psSIA

0.1.0

Tests/Unit/Public/Access.Tests.ps1

BeforeAll {
    $moduleRoot = (Resolve-Path (Join-Path $PSScriptRoot '../../..')).Path
    Import-Module (Join-Path $moduleRoot 'psSIA.psd1') -Force
}

Describe 'Get-SIAAccessRequest' {
    It 'lists requests when -Id is omitted' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Service)
                $Path | Should -Be '/workflows/requests'
                $Service | Should -Be 'Uar'
                @()
            }

            Get-SIAAccessRequest | Out-Null
        }
    }

    It 'retrieves a single request by ID' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path)
                $Path | Should -Be '/workflows/requests/req-1'
                [pscustomobject]@{ id = 'req-1' }
            }

            (Get-SIAAccessRequest -Id 'req-1').id | Should -Be 'req-1'
        }
    }
}

Describe 'Stop-SIAAccessRequest' {
    It 'calls the cancel endpoint' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Method)
                $Path | Should -Be '/workflows/requests/req-1/cancel'
                $Method | Should -Be 'POST'
            }

            Stop-SIAAccessRequest -Id 'req-1' -Confirm:$false
        }
    }
}

Describe 'Approve-SIAAccessRequest' {
    It 'sends result APPROVED with the supplied reason' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Body)
                $Path | Should -Be '/workflows/requests/req-1/finalize'
                $Body.result | Should -Be 'APPROVED'
                $Body.finalizationReason | Should -Be 'All requirements met'
            }

            Approve-SIAAccessRequest -Id 'req-1' -Reason 'All requirements met' -Confirm:$false
        }
    }
}

Describe 'Deny-SIAAccessRequest' {
    It 'sends result REJECTED with the supplied reason' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Body)
                $Path | Should -Be '/workflows/requests/req-1/finalize'
                $Body.result | Should -Be 'REJECTED'
                $Body.finalizationReason | Should -Be 'Insufficient justification'
            }

            Deny-SIAAccessRequest -Id 'req-1' -Reason 'Insufficient justification' -Confirm:$false
        }
    }
}

Describe 'Unlock-SIAAssetSecret' {
    It 'calls the asset secret endpoint against the user portal service' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Service, $Method)
                $Path | Should -Be '/api/assets/asset-1/secret'
                $Service | Should -Be 'UserPortal'
                $Method | Should -Be 'POST'
            }

            Unlock-SIAAssetSecret -AssetId 'asset-1' -Confirm:$false
        }
    }

    It 'does nothing under -WhatIf' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {}
            Unlock-SIAAssetSecret -AssetId 'asset-1' -WhatIf
            Should -Invoke Invoke-SIARequest -Times 0 -Exactly
        }
    }
}

Describe 'Get-SIAAsset' {
    It 'lists assets against the user portal service' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Service)
                $Path | Should -Be '/api/assets'
                $Service | Should -Be 'UserPortal'
                @()
            }

            Get-SIAAsset | Out-Null
        }
    }
}

Describe 'Get-SIAAccessRequestForm' {
    It 'calls the request-forms endpoint against the Uar service' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $Service)
                $Path | Should -Be '/workflows/request-forms'
                $Service | Should -Be 'Uar'
                @()
            }

            Get-SIAAccessRequestForm | Out-Null
        }
    }
}

Describe 'New-SIAAccessRequest' {
    It 'assembles targetCategory, requestType, and requestDetails' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path, $Body, $Service)
                $Method | Should -Be 'POST'
                $Path | Should -Be '/workflows/requests'
                $Body.targetCategory | Should -Be 'CLOUD_CONSOLE'
                $Body.requestType | Should -Be 'ON_DEMAND'
                $Body.requestDetails.locationType | Should -Be 'Azure'
                $Service | Should -Be 'Uar'
            }

            New-SIAAccessRequest -TargetCategory CLOUD_CONSOLE -RequestDetails @{ locationType = 'Azure' } -Confirm:$false
        }
    }

    It 'defaults RequestType to ON_DEMAND and accepts DUAL_CONTROL' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest { param($Body) $Body.requestType | Should -Be 'DUAL_CONTROL' }

            New-SIAAccessRequest -TargetCategory CLOUD_CONSOLE -RequestType DUAL_CONTROL -RequestDetails @{} -Confirm:$false
        }
    }

    It 'does nothing under -WhatIf' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {}
            New-SIAAccessRequest -TargetCategory CLOUD_CONSOLE -RequestDetails @{} -WhatIf
            Should -Invoke Invoke-SIARequest -Times 0 -Exactly
        }
    }
}