chore: release v2.4

- Add theme system (Dark/Light palettes, ModernTheme, ThemeManager)
- Add InputDialog, Spinner common view
- Add DuplicatesCsvExportService
- Refresh views, dialogs, and view models across tabs
- Update localization strings (en/fr)
- Tweak services (transfer, permissions, search, user access, ownership elevation, bulk operations)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs

@@ -308,6 +308,32 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     /// Derives the tenant admin URL from a standard tenant URL.
     /// E.g. https://tenant.sharepoint.com → https://tenant-admin.sharepoint.com
     /// </summary>
+    /// <summary>
+    /// Extracts the site-collection root URL from an arbitrary SharePoint object URL.
+    /// E.g. https://t.sharepoint.com/sites/hr/Shared%20Documents/Reports → https://t.sharepoint.com/sites/hr
+    /// Falls back to scheme+host for root-collection URLs.
+    /// </summary>
+    internal static string DeriveSiteCollectionUrl(string objectUrl)
+    {
+        if (string.IsNullOrWhiteSpace(objectUrl)) return string.Empty;
+        if (!Uri.TryCreate(objectUrl, UriKind.Absolute, out var uri))
+            return objectUrl.TrimEnd('/');
+
+        var baseUrl = $"{uri.Scheme}://{uri.Host}";
+        var segments = uri.AbsolutePath.Trim('/').Split('/', StringSplitOptions.RemoveEmptyEntries);
+
+        // Managed paths: /sites/<name> or /teams/<name>
+        if (segments.Length >= 2 &&
+            (segments[0].Equals("sites", StringComparison.OrdinalIgnoreCase) ||
+             segments[0].Equals("teams", StringComparison.OrdinalIgnoreCase)))
+        {
+            return $"{baseUrl}/{segments[0]}/{segments[1]}";
+        }
+
+        // Root site collection
+        return baseUrl;
+    }
+
     internal static string DeriveAdminUrl(string tenantUrl)
     {
         var uri = new Uri(tenantUrl.TrimEnd('/'));
@@ -408,29 +434,57 @@ public partial class PermissionsViewModel : FeatureViewModelBase
             }
 
             IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null;
-            if (_groupResolver != null && Results.Count > 0)
+            if (_groupResolver != null && Results.Count > 0 && _currentProfile != null)
             {
-                var groupNames = Results
+                // SharePoint groups live per site collection. Bucket each group
+                // by the site it was observed on, then resolve against that
+                // site's context. Using the root tenant ctx for a group that
+                // lives on a sub-site makes CSOM fail with "Group not found".
+                var groupsBySite = Results
                     .Where(r => r.PrincipalType == "SharePointGroup")
-                    .SelectMany(r => r.Users.Split(';', StringSplitOptions.RemoveEmptyEntries))
-                    .Select(n => n.Trim())
-                    .Where(n => n.Length > 0)
-                    .Distinct(StringComparer.OrdinalIgnoreCase)
+                    .SelectMany(r => r.Users
+                        .Split(';', StringSplitOptions.RemoveEmptyEntries)
+                        .Select(n => (SiteUrl: DeriveSiteCollectionUrl(r.Url), GroupName: n.Trim())))
+                    .Where(x => x.GroupName.Length > 0)
+                    .GroupBy(x => x.SiteUrl, StringComparer.OrdinalIgnoreCase)
                     .ToList();
 
-                if (groupNames.Count > 0 && _currentProfile != null)
+                if (groupsBySite.Count > 0)
                 {
-                    try
+                    var merged = new Dictionary<string, IReadOnlyList<ResolvedMember>>(
+                        StringComparer.OrdinalIgnoreCase);
+
+                    foreach (var bucket in groupsBySite)
                     {
-                        var ctx = await _sessionManager.GetOrCreateContextAsync(
-                            _currentProfile, CancellationToken.None);
-                        groupMembers = await _groupResolver.ResolveGroupsAsync(
-                            ctx, _currentProfile.ClientId, groupNames, CancellationToken.None);
-                    }
-                    catch (Exception ex)
-                    {
-                        _logger.LogWarning(ex, "Group resolution failed — exporting without member expansion.");
+                        var distinctNames = bucket
+                            .Select(x => x.GroupName)
+                            .Distinct(StringComparer.OrdinalIgnoreCase)
+                            .ToList();
+
+                        try
+                        {
+                            var siteProfile = new TenantProfile
+                            {
+                                TenantUrl = bucket.Key,
+                                ClientId = _currentProfile.ClientId,
+                                Name = _currentProfile.Name
+                            };
+                            var ctx = await _sessionManager.GetOrCreateContextAsync(
+                                siteProfile, CancellationToken.None);
+                            var resolved = await _groupResolver.ResolveGroupsAsync(
+                                ctx, _currentProfile.ClientId, distinctNames, CancellationToken.None);
+                            foreach (var kv in resolved)
+                                merged[kv.Key] = kv.Value;
+                        }
+                        catch (Exception ex)
+                        {
+                            _logger.LogWarning(ex,
+                                "Group resolution failed for {Site} — continuing without member expansion.",
+                                bucket.Key);
+                        }
                     }
+
+                    groupMembers = merged;
                 }
             }