1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
# Copyright 2026 Heath Stewart.
# Licensed under the MIT License. See LICENSE.txt in the project root for license information.
#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
# Run with: Invoke-Pester tests/Certificates.Tests.ps1
# Pass -Release to test a release build:
# $container = New-PesterContainer -Path ./tests/Certificates.Tests.ps1 -Data @{ Release = $true }
# $config = New-PesterConfiguration
# $config.Run.Container = $container
# Invoke-Pester -Configuration $config
#
# Requires a provisioned Key Vault via `azd up` or AZURE_KEYVAULT_URL set in the environment.
param(
[switch] $Release
)
# cspell:ignore LASTEXITCODE
Describe 'Certificates' -Tag 'Certificates' {
BeforeAll {
# Build the binary before running tests.
$repoRoot = Join-Path $PSScriptRoot '..' -Resolve
if ($Release) {
Write-Host 'Building release binary...'
cargo build --release 2>&1
$script:akv = Join-Path $repoRoot 'target' 'release' 'akv'
} else {
Write-Host 'Building debug binary...'
cargo build 2>&1
$script:akv = Join-Path $repoRoot 'target' 'debug' 'akv'
}
if ($LASTEXITCODE -ne 0) {
throw "cargo build failed with exit code $LASTEXITCODE"
}
# Resolve AZURE_KEYVAULT_URL from the environment or via azd.
$script:AZURE_KEYVAULT_URL = if ($env:AZURE_KEYVAULT_URL) {
$env:AZURE_KEYVAULT_URL
} else {
azd env get-value AZURE_KEYVAULT_URL 2>$null
}
if (-not $script:AZURE_KEYVAULT_URL) {
throw "AZURE_KEYVAULT_URL is not set. Run 'azd up' to provision resources first."
}
$script:AZURE_KEYVAULT_URL = $script:AZURE_KEYVAULT_URL.TrimEnd('/')
$script:certName = 'test-cert'
# Create certificate (polls until ready, may take ~30s).
# JSON output: versioned URL is at .id.
$v1 = & $script:akv certificate create --name $script:certName --vault $script:AZURE_KEYVAULT_URL --type ec --curve p256 --output json | ConvertFrom-Json
$script:certV1Url = $v1.id
}
Context 'Args' -Tag 'Args' {
It 'rejects URL with --name' {
& $script:akv certificate get $script:certV1Url --name $script:certName 2>$null
$LASTEXITCODE | Should -Be 2
}
It 'rejects URL with --version' {
$version = $script:certV1Url.Split('/')[-1]
& $script:akv certificate get $script:certV1Url --version $version 2>$null
$LASTEXITCODE | Should -Be 2
}
It 'rejects --version without --name' {
$version = $script:certV1Url.Split('/')[-1]
& $script:akv certificate get --vault $script:AZURE_KEYVAULT_URL --version $version 2>$null
$LASTEXITCODE | Should -Be 2
}
}
Context 'Select by URL' -Tag 'URL' {
It 'edits a certificate using URL form' {
$result = & $script:akv certificate edit $script:certV1Url --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/certificates/${script:certName}/"
$result.tags | Should -Not -BeNullOrEmpty
$result.tags.env | Should -Be 'test'
}
It 'lists versions using URL form' {
$versions = & $script:akv certificate list-versions $script:certV1Url --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$versions.Count | Should -BeGreaterOrEqual 1
}
It 'gets a versioned certificate using URL form' {
$result = & $script:akv certificate get $script:certV1Url --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Be $script:certV1Url
$result.cer | Should -Not -BeNullOrEmpty
}
It 'gets the latest (versionless) certificate using URL form' {
$versionlessUrl = "${script:AZURE_KEYVAULT_URL}/certificates/${script:certName}"
$result = & $script:akv certificate get $versionlessUrl --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/certificates/${script:certName}/"
$result.tags | Should -Not -BeNullOrEmpty
$result.tags.env | Should -Be 'test'
}
}
Context 'Select by --name' -Tag 'Name' {
It 'edits a certificate using --name' {
$result = & $script:akv certificate edit --name $script:certName --vault $script:AZURE_KEYVAULT_URL --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/certificates/${script:certName}/"
$result.tags | Should -Not -BeNullOrEmpty
$result.tags.env | Should -Be 'test'
}
It 'edits a versioned certificate using --name and --version' {
$version = $script:certV1Url.Split('/')[-1]
$result = & $script:akv certificate edit --name $script:certName --vault $script:AZURE_KEYVAULT_URL --version $version --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Be $script:certV1Url
$result.tags | Should -Not -BeNullOrEmpty
$result.tags.env | Should -Be 'test'
}
It 'lists versions using --name' {
$versions = & $script:akv certificate list-versions --name $script:certName --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$versions.Count | Should -BeGreaterOrEqual 1
}
It 'gets the latest certificate using --name' {
$result = & $script:akv certificate get --name $script:certName --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/certificates/${script:certName}/"
$result.tags | Should -Not -BeNullOrEmpty
$result.tags.env | Should -Be 'test'
}
It 'gets a versioned certificate using --name and --version' {
$version = $script:certV1Url.Split('/')[-1]
$result = & $script:akv certificate get --name $script:certName --vault $script:AZURE_KEYVAULT_URL --version $version --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Be $script:certV1Url
$result.cer | Should -Not -BeNullOrEmpty
}
}
}