fix(app-approval): use linked permission set data

Add `Get-CIPPAppApprovalPermissions` to centralize template permission resolution and prefer the linked `PermissionSetId` as the source of truth, with fallback to template-stored permissions for legacy or missing sets. Update app and delegated permission grant paths to use this helper, and fix template creation by merging duplicate `resourceAppId` entries and deduplicating permission claims so delegated and application scopes are not lost.

Author: Zacgoose

Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1

@@ -31,11 +31,9 @@ function Add-CIPPApplicationPermission {
     } else {
         if (!$RequiredResourceAccess -and $TemplateId) {
             Write-Information "Adding application permissions for template $TemplateId"
-            $TemplateTable = Get-CIPPTable -TableName 'templates'
-            $Filter = "RowKey eq '$TemplateId' and PartitionKey eq 'AppApprovalTemplate'"
-            $Template = (Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter).JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
-            $ApplicationId = $Template.AppId
-            $Permissions = $Template.Permissions
+            $TemplatePermissions = Get-CIPPAppApprovalPermissions -TemplateId $TemplateId
+            $ApplicationId = $TemplatePermissions.ApplicationId
+            $Permissions = $TemplatePermissions.Permissions
             $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
             foreach ($AppId in $Permissions.PSObject.Properties.Name) {
                 $AppPermissions = @($Permissions.$AppId.applicationPermissions)

Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1

@@ -45,11 +45,9 @@ function Add-CIPPDelegatedPermission {
     } else {
         if (!$RequiredResourceAccess -and $TemplateId) {
             Write-Information "Adding delegated permissions for template $TemplateId"
-            $TemplateTable = Get-CIPPTable -TableName 'templates'
-            $Filter = "RowKey eq '$TemplateId' and PartitionKey eq 'AppApprovalTemplate'"
-            $Template = (Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter).JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
-            $ApplicationId = $Template.AppId
-            $Permissions = $Template.Permissions
+            $TemplatePermissions = Get-CIPPAppApprovalPermissions -TemplateId $TemplateId
+            $ApplicationId = $TemplatePermissions.ApplicationId
+            $Permissions = $TemplatePermissions.Permissions
             $NoTranslateRequired = $true
             $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
             foreach ($AppId in $Permissions.PSObject.Properties.Name) {

Modules/CIPPCore/Public/Get-CIPPAppApprovalPermissions.ps1

@@ -0,0 +1,51 @@
+function Get-CIPPAppApprovalPermissions {
+    <#
+    .SYNOPSIS
+        Resolves the effective permissions for an App Approval template.
+    .DESCRIPTION
+        App Approval templates persist a copy of the permission set at the time the template was saved.
+        That copy goes stale the moment the linked permission set is edited, so when a template links to
+        a permission set the set is treated as the source of truth. Templates without a PermissionSetId
+        (older or hand-built ones) fall back to the copy stored on the template.
+    .PARAMETER TemplateId
+        RowKey of the AppApprovalTemplate to resolve.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TemplateId
+    )
+
+    $TemplateTable = Get-CIPPTable -TableName 'templates'
+    $Filter = "RowKey eq '$TemplateId' and PartitionKey eq 'AppApprovalTemplate'"
+    $Template = (Get-CIPPAzDataTableEntity @TemplateTable -Filter $Filter).JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
+
+    if (!$Template) {
+        Write-Information "App approval template $TemplateId not found"
+        return $null
+    }
+
+    $Permissions = $Template.Permissions
+
+    if ($Template.PermissionSetId) {
+        $PermissionsTable = Get-CIPPTable -TableName 'AppPermissions'
+        $SetFilter = "PartitionKey eq 'Templates' and RowKey eq '$($Template.PermissionSetId)'"
+        $PermissionSet = Get-CIPPAzDataTableEntity @PermissionsTable -Filter $SetFilter
+
+        if ($PermissionSet.Permissions) {
+            $SetPermissions = $PermissionSet.Permissions | ConvertFrom-Json -ErrorAction SilentlyContinue
+            if ($SetPermissions) {
+                $Permissions = $SetPermissions
+            } else {
+                Write-Information "Permission set $($Template.PermissionSetId) for template $TemplateId could not be parsed, falling back to the permissions stored on the template"
+            }
+        } else {
+            Write-Information "Permission set $($Template.PermissionSetId) for template $TemplateId not found, falling back to the permissions stored on the template"
+        }
+    }
+
+    return [PSCustomObject]@{
+        ApplicationId = $Template.AppId
+        Permissions   = $Permissions
+    }
+}

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1

@@ -236,6 +236,17 @@ function Invoke-ExecCreateAppTemplate {
         $PermissionSetId = $null
         $PermissionSetName = "$DisplayName (Auto-created)"
 
+        # The service principal fallback above emits a separate entry for delegated access
+        # (oauth2PermissionGrants) and application access (appRoleAssignments), so a resource that has
+        # both appears twice. $CIPPPermissions is keyed by resourceAppId, so without merging here the
+        # second entry overwrites the first and one of the two permission types is silently discarded.
+        $Permissions = @($Permissions | Group-Object -Property resourceAppId | ForEach-Object {
+                [PSCustomObject]@{
+                    resourceAppId  = $_.Name
+                    resourceAccess = @($_.Group.resourceAccess)
+                }
+            })
+
         if ($Permissions -and $Permissions.Count -gt 0) {
             # Build bulk requests to get all service principals efficiently using object IDs from cached list
             $BulkRequests = [System.Collections.Generic.List[object]]::new()
@@ -334,9 +345,11 @@ function Invoke-ExecCreateAppTemplate {
                     }
                 }
 
+                # A resource can carry several oauth2PermissionGrants rows (an AllPrincipals grant plus
+                # per-user grants), which repeats the same scope once merged, so dedupe on the claim value.
                 $CIPPPermissions[$ResourceAppId] = [PSCustomObject]@{
-                    applicationPermissions = @($AppPerms)
-                    delegatedPermissions   = @($DelegatedPerms)
+                    applicationPermissions = @($AppPerms | Sort-Object -Property value -Unique)
+                    delegatedPermissions   = @($DelegatedPerms | Sort-Object -Property value -Unique)
                 }
             }