T

kawa e4125c6643 Instrument elevation path to diagnose ineffective grants

A SharePoint admin reported the grant runs without a logged error yet the
account never appears as site-collection admin on Group/Teams sites. The
failure was invisible: ElevateAsync called ExecuteQueryAsync directly (no
enrichment/logging) and the coordinator only surfaced elevate failures on the
page, not to Serilog.

- Route the admin-endpoint ExecuteQuery through ExecuteQueryRetryHelper so a
  denial there is enriched (serverErrorType/httpStatus) and logged.
- Log the resolved login and SetSiteAdmin acceptance in OwnershipElevationService.
- Log elevate failures to Serilog in the coordinator.
- Add a post-elevation verify that reads CurrentUser.IsSiteAdmin on the target
  site so logs distinguish a failed/no-op grant from a scan failing for another
  reason. Diagnostic only; never throws into the operation flow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-02 14:35:48 +02:00

Components

Wire auto-elevate ownership across all SharePoint operations

2026-06-02 14:16:12 +02:00

Core

Classify bare HTTP 403 as access-denied for Group/Teams sites

2026-06-02 14:26:01 +02:00

data

Stop tracking runtime data; seed from *.example.json

2026-06-02 11:30:34 +02:00

Infrastructure

2026-06-02 11:47:23 +02:00