1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# Copyright 2026 Heath Stewart.
# Licensed under the MIT License. See LICENSE.txt in the project root for license information.
#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
# Run with: Invoke-Pester tests/Keys.Tests.ps1
# Pass -Release to test a release build:
# $container = New-PesterContainer -Path ./tests/Keys.Tests.ps1 -Data @{ Release = $true }
# $config = New-PesterConfiguration
# $config.Run.Container = $container
# Invoke-Pester -Configuration $config
#
# Requires a provisioned Key Vault via `azd up` or AZURE_KEYVAULT_URL set in the environment.
param(
[switch] $Release
)
# cspell:ignore LASTEXITCODE
Describe 'Keys' -Tag 'Keys' {
BeforeAll {
# Build the binary before running tests.
$repoRoot = Join-Path $PSScriptRoot '..' -Resolve
if ($Release) {
Write-Host 'Building release binary...'
cargo build --release 2>&1
$script:akv = Join-Path $repoRoot 'target' 'release' 'akv'
} else {
Write-Host 'Building debug binary...'
cargo build 2>&1
$script:akv = Join-Path $repoRoot 'target' 'debug' 'akv'
}
if ($LASTEXITCODE -ne 0) {
throw "cargo build failed with exit code $LASTEXITCODE"
}
# Resolve AZURE_KEYVAULT_URL from the environment or via azd.
$script:AZURE_KEYVAULT_URL = if ($env:AZURE_KEYVAULT_URL) {
$env:AZURE_KEYVAULT_URL
} else {
azd env get-value AZURE_KEYVAULT_URL 2>$null
}
if (-not $script:AZURE_KEYVAULT_URL) {
throw "AZURE_KEYVAULT_URL is not set. Run 'azd up' to provision resources first."
}
$script:AZURE_KEYVAULT_URL = $script:AZURE_KEYVAULT_URL.TrimEnd('/')
$script:keyName = 'test-key'
# Create first key version. JSON output: versioned URL is at .key.kid.
$v1 = & $script:akv key create --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --type rsa --size 2048 --output json | ConvertFrom-Json
$script:keyV1Url = $v1.key.kid
# Create second key version by issuing create again with the same name.
& $script:akv key create --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --type rsa --size 2048 | Out-Null
}
Context 'Args' -Tag 'Args' {
It 'rejects URL with --name' {
& $script:akv key get $script:keyV1Url --name $script:keyName 2>$null
$LASTEXITCODE | Should -Be 2
}
It 'rejects URL with --version' {
$version = $script:keyV1Url.Split('/')[-1]
& $script:akv key get $script:keyV1Url --version $version 2>$null
$LASTEXITCODE | Should -Be 2
}
It 'rejects --version without --name' {
$version = $script:keyV1Url.Split('/')[-1]
& $script:akv key get --vault $script:AZURE_KEYVAULT_URL --version $version 2>$null
$LASTEXITCODE | Should -Be 2
}
}
Context 'Select by URL' -Tag 'URL' {
It 'edits a key using URL form' {
$result = & $script:akv key edit $script:keyV1Url --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Match "/keys/${script:keyName}/"
}
It 'lists versions using URL form' {
$versions = & $script:akv key list-versions $script:keyV1Url --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$versions.Count | Should -BeGreaterOrEqual 2
}
It 'gets a versioned key using URL form' {
$result = & $script:akv key get $script:keyV1Url --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Be $script:keyV1Url
}
It 'gets the latest (versionless) key using URL form' {
$versionlessUrl = "${script:AZURE_KEYVAULT_URL}/keys/${script:keyName}"
$result = & $script:akv key get $versionlessUrl --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Match "/keys/${script:keyName}/"
}
}
Context 'Select by --name' -Tag 'Name' {
It 'edits a key using --name' {
$result = & $script:akv key edit --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Match "/keys/${script:keyName}/"
}
It 'edits a versioned key using --name and --version' {
$version = $script:keyV1Url.Split('/')[-1]
$result = & $script:akv key edit --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --version $version --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Be $script:keyV1Url
}
It 'lists versions using --name' {
$versions = & $script:akv key list-versions --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$versions.Count | Should -BeGreaterOrEqual 2
}
It 'gets the latest key using --name' {
$result = & $script:akv key get --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Match "/keys/${script:keyName}/"
$result.key.kid | Should -Not -Be $script:keyV1Url
}
It 'gets a versioned key using --name and --version' {
$version = $script:keyV1Url.Split('/')[-1]
$result = & $script:akv key get --name $script:keyName --vault $script:AZURE_KEYVAULT_URL --version $version --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.key.kid | Should -Be $script:keyV1Url
}
}
}