Resolve-DSCConfigurationData/Public/Set-DSCConfigurationDataCredentialProvider.ps1

function Set-DSCConfigurationDataCredentialProvider {
    [CmdletBinding(SupportsShouldProcess=$true)]
    Param(
        [Parameter(Mandatory=$false)]
        [string]
        $Vault,

        [Parameter(Mandatory=$false)]
        [AllowEmptyString()]
        [ValidateSet("", "Generic", "KeePass")]
        [string]
        $VaultType = "",

        [Parameter(Mandatory=$false)]
        [string]
        $DatabasePath,

        [Parameter(Mandatory=$false)]
        [string]
        $KeyPath,

        [Parameter(Mandatory=$false)]
        [switch]
        $DisableKeePassKeyFile,

        [Parameter(Mandatory=$false)]
        [string]
        $ModuleName,

        [Parameter(Mandatory=$false)]
        [hashtable]
        $VaultParameters = @{},

        [Parameter(Mandatory=$false)]
        [switch]
        $RegisterVault,

        [Parameter(Mandatory=$false)]
        [switch]
        $DefaultVault,

        [Parameter(Mandatory=$false)]
        [switch]
        $AllowClobber,

        [Parameter(Mandatory=$false)]
        [Alias("UseMasterKey")]
        [switch]
        $UseMasterPassword,

        [Parameter(Mandatory=$false)]
        [Alias("NoMasterKey", "NoMasterPassword")]
        [switch]
        $DisableMasterPassword,

        [Parameter(Mandatory=$false)]
        [Alias("MasterKey")]
        [System.Security.SecureString]
        $MasterPassword,

        [Parameter(Mandatory=$false)]
        [Alias("MasterKeyPath")]
        [string]
        $MasterPasswordKeyPath,

        [Parameter(Mandatory=$false)]
        [switch]
        $UseWindowsAccount,

        [Parameter(Mandatory=$false)]
        [switch]
        $ShowFullTitle,

        [Parameter(Mandatory=$false)]
        [switch]
        $ShowRecycleBin,

        [Parameter(Mandatory=$false)]
        [switch]
        $SkipValidate,

        [Parameter(Mandatory=$false)]
        [string]
        $SettingsPath,

        [Parameter(Mandatory=$false)]
        [switch]
        $Force,

        [Parameter(Mandatory=$false)]
        [switch]
        $PassThru
    )

    DynamicParam {
        $ProviderNames = @(Get-ConfigurationDataSecretProviderName)
        if($ProviderNames.Count -eq 0){
            $ProviderNames = @("__NoProvidersRegistered__")
        }

        $ParameterAttribute = [System.Management.Automation.ParameterAttribute]::new()
        $ParameterAttribute.Mandatory = $false
        $ParameterAttribute.Position = 0

        $ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute -ArgumentList (,[string[]]$ProviderNames)
        $Attributes = [System.Collections.ObjectModel.Collection[System.Attribute]]::new()
        $Attributes.Add($ParameterAttribute)
        $Attributes.Add($ValidateSetAttribute)

        $RuntimeParameter = [System.Management.Automation.RuntimeDefinedParameter]::new(
            "Provider",
            [string],
            $Attributes
        )

        $Dictionary = [System.Management.Automation.RuntimeDefinedParameterDictionary]::new()
        $Dictionary.Add("Provider", $RuntimeParameter)
        return $Dictionary
    }

    begin {
        $Provider = [string]$PSBoundParameters["Provider"]
        if([string]::IsNullOrWhiteSpace($Provider)){
            $ProviderNames = @(Get-ConfigurationDataSecretProviderName)
            if($ProviderNames.Count -eq 1){
                $Provider = $ProviderNames[0]
            }elseif($ProviderNames.Count -eq 0){
                throw "No configuration data secret providers are registered."
            }else{
                throw "Provider is required. Registered providers: $($ProviderNames -join ', ')."
            }
        }

        $ProviderInfo = Get-DSCConfigurationDataCredentialProvider -Provider $Provider -Vault $Vault -SettingsPath $SettingsPath
        if([string]::IsNullOrWhiteSpace($Vault)){
            $Vault = [string]$ProviderInfo.DefaultVault
        }

        if([string]::IsNullOrWhiteSpace($Vault)){
            throw "Vault is required. Pass [Vault] or define [DefaultVault] in the provider settings file."
        }
    }

    process {
        $ExistingVault = @($ProviderInfo.RegisteredVaults | Select-Object -First 1)
        $ExistingVaultParameters = @{}
        if($ExistingVault.Count -gt 0 -and $ExistingVault[0].PSObject.Properties["VaultParameters"] -and $ExistingVault[0].VaultParameters -is [System.Collections.IDictionary]){
            foreach($Key in $ExistingVault[0].VaultParameters.Keys){
                $ExistingVaultParameters[$Key] = $ExistingVault[0].VaultParameters[$Key]
            }
        }

        $EffectiveVaultType = $VaultType
        if([string]::IsNullOrWhiteSpace($EffectiveVaultType) -and $ProviderInfo.ProviderSettings -is [System.Collections.IDictionary] -and $ProviderInfo.ProviderSettings.ContainsKey("VaultType")){
            $EffectiveVaultType = [string]$ProviderInfo.ProviderSettings.VaultType
        }

        if([string]::IsNullOrWhiteSpace($EffectiveVaultType) -and $ExistingVault.Count -gt 0 -and $ExistingVault[0].PSObject.Properties["ModuleName"]){
            if([string]$ExistingVault[0].ModuleName -match "SecretManagement\.KeePass"){
                $EffectiveVaultType = "KeePass"
            }
        }

        if([string]::IsNullOrWhiteSpace($EffectiveVaultType)){
            $EffectiveVaultType = "Generic"
        }

        $EffectiveVaultParameters = @{}
        foreach($Key in $ExistingVaultParameters.Keys){
            $EffectiveVaultParameters[$Key] = $ExistingVaultParameters[$Key]
        }

        foreach($Key in $VaultParameters.Keys){
            $EffectiveVaultParameters[$Key] = $VaultParameters[$Key]
        }

        if(-not [string]::IsNullOrWhiteSpace($DatabasePath)){
            $EffectiveVaultParameters["Path"] = $DatabasePath
        }

        if(-not [string]::IsNullOrWhiteSpace($KeyPath)){
            $EffectiveVaultParameters["KeyPath"] = $KeyPath
        }

        if($DisableKeePassKeyFile){
            $EffectiveVaultParameters["KeyPath"] = $null
        }

        if($UseMasterPassword -and $DisableMasterPassword){
            throw "Use either [UseMasterPassword] or [DisableMasterPassword], not both."
        }

        foreach($SwitchName in @("UseMasterPassword", "UseWindowsAccount", "ShowFullTitle", "ShowRecycleBin", "SkipValidate")){
            if($PSBoundParameters.ContainsKey($SwitchName)){
                $EffectiveVaultParameters[$SwitchName] = [bool]$PSBoundParameters[$SwitchName]
            }
        }

        if($DisableMasterPassword){
            $EffectiveVaultParameters["UseMasterPassword"] = $false
        }

        if($PSCmdlet.ShouldProcess($Vault, "Update DSC configuration data credential provider settings")){
            $EffectiveMasterPasswordKeyPath = $MasterPasswordKeyPath
            if([string]::IsNullOrWhiteSpace($EffectiveMasterPasswordKeyPath) -and
                $ProviderInfo.ProviderSettings -is [System.Collections.IDictionary] -and
                $ProviderInfo.ProviderSettings.ContainsKey("MasterPassword") -and
                $ProviderInfo.ProviderSettings.MasterPassword -is [System.Collections.IDictionary] -and
                $ProviderInfo.ProviderSettings.MasterPassword.ContainsKey("KeyPath")){
                $EffectiveMasterPasswordKeyPath = [string]$ProviderInfo.ProviderSettings.MasterPassword.KeyPath
            }

            $CommandParameters = @{
                Provider = $Provider
                Vault = $Vault
                VaultType = $EffectiveVaultType
                SettingsPath = $SettingsPath
                VaultParameters = $EffectiveVaultParameters
                Force = $Force
                PassThru = $true
            }

            if(-not [string]::IsNullOrWhiteSpace($ModuleName)){
                $CommandParameters["ModuleName"] = $ModuleName
            }

            if($RegisterVault){
                $CommandParameters["RegisterVault"] = $true
            }

            if($DefaultVault){
                $CommandParameters["DefaultVault"] = $true
            }

            if($AllowClobber){
                $CommandParameters["AllowClobber"] = $true
            }

            if($null -ne $MasterPassword){
                $CommandParameters["MasterPassword"] = $MasterPassword
            }

            if(-not [string]::IsNullOrWhiteSpace($EffectiveMasterPasswordKeyPath)){
                $CommandParameters["MasterPasswordKeyPath"] = $EffectiveMasterPasswordKeyPath
            }

            $Result = Register-DSCConfigurationDataCredentialProvider @CommandParameters
        }

        if($PassThru){
            if($null -ne $Result){
                return $Result
            }

            return (Get-DSCConfigurationDataCredentialProvider -Provider $Provider -Vault $Vault -SettingsPath $SettingsPath)
        }
    }
}