Private/Get-SPMRoleAssignmentSet.ps1
|
function Get-SPMRoleAssignmentSet { <# .SYNOPSIS Loads the role assignments of a securable object (web, list or list item) as matrix entries. .DESCRIPTION Limited-access-only assignments are dropped (noise). For multiple role definitions on one principal the highest level determines the cell value; all role names are kept for the tooltip. #> [CmdletBinding()] param( [Parameter(Mandatory)] $Securable, [Parameter(Mandatory)] [hashtable]$SiteContext ) $rank = @('FC', 'W', 'C', 'R') $result = [System.Collections.Generic.List[object]]::new() $roleAssignments = Invoke-SPMWithRetry { Get-PnPProperty -ClientObject $Securable -Property RoleAssignments } foreach ($ra in $roleAssignments) { $null = Invoke-SPMWithRetry { Get-PnPProperty -ClientObject $ra -Property Member, RoleDefinitionBindings } # SharePoint-managed limited-access carrier groups - pure noise for the matrix. if ([string]$ra.Member.Title -like 'Limited Access System Group*') { continue } $roleNames = @($ra.RoleDefinitionBindings | ForEach-Object { $_.Name }) $abbreviations = [System.Collections.Generic.List[string]]::new() foreach ($roleName in $roleNames) { $abbr = Get-SPMPermissionAbbreviation -RoleName $roleName -CustomRoles $SiteContext.CustomRoles if ($abbr) { $abbreviations.Add($abbr) } } if ($abbreviations.Count -eq 0) { continue } $top = $abbreviations | Sort-Object { $i = [array]::IndexOf($rank, $_); if ($i -lt 0) { 99 } else { $i } } | Select-Object -First 1 $principalId = Resolve-SPMPrincipal -Member $ra.Member -PrincipalIndex $SiteContext.Principals -GroupCache $SiteContext.GroupCache $result.Add([pscustomobject]@{ principalId = $principalId permission = $top roles = $roleNames }) } return , $result.ToArray() } |