Initial
This commit is contained in:
191
server/data/psadtValidationRules.js
Normal file
191
server/data/psadtValidationRules.js
Normal file
@@ -0,0 +1,191 @@
|
||||
export const psadtValidationRules = [
|
||||
{
|
||||
id: 'REQ-PSVERSION-MINIMUM',
|
||||
severity: 'warning',
|
||||
category: 'Requirements',
|
||||
sourceId: 'requirements',
|
||||
title: 'PowerShell version requirement is below PSADT v4 support floor',
|
||||
description: 'PSADT v4 supports Windows PowerShell 5.1 and PowerShell 7.4+. Lower #requires values can hide unsupported runtime assumptions.',
|
||||
remediation: 'Use Windows PowerShell 5.1 or PowerShell 7.4+ for PSADT v4 deployments.'
|
||||
},
|
||||
{
|
||||
id: 'UPG-REQUIREADMIN-CONFIG',
|
||||
severity: 'error',
|
||||
category: 'v4.1 upgrade',
|
||||
sourceId: 'upgrade-v41',
|
||||
title: 'RequireAdmin appears to be configured outside ADTSession',
|
||||
description: 'PSADT v4.1 moved RequireAdmin out of Config.psd1 and into the deployment session properties.',
|
||||
remediation: 'Set RequireAdmin in $adtSession, e.g. RequireAdmin = $true or RequireAdmin = $false.'
|
||||
},
|
||||
{
|
||||
id: 'UPG-REMOVED-CONFIG-DETECTION',
|
||||
severity: 'error',
|
||||
category: 'v4.1 upgrade',
|
||||
sourceId: 'upgrade-v41',
|
||||
title: 'Removed OOBE/session detection config option found',
|
||||
description: 'Toolkit.OobeDetection and Toolkit.SessionDetection were removed from Config.psd1 in v4.1.',
|
||||
remediation: 'Move this decision to deployment/session options such as NoOobeDetection or NoSessionDetection when needed.'
|
||||
},
|
||||
{
|
||||
id: 'UPG-APP-PROCESSES-SESSION',
|
||||
severity: 'warning',
|
||||
category: 'v4.1 upgrade',
|
||||
sourceId: 'upgrade-v41',
|
||||
title: 'Close-processes are not centralized in AppProcessesToClose',
|
||||
description: 'PSADT v4.1 recommends defining AppProcessesToClose in the ADTSession object and reusing it across phases.',
|
||||
remediation: 'Move repeated process definitions into $adtSession.AppProcessesToClose and pass that to Show-ADTInstallationWelcome.'
|
||||
},
|
||||
{
|
||||
id: 'UPG-MISSING-SESSION-CLEANUP',
|
||||
severity: 'warning',
|
||||
category: 'v4.1 upgrade',
|
||||
sourceId: 'upgrade-v41',
|
||||
title: 'Open-ADTSession is used without removing null or empty session values',
|
||||
description: 'The v4.1 template strips null/empty values from the ADTSession hashtable before Open-ADTSession.',
|
||||
remediation: 'Call Remove-ADTHashtableNullOrEmptyValues before Open-ADTSession when you build the session hashtable manually.'
|
||||
},
|
||||
{
|
||||
id: 'REPO-MODULE-VERSION-DRIFT',
|
||||
severity: 'warning',
|
||||
category: 'Upstream parity',
|
||||
sourceId: 'github',
|
||||
title: 'Generated/imported module version is behind upstream 4.2.0',
|
||||
description: 'The upstream repo template currently imports PSAppDeployToolkit module version 4.2.0.',
|
||||
remediation: 'Update ModuleVersion pins and generated templates to 4.2.0 unless you intentionally target an older package.'
|
||||
},
|
||||
{
|
||||
id: 'REPO-DEPLOYMODE-NO-AUTO',
|
||||
severity: 'info',
|
||||
category: 'Upstream parity',
|
||||
sourceId: 'github',
|
||||
title: 'DeployMode is hard-coded instead of allowing Auto',
|
||||
description: 'The upstream v4 frontend template defaults DeployMode to Auto and says not to hard-code it unless required.',
|
||||
remediation: 'Prefer omitting -DeployMode or using Auto unless the deployment specifically requires Interactive, NonInteractive, or Silent.'
|
||||
},
|
||||
{
|
||||
id: 'LEGACY-V3-FUNCTION',
|
||||
severity: 'error',
|
||||
category: 'Legacy v3 pattern',
|
||||
sourceId: 'release-notes',
|
||||
title: 'Legacy v3 function name found',
|
||||
description: 'PSADT v4 renamed many common v3 functions to ADT-prefixed equivalents.',
|
||||
remediation: 'Use the v4 function mapping and replace legacy function names such as Execute-Process, Execute-MSI, Write-Log, and Show-InstallationWelcome.'
|
||||
},
|
||||
{
|
||||
id: 'LEGACY-DEPLOY-APPLICATION',
|
||||
severity: 'warning',
|
||||
category: 'Legacy v3 pattern',
|
||||
sourceId: 'release-notes',
|
||||
title: 'Legacy Deploy-Application naming found',
|
||||
description: 'PSADT v4 renamed Deploy-Application.ps1/exe to Invoke-AppDeployToolkit.ps1/exe.',
|
||||
remediation: 'Use Invoke-AppDeployToolkit.ps1 and Invoke-AppDeployToolkit.exe in v4 packages.'
|
||||
},
|
||||
{
|
||||
id: 'LEGACY-DEPLOYMENT-VARIABLE',
|
||||
severity: 'warning',
|
||||
category: 'ADTSession',
|
||||
sourceId: 'faq',
|
||||
title: 'Legacy deployment variable found',
|
||||
description: 'Deployment variables such as $appName and $appVersion are stored on $adtSession in PSADT v4.',
|
||||
remediation: 'Use $adtSession.AppName, $adtSession.AppVersion, and related ADTSession properties.'
|
||||
},
|
||||
{
|
||||
id: 'FAQ-ENV-VAR-BEFORE-SESSION',
|
||||
severity: 'info',
|
||||
category: 'ADTSession',
|
||||
sourceId: 'faq',
|
||||
title: 'Toolkit environment variables require an ADTSession',
|
||||
description: 'PSADT environment variables are available after opening an ADTSession or exporting the environment table.',
|
||||
remediation: 'Ensure Open-ADTSession or Export-ADTEnvironmentTableToSessionState runs before relying on PSADT environment variables.'
|
||||
},
|
||||
{
|
||||
id: 'INTUNE-SERVICEUI',
|
||||
severity: 'critical',
|
||||
category: 'Intune/security',
|
||||
sourceId: 'release-notes',
|
||||
title: 'ServiceUI usage found',
|
||||
description: 'PSADT v4.1 no longer requires ServiceUI for Intune UI display and the release notes call out security risk in token manipulation approaches.',
|
||||
remediation: 'Remove ServiceUI workarounds and rely on PSADT v4.1 native user-session UI handling.'
|
||||
},
|
||||
{
|
||||
id: 'INTUNE-DEFER-RUN-INTERVAL',
|
||||
severity: 'warning',
|
||||
category: 'Intune/retry',
|
||||
sourceId: 'faq',
|
||||
title: 'Deferral prompt lacks DeferRunInterval',
|
||||
description: 'Intune retries quickly after a 1602 defer result. PSADT FAQ recommends DeferRunInterval to prevent repeated close-app prompts.',
|
||||
remediation: 'Add -DeferRunInterval when using AllowDefer for Intune-targeted deployments.'
|
||||
},
|
||||
{
|
||||
id: 'UI-PROMPT-ICON-FLUENT',
|
||||
severity: 'warning',
|
||||
category: 'UI',
|
||||
sourceId: 'release-notes',
|
||||
title: 'Show-ADTInstallationPrompt uses -Icon',
|
||||
description: 'The v4.1.8 template removed -Icon from Show-ADTInstallationPrompt because it is not supported in Fluent UI.',
|
||||
remediation: 'Remove -Icon from Show-ADTInstallationPrompt or switch to a function that supports the desired icon behavior.'
|
||||
},
|
||||
{
|
||||
id: 'INSTALL-RAW-MSIEXEC',
|
||||
severity: 'warning',
|
||||
category: 'Installer',
|
||||
sourceId: 'installing',
|
||||
title: 'Raw msiexec usage found',
|
||||
description: 'PSADT provides Start-ADTMsiProcess for MSI install/uninstall/repair/patch handling and logging.',
|
||||
remediation: 'Use Start-ADTMsiProcess instead of calling msiexec.exe directly where possible.'
|
||||
},
|
||||
{
|
||||
id: 'INSTALL-PROCESS-NO-WAIT-CHILD',
|
||||
severity: 'info',
|
||||
category: 'Installer',
|
||||
sourceId: 'release-notes',
|
||||
title: 'Start-ADTProcess may exit before child installers finish',
|
||||
description: 'PSADT v4.1 added -WaitForChildProcesses for installers that hand off to child processes.',
|
||||
remediation: 'Consider -WaitForChildProcesses for setup.exe installers that spawn child processes and exit early.'
|
||||
},
|
||||
{
|
||||
id: 'EXIT-RESERVED-BUILTIN',
|
||||
severity: 'error',
|
||||
category: 'Exit codes',
|
||||
sourceId: 'exit-codes',
|
||||
title: 'Reserved PSADT built-in exit code used as custom code',
|
||||
description: 'Exit codes 60000-68999 are reserved for built-in PSADT exit codes.',
|
||||
remediation: 'Use 69000-69999 for custom Invoke-AppDeployToolkit.ps1 exit codes or 70000-79999 for extension module codes.'
|
||||
},
|
||||
{
|
||||
id: 'EXIT-CUSTOM-RANGE',
|
||||
severity: 'info',
|
||||
category: 'Exit codes',
|
||||
sourceId: 'exit-codes',
|
||||
title: 'Custom exit code range detected',
|
||||
description: 'Exit codes 69000-69999 are recommended for user customized Invoke-AppDeployToolkit.ps1 exit codes.',
|
||||
remediation: 'Confirm the code is documented in the package and deployment platform return-code mapping.'
|
||||
},
|
||||
{
|
||||
id: 'FAQ-GLOBAL-MODULE-IMPORT',
|
||||
severity: 'warning',
|
||||
category: 'Packaging',
|
||||
sourceId: 'faq',
|
||||
title: 'Global PSADT module import found',
|
||||
description: 'The FAQ notes packages can include the toolkit module, while central module installs risk running tested packages against newer module versions.',
|
||||
remediation: 'Prefer package-local PSAppDeployToolkit module files unless you intentionally govern a central module lifecycle.'
|
||||
},
|
||||
{
|
||||
id: 'DEPRECATED-GET-ADTOBJECTPROPERTY',
|
||||
severity: 'warning',
|
||||
category: 'Deprecation',
|
||||
sourceId: 'github',
|
||||
title: 'Deprecated Get-ADTObjectProperty usage found',
|
||||
description: 'The upstream function help marks Get-ADTObjectProperty as deprecated and scheduled for removal in PSAppDeployToolkit 4.3.0.',
|
||||
remediation: 'Replace Get-ADTObjectProperty usage with direct object/property access or a supported helper before upgrading to 4.3.0.'
|
||||
},
|
||||
{
|
||||
id: 'USERCONTEXT-REQUIREADMIN',
|
||||
severity: 'warning',
|
||||
category: 'User context',
|
||||
sourceId: 'faq',
|
||||
title: 'User-context process with RequireAdmin enabled',
|
||||
description: 'The FAQ recommends RequireAdmin = $false for user-context application installs.',
|
||||
remediation: 'Set $adtSession.RequireAdmin to $false when the deployment is intended to run in user context.'
|
||||
}
|
||||
];
|
||||
Reference in New Issue
Block a user