PowerDataOps

2.0.0.59

src/Security/Get-XrmRolePrivileges.ps1

<#
    .SYNOPSIS
    Retrieve security role privileges.

    .DESCRIPTION
    Get role privileges from given role (RetrieveRolePrivilegesRole): one RolePrivilege per privilege, with its depth.
    Each RolePrivilege also carries EntityLogicalName and AccessRight (see Get-XrmPrivileges), and its PrivilegeName is filled when the platform leaves it empty.

    .PARAMETER XrmClient
    Xrm connector initialized to target instance. Use latest one by default. (Dataverse ServiceClient)

    .PARAMETER RoleId
    Role unique identifier.

    .OUTPUTS
    Microsoft.Crm.Sdk.Messages.RolePrivilege[]. Privileges of the role, with the EntityLogicalName and AccessRight note properties.

    .EXAMPLE
    $privileges = Get-XrmRolePrivileges -XrmClient $xrmClient -RoleId $role.Id;
    $privileges | Where-Object { $_.EntityLogicalName -eq "account" } | Select-Object PrivilegeName, AccessRight, Depth;

    .LINK
    https://github.com/AymericM78/PowerDataOps/blob/main/documentation/commands/Get-XrmRolePrivileges.md
#>
function Get-XrmRolePrivileges {
    [CmdletBinding()]
    [OutputType([Microsoft.Crm.Sdk.Messages.RolePrivilege[]])]
    param
    (
        [Parameter(Mandatory = $false, ValueFromPipeline)]
        [Microsoft.PowerPlatform.Dataverse.Client.ServiceClient]
        $XrmClient = $Global:XrmClient,

        [Parameter(Mandatory = $true)]
        [Guid]
        $RoleId
    )
    begin {
        $StopWatch = [System.Diagnostics.Stopwatch]::StartNew();
        Trace-XrmFunction -Name $MyInvocation.MyCommand.Name -Stage Start -Parameters ($MyInvocation.MyCommand.Parameters);
    }
    process {
        $request = New-XrmRequest -Name "RetrieveRolePrivilegesRole";
        $request = $request | Add-XrmRequestParameter -Name "RoleId" -Value $RoleId;
        $response = Invoke-XrmRequest -XrmClient $XrmClient -Request $request;
        if ($null -eq $response) {
            return;
        }
        $privileges = $response.Results["RolePrivileges"];

        # Names (sometimes empty in the response), tables and access rights
        $privilegeInfos = @{};
        foreach ($privilegeInfo in (Get-XrmPrivileges -XrmClient $XrmClient -RoleId $RoleId)) {
            $privilegeInfos[$privilegeInfo.Id] = $privilegeInfo;
        }
        foreach ($privilege in $privileges) {
            $privilegeInfo = $privilegeInfos[$privilege.PrivilegeId];
            if ($privilegeInfo -and -not $privilege.PrivilegeName) {
                $privilege.PrivilegeName = $privilegeInfo.Name;
            }
            $privilege | Add-Member -MemberType NoteProperty -Name "EntityLogicalName" -Value $privilegeInfo.EntityLogicalName -Force;
            $privilege | Add-Member -MemberType NoteProperty -Name "AccessRight" -Value $privilegeInfo.AccessRight -Force;
        }
        $privileges;
    }
    end {
        $StopWatch.Stop();
        Trace-XrmFunction -Name $MyInvocation.MyCommand.Name -Stage Stop -StopWatch $StopWatch;
    }
}
Export-ModuleMember -Function Get-XrmRolePrivileges -Alias *;