tenant group support for scripted alerts

Author: JohnDuprey

Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1

@@ -1,6 +1,6 @@
 using namespace System.Net
 
-Function Invoke-ListAlertsQueue {
+function Invoke-ListAlertsQueue {
     <#
     .FUNCTIONALITY
         Entrypoint
@@ -70,22 +70,87 @@ Function Invoke-ListAlertsQueue {
             $ExcludedTenants = @()
         }
 
+        # Handle tenant group display information for alerts
+        $TenantsForDisplay = @()
+        if ($Task.TenantGroup) {
+            try {
+                $TenantGroupObject = $Task.TenantGroup | ConvertFrom-Json -ErrorAction SilentlyContinue
+                if ($TenantGroupObject) {
+                    # Create a tenant group object for display
+                    $TenantGroupForDisplay = [PSCustomObject]@{
+                        label = $TenantGroupObject.label
+                        value = $TenantGroupObject.value
+                        type  = 'Group'
+                    }
+                    $TenantsForDisplay = @($TenantGroupForDisplay)
+                }
+            } catch {
+                Write-Warning "Failed to parse tenant group information for alert task $($Task.RowKey): $($_.Exception.Message)"
+                # Fall back to regular tenant display
+                $TenantsForDisplay = @($Task.Tenant)
+            }
+        } else {
+            # For regular tenants, create a tenant object for consistent formatting
+            $TenantForDisplay = [PSCustomObject]@{
+                label = $Task.Tenant
+                value = $Task.Tenant
+                type  = 'Tenant'
+            }
+            $TenantsForDisplay = @($TenantForDisplay)
+        }
+
         $TaskEntry = [PSCustomObject]@{
             RowKey          = $Task.RowKey
             PartitionKey    = $Task.PartitionKey
             excludedTenants = @($ExcludedTenants)
-            Tenants         = @($Task.Tenant)
+            Tenants         = $TenantsForDisplay
             Conditions      = $Task.Name
             Actions         = $Task.PostExecution
             LogType         = 'Scripted'
             EventType       = 'Scheduled Task'
             RepeatsEvery    = $Task.Recurrence
             RawAlert        = $Task
         }
+
         if ($AllowedTenants -notcontains 'AllTenants') {
-            $Tenant = $TenantList | Where-Object -Property defaultDomainName -EQ $Task.Tenant
-            if ($AllowedTenants -contains $Tenant.customerId) {
-                $AllTasksArrayList.Add($TaskEntry)
+            # For tenant groups, we need to expand and check access
+            if ($Task.TenantGroup) {
+                try {
+                    $TenantGroupObject = $Task.TenantGroup | ConvertFrom-Json -ErrorAction SilentlyContinue
+                    if ($TenantGroupObject) {
+                        # Create a tenant filter object for expansion
+                        $TenantFilterForExpansion = @([PSCustomObject]@{
+                                type  = 'Group'
+                                value = $TenantGroupObject.value
+                                label = $TenantGroupObject.label
+                            })
+
+                        # Expand the tenant group to individual tenants
+                        $ExpandedTenants = Expand-CIPPTenantGroups -TenantFilter $TenantFilterForExpansion
+
+                        # Check if user has access to any tenant in the group
+                        $HasAccess = $false
+                        foreach ($ExpandedTenant in $ExpandedTenants) {
+                            $TenantInfo = $TenantList | Where-Object -Property defaultDomainName -EQ $ExpandedTenant.value
+                            if ($TenantInfo -and $AllowedTenants -contains $TenantInfo.customerId) {
+                                $HasAccess = $true
+                                break
+                            }
+                        }
+
+                        if ($HasAccess) {
+                            $AllTasksArrayList.Add($TaskEntry)
+                        }
+                    }
+                } catch {
+                    Write-Warning "Failed to expand tenant group for access check: $($_.Exception.Message)"
+                }
+            } else {
+                # Regular tenant access check
+                $Tenant = $TenantList | Where-Object -Property defaultDomainName -EQ $Task.Tenant
+                if ($AllowedTenants -contains $Tenant.customerId) {
+                    $AllTasksArrayList.Add($TaskEntry)
+                }
             }
         } else {
             $AllTasksArrayList.Add($TaskEntry)