xPSDesiredStateConfiguration

9.2.1

DSCResources/xFileUpload/xFileUpload.schema.psm1

$errorActionPreference = 'Stop'
Set-StrictMode -Version 'Latest'

$modulePath = Join-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent) -ChildPath 'Modules'

# Import the shared modules
Import-Module -Name (Join-Path -Path $modulePath `
    -ChildPath (Join-Path -Path 'xPSDesiredStateConfiguration.Common' `
        -ChildPath 'xPSDesiredStateConfiguration.Common.psm1'))

Import-Module -Name (Join-Path -Path $modulePath -ChildPath 'DscResource.Common')
<#
    .SYNOPSIS
        DSC Composite Resource uploads file or folder to an SMB share.
 
    .DESCRIPTION
        This is a DSC Composite resource that can be used to upload
        a file or folder into an SMB file share. The SMB file share
        does not have to be currently mounted. It will be mounted
        during the upload process using the optional Credential
        and then dismounted after completion of the upload.
 
    .PARAMETER DestinationPath
        The destination SMB share path to upload the file or folder to.
 
    .PARAMETER SourcePath
        The source path of the file or folder to upload.
 
    .PARAMETER Credential
        Credentials to access the destination SMB share path where file
        or folder should be uploaded.
 
    .PARAMETER certificateThumbprint
        Thumbprint of the certificate which should be used for encryption/decryption.
 
    .EXAMPLE
        $securePassword = ConvertTo-SecureString -String 'password' -AsPlainText -Force
        $credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 'domain\user', $securePassword
        xFileUpload `
            -DestinationPath '\\machine\share\destinationfolder' `
            -SourcePath 'C:\folder\file.txt' `
            -Credential $credential
#>
configuration xFileUpload
{
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '')]
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('DscResource.AnalyzerRules\Measure-Keyword', '', Justification = 'Script resource name is seen as a keyword if this is not used.')]
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.String]
        $DestinationPath,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.String]
        $SourcePath,

        [Parameter()]
        [System.Management.Automation.Credential()]
        [System.Management.Automation.PSCredential]
        $Credential,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    $cacheLocation = "$env:ProgramData\Microsoft\Windows\PowerShell\configuration\BuiltinProvCache\DSC_xFileUpload"

    if ($Credential)
    {
        $username = $Credential.UserName

        # Encrypt password
        $password = Invoke-Command `
            -ScriptBlock $getEncryptedPassword `
            -ArgumentList $Credential, $CertificateThumbprint
    }

    Script FileUpload
    {
        # Get script is not implemented cause reusing Script resource's schema does not make sense
        GetScript  = {
            return @{}
        };

        SetScript  = {
            # Generating credential object if password and username are specified
            $Credential = $null

            if (($using:password) -and ($using:username))
            {
                # Validate that certificate thumbprint is specified
                if (-not $using:CertificateThumbprint)
                {
                    $errorMessage = 'Certificate thumbprint has to be specified if credentials are present.'
                    Invoke-Command `
                        -ScriptBlock $using:throwTerminatingError `
                        -ArgumentList 'CertificateThumbprintIsRequired', $errorMessage, 'InvalidData'
                }

                Write-Debug -Message 'Username and password specified.'

                # Decrypt password
                $decryptedPassword = Invoke-Command `
                    -ScriptBlock $using:getDecryptedPassword `
                    -ArgumentList $using:password, $using:CertificateThumbprint

                # Generate credential
                $securePassword = ConvertTo-SecureString -String $decryptedPassword -AsPlainText -Force
                $Credential = New-Object `
                    -TypeName System.Management.Automation.PSCredential `
                    -ArgumentList ($using:username, $securePassword)
            }

            # Validate DestinationPath is UNC path
            if (-not ($using:DestinationPath -as [System.Uri]).isUnc)
            {
                $errorMessage = "Destination path $using:DestinationPath is not a valid UNC path."
                Invoke-Command `
                    -ScriptBlock $using:throwTerminatingError `
                    -ArgumentList 'DestinationPathIsNotUNCFailure', $errorMessage, 'InvalidData'
            }

            # Verify source is localpath
            if (-not (($using:SourcePath -as [System.Uri]).Scheme -match 'file'))
            {
                $errorMessage = "Source path $using:SourcePath has to be local path."
                Invoke-Command `
                    -ScriptBlock $using:throwTerminatingError `
                    -ArgumentList 'SourcePathIsNotLocalFailure', $errorMessage, 'InvalidData'
            }

            # Check whether source path is existing file or directory
            $sourcePathType = $null

            if (-not (Test-Path -Path $using:SourcePath))
            {
                $errorMessage = "Source path $using:SourcePath does not exist."
                Invoke-Command `
                    -ScriptBlock $using:throwTerminatingError `
                    -ArgumentList 'SourcePathDoesNotExistFailure', $errorMessage, 'InvalidData'
            }
            else
            {
                $item = Get-Item -Path $using:SourcePath

                switch ($item.GetType().Name)
                {
                    'FileInfo'
                    {
                        $sourcePathType = 'File'
                    }

                    'DirectoryInfo'
                    {
                        $sourcePathType = 'Directory'
                    }
                }
            }

            Write-Debug -Message "SourcePath $using:SourcePath is of type: $sourcePathType"

            $psDrive = $null

            # Mount the drive only if Credentials are specified and it's currently not accessible
            if ($Credential)
            {
                if (Test-Path -Path $using:DestinationPath -ErrorAction Ignore)
                {
                    Write-Debug -Message "Destination path $using:DestinationPath is already accessible. No mount needed."
                }
                else
                {
                    $psDriveArgs = @{
                        Name       = ([System.Guid]::NewGuid())
                        PSProvider = 'FileSystem'
                        Root       = $using:DestinationPath
                        Scope      = 'Private'
                        Credential = $Credential
                    }

                    try
                    {
                        Write-Debug -Message "Create psdrive with destination path $using:DestinationPath..."
                        $psDrive = New-PSDrive @psDriveArgs -ErrorAction Stop
                    }
                    catch
                    {
                        $errorMessage = "Cannot access destination path $using:DestinationPath with given Credential"
                        Invoke-Command `
                            -ScriptBlock $using:throwTerminatingError `
                            -ArgumentList 'DestinationPathNotAccessibleFailure', $errorMessage, 'InvalidData'
                    }
                }
            }

            try
            {
                # Get expected destination path
                $expectedDestinationPath = $null

                if (-not (Test-Path -Path $using:DestinationPath))
                {
                    # DestinationPath has to exist
                    $errorMessage = 'Invalid parameter values: DestinationPath does not exist, but has to be existing directory.'
                    Throw-TerminatingError -ErrorMessage $errorMessage -ErrorCategory 'InvalidData' -ErrorId 'DestinationPathDoesNotExistFailure'
                }
                else
                {
                    $item = Get-Item -Path $using:DestinationPath

                    switch ($item.GetType().Name)
                    {
                        'FileInfo'
                        {
                            # DestinationPath cannot be file
                            $errorMessage = 'Invalid parameter values: DestinationPath is file, but has to be existing directory.'
                            Invoke-Command `
                                -ScriptBlock $using:throwTerminatingError `
                                -ArgumentList 'DestinationPathCannotBeFileFailure', $errorMessage, 'InvalidData'
                        }

                        'DirectoryInfo'
                        {
                            $expectedDestinationPath = Join-Path `
                                -Path $using:DestinationPath `
                                -ChildPath (Split-Path -Path $using:SourcePath -Leaf)
                        }
                    }

                    Write-Debug -Message "ExpectedDestinationPath is $expectedDestinationPath"
                }

                # Copy destination path
                try
                {
                    Write-Debug -Message "Copying $using:SourcePath to $using:DestinationPath"
                    Copy-Item -Path $using:SourcePath -Destination $using:DestinationPath -Recurse -Force -ErrorAction Stop
                }
                catch
                {
                    $errorMessage = "Could not copy source path $using:SourcePath to $using:DestinationPath : $($_.Exception)"
                    Invoke-Command `
                        -ScriptBlock $using:throwTerminatingError `
                        -ArgumentList 'CopyDirectoryOverFileFailure', $errorMessage, 'InvalidData'
                }

                # Verify whether expectedDestinationPath was created
                if (-not (Test-Path -Path $expectedDestinationPath))
                {
                    $errorMessage = "Destination path $using:DestinationPath could not be created"
                    Invoke-Command `
                        -ScriptBlock $using:throwTerminatingError `
                        -ArgumentList 'DestinationPathNotCreatedFailure', $errorMessage, 'InvalidData'
                }
                # If expectedDestinationPath exists
                else
                {
                    Write-Verbose -Message "$sourcePathType $expectedDestinationPath has been successfully created"

                    # Update cache
                    $uploadedItem = Get-Item -Path $expectedDestinationPath
                    $lastWriteTime = $uploadedItem.LastWriteTimeUtc
                    $inputObject = @{}
                    $inputObject['LastWriteTimeUtc'] = $lastWriteTime
                    $key = [System.String]::Join('', @($using:DestinationPath, $using:SourcePath, $expectedDestinationPath)).GetHashCode().ToString()
                    $path = Join-Path $using:cacheLocation $key

                    if (-not (Test-Path -Path $using:cacheLocation))
                    {
                        New-Item -Path $using:cacheLocation -ItemType Directory | Out-Null
                    }

                    Write-Debug -Message "Updating cache for DestinationPath = $using:DestinationPath and SourcePath = $using:SourcePath. CacheKey = $key"
                    Export-CliXml -Path $path -InputObject $inputObject -Force
                }
            }
            finally
            {
                # Remove PSDrive
                if ($psDrive)
                {
                    Write-Debug -Message "Removing PSDrive on root $($psDrive.Root)"
                    Remove-PSDrive -Name $psDrive -Force
                }
            }
        };

        TestScript = {
            # Generating credential object if password and username are specified
            $Credential = $null

            if (($using:password) -and ($using:username))
            {
                # Validate that certificate thumbprint is specified
                if (-not $using:CertificateThumbprint)
                {
                    $errorMessage = 'Certificate thumbprint has to be specified if credentials are present.'
                    Invoke-Command `
                        -ScriptBlock $using:throwTerminatingError `
                        -ArgumentList 'CertificateThumbprintIsRequired', $errorMessage, 'InvalidData'
                }

                Write-Debug -Message 'Username and password specified. Generating credential'

                # Decrypt password
                $decryptedPassword = Invoke-Command `
                    -ScriptBlock $using:getDecryptedPassword `
                    -ArgumentList $using:password, $using:CertificateThumbprint

                # Generate credential
                $securePassword = ConvertTo-SecureString -String $decryptedPassword -AsPlainText -Force
                $Credential = New-Object `
                    -TypeName System.Management.Automation.PSCredential `
                    -ArgumentList ($using:username, $securePassword)
            }
            else
            {
                Write-Debug -Message 'No credentials specified.'
            }

            # Validate DestinationPath is UNC path
            if (-not ($using:DestinationPath -as [System.Uri]).isUnc)
            {
                $errorMessage = "Destination path $using:DestinationPath is not a valid UNC path."
                Invoke-Command `
                    -ScriptBlock $using:throwTerminatingError `
                    -ArgumentList 'DestinationPathIsNotUNCFailure', $errorMessage, 'InvalidData'

            }

            # Check whether source path is existing file or directory (needed for expectedDestinationPath)
            $sourcePathType = $null
            if (-not (Test-Path -Path $using:SourcePath))
            {
                $errorMessage = "Source path $using:SourcePath does not exist."
                Invoke-Command `
                    -ScriptBlock $using:throwTerminatingError `
                    -ArgumentList 'SourcePathDoesNotExistFailure', $errorMessage, 'InvalidData'
            }
            else
            {
                $item = Get-Item -Path $using:SourcePath

                switch ($item.GetType().Name)
                {
                    'FileInfo'
                    {
                        $sourcePathType = 'File'
                    }

                    'DirectoryInfo'
                    {
                        $sourcePathType = 'Directory'
                    }
                }
            }

            Write-Debug -Message "SourcePath $using:SourcePath is of type: $sourcePathType"

            $psDrive = $null

            # Mount the drive only if credentials are specified and it's currently not accessible
            if ($Credential)
            {
                if (Test-Path -Path $using:DestinationPath -ErrorAction Ignore)
                {
                    Write-Debug -Message "Destination path $using:DestinationPath is already accessible. No mount needed."
                }
                else
                {
                    $psDriveArgs = @{
                        Name       = ([System.Guid]::NewGuid())
                        PSProvider = 'FileSystem'
                        Root       = $using:DestinationPath
                        Scope      = 'Private'
                        Credential = $Credential

                    }
                    try
                    {
                        Write-Debug -Message "Create psdrive with destination path $using:DestinationPath..."
                        $psDrive = New-PSDrive @psDriveArgs -ErrorAction Stop
                    }
                    catch
                    {
                        $errorMessage = "Cannot access destination path $using:DestinationPath with given Credential"
                        Invoke-Command `
                            -ScriptBlock $using:throwTerminatingError `
                            -ArgumentList 'DestinationPathNotAccessibleFailure', $errorMessage, 'InvalidData'
                    }
                }
            }

            try
            {
                # Get expected destination path
                $expectedDestinationPath = $null

                if (-not (Test-Path -Path $using:DestinationPath))
                {
                    # DestinationPath has to exist
                    $errorMessage = 'Invalid parameter values: DestinationPath does not exist or is not accessible. DestinationPath has to be existing directory.'
                    Invoke-Command `
                        -ScriptBlock $using:throwTerminatingError `
                        -ArgumentList 'DestinationPathDoesNotExistFailure', $errorMessage, 'InvalidData'
                }
                else
                {
                    $item = Get-Item -Path $using:DestinationPath

                    switch ($item.GetType().Name)
                    {
                        'FileInfo'
                        {
                            # DestinationPath cannot be file
                            $errorMessage = 'Invalid parameter values: DestinationPath is file, but has to be existing directory.'
                            Invoke-Command `
                                -ScriptBlock $using:throwTerminatingError `
                                -ArgumentList 'DestinationPathCannotBeFileFailure', $errorMessage, 'InvalidData'
                        }

                        'DirectoryInfo'
                        {
                            $expectedDestinationPath = Join-Path `
                                -Path $using:DestinationPath `
                                -ChildPath (Split-Path -Path $using:SourcePath -Leaf)
                        }
                    }

                    Write-Debug -Message "ExpectedDestinationPath is $expectedDestinationPath"
                }

                # Check whether ExpectedDestinationPath exists and has expected type
                $itemExists = $false

                if (-not (Test-Path $expectedDestinationPath))
                {
                    Write-Debug -Message 'Expected destination path does not exist or is not accessible.'
                }
                # If expectedDestinationPath exists
                else
                {
                    $expectedItem = Get-Item -Path $expectedDestinationPath
                    $expectedItemType = $expectedItem.GetType().Name

                    # If expectedDestinationPath has same type as sourcePathType, we need to verify cache to determine whether no upload is needed
                    if ((($expectedItemType -eq 'FileInfo') -and ($sourcePathType -eq 'File')) -or `
                        (($expectedItemType -eq 'DirectoryInfo') -and ($sourcePathType -eq 'Directory')))
                    {
                        # Get cache
                        Write-Debug -Message "Getting cache for $expectedDestinationPath"
                        $cacheContent = $null
                        $key = [System.String]::Join('', @($using:DestinationPath, $using:SourcePath, $expectedDestinationPath)).GetHashCode().ToString()
                        $path = Join-Path -Path $using:cacheLocation -ChildPath $key
                        Write-Debug -Message "Looking for cache under $path"

                        if (-not (Test-Path -Path $path))
                        {
                            Write-Debug -Message "No cache found for DestinationPath = $using:DestinationPath and SourcePath = $using:SourcePath. CacheKey = $key"
                        }
                        else
                        {
                            $cacheContent = Import-CliXml -Path $path
                            Write-Debug -Message "Found cache for DestinationPath = $using:DestinationPath and SourcePath = $using:SourcePath. CacheKey = $key"
                        }

                        # Verify whether cache reflects current state or upload is needed
                        if ($cacheContent -ne $null -and ($cacheContent.LastWriteTimeUtc -eq $expectedItem.LastWriteTimeUtc))
                        {
                            # No upload needed
                            Write-Debug -Message 'Cache reflects current state. No need for upload.'
                            $itemExists = $true
                        }
                        else
                        {
                            Write-Debug -Message 'Cache is empty or it does not reflect current state. Upload will be performed.'
                        }
                    }
                    else
                    {
                        Write-Debug -Message "Expected destination path: $expectedDestinationPath is of type $expectedItemType, although source path is $sourcePathType"
                    }
                }
            }
            finally
            {
                # Remove PSDrive
                if ($psDrive)
                {
                    Write-Debug -Message "Removing PSDrive on root $($psDrive.Root)"
                    Remove-PSDrive -Name $psDrive -Force
                }
            }

            return $itemExists
        };
    }
}

# Encrypts password using the defined public key
[System.Management.Automation.ScriptBlock] $getEncryptedPassword = {
    param
    (
        [Parameter(Mandatory = $true)]
        [PSCredential]
        $Credential,

        [Parameter(Mandatory = $true)]
        [System.String]
        $CertificateThumbprint
    )

    $value = $Credential.GetNetworkCredential().Password

    $cert = Invoke-Command `
        -ScriptBlock $getCertificate `
        -ArgumentList $CertificateThumbprint

    $encryptedPassword = $null

    if ($cert)
    {
        # Cast the public key correctly
        $rsaProvider = [System.Security.Cryptography.RSACryptoServiceProvider] $cert.PublicKey.Key

        if ($rsaProvider -eq $null)
        {
            $errorMessage = "Could not get public key from certificate with thumbprint: $CertificateThumbprint . Please verify certificate is valid for encryption."
            Invoke-Command `
                -ScriptBlock $throwTerminatingError `
                -ArgumentList "DecryptionCertificateNotFound", $errorMessage, "InvalidOperation"
        }

        # Convert to a byte array
        $keybytes = [System.Text.Encoding]::UNICODE.GetBytes($value)

        # Add a null terminator to the byte array
        $keybytes += 0
        $keybytes += 0

        # Encrypt using the public key
        $encbytes = $rsaProvider.Encrypt($keybytes, $false)

        # Return a string
        $encryptedPassword = [Convert]::ToBase64String($encbytes)
    }
    else
    {
        $errorMessage = "Could not find certificate which matches thumbprint: $CertificateThumbprint . Could not encrypt password"
        Invoke-Command `
            -ScriptBlock $throwTerminatingError `
            -ArgumentList "EncryptionCertificateNot", $errorMessage, "InvalidOperation"
    }

    return $encryptedPassword
}

# Retrieves certificate by thumbprint
[System.Management.Automation.ScriptBlock] $getCertificate = {
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $CertificateThumbprint
    )

    $cert = $null

    foreach ($certIndex in (Get-Childitem -Path Cert:\LocalMachine\My))
    {
        if ($certIndex.Thumbprint -match $CertificateThumbprint)
        {
            $cert = $certIndex
            break
        }
    }

    if (-not $cert)
    {
        $errorMessage = "Error Reading certificate store for {0}. Please verify thumbprint is correct and certificate belongs to cert:\LocalMachine\My store." -f ${CertificateThumbprint};
        Invoke-Command `
            -ScriptBlock $throwTerminatingError `
            -ArgumentList "InvalidPathSpecified", $errorMessage, "InvalidOperation"
    }
    else
    {
        $cert
    }
}

# Throws terminating error specified errorCategory, errorId and errorMessage
[System.Management.Automation.ScriptBlock] $throwTerminatingError = {
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $ErrorId,

        [Parameter(Mandatory = $true)]
        [System.String]
        $ErrorMessage,

        [Parameter(Mandatory = $true)]
        $ErrorCategory
    )

    $exception = New-Object -TypeName System.InvalidOperationException -ArgumentList $ErrorMessage
    $errorRecord = New-Object -TypeName System.Management.Automation.ErrorRecord -ArgumentList ($exception, $ErrorId, $ErrorCategory, $null)
    throw $errorRecord
}

# Decrypts password using the defined private key
[System.Management.Automation.ScriptBlock] $getDecryptedPassword = {
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $Value,

        [Parameter(Mandatory = $true)]
        [System.String]
        $CertificateThumbprint
    )

    $cert = $null

    foreach ($certIndex in (Get-Childitem -Path Cert:\LocalMachine\My))
    {
        if ($certIndex.Thumbprint -match $CertificateThumbprint)
        {
            $cert = $certIndex
            break
        }
    }

    if (-not $cert)
    {
        $errorMessage = "Error Reading certificate store for {0}. Please verify thumbprint is correct and certificate belongs to cert:\LocalMachine\My store." -f ${CertificateThumbprint};
        $exception = New-Object -TypeName System.InvalidOperationException -ArgumentList $errorMessage
        $errorRecord = New-Object -TypeName System.Management.Automation.ErrorRecord -ArgumentList ($exception, "InvalidPathSpecified", "InvalidOperation", $null)
        throw $errorRecord
    }

    $decryptedPassword = $null

    # Get RSA provider
    $rsaProvider = [System.Security.Cryptography.RSACryptoServiceProvider] $cert.PrivateKey

    if ($rsaProvider -eq $null)
    {
        $errorMessage = "Could not get private key from certificate with thumbprint: $CertificateThumbprint . Please verify certificate is valid for decryption."
        $exception = New-Object -TypeName System.InvalidOperationException -ArgumentList $errorMessage
        $errorRecord = New-Object -TypeName System.Management.Automation.ErrorRecord -ArgumentList ($exception, "DecryptionCertificateNotFound", "InvalidOperation", $null)
        throw $errorRecord
    }

    # Convert to bytes array
    $encBytes = [Convert]::FromBase64String($value)

    # Decrypt bytes
    $decryptedBytes = $rsaProvider.Decrypt($encBytes, $false)

    # Convert to string
    $decryptedPassword = [System.Text.Encoding]::Unicode.GetString($decryptedBytes)

    return $decryptedPassword
}