Add support for SecretManagement and SecretStore providers, enhance configuration data handling, and introduce new utility functions

2026-07-02 23:57:14 +02:00
parent 115b8be385
commit 9b36693444
16 changed files with 979 additions and 7 deletions
--- a/Public/Unregister-DSCConfigurationDataCredentialProvider.ps1
+++ b/Public/Unregister-DSCConfigurationDataCredentialProvider.ps1
@@ -0,0 +1,142 @@
+function Unregister-DSCConfigurationDataCredentialProvider {
+    [CmdletBinding(SupportsShouldProcess=$true, ConfirmImpact="High")]
+    Param(
+        [Parameter(Mandatory=$true)]
+        [string]
+        $Vault,
+
+        [Parameter(Mandatory=$false)]
+        [string]
+        $KeyPath,
+
+        [Parameter(Mandatory=$false)]
+        [string]
+        $SettingsPath,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $RemoveSettings,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $RemoveKeyFile,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $UnregisterVault,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $ResetSecretStore,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $Force,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $PassThru
+    )
+
+    DynamicParam {
+        $ProviderNames = @(Get-ConfigurationDataSecretProviderName)
+        if($ProviderNames.Count -eq 0){
+            $ProviderNames = @("__NoProvidersRegistered__")
+        }
+
+        $ParameterAttribute = [System.Management.Automation.ParameterAttribute]::new()
+        $ParameterAttribute.Mandatory = $false
+        $ParameterAttribute.Position = 0
+
+        $ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute -ArgumentList (,[string[]]$ProviderNames)
+        $Attributes = [System.Collections.ObjectModel.Collection[System.Attribute]]::new()
+        $Attributes.Add($ParameterAttribute)
+        $Attributes.Add($ValidateSetAttribute)
+
+        $RuntimeParameter = [System.Management.Automation.RuntimeDefinedParameter]::new(
+            "Provider",
+            [string],
+            $Attributes
+        )
+
+        $Dictionary = [System.Management.Automation.RuntimeDefinedParameterDictionary]::new()
+        $Dictionary.Add("Provider", $RuntimeParameter)
+        return $Dictionary
+    }
+
+    begin {
+        $Provider = [string]$PSBoundParameters["Provider"]
+        if([string]::IsNullOrWhiteSpace($Provider)){
+            $ProviderNames = @(Get-ConfigurationDataSecretProviderName)
+            if($ProviderNames.Count -eq 1){
+                $Provider = $ProviderNames[0]
+            }elseif($ProviderNames.Count -eq 0){
+                throw "No configuration data secret providers are registered."
+            }else{
+                throw "Provider is required. Registered providers: $($ProviderNames -join ', ')."
+            }
+        }
+
+        $SettingsPath = Resolve-ConfigurationDataProviderSettingsPath -Provider $Provider -SettingsPath $SettingsPath
+    }
+
+    process {
+        $Result = [ordered]@{
+            Provider = $Provider
+            Vault = $Vault
+            SettingsPath = $SettingsPath
+            RemovedSettings = $false
+            RemovedKeyFile = $false
+            UnregisteredVault = $false
+            ResetSecretStore = $false
+        }
+
+        if($RemoveSettings -or (-not $PSBoundParameters.ContainsKey("RemoveSettings"))){
+            if(Test-Path -Path $SettingsPath -PathType Leaf){
+                if($PSCmdlet.ShouldProcess($SettingsPath, "Remove provider settings file")){
+                    Remove-Item -Path $SettingsPath -Force:$Force
+                    $Result.RemovedSettings = $true
+                }
+            }
+        }
+
+        if($RemoveKeyFile){
+            if([string]::IsNullOrWhiteSpace($KeyPath)){
+                throw "RemoveKeyFile requires [KeyPath]."
+            }
+
+            if(Test-Path -Path $KeyPath -PathType Leaf){
+                if($PSCmdlet.ShouldProcess($KeyPath, "Remove provider key file")){
+                    Remove-Item -Path $KeyPath -Force:$Force
+                    $Result.RemovedKeyFile = $true
+                }
+            }
+        }
+
+        if($UnregisterVault){
+            if($Provider -notin @("SecretManagement", "SecretStore")){
+                Write-Verbose "Provider [$Provider] does not register a SecretManagement vault."
+            }else{
+                if($PSCmdlet.ShouldProcess($Vault, "Unregister SecretManagement vault")){
+                    Unregister-SecretVault -Name $Vault
+                    $Result.UnregisteredVault = $true
+                }
+            }
+        }
+
+        if($ResetSecretStore){
+            if($Provider -ne "SecretStore"){
+                Write-Verbose "ResetSecretStore is only applicable to provider [SecretStore]."
+            }else{
+                if($PSCmdlet.ShouldProcess("SecretStore", "Reset local SecretStore and delete all contained secrets")){
+                    Reset-SecretStore -Force -Confirm:$false
+                    $Result.ResetSecretStore = $true
+                }
+            }
+        }
+
+        if($PassThru){
+            return [PSCustomObject]$Result
+        }
+    }
+}