psSIA

0.1.0

Tests/Unit/Public/Resources.Tests.ps1

BeforeAll {
    $moduleRoot = (Resolve-Path (Join-Path $PSScriptRoot '../../..')).Path
    Import-Module (Join-Path $moduleRoot 'psSIA.psd1') -Force
}

Describe 'Get-SIAWindowsStrongAccount' {
    It 'maps filter parameters to documented query parameters' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path, $QueryParameter)
                $Path | Should -Be '/api/secrets/public/v1'
                $QueryParameter.secret_type | Should -Be 'ProvisionerUser,PCloudAccount'
                $QueryParameter.secret_name | Should -Be 'svc-*'
                $QueryParameter.any_details | Should -Be 'true'
                [pscustomobject]@{}
            }

            Get-SIAWindowsStrongAccount -Type 'ProvisionerUser', 'PCloudAccount' -Name 'svc-*' -MatchAnyDetail | Out-Null
        }
    }

    It 'requests a single account by ID' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path)
                $Path | Should -Be '/api/secrets/public/v1/secret-1'
                [pscustomobject]@{ secret_id = 'secret-1' }
            }

            $result = Get-SIAWindowsStrongAccount -Id 'secret-1'
            $result.secret_id | Should -Be 'secret-1'
        }
    }

    It 'paginates via -All using the confirmed continuation field' {
        InModuleScope psSIA {
            $script:callCount = 0
            Mock Invoke-SIARequest {
                $script:callCount++
                if ($script:callCount -eq 1) {
                    [pscustomobject]@{ secrets = @(@{ secret_id = 'a' }); b64_last_evaluated_key = 'next' }
                } else {
                    [pscustomobject]@{ secrets = @(@{ secret_id = 'b' }); b64_last_evaluated_key = $null }
                }
            }

            $result = Get-SIAWindowsStrongAccount -All

            $result.Count | Should -Be 2
            Should -Invoke Invoke-SIARequest -Times 2 -Exactly
        }
    }

    It 'warns and returns the raw page when -All cannot find an item array' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest { [pscustomobject]@{ b64_last_evaluated_key = $null } }
            Mock Write-Warning {}

            Get-SIAWindowsStrongAccount -All | Out-Null

            Should -Invoke Write-Warning -Times 1 -Exactly
        }
    }
}

Describe 'Remove-SIAWindowsStrongAccount' {
    It 'calls DELETE for the specified secret' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path)
                $Method | Should -Be 'DELETE'
                $Path | Should -Be '/api/secrets/public/v1/secret-1'
            }

            Remove-SIAWindowsStrongAccount -Id 'secret-1' -Confirm:$false
        }
    }
}

Describe 'Get-SIADatabaseStrongAccount' {
    It 'lists every database strong account with no filters' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Path)
                $Path | Should -Be '/api/database-strong-accounts'
                @(@{ id = 'db-1' }, @{ id = 'db-2' })
            }

            (Get-SIADatabaseStrongAccount).Count | Should -Be 2
        }
    }
}

Describe 'Windows strong account write cmdlets' {
    It 'New-SIAWindowsStrongAccount assembles the SecretDto body from typed parameters' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path, $Body)
                $Method | Should -Be 'POST'
                $Path | Should -Be '/api/secrets/public/v1'
                $Body.secret_name | Should -Be 'svc-app01'
                $Body.secret_type | Should -Be 'ProvisionerUser'
                $Body.secret.secret_data | Should -Be 'P@ssw0rd'
                $Body.secret_details.account_domain | Should -Be 'local'
                $Body.is_active | Should -Be $true
            }

            New-SIAWindowsStrongAccount -SecretName 'svc-app01' -SecretType ProvisionerUser `
                -SecretData @{ secret_data = 'P@ssw0rd' } -SecretDetails @{ account_domain = 'local' } -Confirm:$false
        }
    }

    It 'Set-SIAWindowsStrongAccount only includes supplied fields' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path, $Body)
                $Method | Should -Be 'PUT'
                $Path | Should -Be '/api/secrets/public/v1/secret-1'
                $Body.secret_name | Should -Be 'svc-app01-renamed'
                $Body.Keys | Should -Not -Contain 'secret_type'
            }

            Set-SIAWindowsStrongAccount -Id 'secret-1' -SecretName 'svc-app01-renamed' -Confirm:$false
        }
    }
}

Describe 'Database strong account write cmdlets' {
    It 'New-SIADatabaseStrongAccount assembles storeType, name, and accountProperties' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path, $Body)
                $Method | Should -Be 'POST'
                $Path | Should -Be '/api/database-strong-accounts'
                $Body.storeType | Should -Be 'pam'
                $Body.name | Should -Be 'MyPAMAccount'
                $Body.accountProperties.safe | Should -Be 'MySafe'
            }

            New-SIADatabaseStrongAccount -StoreType pam -Name 'MyPAMAccount' `
                -AccountProperties @{ safe = 'MySafe'; accountName = 'admin@example.com' } -Confirm:$false
        }
    }

    It 'Set-SIADatabaseStrongAccount only includes supplied fields' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path, $Body)
                $Method | Should -Be 'PUT'
                $Path | Should -Be '/api/database-strong-accounts/db-1'
                $Body.name | Should -Be 'pg-admin-renamed'
                $Body.Keys | Should -Not -Contain 'storeType'
            }

            Set-SIADatabaseStrongAccount -Id 'db-1' -Name 'pg-admin-renamed' -Confirm:$false
        }
    }

    It 'Remove-SIADatabaseStrongAccount deletes /api/database-strong-accounts/{id}' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {
                param($Method, $Path)
                $Method | Should -Be 'DELETE'
                $Path | Should -Be '/api/database-strong-accounts/db-1'
            }

            Remove-SIADatabaseStrongAccount -Id 'db-1' -Confirm:$false
        }
    }

    It 'does not call the API under -WhatIf' {
        InModuleScope psSIA {
            Mock Invoke-SIARequest {}
            Remove-SIADatabaseStrongAccount -Id 'db-1' -WhatIf
            Should -Invoke Invoke-SIARequest -Times 0 -Exactly
        }
    }
}