Feature Request

Release a SDK for Developing custom plugins to work with PowerShell Universal. I want to expand the functionality of PSU with a better notification system which would not rely on powershell to run, so I could ensure I'd get notified even if PowerShell is acting up. Also a extension for FTP/SFTP manager. This is to extend the functionality of the Admin side of PSU.

From the docs here: https://docs.powershelluniversal.com/config/repository#database-resources The workflows does not allow only being in the database. This could be a really nice thing for different stages like a staging server and a dev and a prod server.

Hi Adam, As discussed at PSConfEU :) Currently when you call a Script from an App with Invoke-PSUScript the called script gets shown in the Portal History even if the Users dont have access to the script. It would be nice to have an option to hide them there as we already hat some question why something is shown there. Thanks, Niko

We need always serialize objects returned from APIs are arrays but we have no idea whether user want an array or a single object due to how the PS SDK works. If we added a new parameter to New-PSUApiResponse to control this, it would be helpful. Right now, users need to manually convert the object to JSON to get this to behave correctly. # New way New-PSUApiResponse -InputObject $MyStuff -AsSingleObject # Old way New-PSUApiResponse -Body ($MyStuff | ConvertTo-Json -Depth 2)

A user would like to be able to select Google Gemini models in PowerShell Universal for their AI Agents.

When environments have many schedules, especially when they begin to scale across the environment, it becomes increasingly hard to track down if schedules ran when they should have. We should have a history via for schedules that includes missed schedule runs. If a schedule is missed, we should add a trigger that runs when that happens.

By default, strings work fine: Param([string[]]$AString) That will pull up the mutliple-selection interface - all good. if you do this: Param([mailaddress[]]$AnEmail) You will only get the option to input a single string. If you provide default parameters, only the first element will be shown in the web interface. As a string (with valid formatting) can be cast to type [mailaddress], it would be great to support this in the web interface when selecting multiple elements. Obviously ValidateScript is an option from the string input, but being able to use standard powershell conventions would be a lot neater. I found this, not sure if it's any help: c# - Can I check if a variable can be cast to a specified type? - Stack Overflow

This is partially due to a Discord channel chat but also some nice to haves I've been thinking about. Running tests manually is fine but it seems like we could make this much more useful. Some use cases I am imagining. Changes are made in dev, promoted to prod, tests run in prod after deployment An increase in app token login failures, run tests to verify access Changes are made throughout the day, run nightly tests While I do think a lot of this is possible outside PSU, I do think that surfacing this in the platform would be very helpful. We don't need it to be extremely complicated but offering a few more integration points would be nice. More configurable test execution options (suite, cases, etc) to limit which tests are run Triggers can run test suites\cases (git sync in prod, run tests) Triggers based on test results (failed tests, run email script) Scheduled test runs (nightly tests) Improved test run reporting (similar to job runs with more filtering, origin, rerun etc) General documentation around running Playwright in PSU (service desktop and accounts etc)

shouldnt i be able to hit the swagger page and then click try now on a /testAuth api with windows auth and the admin rold on it, and it return a 200? right now i am getting a 403 forbidden. if i get a token with powershell and do a login and pass it in, it works just fine

Currently, there seems to be no way to make apps complaint with WCAG standards for screen reader support. Consider the following: New-UDTextbox -Id 'HardWords' -Label 'Nougat Croissant Valet' The screenreader may read the label as " noujet Croi-sant val-it" , a known issue with screen readers. This is what Aria-Label would be used for in web development. A new property on all the elements such as - Aria-Label "noo-gah Krwah-sahn val-ay" would resolve this issue. A even better solution is a way to inject HTML tag attributes into any element in the same fashion as New-UDStyle for styling such as New-UDAttributes or a similar name.

I believe all modern services should natively provide TOTP and I would love to see it in PSU. Here is all the algorithm stuff you need to do it in pwsh: https://github.com/ecspresso/TOTPPowerShellModule Whats missing on that page: When checking user input against the results from the function, it is important not to just use "-eq" (according to AI). This is how to do it safely: function Compare-ConstantTime { #prevents timing based attacks param([string]$a, [string]$b) if ($a.Length -ne $b.Length) { return $false } $result = 0 for ($i = 0; $i -lt $a.Length; $i++) { $result = $result -bor ($a[$i].GetHashCode() -bxor $b[$i].GetHashCode()) } return $result -eq 0 } I have already implement something similar in the past but it was quite cumbersome to set everything up (authentication.ps1, login.ps1, storing and retrieving secrets) so a native implementation would be awesome. Thank you for considering ~~

I'd like to see some more options for tweaking application auto startup. For example if a app isnt as important the app could be put on a delayed startup similar to how services in windows work. This would help get PSU up and running quicker in the event the server needs to restart

Hi everyone, I'm currently running a setup with a WAF using the OWASP Core Rule Set (CRS). I've encountered two specific rules causing total page blanking (403 errors) for legitimate traffic. While i can change the rule set and make exclusions, i was hoping that there could be changes made to PSU so others wont run into the same problem. 1. Rule 943120 Possible Session Fixation Attack: SessionID Parameter Name with No Referrer Legitimate requests containing a sessionID parameter are blocked if the Referrer header is missing. In the logs the /dashboardhub path was flagged with this rule on every app page, causing it to load blank pages. AI was suggesting moving the session id to a cookie instead of the URL parameter to get around the rule trigger. 2. Rule 942421 (SQL Injection - Special Characters) Requests are blocked when the .NET cookies contains a high number (3) of special characters. Environment: - Docker hosted reverse proxy "Caddy" with Coraza plugin: https://github.com/docker-servers/coraza-caddy - CRS Version: 4.25.0 Index of all rules: https://web.archive.org/web/20230901104426/https://www.netnea.com/cms/core-rule-set-inventory/ Here are a few more rules that i observed in detection mode but ultimately where irrelevant after blocking the 2 rules above. [image] Thanks!

I would like to be able to create a schedule that can be assigned to multiple scripts. I'm thinking something like Schedule When to run Every Day at Midnight What to run Script 1 script 2 Or something like that.

In order to save cpu and memory resources on our PSU instance we dont have all apps running 24/7. Currently when a technician wants to use an app that is offline they have to ask me to turn it on for them. I would like to see a way to grant the ability to turn an app on via the PSU portal and have the ability tied to security roles.

When i try to add HEAD to the code in the endpoints.ps1, it breaks the api's [image] endpoints.ps1 Cannot validate argument on parameter 'Method'. The argument "HEAD" does not belong to the set "GET,POST,PUT,DELETE,OPTIONS,PATCH" specified by the ValidateSet attribute. Supply an argument that is in the set and then try the command again.