functions/New-PasswordStateListPermission.ps1
|
function New-PasswordStateListPermission { [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingUserNameAndPassWordParams', '', Justification = '*UserID and *PasswordListID are not a user and not a password')] [cmdletbinding(SupportsShouldProcess = $true, DefaultParameterSetName = 'All')] param ( [parameter(ValueFromPipelineByPropertyName, Position = 0, Mandatory = $true)] [int32]$PasswordListID, [parameter(ValueFromPipelineByPropertyName, Position = 1, Mandatory = $true)] [ValidateSet('A', 'M', 'V')] [string]$Permission, [parameter(ValueFromPipelineByPropertyName, Position = 2, Mandatory = $false)] [ValidateLength(0, 100)] [string]$ApplyPermissionsForUserID = $null, [parameter(parameterSetName = 'PermissionID', Position = 3, ValueFromPipelineByPropertyName, Mandatory = $true)] [Nullable[System.Int32]]$ApplyPermissionsForSecurityGroupID = $null, [parameter(parameterSetName = 'PermissionName', Position = 3, ValueFromPipelineByPropertyName, Mandatory = $true)] [string]$ApplyPermissionsForSecurityGroupName = $null ) begin { switch ($Permission) { A { $PermissionLevel = "Admin" $AvailablePermissionLevel = @("Modify", "View", "Mobile Access") } M { $PermissionLevel = "Modify" $AvailablePermissionLevel = @("Admin", "View", "Mobile Access") } V { $PermissionLevel = "View" $AvailablePermissionLevel = @("Admin", "Modify", "Mobile Access") } } if ($ApplyPermissionsForUserID) { try { $AllPermissions = Get-PasswordStatePermission -ReportID 24 -UserID $ApplyPermissionsForUserID -ErrorAction Stop } catch { $_.Exception } if ($AllPermissions) { foreach ($Permissions in $AllPermissions) { if (($Permissions.PasswordListID -eq $PasswordListID) -and ($Permissions.$PermissionLevel -eq "Yes")) { throw "Permission '$Permission' ($PermissionLevel) on PasswordList '$($Permissions.PasswordList)' (ID '$PasswordListID') for UserID '$ApplyPermissionsForUserID' already exists!" } elseif ($Permissions.PasswordListID -eq $PasswordListID) { foreach ($AvailablePermission in $AvailablePermissionLevel) { if ($Permissions.$AvailablePermission -eq "Yes") { throw "UserID '$ApplyPermissionsForUserID' already has Permission '$AvailablePermission' on PasswordList '$($Permissions.PasswordList)' (ID '$PasswordListID')! Please use 'Set-PasswordStateListPermission -Permission '$Permission' -ApplyPermissionsForUserID '$ApplyPermissionsForUserID' -PasswordListID '$PasswordListID'' to update the permissions to type '$Permission' ($PermissionLevel)" } } } } } } if ($ApplyPermissionsForSecurityGroupName) { try { $AllPermissions = Get-PasswordStatePermission -ReportID 25 -SecurityGroupName $ApplyPermissionsForSecurityGroupName -ErrorAction Stop } catch { $_.Exception } if ($AllPermissions) { foreach ($Permissions in $AllPermissions) { if (($Permissions.PasswordListID -eq $PasswordListID) -and ($Permissions.$PermissionLevel -eq "Yes")) { throw "Permission '$Permission' ($PermissionLevel) on PasswordList '$($Permissions.PasswordList)' (ID '$PasswordListID') for SecurityGroup '$ApplyPermissionsForSecurityGroupName' already exists!" } elseif ($Permissions.PasswordListID -eq $PasswordListID) { foreach ($AvailablePermission in $AvailablePermissionLevel) { if ($Permissions.$AvailablePermission -eq "Yes") { throw "SecurityGroup '$ApplyPermissionsForSecurityGroupName' already has Permission '$AvailablePermission' on PasswordList '$($Permissions.PasswordList)' (ID '$PasswordListID')! Please use 'Set-PasswordStateListPermission -Permission '$Permission' -ApplyPermissionsForSecurityGroupName '$ApplyPermissionsForSecurityGroupName' -PasswordListID '$PasswordListID'' to update the permissions to type '$Permission' ($PermissionLevel)" } } } } } } if ($ApplyPermissionsForSecurityGroupID) { # Cannot validate SecurityGroupID for now because the api has not implemented a possibility to query the IDs of security groups in any method/report Continue } } process { # Build the Custom object to convert to json and send to the api. $body = [PSCustomObject]@{ "PasswordListID" = $PasswordListID "ApplyPermissionsForUserID" = $ApplyPermissionsForUserID "ApplyPermissionsForSecurityGroupID" = $ApplyPermissionsForSecurityGroupID "ApplyPermissionsForSecurityGroupName" = $ApplyPermissionsForSecurityGroupName "Permission" = $Permission } # Adding API Key to the body if using APIKey as Authentication Type to use the api instead of winAPI $penv = Get-PasswordStateEnvironment if ($penv.AuthType -eq "APIKey") { $body | Add-Member -MemberType NoteProperty -Name "APIKey" -Value $penv.Apikey } if ($PSCmdlet.ShouldProcess("PasswordListID $PasswordListID - Setting Permission '$Permission'. Applying to: User = '$ApplyPermissionsForUserID', SecurityGroup = '$ApplyPermissionsForSecurityGroupName' or SecurityGroupID = '$ApplyPermissionsForSecurityGroupID'")) { # Sort the CustomObject and then covert body to json and execute the api query $body = "$($body | ConvertTo-Json)" try { $output = New-PasswordStateResource -uri "/api/passwordlistpermissions" -body $body -ErrorAction Stop } catch { throw $_.Exception } } } end { if ($output) { return $output } } } |