Private/Guardrails/Assert-PckProfileAligned.ps1
|
function Assert-PckProfileAligned { <# .SYNOPSIS Refuses to run pac commands when the active pac auth profile points at a different environment than the one the caller pinned. .DESCRIPTION pac auth profiles are machine-global, and another workspace on the same machine can silently re-point the active one; the founding war story of canon 4 (war story 6). Every pac command that talks to an org runs against the active profile, so alignment is verified against pac org who before any of them. Output shape verified live on 2026-08-16: pac org who prints 'Environment ID:' and 'Org URL:' lines. #> [CmdletBinding()] param( [Parameter(Mandatory)] [string] $EnvironmentId, [string] $EnvironmentUrl ) $output = '' try { $output = (Invoke-PckPacCommand -Arguments @('org', 'who')) -join "`n" } catch { throw [PckPreflightError]::new( "No active pac auth profile answered 'pac org who'. Create one aimed at the pinned environment: pac auth create --environment $EnvironmentId", $script:PckExitCode.ProfileMisaligned) } if ($output -match "(?im)^\s*Environment ID:\s*$([regex]::Escape($EnvironmentId))\s*$") { return } if (-not [string]::IsNullOrWhiteSpace($EnvironmentUrl)) { $targetHost = ([uri]$EnvironmentUrl).Host if ($output -match "(?im)^\s*Org URL:\s*https://$([regex]::Escape($targetHost))/?\s*$") { return } } $current = if ($output -match '(?im)^\s*Environment ID:\s*([0-9a-fA-F-]{36})') { $Matches[1] } else { 'unreadable' } throw [PckPreflightError]::new( "The active pac auth profile points at environment $current, not $EnvironmentId. pac commands would run against the wrong environment (canon 4). Fix: pac auth select, or pac auth create --environment $EnvironmentId", $script:PckExitCode.ProfileMisaligned) } |