($_.customerId)" } },
-                @{Name = 'portal_sharepoint'; Expression = { "/api/ListSharePointAdminUrl?tenantFilter=$($_.defaultDomainName)" } },
+                @{Name = 'portal_sharepoint'; Expression = {
+                        # Unlike the other portals, SharePoint's host name cannot be derived from the
+                        # tenant - it has to be resolved through Graph. Hand out the cached URL when we
+                        # have one so the link behaves like every other portal, and fall back to the
+                        # endpoint that resolves (and caches) it on first use.
+                        if ($_.SharepointAdminUrl) { $_.SharepointAdminUrl } else { "/api/ListSharePointAdminUrl?tenantFilter=$($_.defaultDomainName)" }
+                    }
+                },
                 @{Name = 'portal_platform'; Expression = { "https://admin.powerplatform.microsoft.com/account/login/$($_.customerId)" } },
                 @{Name = 'portal_bi'; Expression = { "https://app.powerbi.com/admin-portal?ctid=$($_.customerId)" } }
             }