gsadmin/PSInfisicalAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

Compare commits

base: gsadmin/PSInfisicalAPI:2026.7.31.101
Branches Tags
gsadmin/PSInfisicalAPI:main gsadmin/PSInfisicalAPI:dev
gsadmin/PSInfisicalAPI:2026.8.1.250 gsadmin/PSInfisicalAPI:2026.7.31.101 gsadmin/PSInfisicalAPI:2026.7.30.2359 gsadmin/PSInfisicalAPI:2026.7.30.2321 gsadmin/PSInfisicalAPI:2026.7.30.2309 gsadmin/PSInfisicalAPI:2026.7.30.2157 gsadmin/PSInfisicalAPI:2026.6.16.220 gsadmin/PSInfisicalAPI:2026.6.10.2048 gsadmin/PSInfisicalAPI:2026.6.10.2043 gsadmin/PSInfisicalAPI:2026.6.7.1438 gsadmin/PSInfisicalAPI:2026.6.7.21 gsadmin/PSInfisicalAPI:2026.6.6.2236 gsadmin/PSInfisicalAPI:2026.6.5.2049 gsadmin/PSInfisicalAPI:2026.6.5.1130
...
compare: gsadmin/PSInfisicalAPI:main
Branches Tags
gsadmin/PSInfisicalAPI:main gsadmin/PSInfisicalAPI:dev
gsadmin/PSInfisicalAPI:2026.8.1.250 gsadmin/PSInfisicalAPI:2026.7.31.101 gsadmin/PSInfisicalAPI:2026.7.30.2359 gsadmin/PSInfisicalAPI:2026.7.30.2321 gsadmin/PSInfisicalAPI:2026.7.30.2309 gsadmin/PSInfisicalAPI:2026.7.30.2157 gsadmin/PSInfisicalAPI:2026.6.16.220 gsadmin/PSInfisicalAPI:2026.6.10.2048 gsadmin/PSInfisicalAPI:2026.6.10.2043 gsadmin/PSInfisicalAPI:2026.6.7.1438 gsadmin/PSInfisicalAPI:2026.6.7.21 gsadmin/PSInfisicalAPI:2026.6.6.2236 gsadmin/PSInfisicalAPI:2026.6.5.2049 gsadmin/PSInfisicalAPI:2026.6.5.1130

16 Commits
2026.7.31.101 ... main

Author SHA1 Message Date
gsadmin e1a0547e73 Merge pull request 'Make -ProjectId optional across PKI cmdlets, add application filtering, and fix the Quick Start' (#23) from dev into main 
Reviewed-on: #23
 2026-08-01 02:49:46 +00:00
gsadmin 22c2db4a96 Repair the changelog and write up the seeding work
Publish to PowerShell Gallery / build (pull_request) Successful in 30s
Details
Publish to PowerShell Gallery / release (pull_request) Successful in 11s
Details
Publish to PowerShell Gallery / publish (pull_request) Successful in 8s
Details 
Two problems, one cause. Before 62131e7 the promotion step renamed the
Unreleased heading instead of consuming it, appending "(carried forward)" on
every build - one heading had accumulated the suffix seven times. Notes were
left stranded under 103 such headings while the version sections the release
workflow extracts held only their build line, so a release would have published
nothing. 62131e7 fixed the mechanism but never repaired the backlog, and
Unreleased was empty besides.

Consolidated the stranded notes under Unreleased and collapsed duplicate
version sections: 1441 lines to 570, with every one of the 144 bullets and 16
sub-headings still present, checked by diffing the sets before and after.

Described the seeding work of the last several commits, which was undocumented:
the enrollment protocols and where they are configured, the dynamic SCEP
challenge, auto-renew by default, and the four defects the first live run
exposed.

Verified the mechanism end to end - a build promotes the notes into its version
section, leaving Unreleased empty, and the workflow's extraction returns 245
lines rather than a bare build line. 340 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 22:46:14 -04:00
gsadmin b27fe6f002 Drop a stale variable from the profile creation log line 
The line still interpolated $enrollmentType, which went away when profile
creation stopped varying by enrollment method. Every run since had adopted
existing profiles, so the create path never executed and never surfaced it.
A run against an emptied project failed there immediately.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 22:34:27 -04:00
gsadmin c75cc145cb Enable enrollment protocols on the application, not by cloning profiles 
The enrollment methods were not appearing in the UI because they were being set
in the wrong place. A profile's own enrollmentType is one value, but that is
only the base; what the UI lists under an application - "configure how this
application will issue certificates via API, EST, ACME, or SCEP" - is a
separate configuration on the application-to-profile link, and those are
independent. A single profile can answer all four at once.

That replaces the previous approach. The mecm-...-scep and ec-...-acme profiles
are gone; there are three profiles again, one per policy, and each declares an
Enrollment block naming the protocols it should answer. Applied with PUT to
/applications/{id}/profiles/{id}/enrollment/{api,scep,acme}, which is idempotent
by nature, so a re-run restates the same settings. The routes take PUT, not
POST, and a POST there returns 404.

SCEP now uses a dynamic challenge, so there is no shared secret to distribute
or rotate; each request collects a one-time password from the challenge
endpoint. -ScepChallengePassword is kept for anyone who sets ChallengeType to
static, and is otherwise unused.

Enabling a protocol is what makes Infisical mint its endpoint - a SCEP URL,
challenge URL and RA certificate, or an ACME directory URL - so the run reads
them back and prints them, and returns them under Enrollment. None of it can be
derived from the configuration alone.

Verified against a live instance: scepConfigured and acmeConfigured come back
true on the intended profiles, the dynamic challenge settings round-trip, and a
re-run restates without creating anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 22:28:35 -04:00
gsadmin c40160f789 Seed SCEP and ACME enrollment alongside API, and auto-renew everywhere 
A profile carries exactly one enrollment method - Infisical rejects a mixed one
with "API enrollment type cannot have EST, ACME, or SCEP configuration" - so
reaching a policy over more than one method means a profile per method, sharing
the CA and policy. Added mecm-server-client-auth-scep and
ec-server-client-auth-acme next to the three API profiles.

SCEP for the RSA policy because that is how domain-joined Windows and mobile
clients enrol without a token, which is the NDES role SCCM/MECM would otherwise
need; RSA because SCEP client support for EC keys is patchy. ACME for the EC
server/client policy, for workloads that already speak it. Code signing stays
API only: SCEP and ACME prove control of a device or a DNS name, and neither
says anything about who may sign code.

A static SCEP profile needs a challenge password of at least eight characters.
Added -ScepChallengePassword, and when it is omitted the run generates one and
prints it once at the end, because Infisical will not hand it back afterwards.

ACME sets skipDnsOwnershipVerification. These are internal names from an
internal CA, and the DNS-01 challenge proves control of a public zone, so
leaving it enforced makes the profile unusable rather than safer. The comment
says so and says when to turn it off.

Auto-renew is now on for every API profile including code signing, at fourteen
days. It is an api-only setting; neither SCEP nor ACME has an equivalent,
because both have the client drive renewal itself.

Verified against a live instance: profiles create with their config ids
populated, a re-run creates nothing and does not reissue the challenge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 22:17:38 -04:00
gsadmin 3015138484 Make the seeding script survive real API responses and emit complete policies 
Ran the script against a live Infisical instance for the first time. It failed
at four separate points, each fixed here.

Responses are read through Get-ApiProperty/Get-ApiCollection/Get-ApiObject
rather than directly. Set-StrictMode makes an absent property terminating, and
the cert-manager routes return bare payloads - a naked array for a list, the
resource itself for a create - where the secrets and pki routes wrap theirs in
a named property. All eighteen reads now handle either shape. The
application-to-profile listing is a join row carrying profileId, not a profile
object with an id, so it is read accordingly.

Renamed the local $configuration inside the CA loop to $caConfiguration.
PowerShell variable names are case-insensitive, so from the second CA onward it
shadowed the script-level $Configuration block and every lookup into it failed.
Renamed the $profile loop variables for the same reason: $profile is an
automatic variable.

Policies now carry subject, sans, and signature algorithms, and profiles carry
defaults. The previous comment claimed omitting subject and sans left them
unconstrained; the opposite is true. Infisical refuses any attribute with no
policy entry ("no subject policies defined"), refuses a policy that defines no
signature algorithm, and refuses a request missing a usage the policy marks
required - Request-InfisicalCertificate sends none of its own, so the profile
default has to supply it. The enumeration list in the header dropped
domain_component, upn, and any_purpose, which the API does not accept.

Verified end to end: a clean run builds both CA hierarchies including the
subordinate CSR-sign-import sequence, and a re-run creates nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 22:02:24 -04:00
gsadmin 74d22a941c Fix the organization listing endpoint and stop blaming the token for it 
Seeding a real instance failed with "Route GET:/api/v2/organizations not found".
The route genuinely does not exist: /api/v2/organizations mounts only
/:organizationId/* sub-routes, and the listing lives on the singular
GET /api/v1/organization, which returns the same { organizations: [...] } shape.

The module had the same defect, so Get-InfisicalOrganization would have 404d on
any current server. ListOrganizations now prefers /api/v1/organization with the
v2 route retained as a fallback candidate, and the organization client invokes
with candidate fallback so the fallback can actually be reached. The endpoint
shape test expected the broken template and now expects the working one.

The script reported this as "The supplied -AccessToken was rejected ... it may
have expired", which sent the reader after a token that was seconds old and
perfectly valid. A 404 or a connection failure says nothing about the token, so
only a 401 or 403 now produces that message; anything else reports that the
instance could not be reached and states plainly that it is not a token problem.

The token probe also moves to /api/v1/projects, which is the next call the
script makes anyway, so a successful probe proves both the token and a route the
run actually depends on rather than one chosen only for validation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 21:23:33 -04:00
gsadmin f2a1492b66 Actually commit the seeding script, and let it authenticate with a token 
The seeding script was never in the repository. .gitignore carries "scripts/"
for local helper scripts, core.ignorecase is true on Windows, so Scripts/
matched it and git add -A silently skipped the file. The commit that claimed to
add the script contained only its CHANGELOG and README entries; the script
itself existed on disk and nowhere else. It now lives in Tools/, which is not
ignored, and the ignore rule says why so this cannot swallow shipped tooling
again.

The script also gains an -AccessToken parameter set alongside
-ClientId/-ClientSecret, so a throwaway instance can be seeded with the bearer
token from a signed-in browser session rather than by first creating a machine
identity. The two are mutually exclusive parameter sets, so supplying both is
rejected at binding rather than silently preferring one.

A supplied token is proven with a single read before anything is created. An
expired browser token is the common case, and failing there is much better than
failing midway through building a CA hierarchy and leaving a half-seeded
project behind; the error says as much and suggests copying a fresh one.

Renaming the internal token variable was not cosmetic. The script held the
bearer token in $Script:AccessToken, the same name as the new parameter, so
PowerShell applied the parameter's [ValidateNotNull()] to every assignment and
both authentication paths failed with "the value $null is not a valid value for
the AccessToken variable" before reaching the network. It is now
$Script:BearerToken.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 20:36:02 -04:00
gsadmin 9f6e81607d Publish the merged pull request description as the release body 
The release body was built solely from the CHANGELOG section, which is a
terse changelog entry rather than the account of what changed. Gitea's
pull_request webhook payload carries the description - PullRequest.Body is a
documented field on the API struct - so it is now passed to the release step as
PR_BODY and leads the release when present.

The CHANGELOG entry is kept behind a fold rather than dropped, so a release
records both the narrative and the versioned entry. With no description the
body falls back to the CHANGELOG exactly as before, and with neither it says so.

Co-author and generation trailers are stripped: they belong on the commit, not
on a published release page. The description supplies its own headings, so no
"## Changes" wrapper is added around it; the fallback branches emit one because
a bare changelog fragment needs it.

Verified by lifting the run: block straight out of the workflow and executing
it, so the test exercises the shipped code rather than a copy: a description
plus changelog produces the folded form, description-only omits the fold,
changelog-only falls back, neither produces the placeholder, and the trailers
are removed while the real content survives. Both workflows still parse as YAML
with the same three jobs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 20:15:24 -04:00
gsadmin 139d1f3a05 Add create, update, and delete for Certificate Manager configuration 
The module was read-only for PKI configuration, which is why standing up an
environment meant raw REST rather than cmdlets. Adds 15: New-, Set-, and Remove-
for certificate authorities, policies, profiles, applications, and PKI
subscribers.

New-InfisicalCertificateAuthority -Type Intermediate returns an authority that
can actually issue. Infisical creates a subordinate with status
pending-certificate and never invokes generateIntermediateCaCertificate from the
create path, so the cmdlet performs the remaining sequence: read the certificate
signing request, sign it with -ParentCaId, import the signed certificate and
chain back.

Policy and profile bodies are deeply nested, so the constraint objects and
per-enrollment-type config blocks are taken as dictionaries rather than as
dozens of parameters, matching how -Subject and -Metadata already work. Two
conversion details matter and are now pinned by tests:

  - PowerShell callers capitalise hashtable keys, and @{ Required = ... } was
    reaching the API as "Required", which its schema does not recognise. The
    constraint vocabulary is emitted lower-cased while every other key keeps its
    camelCase, since those are API field names supplied verbatim and lowercasing
    ttlDays or isCA would silently drop them.
  - An empty collection is omitted rather than sent. "allowed": [] reads to
    Infisical as "allow nothing", never what @{ Allowed = @() } was meant to
    express, and an entry carrying only "type" is rejected outright.

-EnrollmentConfig routes to the block matching -EnrollmentType so EST, ACME, and
SCEP settings arrive through one parameter. -AutoRenew is sent only when bound,
because a switch is false when absent and sending it unconditionally would
disable renewal on an update that never mentioned it.

-ProjectId is optional on all 15 and resolves as it does elsewhere. Every one
supports -WhatIf; Remove- cmdlets default to high confirm impact.

Also fixes Update-Changelog, which inserted the version heading above the notes
so the section the release workflow extracts held only the build line while the
notes stayed under Unreleased - every release published an empty changelog.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 17:41:13 -04:00
gsadmin 62131e7501 Promote the changelog notes into each version, and correct route ordering 
Update-Changelog inserted the version heading above the notes, so the section
the release workflow extracts contained only the build line while the actual
notes stayed under "Unreleased". Every release published an empty changelog. It
now promotes whatever sits under Unreleased into the version section and leaves
a fresh empty Unreleased above it, with the provenance line italicised and last
so it does not read as another entry in whichever section the notes ended on.
Re-running the same version remains a no-op, and a build with nothing to say
still produces a section.

SignCertificateByCa now prefers /api/v1/cert-manager over the older /api/v1/pki
route.

RetrieveCertificate and GetCertificateBundle deliberately keep the older route
first, which is the opposite of what it looks like. The /api/v1/pki route
resolves a certificate by serial number, which is what callers supply; the
cert-manager route takes a certificate ID and passes it through as
getCert({ id }), so it cannot answer a serial. Both remain registered so either
identifier resolves - which is what lets the metadata path look a certificate up
by ID - and a comment now records why reordering them would break serial
lookups.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 16:46:20 -04:00
gsadmin f1a6db14c7 Make the seeding script adopt an existing project and seed an application 
The script created a Certificate Manager project whenever the configured slug
did not match an existing one. Against an organization that already had one
that produced a second, which would then be unable to hold applications at all -
they are served only from the organization's active project. It now adopts the
existing project and says so, creating one only when the organization has none,
and notes when an organization has several that applications work in one.

It also seeds a certificate application and attaches the seeded profiles to it.
Applications are how the console groups profiles and how
Get-InfisicalCertificateProfile -ApplicationId scopes a lookup, so seeding
profiles without one left an environment the documented workflow could not
navigate. Profiles are attached at creation via profileIds, and an application
that already exists has only its missing profiles added.

Project discovery moves to /api/v1/projects, matching the module, and tolerates
either response shape.

Separately, the environment-variable discovery table listed ProjectId,
Environment, and SecretPath as discoverable Connect-Infisical parameters.
InfisicalEnvironmentResolver defines patterns for BaseUri, OrganizationId,
ClientId, ClientSecret, AccessToken, and ApiVersion only - the other three are
per-call parameters and were never resolved from the environment. Same defect as
the Quick Start, in the table immediately below it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 16:20:04 -04:00
gsadmin e7674af161 Bring the README examples in line with optional -ProjectId and add renewal 
Several examples still passed -ProjectId ($Project.Id) from a project lookup the
walkthrough no longer performs, so they read as though the parameter were still
required. Removed from the profile, policy, subscriber, and certificate
authority examples, and from the offline-fallback snippet.

The end-to-end example loses the site-specific application name, and the profile
selection collapses to one line. Its "Example output" section still showed the
project and certificate authority records the example stopped fetching, so it now
matches what the script actually emits, including the project-resolution line.

Adds a renewal example directly beneath, reusing the parameters built above so
the difference is visible as two added keys rather than a second wall of setup.
It notes that the call is safe to repeat, that reuse is matched on the issuing
profile and the SAN set so a changed profile or added name reissues, and that
-Force ignores both.

Also drops the note about $CertificateProfile versus the $Profile automatic
variable, which explained a naming choice the reader has no reason to care
about, and points the extension docs at ResolveCertManagerProjectId rather than
the ResolveProjectId name that no longer exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 16:13:58 -04:00
gsadmin a1e1d22e72 Treat a missing cert-manager project as an empty result rather than an error 
An organization that has not set up Certificate Manager has nothing to list, so
resolution now returns nothing instead of throwing, and the PKI Get-* cmdlets
return quietly. -Verbose explains what happened and what to do:

  -ProjectId was not supplied and this organization has no Certificate Manager
  project, so there is nothing to resolve to. Create one in Infisical
  (Certificate Management), or pass -ProjectId to target a specific project.

Without the guard the null would have travelled to the client layer and
surfaced as "ProjectId is required" from somewhere unrelated to the cause, so
each Get-* cmdlet returns as soon as resolution comes back empty.

Request-InfisicalCertificate deliberately proceeds, because profile issuance
does not need a project: only the reuse search does, and that already degrades
to a local match with a warning when the search cannot run.

Resolution is now attempted once per cmdlet instance rather than once per
non-null result, so an organization with no project does not re-query on every
call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 16:06:33 -04:00
gsadmin 276958e3a8 Resolve to the organization's active cert-manager project instead of erroring 
Several Certificate Manager projects in one organization is a normal
configuration, not an ambiguity to reject. Infisical designates one as the
organization's active project and serves certificate applications only from it:

  if (req.internalCertManagerProjectId !== activeProjectId) {
    throw new BadRequestError({ message: "Applications are only available on
    this organization's active Certificate Manager project." });
  }

So an application-centric workflow is single-project by design, and resolving to
the active project is what makes it work. Resolution now picks that project when
several exist, falling back to the first - saying so on the verbose stream -
when the organization designates none. Only an organization with no Certificate
Manager project at all still errors, because there is genuinely nothing to
resolve to.

Adds InfisicalOrganization.DefaultCertManagerProjectId, which is what the
organization record calls its active project, so the choice is read rather than
guessed.

Moves Get-InfisicalProject onto /api/v1/projects. /api/v1/workspace mounts
Infisical's deprecated project router; it is retained as a fallback candidate so
older servers keep working, and the endpoint shape test now expects the current
route.

The end-to-end README example drops to the four calls that actually do the work:
find the application, pick its profile, gather SANs, request. The project lookup
is gone because -ProjectId resolves itself, and the CA lookup is gone because the
profile already binds its issuing CA and -InstallChain installs the chain
regardless.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 15:58:56 -04:00
gsadmin 633f40c1fa Make -ProjectId optional across the PKI cmdlets and add application filtering 
The Infisical console never asks which Certificate Manager project to use. The
project is in the URL, but it is chosen implicitly - the service resolver takes
the single cert-manager project when an organization has exactly one - and
everything below it is presented as applications. Requiring -ProjectId on every
PKI cmdlet made the module stricter than the service it wraps.

-ProjectId is now optional on Get-InfisicalCertificateApplication,
-ApplicationEnrollment, -Authority, -Certificate, -CertificatePolicy,
-CertificateProfile, Get-InfisicalPkiSubscriber, and
Request-InfisicalCertificate. Omitting it applies the same rule the server
applies and reports the resolved project on the verbose stream; an organization
with several produces an error naming the candidates rather than guessing.

Resolution is client-side rather than deferred to the server because several PKI
endpoints carry the project in the URL path - /api/v1/projects/{projectId}/
pki-subscribers and .../certificates/search - and cannot fall back to the
server's resolver at all. Doing it in one place keeps path-scoped and
query-scoped endpoints behaving identically.

Get-InfisicalCertificate -SerialNumber no longer resolves a project, since
addressing a certificate by serial does not need one.

Adds -ApplicationId and -CaId to Get-InfisicalCertificateProfile, which the
profiles endpoint already supports as query filters, so a listing can be scoped
the way the console groups profiles. Get-InfisicalCertificate already accepted
-ApplicationId. The existing five-argument ListCertificateProfiles overload is
retained.

Also fixes the README Quick Start, which did not run: it passed -ProjectId and
-Environment to Connect-Infisical, which has neither, failing with "A parameter
cannot be found that matches parameter name 'ProjectId'". Project, environment,
and secret path are per-call parameters. Documents that a project contains
applications, since listing projects returning one entry while the console shows
several applications is the confusing part.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 15:25:09 -04:00
39 changed files with 5394 additions and 1252 deletions
Expand all files Collapse all files
.gitea/workflows/publish-psgallery.yml
+39 -3
View File
@@ -129,6 +129,7 @@ jobs:
COMMIT_SHA: ${{ github.sha }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_TITLE: ${{ github.event.pull_request.title }}
PR_BODY: ${{ github.event.pull_request.body }}
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
SERVER_URL: ${{ github.server_url }}
RUN_ID: ${{ github.run_id }}
@@ -175,7 +176,17 @@ jobs:
Write-Host " CHANGELOG section length: $($changelogSection.Length) chars"
Write-Host "==> [4/8] Building release body"
$changelogText = if ($changelogSection) { $changelogSection } else { '_No CHANGELOG section found for this version._' }
# The merged pull request description is the account written for humans, so it leads when present.
# Trailing co-author and generation trailers are dropped; they belong on the commit, not the release.
$prBody = ''
if (-not [string]::IsNullOrWhiteSpace($env:PR_BODY)) {
$prBody = ($env:PR_BODY -replace '(?m)^\s*(Co-Authored-By|Co-authored-by):.*$', '')
$prBody = ($prBody -replace '(?m)^\s*(Generated with|🤖 Generated with).*$', '')
$prBody = $prBody.Trim()
}
Write-Host " PR description length: $($prBody.Length) chars"
$sb = New-Object System.Text.StringBuilder
[void]$sb.AppendLine("**PSInfisicalAPI $($env:VERSION)**")
[void]$sb.AppendLine('')
@@ -188,8 +199,33 @@ jobs:
[void]$sb.AppendLine("| Merged PR | [#$($env:PR_NUMBER) $($env:PR_TITLE)]($prUrl) by @$($env:PR_AUTHOR) |")
[void]$sb.AppendLine("| Workflow run | [$($env:RUN_ID)]($runUrl) |")
[void]$sb.AppendLine('')
[void]$sb.AppendLine('## Changes')
[void]$sb.AppendLine($changelogText)
if ($prBody) {
# The description carries its own headings, so it is emitted without a wrapper.
[void]$sb.AppendLine($prBody)
# Folded so the release leads with the narrative but still records the changelog entry.
if ($changelogSection) {
[void]$sb.AppendLine('')
[void]$sb.AppendLine('<details>')
[void]$sb.AppendLine("<summary>CHANGELOG entry for $($env:VERSION)</summary>")
[void]$sb.AppendLine('')
[void]$sb.AppendLine($changelogSection)
[void]$sb.AppendLine('')
[void]$sb.AppendLine('</details>')
}
}
elseif ($changelogSection) {
[void]$sb.AppendLine('## Changes')
[void]$sb.AppendLine('')
[void]$sb.AppendLine($changelogSection)
}
else {
[void]$sb.AppendLine('## Changes')
[void]$sb.AppendLine('')
[void]$sb.AppendLine('_No pull request description or CHANGELOG section found for this version._')
}
[void]$sb.AppendLine('')
[void]$sb.AppendLine('## Install')
[void]$sb.AppendLine('```powershell')
.github/workflows/publish-psgallery.yml
+39 -3
View File
@@ -131,6 +131,7 @@ jobs:
COMMIT_SHA: ${{ github.sha }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_TITLE: ${{ github.event.pull_request.title }}
PR_BODY: ${{ github.event.pull_request.body }}
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
SERVER_URL: ${{ github.server_url }}
RUN_ID: ${{ github.run_id }}
@@ -177,7 +178,17 @@ jobs:
Write-Host " CHANGELOG section length: $($changelogSection.Length) chars"
Write-Host "==> [4/8] Building release body"
$changelogText = if ($changelogSection) { $changelogSection } else { '_No CHANGELOG section found for this version._' }
# The merged pull request description is the account written for humans, so it leads when present.
# Trailing co-author and generation trailers are dropped; they belong on the commit, not the release.
$prBody = ''
if (-not [string]::IsNullOrWhiteSpace($env:PR_BODY)) {
$prBody = ($env:PR_BODY -replace '(?m)^\s*(Co-Authored-By|Co-authored-by):.*$', '')
$prBody = ($prBody -replace '(?m)^\s*(Generated with|🤖 Generated with).*$', '')
$prBody = $prBody.Trim()
}
Write-Host " PR description length: $($prBody.Length) chars"
$sb = New-Object System.Text.StringBuilder
[void]$sb.AppendLine("**PSInfisicalAPI $($env:VERSION)**")
[void]$sb.AppendLine('')
@@ -190,8 +201,33 @@ jobs:
[void]$sb.AppendLine("| Merged PR | [#$($env:PR_NUMBER) $($env:PR_TITLE)]($prUrl) by @$($env:PR_AUTHOR) |")
[void]$sb.AppendLine("| Workflow run | [$($env:RUN_ID)]($runUrl) |")
[void]$sb.AppendLine('')
[void]$sb.AppendLine('## Changes')
[void]$sb.AppendLine($changelogText)
if ($prBody) {
# The description carries its own headings, so it is emitted without a wrapper.
[void]$sb.AppendLine($prBody)
# Folded so the release leads with the narrative but still records the changelog entry.
if ($changelogSection) {
[void]$sb.AppendLine('')
[void]$sb.AppendLine('<details>')
[void]$sb.AppendLine("<summary>CHANGELOG entry for $($env:VERSION)</summary>")
[void]$sb.AppendLine('')
[void]$sb.AppendLine($changelogSection)
[void]$sb.AppendLine('')
[void]$sb.AppendLine('</details>')
}
}
elseif ($changelogSection) {
[void]$sb.AppendLine('## Changes')
[void]$sb.AppendLine('')
[void]$sb.AppendLine($changelogSection)
}
else {
[void]$sb.AppendLine('## Changes')
[void]$sb.AppendLine('')
[void]$sb.AppendLine('_No pull request description or CHANGELOG section found for this version._')
}
[void]$sb.AppendLine('')
[void]$sb.AppendLine('## Install')
[void]$sb.AppendLine('```powershell')
.gitignore
+2 -1
View File
@@ -30,5 +30,6 @@ TestResults/
*.trx
*.coverage
## Local helper scripts (not part of the module)
## Local helper scripts (not part of the module). Case-insensitive on Windows, so this also matches
## Scripts/ - shipped tooling lives in Tools/ instead.
scripts/
CHANGELOG.md
+388 -1150
View File
File diff suppressed because one or more lines are too long
Module/PSInfisicalAPI/PSInfisicalAPI.psd1
+18 -3
View File
@@ -1,6 +1,6 @@
@{
RootModule = 'PSInfisicalAPI.psm1'
ModuleVersion = '2026.07.31.0045'
ModuleVersion = '2026.08.01.0245'
GUID = 'b8a2f3d4-7c51-4d2f-9e6a-1f0c8b3d4e51'
Author = 'Grace Solutions'
CompanyName = 'Grace Solutions'
@@ -62,7 +62,22 @@
'Write-InfisicalScepMdmProfileToWmi',
'Start-InfisicalProcess',
'Get-InfisicalEnvironmentVariable',
'Get-InfisicalSANList'
'Get-InfisicalSANList',
'New-InfisicalCertificateAuthority',
'Set-InfisicalCertificateAuthority',
'Remove-InfisicalCertificateAuthority',
'New-InfisicalCertificatePolicy',
'Set-InfisicalCertificatePolicy',
'Remove-InfisicalCertificatePolicy',
'New-InfisicalCertificateProfile',
'Set-InfisicalCertificateProfile',
'Remove-InfisicalCertificateProfile',
'New-InfisicalCertificateApplication',
'Set-InfisicalCertificateApplication',
'Remove-InfisicalCertificateApplication',
'New-InfisicalPkiSubscriber',
'Set-InfisicalPkiSubscriber',
'Remove-InfisicalPkiSubscriber'
)
AliasesToExport = @()
VariablesToExport = @()
@@ -74,7 +89,7 @@
LicenseUri = 'https://www.gnu.org/licenses/agpl-3.0.html'
ProjectUri = 'https://prod.git.gracesolution.info/gsadmin/PSInfisicalAPI'
ReleaseNotes = 'See CHANGELOG.md in the project repository for release history.'
CommitHash = 'd47a5af6b3a6'
CommitHash = 'b27fe6f002f4'
}
}
}
Module/PSInfisicalAPI/bin/PSInfisicalAPI.dll
BIN
View File
Binary file not shown.
Module/PSInfisicalAPI/bin/en-US/PSInfisicalAPI.dll-Help.xml
+436
View File
@@ -1066,6 +1066,7 @@ $RemoveInfisicalTagResult = Remove-InfisicalTag @RemoveInfisicalTagParameters</d
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>-ProjectId is optional. The Infisical console never asks which Certificate Manager project to use, because its resolver selects the single cert-manager project when an organization has exactly one; omitting -ProjectId applies the same rule and reports the resolved project on the verbose stream. Pass it explicitly when an organization has more than one, in which case the error lists the candidates. Note that a project contains applications: Get-InfisicalProject -Type cert-manager returns the project, while Get-InfisicalCertificateApplication returns the applications inside it.</maml:para>
<maml:para>ByID retrieval currently always resolves against the internal CA endpoint. CA Ids returned here are the values to pass on -CertificateAuthorityId to Request-InfisicalCertificate. The Type property distinguishes 'internal' from 'acme' when -Kind Any is used. Only CAs whose EnableDirectIssuance property is True can sign a CSR through -CertificateAuthorityId; the others must issue through Request-InfisicalCertificate -CertificateProfileId, which bypasses that check. EnableDirectIssuance is fixed at CA creation and appears in no Infisical update schema, so it cannot be toggled afterwards; a CA migrated from the older requireTemplateForIssuance column reads False permanently.</maml:para>
</maml:alert>
</maml:alertSet>
@@ -2103,4 +2104,439 @@ $Sans = Get-InfisicalSANList @GetInfisicalSANListParameters</dev:code>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificateAuthority</command:name>
<maml:description><maml:para>Creates an internal Infisical certificate authority, signing a subordinate with its parent.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificateAuthority</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a root or intermediate internal certificate authority in a Certificate Manager project. A root is self-signed on creation. Infisical creates an intermediate pending a certificate and exposes no single call that completes it, so this cmdlet performs the remaining sequence itself: it reads the certificate signing request, signs it with the authority named by -ParentCaId, and imports the signed certificate and chain back, returning an authority that is ready to issue. -NotAfter defaults to ten years for a root and five for an intermediate; -MaxPathLength defaults to 1 for a root and 0 otherwise. -ProjectId is optional and resolves to the organization&apos;s Certificate Manager project.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Certificate authorities created through the API always have direct issuance disabled, because Infisical&apos;s creation service sets it explicitly and exposes no way to change it afterwards. Issue through a certificate profile, which does not consult that flag. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>$Root = New-InfisicalCertificateAuthority -Name &apos;root-ca&apos; -Type Root -CommonName &apos;Contoso Root Certificate Authority&apos; -Organization &apos;Contoso&apos; -Country &apos;US&apos;</dev:code>
<dev:remarks><maml:para>Creates a self-signed root valid for ten years.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificateAuthority -Name &apos;issuing-ca&apos; -Type Intermediate -ParentCaId $Root.Id -CommonName &apos;Contoso Issuing Certificate Authority&apos; -KeyAlgorithm &apos;EC_secp384r1&apos;</dev:code>
<dev:remarks><maml:para>Creates a subordinate, signs it with the root, and imports the signed certificate so it can issue immediately.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificateAuthority</command:name>
<maml:description><maml:para>Renames an internal Infisical certificate authority or changes its status.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificateAuthority</command:noun>
</command:details>
<maml:description>
<maml:para>Updates the name or status of an internal certificate authority. Infisical&apos;s update schema accepts only these two fields; subject, key algorithm, and validity are fixed when the authority is created. Supply -PassThru to emit the updated record.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Disabling an authority stops it issuing without deleting it or the certificates it has already signed. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificateAuthority -CaId $Ca.Id -Status disabled</dev:code>
<dev:remarks><maml:para>Stops the authority issuing new certificates.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificateAuthority -CaId $Ca.Id -Name &apos;retired-issuing-ca&apos; -PassThru</dev:code>
<dev:remarks><maml:para>Renames the authority and emits the updated record.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificateAuthority</command:name>
<maml:description><maml:para>Deletes an internal Infisical certificate authority.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificateAuthority</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes an internal certificate authority from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. Certificates already issued by the authority stop chaining to a known issuer once it is gone, and any subordinate beneath it is orphaned. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificateAuthority -CaId $Ca.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the authority without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificateAuthority -Kind Internal | Where-Object {($_.Status -eq &apos;disabled&apos;)} | Remove-InfisicalCertificateAuthority</dev:code>
<dev:remarks><maml:para>Removes every disabled authority, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificatePolicy</command:name>
<maml:description><maml:para>Creates an Infisical certificate policy that constrains what a profile may issue.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificatePolicy</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a certificate policy: the constraints a certificate profile issues within. Subject attributes, subject alternative names, key usages, and extended key usages are each expressed as allowed, required, and denied sets, supplied as dictionaries so the nested shape stays readable. -MaxValidity caps certificate lifetime, -KeyAlgorithm and -SignatureAlgorithm restrict the cryptography. A constraint that is not supplied leaves that dimension unconstrained, which is what fleet enrollment needs so each machine can present its own name.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Constraint values use Infisical&apos;s snake_case names: digital_signature, key_encipherment, server_auth, client_auth, code_signing, common_name, dns_name, ip_address. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalCertificatePolicy -Name &apos;server-auth&apos; -MaxValidity &apos;90d&apos; -KeyAlgorithm &apos;RSA_2048&apos;,&apos;EC_secp384r1&apos; -KeyUsage @{ Required = @(&apos;digital_signature&apos;,&apos;key_encipherment&apos;) } -ExtendedKeyUsage @{ Required = @(&apos;server_auth&apos;,&apos;client_auth&apos;) }</dev:code>
<dev:remarks><maml:para>Creates a policy for server and client authentication, leaving subject and SANs unconstrained.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificatePolicy -Name &apos;code-signing&apos; -MaxValidity &apos;365d&apos; -ExtendedKeyUsage @{ Required = @(&apos;code_signing&apos;); Denied = @(&apos;server_auth&apos;,&apos;client_auth&apos;) } -SubjectAlternativeName @(@{ Type = &apos;dns_name&apos;; Allowed = @(&apos;*.contoso.com&apos;) })</dev:code>
<dev:remarks><maml:para>Creates a code signing policy that forbids TLS usage and restricts DNS names to one suffix.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificatePolicy</command:name>
<maml:description><maml:para>Updates an Infisical certificate policy.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificatePolicy</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a certificate policy. Only the constraints supplied on the command line are sent; anything omitted keeps its stored value. Supply -PassThru to emit the updated policy.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Changing a policy affects every profile bound to it, and therefore every future certificate those profiles issue. Certificates already issued are unaffected. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificatePolicy -PolicyId $Policy.Id -MaxValidity &apos;30d&apos;</dev:code>
<dev:remarks><maml:para>Shortens the maximum lifetime, leaving every other constraint as it was.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificatePolicy -PolicyId $Policy.Id -ExtendedKeyUsage @{ Required = @(&apos;server_auth&apos;) } -PassThru</dev:code>
<dev:remarks><maml:para>Narrows the extended key usage and emits the updated policy.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificatePolicy</command:name>
<maml:description><maml:para>Deletes an Infisical certificate policy.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificatePolicy</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a certificate policy from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. A profile bound to the policy cannot issue once it is gone, so remove or repoint dependent profiles first. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificatePolicy -PolicyId $Policy.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the policy without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificatePolicy | Where-Object {($_.Name -like &apos;test-*&apos;)} | Remove-InfisicalCertificatePolicy</dev:code>
<dev:remarks><maml:para>Removes every policy whose name begins with test-, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificateProfile</command:name>
<maml:description><maml:para>Creates an Infisical certificate profile that binds an issuing authority to a policy.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificateProfile</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a certificate profile: the object Request-InfisicalCertificate -CertificateProfileId issues against. A profile binds an issuing certificate authority to a certificate policy and exposes it for one enrollment type. -Slug accepts lowercase letters, numbers, and hyphens. -EnrollmentConfig carries the settings for the chosen -EnrollmentType, so EST, ACME, and SCEP settings all arrive through one parameter; for the default api type, -AutoRenew and -RenewBeforeDays are folded into it.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Profile issuance is the only path that does not consult the issuing authority&apos;s direct-issuance flag, so a profile issues successfully against an authority whose EnableDirectIssuance is False. Unlike a PKI subscriber, a profile accepts a per-request common name, which is what makes it suitable for fleet enrollment. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalCertificateProfile -Slug &apos;server-auth&apos; -CertificatePolicyId $Policy.Id -CaId $Ca.Id</dev:code>
<dev:remarks><maml:para>Creates an API enrollment profile bound to a policy and issuing authority.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificateProfile -Slug &apos;workload&apos; -CertificatePolicyId $Policy.Id -CaId $Ca.Id -AutoRenew -RenewBeforeDays 14 -Defaults @{ ttlDays = 90 }</dev:code>
<dev:remarks><maml:para>Creates a profile that renews issued certificates fourteen days before expiry and defaults to a ninety day lifetime.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificateProfile</command:name>
<maml:description><maml:para>Updates an Infisical certificate profile.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificateProfile</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a certificate profile. Only the values supplied on the command line are sent; anything omitted keeps its stored value, including the enrollment type unless -EnrollmentType is passed explicitly. Supply -PassThru to emit the updated profile.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Repointing a profile at a different policy or issuing authority changes what future requests produce. Because certificate reuse is scoped by profile, Request-InfisicalCertificate keeps reusing certificates the profile issued previously until they fall inside their renewal window. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificateProfile -ProfileId $Profile.Id -CertificatePolicyId $NewPolicy.Id</dev:code>
<dev:remarks><maml:para>Repoints the profile at a different policy.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificateProfile -ProfileId $Profile.Id -AutoRenew -RenewBeforeDays 7 -PassThru</dev:code>
<dev:remarks><maml:para>Enables automatic renewal seven days before expiry and emits the updated profile.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificateProfile</command:name>
<maml:description><maml:para>Deletes an Infisical certificate profile.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificateProfile</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a certificate profile from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. Any script requesting certificates through the profile fails once it is gone, and the profile is detached from every application that referenced it. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificateProfile -ProfileId $Profile.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the profile without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificateProfile -ApplicationId $Application.Id | Remove-InfisicalCertificateProfile</dev:code>
<dev:remarks><maml:para>Removes every profile attached to an application, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificateApplication</command:name>
<maml:description><maml:para>Creates an Infisical certificate application to group profiles and certificates.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificateApplication</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a certificate application: the grouping the Infisical console presents profiles, members, and certificates under, and the scope Get-InfisicalCertificateProfile -ApplicationId and Get-InfisicalCertificate -ApplicationId filter by. Certificate profiles can be attached at creation with -ProfileId.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Applications are served only from the organization&apos;s active Certificate Manager project. Creating one in any other cert-manager project fails, which is why -ProjectId resolves to the active project when it is not supplied. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalCertificateApplication -Name &apos;platform&apos; -Description &apos;Endpoint and workload certificates&apos;</dev:code>
<dev:remarks><maml:para>Creates an empty application.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificateApplication -Name &apos;platform&apos; -ProfileId $ServerProfile.Id, $CodeSigningProfile.Id</dev:code>
<dev:remarks><maml:para>Creates an application with two profiles already attached.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificateApplication</command:name>
<maml:description><maml:para>Renames an Infisical certificate application or changes which profiles it holds.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificateApplication</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a certificate application. -Name and -Description change the record; -AddProfileId and -RemoveProfileId change which certificate profiles the application groups. The record and its profile attachments are separate endpoints, so supplying only profile parameters skips the record update entirely. Supply -PassThru to emit the updated application.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Detaching a profile does not delete it; the profile continues to exist and issue, it is simply no longer grouped under the application. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificateApplication -ApplicationId $Application.Id -AddProfileId $Profile.Id</dev:code>
<dev:remarks><maml:para>Attaches a profile to the application.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificateApplication -ApplicationId $Application.Id -Name &apos;endpoint-management&apos; -RemoveProfileId $Old.Id -PassThru</dev:code>
<dev:remarks><maml:para>Renames the application, detaches a profile, and emits the updated record.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificateApplication</command:name>
<maml:description><maml:para>Deletes an Infisical certificate application.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificateApplication</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a certificate application from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. The profiles the application grouped are not deleted, but scripts that locate a profile by application can no longer find it. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificateApplication -ApplicationId $Application.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the application without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificateApplication | Where-Object {($_.CertificateCount -eq 0)} | Remove-InfisicalCertificateApplication</dev:code>
<dev:remarks><maml:para>Removes every application holding no certificates, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalPkiSubscriber</command:name>
<maml:description><maml:para>Creates an Infisical PKI subscriber, a named enrollment identity with a fixed common name.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalPkiSubscriber</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a PKI subscriber: a named enrollment identity that pins one common name, an allowlist of subject alternative names, a lifetime, and the permitted key usages, so a request carries only a certificate signing request. -CommonName is the identity the subscriber issues for, and -SubjectAlternativeName is an allowlist rather than a default.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>A subscriber is a single identity, not a template. Infisical rejects any request whose certificate signing request names a different common name, and rejects any subject alternative name outside the allowlist, so enrolling many machines through subscribers means one subscriber per machine. Use a certificate profile for fleet enrollment. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalPkiSubscriber -Name &apos;web01&apos; -CommonName &apos;WEB01.contoso.com&apos; -CaId $Ca.Id -Ttl &apos;90d&apos;</dev:code>
<dev:remarks><maml:para>Creates a subscriber for one host.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalPkiSubscriber -Name &apos;web01&apos; -CommonName &apos;WEB01.contoso.com&apos; -CaId $Ca.Id -Ttl &apos;90d&apos; -SubjectAlternativeName &apos;WEB01&apos;,&apos;WEB01.contoso.com&apos; -ExtendedKeyUsage &apos;serverAuth&apos;,&apos;clientAuth&apos;</dev:code>
<dev:remarks><maml:para>Creates a subscriber that also permits two subject alternative names and restricts extended key usage.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalPkiSubscriber</command:name>
<maml:description><maml:para>Updates an Infisical PKI subscriber.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalPkiSubscriber</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a PKI subscriber, addressed by its current -Name. Only the values supplied on the command line are sent; anything omitted keeps its stored value. -NewName renames the subscriber. Supply -PassThru to emit the updated record.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Changing -CommonName changes the identity the subscriber issues for, so any script signing against it must present a matching certificate signing request afterwards. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalPkiSubscriber -Name &apos;web01&apos; -Ttl &apos;30d&apos;</dev:code>
<dev:remarks><maml:para>Shortens the lifetime of certificates issued for the subscriber.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalPkiSubscriber -Name &apos;web01&apos; -SubjectAlternativeName &apos;WEB01&apos;,&apos;WEB01.contoso.com&apos;,&apos;www.contoso.com&apos; -PassThru</dev:code>
<dev:remarks><maml:para>Extends the permitted subject alternative names and emits the updated subscriber.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalPkiSubscriber</command:name>
<maml:description><maml:para>Deletes an Infisical PKI subscriber.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalPkiSubscriber</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a PKI subscriber from a Certificate Manager project, addressed by name. -PassThru emits the removed name for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. Any script signing through the subscriber fails once it is gone. Certificates already issued are unaffected. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalPkiSubscriber -Name &apos;web01&apos; -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the subscriber without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalPkiSubscriber | Where-Object {($_.Status -ne &apos;active&apos;)} | Remove-InfisicalPkiSubscriber</dev:code>
<dev:remarks><maml:para>Removes every inactive subscriber, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
</helpItems>
Module/PSInfisicalAPI/en-US/PSInfisicalAPI.dll-Help.xml
+436
View File
@@ -1066,6 +1066,7 @@ $RemoveInfisicalTagResult = Remove-InfisicalTag @RemoveInfisicalTagParameters</d
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>-ProjectId is optional. The Infisical console never asks which Certificate Manager project to use, because its resolver selects the single cert-manager project when an organization has exactly one; omitting -ProjectId applies the same rule and reports the resolved project on the verbose stream. Pass it explicitly when an organization has more than one, in which case the error lists the candidates. Note that a project contains applications: Get-InfisicalProject -Type cert-manager returns the project, while Get-InfisicalCertificateApplication returns the applications inside it.</maml:para>
<maml:para>ByID retrieval currently always resolves against the internal CA endpoint. CA Ids returned here are the values to pass on -CertificateAuthorityId to Request-InfisicalCertificate. The Type property distinguishes 'internal' from 'acme' when -Kind Any is used. Only CAs whose EnableDirectIssuance property is True can sign a CSR through -CertificateAuthorityId; the others must issue through Request-InfisicalCertificate -CertificateProfileId, which bypasses that check. EnableDirectIssuance is fixed at CA creation and appears in no Infisical update schema, so it cannot be toggled afterwards; a CA migrated from the older requireTemplateForIssuance column reads False permanently.</maml:para>
</maml:alert>
</maml:alertSet>
@@ -2103,4 +2104,439 @@ $Sans = Get-InfisicalSANList @GetInfisicalSANListParameters</dev:code>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificateAuthority</command:name>
<maml:description><maml:para>Creates an internal Infisical certificate authority, signing a subordinate with its parent.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificateAuthority</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a root or intermediate internal certificate authority in a Certificate Manager project. A root is self-signed on creation. Infisical creates an intermediate pending a certificate and exposes no single call that completes it, so this cmdlet performs the remaining sequence itself: it reads the certificate signing request, signs it with the authority named by -ParentCaId, and imports the signed certificate and chain back, returning an authority that is ready to issue. -NotAfter defaults to ten years for a root and five for an intermediate; -MaxPathLength defaults to 1 for a root and 0 otherwise. -ProjectId is optional and resolves to the organization&apos;s Certificate Manager project.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Certificate authorities created through the API always have direct issuance disabled, because Infisical&apos;s creation service sets it explicitly and exposes no way to change it afterwards. Issue through a certificate profile, which does not consult that flag. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>$Root = New-InfisicalCertificateAuthority -Name &apos;root-ca&apos; -Type Root -CommonName &apos;Contoso Root Certificate Authority&apos; -Organization &apos;Contoso&apos; -Country &apos;US&apos;</dev:code>
<dev:remarks><maml:para>Creates a self-signed root valid for ten years.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificateAuthority -Name &apos;issuing-ca&apos; -Type Intermediate -ParentCaId $Root.Id -CommonName &apos;Contoso Issuing Certificate Authority&apos; -KeyAlgorithm &apos;EC_secp384r1&apos;</dev:code>
<dev:remarks><maml:para>Creates a subordinate, signs it with the root, and imports the signed certificate so it can issue immediately.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificateAuthority</command:name>
<maml:description><maml:para>Renames an internal Infisical certificate authority or changes its status.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificateAuthority</command:noun>
</command:details>
<maml:description>
<maml:para>Updates the name or status of an internal certificate authority. Infisical&apos;s update schema accepts only these two fields; subject, key algorithm, and validity are fixed when the authority is created. Supply -PassThru to emit the updated record.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Disabling an authority stops it issuing without deleting it or the certificates it has already signed. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificateAuthority -CaId $Ca.Id -Status disabled</dev:code>
<dev:remarks><maml:para>Stops the authority issuing new certificates.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificateAuthority -CaId $Ca.Id -Name &apos;retired-issuing-ca&apos; -PassThru</dev:code>
<dev:remarks><maml:para>Renames the authority and emits the updated record.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificateAuthority</command:name>
<maml:description><maml:para>Deletes an internal Infisical certificate authority.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificateAuthority</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes an internal certificate authority from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. Certificates already issued by the authority stop chaining to a known issuer once it is gone, and any subordinate beneath it is orphaned. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificateAuthority -CaId $Ca.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the authority without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificateAuthority -Kind Internal | Where-Object {($_.Status -eq &apos;disabled&apos;)} | Remove-InfisicalCertificateAuthority</dev:code>
<dev:remarks><maml:para>Removes every disabled authority, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificatePolicy</command:name>
<maml:description><maml:para>Creates an Infisical certificate policy that constrains what a profile may issue.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificatePolicy</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a certificate policy: the constraints a certificate profile issues within. Subject attributes, subject alternative names, key usages, and extended key usages are each expressed as allowed, required, and denied sets, supplied as dictionaries so the nested shape stays readable. -MaxValidity caps certificate lifetime, -KeyAlgorithm and -SignatureAlgorithm restrict the cryptography. A constraint that is not supplied leaves that dimension unconstrained, which is what fleet enrollment needs so each machine can present its own name.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Constraint values use Infisical&apos;s snake_case names: digital_signature, key_encipherment, server_auth, client_auth, code_signing, common_name, dns_name, ip_address. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalCertificatePolicy -Name &apos;server-auth&apos; -MaxValidity &apos;90d&apos; -KeyAlgorithm &apos;RSA_2048&apos;,&apos;EC_secp384r1&apos; -KeyUsage @{ Required = @(&apos;digital_signature&apos;,&apos;key_encipherment&apos;) } -ExtendedKeyUsage @{ Required = @(&apos;server_auth&apos;,&apos;client_auth&apos;) }</dev:code>
<dev:remarks><maml:para>Creates a policy for server and client authentication, leaving subject and SANs unconstrained.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificatePolicy -Name &apos;code-signing&apos; -MaxValidity &apos;365d&apos; -ExtendedKeyUsage @{ Required = @(&apos;code_signing&apos;); Denied = @(&apos;server_auth&apos;,&apos;client_auth&apos;) } -SubjectAlternativeName @(@{ Type = &apos;dns_name&apos;; Allowed = @(&apos;*.contoso.com&apos;) })</dev:code>
<dev:remarks><maml:para>Creates a code signing policy that forbids TLS usage and restricts DNS names to one suffix.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificatePolicy</command:name>
<maml:description><maml:para>Updates an Infisical certificate policy.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificatePolicy</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a certificate policy. Only the constraints supplied on the command line are sent; anything omitted keeps its stored value. Supply -PassThru to emit the updated policy.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Changing a policy affects every profile bound to it, and therefore every future certificate those profiles issue. Certificates already issued are unaffected. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificatePolicy -PolicyId $Policy.Id -MaxValidity &apos;30d&apos;</dev:code>
<dev:remarks><maml:para>Shortens the maximum lifetime, leaving every other constraint as it was.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificatePolicy -PolicyId $Policy.Id -ExtendedKeyUsage @{ Required = @(&apos;server_auth&apos;) } -PassThru</dev:code>
<dev:remarks><maml:para>Narrows the extended key usage and emits the updated policy.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificatePolicy</command:name>
<maml:description><maml:para>Deletes an Infisical certificate policy.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificatePolicy</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a certificate policy from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. A profile bound to the policy cannot issue once it is gone, so remove or repoint dependent profiles first. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificatePolicy -PolicyId $Policy.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the policy without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificatePolicy | Where-Object {($_.Name -like &apos;test-*&apos;)} | Remove-InfisicalCertificatePolicy</dev:code>
<dev:remarks><maml:para>Removes every policy whose name begins with test-, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificateProfile</command:name>
<maml:description><maml:para>Creates an Infisical certificate profile that binds an issuing authority to a policy.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificateProfile</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a certificate profile: the object Request-InfisicalCertificate -CertificateProfileId issues against. A profile binds an issuing certificate authority to a certificate policy and exposes it for one enrollment type. -Slug accepts lowercase letters, numbers, and hyphens. -EnrollmentConfig carries the settings for the chosen -EnrollmentType, so EST, ACME, and SCEP settings all arrive through one parameter; for the default api type, -AutoRenew and -RenewBeforeDays are folded into it.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Profile issuance is the only path that does not consult the issuing authority&apos;s direct-issuance flag, so a profile issues successfully against an authority whose EnableDirectIssuance is False. Unlike a PKI subscriber, a profile accepts a per-request common name, which is what makes it suitable for fleet enrollment. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalCertificateProfile -Slug &apos;server-auth&apos; -CertificatePolicyId $Policy.Id -CaId $Ca.Id</dev:code>
<dev:remarks><maml:para>Creates an API enrollment profile bound to a policy and issuing authority.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificateProfile -Slug &apos;workload&apos; -CertificatePolicyId $Policy.Id -CaId $Ca.Id -AutoRenew -RenewBeforeDays 14 -Defaults @{ ttlDays = 90 }</dev:code>
<dev:remarks><maml:para>Creates a profile that renews issued certificates fourteen days before expiry and defaults to a ninety day lifetime.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificateProfile</command:name>
<maml:description><maml:para>Updates an Infisical certificate profile.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificateProfile</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a certificate profile. Only the values supplied on the command line are sent; anything omitted keeps its stored value, including the enrollment type unless -EnrollmentType is passed explicitly. Supply -PassThru to emit the updated profile.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Repointing a profile at a different policy or issuing authority changes what future requests produce. Because certificate reuse is scoped by profile, Request-InfisicalCertificate keeps reusing certificates the profile issued previously until they fall inside their renewal window. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificateProfile -ProfileId $Profile.Id -CertificatePolicyId $NewPolicy.Id</dev:code>
<dev:remarks><maml:para>Repoints the profile at a different policy.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificateProfile -ProfileId $Profile.Id -AutoRenew -RenewBeforeDays 7 -PassThru</dev:code>
<dev:remarks><maml:para>Enables automatic renewal seven days before expiry and emits the updated profile.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificateProfile</command:name>
<maml:description><maml:para>Deletes an Infisical certificate profile.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificateProfile</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a certificate profile from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. Any script requesting certificates through the profile fails once it is gone, and the profile is detached from every application that referenced it. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificateProfile -ProfileId $Profile.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the profile without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificateProfile -ApplicationId $Application.Id | Remove-InfisicalCertificateProfile</dev:code>
<dev:remarks><maml:para>Removes every profile attached to an application, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalCertificateApplication</command:name>
<maml:description><maml:para>Creates an Infisical certificate application to group profiles and certificates.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalCertificateApplication</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a certificate application: the grouping the Infisical console presents profiles, members, and certificates under, and the scope Get-InfisicalCertificateProfile -ApplicationId and Get-InfisicalCertificate -ApplicationId filter by. Certificate profiles can be attached at creation with -ProfileId.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Applications are served only from the organization&apos;s active Certificate Manager project. Creating one in any other cert-manager project fails, which is why -ProjectId resolves to the active project when it is not supplied. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalCertificateApplication -Name &apos;platform&apos; -Description &apos;Endpoint and workload certificates&apos;</dev:code>
<dev:remarks><maml:para>Creates an empty application.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalCertificateApplication -Name &apos;platform&apos; -ProfileId $ServerProfile.Id, $CodeSigningProfile.Id</dev:code>
<dev:remarks><maml:para>Creates an application with two profiles already attached.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalCertificateApplication</command:name>
<maml:description><maml:para>Renames an Infisical certificate application or changes which profiles it holds.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalCertificateApplication</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a certificate application. -Name and -Description change the record; -AddProfileId and -RemoveProfileId change which certificate profiles the application groups. The record and its profile attachments are separate endpoints, so supplying only profile parameters skips the record update entirely. Supply -PassThru to emit the updated application.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Detaching a profile does not delete it; the profile continues to exist and issue, it is simply no longer grouped under the application. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalCertificateApplication -ApplicationId $Application.Id -AddProfileId $Profile.Id</dev:code>
<dev:remarks><maml:para>Attaches a profile to the application.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalCertificateApplication -ApplicationId $Application.Id -Name &apos;endpoint-management&apos; -RemoveProfileId $Old.Id -PassThru</dev:code>
<dev:remarks><maml:para>Renames the application, detaches a profile, and emits the updated record.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalCertificateApplication</command:name>
<maml:description><maml:para>Deletes an Infisical certificate application.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalCertificateApplication</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a certificate application from a Certificate Manager project. -PassThru emits the removed identifier for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. The profiles the application grouped are not deleted, but scripts that locate a profile by application can no longer find it. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalCertificateApplication -ApplicationId $Application.Id -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the application without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalCertificateApplication | Where-Object {($_.CertificateCount -eq 0)} | Remove-InfisicalCertificateApplication</dev:code>
<dev:remarks><maml:para>Removes every application holding no certificates, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>New-InfisicalPkiSubscriber</command:name>
<maml:description><maml:para>Creates an Infisical PKI subscriber, a named enrollment identity with a fixed common name.</maml:para></maml:description>
<command:verb>New</command:verb>
<command:noun>InfisicalPkiSubscriber</command:noun>
</command:details>
<maml:description>
<maml:para>Creates a PKI subscriber: a named enrollment identity that pins one common name, an allowlist of subject alternative names, a lifetime, and the permitted key usages, so a request carries only a certificate signing request. -CommonName is the identity the subscriber issues for, and -SubjectAlternativeName is an allowlist rather than a default.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>A subscriber is a single identity, not a template. Infisical rejects any request whose certificate signing request names a different common name, and rejects any subject alternative name outside the allowlist, so enrolling many machines through subscribers means one subscriber per machine. Use a certificate profile for fleet enrollment. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>New-InfisicalPkiSubscriber -Name &apos;web01&apos; -CommonName &apos;WEB01.contoso.com&apos; -CaId $Ca.Id -Ttl &apos;90d&apos;</dev:code>
<dev:remarks><maml:para>Creates a subscriber for one host.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>New-InfisicalPkiSubscriber -Name &apos;web01&apos; -CommonName &apos;WEB01.contoso.com&apos; -CaId $Ca.Id -Ttl &apos;90d&apos; -SubjectAlternativeName &apos;WEB01&apos;,&apos;WEB01.contoso.com&apos; -ExtendedKeyUsage &apos;serverAuth&apos;,&apos;clientAuth&apos;</dev:code>
<dev:remarks><maml:para>Creates a subscriber that also permits two subject alternative names and restricts extended key usage.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Set-InfisicalPkiSubscriber</command:name>
<maml:description><maml:para>Updates an Infisical PKI subscriber.</maml:para></maml:description>
<command:verb>Set</command:verb>
<command:noun>InfisicalPkiSubscriber</command:noun>
</command:details>
<maml:description>
<maml:para>Updates a PKI subscriber, addressed by its current -Name. Only the values supplied on the command line are sent; anything omitted keeps its stored value. -NewName renames the subscriber. Supply -PassThru to emit the updated record.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Changing -CommonName changes the identity the subscriber issues for, so any script signing against it must present a matching certificate signing request afterwards. Honors -WhatIf and -Confirm.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Set-InfisicalPkiSubscriber -Name &apos;web01&apos; -Ttl &apos;30d&apos;</dev:code>
<dev:remarks><maml:para>Shortens the lifetime of certificates issued for the subscriber.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Set-InfisicalPkiSubscriber -Name &apos;web01&apos; -SubjectAlternativeName &apos;WEB01&apos;,&apos;WEB01.contoso.com&apos;,&apos;www.contoso.com&apos; -PassThru</dev:code>
<dev:remarks><maml:para>Extends the permitted subject alternative names and emits the updated subscriber.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10">
<command:details>
<command:name>Remove-InfisicalPkiSubscriber</command:name>
<maml:description><maml:para>Deletes an Infisical PKI subscriber.</maml:para></maml:description>
<command:verb>Remove</command:verb>
<command:noun>InfisicalPkiSubscriber</command:noun>
</command:details>
<maml:description>
<maml:para>Deletes a PKI subscriber from a Certificate Manager project, addressed by name. -PassThru emits the removed name for logging.</maml:para>
</maml:description>
<maml:alertSet>
<maml:title>Notes</maml:title>
<maml:alert>
<maml:para>Destructive. Any script signing through the subscriber fails once it is gone. Certificates already issued are unaffected. High ConfirmImpact prompts unless -Confirm:$False is supplied.</maml:para>
</maml:alert>
</maml:alertSet>
<command:examples>
<command:example>
<maml:title>EXAMPLE 1</maml:title>
<dev:code>Remove-InfisicalPkiSubscriber -Name &apos;web01&apos; -Confirm:$False</dev:code>
<dev:remarks><maml:para>Deletes the subscriber without prompting.</maml:para></dev:remarks>
</command:example>
<command:example>
<maml:title>EXAMPLE 2</maml:title>
<dev:code>Get-InfisicalPkiSubscriber | Where-Object {($_.Status -ne &apos;active&apos;)} | Remove-InfisicalPkiSubscriber</dev:code>
<dev:remarks><maml:para>Removes every inactive subscriber, prompting for each.</maml:para></dev:remarks>
</command:example>
</command:examples>
</command:command>
</helpItems>
README.md
+163 -69
View File
@@ -26,7 +26,7 @@ Import-Module -Name .\Module\PSInfisicalAPI
## Cmdlets
The module exports 51 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List` (default) / single-record parameter-set pair: invoking without the identity parameter returns the collection, supplying the identity parameter returns one record.
The module exports 68 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List` (default) / single-record parameter-set pair: invoking without the identity parameter returns the collection, supplying the identity parameter returns one record.
### Session
@@ -118,6 +118,44 @@ The module exports 51 cmdlets. Discovery cmdlets (`Get-Infisical*`) use a `List`
| `Write-InfisicalScepMdmProfileToWmi`| Submits a SCEP MDM profile to the local MDM Bridge WMI provider to trigger enrollment. |
| `Get-InfisicalSANList` | Builds a SAN candidate list (device name, `<device>.<suffix>` per adapter DNS suffix, RFC 1918 + CGNAT IPv4 addresses, IPv4/IPv6 loopback) for `Request-InfisicalCertificate -DnsName`. |
### PKI configuration
Creating and changing the objects a Certificate Manager project is built from. `-ProjectId` is optional on all of them, and every one honours `-WhatIf`.
| Cmdlet | Purpose |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------- |
| `New-InfisicalCertificateAuthority` | Creates a root or intermediate internal CA, signing a subordinate with its parent so it can issue. |
| `Set-InfisicalCertificateAuthority` | Renames an internal CA or changes its status. |
| `Remove-InfisicalCertificateAuthority` | Deletes an internal CA. |
| `New-InfisicalCertificatePolicy` | Creates a certificate policy constraining subject, SANs, key usages, and validity. |
| `Set-InfisicalCertificatePolicy` | Updates a certificate policy; only supplied constraints are sent. |
| `Remove-InfisicalCertificatePolicy` | Deletes a certificate policy. |
| `New-InfisicalCertificateProfile` | Creates a certificate profile binding an issuing CA to a policy for enrollment. |
| `Set-InfisicalCertificateProfile` | Updates a certificate profile. |
| `Remove-InfisicalCertificateProfile` | Deletes a certificate profile. |
| `New-InfisicalCertificateApplication` | Creates a certificate application and optionally attaches profiles. |
| `Set-InfisicalCertificateApplication` | Renames an application, or attaches and detaches profiles. |
| `Remove-InfisicalCertificateApplication` | Deletes a certificate application. |
| `New-InfisicalPkiSubscriber` | Creates a PKI subscriber: one named identity with a fixed common name. |
| `Set-InfisicalPkiSubscriber` | Updates a PKI subscriber. |
| `Remove-InfisicalPkiSubscriber` | Deletes a PKI subscriber. |
Constraint dictionaries take `Allowed`, `Required`, and `Denied` in whatever casing reads naturally — they reach the API lower-cased — and an empty list is omitted rather than sent as "allow nothing":
```powershell
$Root = New-InfisicalCertificateAuthority -Name 'root-ca' -Type Root -CommonName 'Contoso Root CA' -Organization 'Contoso' -Country 'US'
$Ca = New-InfisicalCertificateAuthority -Name 'issuing-ca' -Type Intermediate -ParentCaId $Root.Id -CommonName 'Contoso Issuing CA'
$Policy = New-InfisicalCertificatePolicy -Name 'server-auth' -MaxValidity '90d' `
-KeyAlgorithm 'RSA_2048','EC_secp384r1' `
-KeyUsage @{ Required = @('digital_signature','key_encipherment') } `
-ExtendedKeyUsage @{ Required = @('server_auth','client_auth') }
$CertificateProfile = New-InfisicalCertificateProfile -Slug 'server-auth' -CertificatePolicyId $Policy.Id -CaId $Ca.Id -AutoRenew -RenewBeforeDays 14
$Application = New-InfisicalCertificateApplication -Name 'platform' -ProfileId $CertificateProfile.Id
```
The intermediate comes back ready to issue: Infisical creates a subordinate pending a certificate, and `New-InfisicalCertificateAuthority` performs the remaining sequence — read the CSR, sign it with `-ParentCaId`, import the result.
### Process
| Cmdlet | Purpose |
@@ -134,16 +172,16 @@ $secureSecret = Read-Host -AsSecureString 'Client Secret'
$connection = Connect-Infisical `
-BaseUri 'https://app.infisical.com' `
-OrganizationId '00000000-0000-0000-0000-000000000000' `
-ProjectId '11111111-1111-1111-1111-111111111111' `
-Environment 'dev' `
-ClientId 'machine-identity-client-id' `
-ClientSecret $secureSecret `
-PassThru
Get-InfisicalSecret -SecretPath '/'
Get-InfisicalSecret -ProjectId '11111111-1111-1111-1111-111111111111' -Environment 'dev' -SecretPath '/'
Disconnect-Infisical
```
`Connect-Infisical` establishes the session; project, environment, and secret path are supplied per call. On the PKI cmdlets `-ProjectId` is optional — see [Project scoping](#project-scoping).
## End-to-end: request and install a chained certificate
Connects, selects a `cert-manager` project, sources SANs from `Get-InfisicalSANList`, requests a certificate through a certificate profile, installs it (and its chain) into the current-user store, and disconnects. Each call uses a splatted `OrderedDictionary` constructed with `OrdinalIgnoreCase` so parameter names round-trip case-insensitively.
@@ -161,43 +199,20 @@ $ConnectInfisicalParameters = New-Object -TypeName 'System.Collections.Specializ
$Connection = Connect-Infisical @ConnectInfisicalParameters
$Project = Get-InfisicalProject -Type cert-manager | Select-Object -First 1
$Application = Get-InfisicalCertificateApplication | Where-Object {($_.Name -ieq 'platform')}
$Project
#region Certificate authorities. Not required for profile issuance - the profile already binds its CA - but
# useful for confirming the chain you expect to be installed.
$CAList = Get-InfisicalCertificateAuthority -ProjectId ($Project.Id) -Kind Internal
$RootCA = $CAList | Where-Object {([String]::IsNullOrEmpty($_.ParentCaId) -eq $True)} | Select-Object -First 1
$RootCA
$IntermediateCA = $CAList | Where-Object {([String]::IsNullOrEmpty($_.ParentCaId) -eq $False)}
$IntermediateCA
#endregion
$CertificateProfile = Get-InfisicalCertificateProfile -ProjectId ($Project.Id) -IncludeConfigs |
Where-Object {($_.EnrollmentType -iin @('API')) -and ($_.Slug -imatch '.*Server.*')} |
Select-Object -First 1
$CertificateProfile
$CertificateProfile = Get-InfisicalCertificateProfile -ApplicationId ($Application.Id) -IncludeConfigs | Where-Object {($_.EnrollmentType -ieq 'api') -and ($_.Slug -imatch 'server')} | Select-Object -First 1
$SanList = Get-InfisicalSANList
$SanList
$RequestInfisicalCertificateParameters = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
$RequestInfisicalCertificateParameters.ProjectId = $Project.Id
$RequestInfisicalCertificateParameters.CertificateProfileId = $CertificateProfile.Id
$RequestInfisicalCertificateParameters.CommonName = $Env:ComputerName.ToUpper()
$RequestInfisicalCertificateParameters.DnsName = New-Object -TypeName 'System.Collections.Generic.List[System.String]'
$RequestInfisicalCertificateParameters.DnsName.AddRange($SanList)
$RequestInfisicalCertificateParameters.DnsName.Add('app.contoso.com')
$RequestInfisicalCertificateParameters.DnsName.Add('api.contoso.com')
$RequestInfisicalCertificateParameters.DnsName.Add('boot.contoso.com')
$RequestInfisicalCertificateParameters.Ttl = '90d'
$RequestInfisicalCertificateParameters.Metadata = [Ordered]@{ Environment = 'Production'; Owner = 'Platform' }
$RequestInfisicalCertificateParameters.Install = $True
$RequestInfisicalCertificateParameters.InstallChain = $True
$RequestInfisicalCertificateParameters.Verbose = $True
@@ -207,39 +222,118 @@ $Certificate = Request-InfisicalCertificate @RequestInfisicalCertificateParamete
$Null = Disconnect-Infisical -Verbose
```
Note `$CertificateProfile` rather than `$Profile`: `$Profile` is an automatic variable in PowerShell (the path to the current profile script), and assigning to it works but shadows something the host relies on.
Four calls: find the application, pick its profile, gather SANs, request. No project lookup — `-ProjectId` resolves itself — and no CA lookup, because the profile already binds its issuing CA and `-InstallChain` installs the whole chain regardless.
`-StoreName`/`-StoreLocation` are omitted deliberately — see [Where certificates get installed](#where-certificates-get-installed).
## Renewing that certificate
Run the same request again with `-AllowRenewal`. Nothing else changes — the parameters below are the ones built above, so this is the shape to put on a schedule:
```powershell
$RequestInfisicalCertificateParameters.AllowRenewal = $True
$RequestInfisicalCertificateParameters.RenewalThresholdDays = 30
$Certificate = Request-InfisicalCertificate @RequestInfisicalCertificateParameters
```
The call is safe to repeat. Outside the renewal window it finds the installed certificate and returns it untouched; inside the window it issues a replacement and installs it:
```text
VERBOSE: Reuse search for CN=WEB01 scoped to certificate profile 'a42f8446-...' returned 1 active certificate(s).
VERBOSE: Reusing existing certificate (Thumbprint=F480A920..., NotAfter=2026-10-28 19:36:49Z).
```
Reuse is matched on the issuing profile *and* the requested SAN set, so the same script issues a new certificate — rather than silently returning the old one — whenever the profile changes or a name is added to `-DnsName`. `-Force` issues unconditionally, ignoring both the renewal window and any existing certificate.
Run it daily and it does nothing until the certificate is within 30 days of expiry, then rotates it. Nothing to gate it with, and no state to keep.
### Project scoping
Opening **Certificate Manager** in the Infisical console never asks which project to use. The project is in the URL — `/organizations/{orgId}/projects/cert-manager/{projectId}/applications` — but it is chosen for you, and everything below it is presented as **applications**. That is because Infisical's own resolver takes the single Certificate Manager project when an organization has exactly one:
```ts
const projects = await projectDAL.find({ orgId: actorOrgId, type: ProjectType.CertificateManager });
if (projects.length === 1) return projects[0].id;
```
The PKI cmdlets follow the same rule: **`-ProjectId` is optional**. Omit it and the module resolves the organization's only Certificate Manager project, reporting the choice on the verbose stream:
```powershell
Get-InfisicalCertificateApplication
Get-InfisicalCertificateAuthority -Kind Internal
Get-InfisicalCertificateProfile -IncludeConfigs
Get-InfisicalPkiSubscriber
Get-InfisicalCertificate -Status active
```
```text
VERBOSE: -ProjectId was not supplied; resolved the organization's only Certificate Manager project
'Microsoft Endpoint Configuration Manager' (2122628e-...).
```
An organization with **no** Certificate Manager project is not an error either. There is nothing to list, so the PKI `Get-*` cmdlets return nothing and `-Verbose` explains why:
```text
VERBOSE: -ProjectId was not supplied and this organization has no Certificate Manager project, so there is
nothing to resolve to. Create one in Infisical (Certificate Management), or pass -ProjectId to
target a specific project.
```
Several Certificate Manager projects in one organization is not an error. Infisical designates one as the organization's **active** project, and that is what resolution picks:
```text
VERBOSE: -ProjectId was not supplied; resolved the organization's active Certificate Manager project
'Platform PKI' (aaaa...).
```
If no active project is designated, the first is used and the verbose line says so; pass `-ProjectId` to target another.
This is resolved client-side rather than left to the server because several PKI endpoints carry the project in the URL path (`/api/v1/projects/{projectId}/pki-subscribers`, `/certificates/search`) and cannot defer to the server's resolver.
#### One project per organization, in practice
An organization *can* hold several Certificate Manager projects, but **certificate applications are served only from the active one**. The applications router rejects anything else outright:
```ts
if (req.internalCertManagerProjectId !== activeProjectId) {
throw new BadRequestError({ message: "Applications are only available on this organization's active Certificate Manager project." });
}
```
So an application-centric workflow is single-project by design. Additional Certificate Manager projects can exist and hold their own CAs, policies, profiles, and certificates, but they are reachable only by passing `-ProjectId` explicitly, and applications will not work in them.
#### Projects contain applications
The two are different levels, which is worth keeping straight when reading output:
| | What it is | Cmdlet |
| --- | --- | --- |
| **Project** | The Certificate Manager project itself. One per organization in most setups. | `Get-InfisicalProject -Type cert-manager` |
| **Application** | A grouping of profiles, members, and certificates inside that project. | `Get-InfisicalCertificateApplication` |
So a project named `pki` can contain applications named `platform` and `endpoint-management`; listing projects returns only `pki`, because the others are not projects. Every application carries the `ProjectId` it belongs to, which is why that field is real rather than vestigial.
Profiles can be filtered to an application, matching how the console groups them:
```powershell
$Application = Get-InfisicalCertificateApplication | Where-Object {($_.Name -ieq 'platform')}
Get-InfisicalCertificateProfile -ApplicationId $Application.Id -IncludeConfigs
Get-InfisicalCertificate -ApplicationId $Application.Id
```
### Example output
```text
Id : 00000000-0000-0000-0000-000000000000
Name : Microsoft Endpoint Configuration Manager
Slug : mecm
Description :
OrganizationId : 11111111-1111-1111-1111-111111111111
Type : cert-manager
AutoCapitalization : False
EnvironmentSlugs : {dev, staging, prod}
CreatedAtUtc : 3/12/2026 8:32:52 PM +00:00
UpdatedAtUtc : 6/21/2026 7:00:28 PM +00:00
Name : root-ca
CommonName : Contoso Root Certificate Authority
Type : internal
Status : active
KeyAlgorithm : RSA_2048
NotAfter : 03/25/2036 00:00:00
Id : 22222222-2222-2222-2222-222222222222
Name : intermediate-ca
CommonName : Contoso Intermediate Certificate Authority
Type : internal
Status : active
KeyAlgorithm : RSA_2048
NotAfter : 03/25/2031 00:00:00
Id : 33333333-3333-3333-3333-333333333333
Id : 11111111-1111-1111-1111-111111111111
ProjectId : 00000000-0000-0000-0000-000000000000
Name : platform
Description :
ProfileCount : 3
MemberCount : 2
CertificateCount : 0
CreatedAtUtc : 7/30/2026 10:05:37 PM +00:00
UpdatedAtUtc : 7/30/2026 10:05:37 PM +00:00
Id : 44444444-4444-4444-4444-444444444444
ProjectId : 00000000-0000-0000-0000-000000000000
@@ -266,6 +360,7 @@ WEB01.contoso.com
127.0.0.1
::1
VERBOSE: [...] - [Information] - [GetInfisicalCertificateApplicationCmdlet] - -ProjectId was not supplied; resolved the organization's only Certificate Manager project 'Platform PKI' (00000000-0000-0000-0000-000000000000).
VERBOSE: [...] - [Information] - [PkiClient] - Attempting to search Infisical certificates. Please Wait...
VERBOSE: [...] - [Verbose] - [HttpClient] - Attempting HTTP POST to https://infisical.contoso.com/api/v1/projects/00000000-0000-0000-0000-000000000000/certificates/search. Please Wait...
VERBOSE: [...] - [Verbose] - [HttpClient] - HTTP POST completed with status 200.
@@ -412,8 +507,8 @@ Request-InfisicalCertificate @RequestInfisicalCertificateParameters -WhatIf
A certificate profile binds a CA to a certificate policy. The policy constrains the subject, key usages, and extended key usages with `allowed`/`required`/`denied` lists, so the common name still varies per request while staying inside guardrails.
```powershell
Get-InfisicalCertificateProfile -ProjectId ($Project.Id) | Format-Table Id, Name, CaId
Get-InfisicalCertificatePolicy -ProjectId ($Project.Id) | Format-Table Id, Name
Get-InfisicalCertificateProfile | Format-Table Id, Slug, CaId, EnrollmentType
Get-InfisicalCertificatePolicy | Format-Table Id, Name
```
Profile issuance is the only path that does **not** consult the CA's direct-issuance flag — the service short-circuits it:
@@ -427,7 +522,7 @@ So a profile issues successfully against a CA whose `EnableDirectIssuance` is `F
#### Discovering subscribers
```powershell
Get-InfisicalPkiSubscriber -ProjectId ($Project.Id) |
Get-InfisicalPkiSubscriber |
Format-Table Name, CommonName, Status, Ttl, CaId
```
@@ -460,10 +555,10 @@ const ca = await certificateAuthorityDAL.create({ projectId, name: resolvedCaNam
So **every CA created through the API or UI has direct issuance disabled**, and nothing can turn it on afterwards. Use a certificate profile, which ignores the flag entirely.
```powershell
Get-InfisicalCertificateAuthority -ProjectId ($Project.Id) -Kind Internal |
Get-InfisicalCertificateAuthority -Kind Internal |
Format-Table Name, CommonName, Status, EnableDirectIssuance
$Ca = Get-InfisicalCertificateAuthority -ProjectId ($Project.Id) -Kind Internal |
$Ca = Get-InfisicalCertificateAuthority -Kind Internal |
Where-Object {($_.EnableDirectIssuance -eq $True)} |
Select-Object -First 1
@@ -519,7 +614,7 @@ A failing item does not abort the batch:
```powershell
'web01', 'does-not-exist', 'web02' |
ForEach-Object { Get-InfisicalPkiSubscriber -ProjectId $ProjectId -Name $_ -ErrorAction SilentlyContinue }
ForEach-Object { Get-InfisicalPkiSubscriber -Name $_ -ErrorAction SilentlyContinue }
# emits web01 and web02; the failure is available in $Error
```
@@ -555,16 +650,15 @@ The resolver matches case-insensitively against patterns aligned with Infisical'
| Parameter | Example variable names matched |
| ----------------- | ------------------------------------------------------------------------------------ |
| `BaseUri` | `INFISICAL_API_URL`, `INFISICAL_BASE_URL`, `INFISICAL_HOST` |
| `BaseUri` | `INFISICAL_API_URL`, `INFISICAL_BASE_URL`, `INFISICAL_BASE_URI`, `INFISICAL_HOST` |
| `OrganizationId` | `INFISICAL_ORG_ID`, `INFISICAL_ORGANIZATION_ID` |
| `ProjectId` | `INFISICAL_PROJECT_ID`, `INFISICAL_WORKSPACE_ID` |
| `Environment` | `INFISICAL_ENVIRONMENT`, `INFISICAL_ENV`, `INFISICAL_ENV_SLUG` |
| `ClientId` | `INFISICAL_CLIENT_ID`, `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` |
| `ClientSecret` | `INFISICAL_CLIENT_SECRET`, `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` |
| `AccessToken` | `INFISICAL_TOKEN`, `INFISICAL_ACCESS_TOKEN`, `INFISICAL_AUTH_TOKEN` |
| `SecretPath` | `INFISICAL_SECRET_PATH`, `INFISICAL_DEFAULT_SECRET_PATH` |
| `ApiVersion` | `INFISICAL_API_VERSION` |
Discovery covers the connection itself. Project, environment, and secret path are per-call parameters, so they are not resolved from the environment.
Sensitive values (`ClientSecret`, `AccessToken`) are read directly into a read-only `SecureString` and never logged.
### Zero-configuration example
@@ -619,7 +713,7 @@ To add a route:
### Adding a new cmdlet
Cmdlets live in `src/PSInfisicalAPI/Cmdlets/` and derive from `InfisicalCmdletBase`, which exposes `HttpClient`, `Logger`, `ResolveProjectId`, and `ThrowTerminatingForException`. Follow the consolidated discovery pattern when the cmdlet supports both list and single-record retrieval:
Cmdlets live in `src/PSInfisicalAPI/Cmdlets/` and derive from `InfisicalCmdletBase`, which exposes `HttpClient`, `Logger`, `ResolveCertManagerProjectId`, and `ThrowTerminatingForException`. Follow the consolidated discovery pattern when the cmdlet supports both list and single-record retrieval:
```csharp
[Cmdlet(VerbsCommon.Get, "InfisicalPkiSubscriber", DefaultParameterSetName = "List")]
@@ -644,7 +738,7 @@ After adding (or removing) a cmdlet:
```powershell
$Params = New-Object -TypeName 'System.Collections.Specialized.OrderedDictionary' -ArgumentList ([System.StringComparer]::OrdinalIgnoreCase)
$Params.ProjectId = (Get-InfisicalProject | Select-Object -First 1).Id
$Params.ProjectId = (Get-InfisicalProject -Type cert-manager | Select-Object -First 1).Id
$Result = Get-InfisicalPkiSubscriber @Params
```
4. Add a `## Unreleased` entry to `CHANGELOG.md` describing the change (mark removals of public cmdlets or parameters as **BREAKING**).
Tools/Initialize-InfisicalCertManagerEnvironment.ps1
+1232
View File
File diff suppressed because it is too large Load Diff
build.ps1
+51 -7
View File
@@ -156,7 +156,22 @@ function Write-Manifest {
'Write-InfisicalScepMdmProfileToWmi',
'Start-InfisicalProcess',
'Get-InfisicalEnvironmentVariable',
'Get-InfisicalSANList'
'Get-InfisicalSANList',
'New-InfisicalCertificateAuthority',
'Set-InfisicalCertificateAuthority',
'Remove-InfisicalCertificateAuthority',
'New-InfisicalCertificatePolicy',
'Set-InfisicalCertificatePolicy',
'Remove-InfisicalCertificatePolicy',
'New-InfisicalCertificateProfile',
'Set-InfisicalCertificateProfile',
'Remove-InfisicalCertificateProfile',
'New-InfisicalCertificateApplication',
'Set-InfisicalCertificateApplication',
'Remove-InfisicalCertificateApplication',
'New-InfisicalPkiSubscriber',
'Set-InfisicalPkiSubscriber',
'Remove-InfisicalPkiSubscriber'
)
AliasesToExport = @()
VariablesToExport = @()
@@ -178,6 +193,15 @@ function Write-Manifest {
}
function Update-Changelog {
<#
Promotes whatever sits under "## Unreleased" into a section for this version, leaving a fresh empty
"## Unreleased" above it.
The release workflow builds its release body by extracting the section whose heading matches the version
it just produced. Inserting the version heading above the notes - as this previously did - left that
section containing only the build line while the actual notes stayed under "Unreleased", so every
release published an empty changelog.
#>
param([string]$Version, [string]$CommitHash)
if (-not $ChangelogFile.Exists) { return }
@@ -185,11 +209,31 @@ function Update-Changelog {
$existing = Get-Content -LiteralPath $ChangelogFile.FullName -Raw
if ($existing -match [Regex]::Escape($marker)) { return }
$insertion = "## $Version`r`n`r`n- Build produced from commit $CommitHash.`r`n`r`n"
$unreleasedRegex = [regex]::new('(?m)^## Unreleased\r?$')
if (-not $unreleasedRegex.IsMatch($existing)) { return }
$updated = $unreleasedRegex.Replace($existing, "## Unreleased`r`n`r`n$insertion## Unreleased (carried forward)", 1)
[System.IO.File]::WriteAllText($ChangelogFile.FullName, $updated, [System.Text.UTF8Encoding]::new($false))
$unreleasedRegex = [regex]::new('(?m)^## Unreleased[^\r\n]*\r?$')
$unreleasedMatch = $unreleasedRegex.Match($existing)
if (-not $unreleasedMatch.Success) { return }
# Everything from just after the Unreleased heading to the next "## " heading is this version's notes.
$bodyStart = $unreleasedMatch.Index + $unreleasedMatch.Length
$nextHeading = [regex]::new('(?m)^## ').Match($existing, $bodyStart)
$bodyEnd = if ($nextHeading.Success) { $nextHeading.Index } else { $existing.Length }
$notes = $existing.Substring($bodyStart, $bodyEnd - $bodyStart).Trim()
# Italicised and last so it reads as provenance rather than as another entry in whichever section the
# notes happened to end on.
$buildLine = "_Build produced from commit $CommitHash._"
$versionBody = if ([string]::IsNullOrWhiteSpace($notes)) { $buildLine } else { "$notes`r`n`r`n$buildLine" }
$rebuilt = New-Object System.Text.StringBuilder
[void]$rebuilt.Append($existing.Substring(0, $unreleasedMatch.Index))
[void]$rebuilt.Append("## Unreleased`r`n`r`n")
[void]$rebuilt.Append("## $Version`r`n`r`n")
[void]$rebuilt.Append($versionBody)
[void]$rebuilt.Append("`r`n`r`n")
[void]$rebuilt.Append($existing.Substring($bodyEnd))
[System.IO.File]::WriteAllText($ChangelogFile.FullName, $rebuilt.ToString(), [System.Text.UTF8Encoding]::new($false))
}
@@ -221,7 +265,7 @@ if (`$cmds.Count -eq 0) {
throw "No cmdlets were exported by the PSInfisicalAPI module."
}
`$expectedCmds = @('Connect-Infisical','Disconnect-Infisical','Get-InfisicalSecret','New-InfisicalSecret','Update-InfisicalSecret','Remove-InfisicalSecret','Copy-InfisicalSecret','ConvertTo-InfisicalSecretDictionary','Export-InfisicalSecrets','Import-InfisicalSecret','Get-InfisicalProject','New-InfisicalProject','Update-InfisicalProject','Remove-InfisicalProject','Get-InfisicalEnvironment','New-InfisicalEnvironment','Update-InfisicalEnvironment','Remove-InfisicalEnvironment','Get-InfisicalFolder','New-InfisicalFolder','Update-InfisicalFolder','Remove-InfisicalFolder','Get-InfisicalTag','New-InfisicalTag','Update-InfisicalTag','Remove-InfisicalTag','Get-InfisicalOrganization','New-InfisicalOrganization','Update-InfisicalOrganization','Remove-InfisicalOrganization','Get-InfisicalSubOrganization','New-InfisicalSubOrganization','Update-InfisicalSubOrganization','Remove-InfisicalSubOrganization','Get-InfisicalCertificateAuthority','Get-InfisicalPkiSubscriber','Get-InfisicalCertificateProfile','Get-InfisicalCertificatePolicy','Get-InfisicalCertificate','Request-InfisicalCertificate','ConvertTo-InfisicalCertificate','Install-InfisicalCertificate','Uninstall-InfisicalCertificate','Export-InfisicalCertificate','Get-InfisicalCertificateApplication','Get-InfisicalCertificateApplicationEnrollment','New-InfisicalScepDynamicChallenge','Get-InfisicalScepMdmProfile','Export-InfisicalScepMdmProfile','Write-InfisicalScepMdmProfileToWmi','Start-InfisicalProcess','Get-InfisicalEnvironmentVariable','Get-InfisicalSANList')
`$expectedCmds = @('Connect-Infisical','Disconnect-Infisical','Get-InfisicalSecret','New-InfisicalSecret','Update-InfisicalSecret','Remove-InfisicalSecret','Copy-InfisicalSecret','ConvertTo-InfisicalSecretDictionary','Export-InfisicalSecrets','Import-InfisicalSecret','Get-InfisicalProject','New-InfisicalProject','Update-InfisicalProject','Remove-InfisicalProject','Get-InfisicalEnvironment','New-InfisicalEnvironment','Update-InfisicalEnvironment','Remove-InfisicalEnvironment','Get-InfisicalFolder','New-InfisicalFolder','Update-InfisicalFolder','Remove-InfisicalFolder','Get-InfisicalTag','New-InfisicalTag','Update-InfisicalTag','Remove-InfisicalTag','Get-InfisicalOrganization','New-InfisicalOrganization','Update-InfisicalOrganization','Remove-InfisicalOrganization','Get-InfisicalSubOrganization','New-InfisicalSubOrganization','Update-InfisicalSubOrganization','Remove-InfisicalSubOrganization','Get-InfisicalCertificateAuthority','Get-InfisicalPkiSubscriber','Get-InfisicalCertificateProfile','Get-InfisicalCertificatePolicy','Get-InfisicalCertificate','Request-InfisicalCertificate','ConvertTo-InfisicalCertificate','Install-InfisicalCertificate','Uninstall-InfisicalCertificate','Export-InfisicalCertificate','Get-InfisicalCertificateApplication','Get-InfisicalCertificateApplicationEnrollment','New-InfisicalScepDynamicChallenge','Get-InfisicalScepMdmProfile','Export-InfisicalScepMdmProfile','Write-InfisicalScepMdmProfileToWmi','Start-InfisicalProcess','Get-InfisicalEnvironmentVariable','Get-InfisicalSANList','New-InfisicalCertificateAuthority','Set-InfisicalCertificateAuthority','Remove-InfisicalCertificateAuthority','New-InfisicalCertificatePolicy','Set-InfisicalCertificatePolicy','Remove-InfisicalCertificatePolicy','New-InfisicalCertificateProfile','Set-InfisicalCertificateProfile','Remove-InfisicalCertificateProfile','New-InfisicalCertificateApplication','Set-InfisicalCertificateApplication','Remove-InfisicalCertificateApplication','New-InfisicalPkiSubscriber','Set-InfisicalPkiSubscriber','Remove-InfisicalPkiSubscriber')
foreach (`$expected in `$expectedCmds) {
if (-not (Get-Command -Name `$expected -Module PSInfisicalAPI -ErrorAction SilentlyContinue)) {
throw "Cmdlet not found: `$expected"
src/PSInfisicalAPI.Tests/EndpointRegistryTests.cs
+6 -2
View File
@@ -50,7 +50,9 @@ namespace PSInfisicalAPI.Tests
[InlineData(InfisicalEndpointNames.CreateSecret, "POST", "/api/v3/secrets/raw/{secretName}")]
[InlineData(InfisicalEndpointNames.UpdateSecret, "PATCH", "/api/v3/secrets/raw/{secretName}")]
[InlineData(InfisicalEndpointNames.DeleteSecret, "DELETE", "/api/v3/secrets/raw/{secretName}")]
[InlineData(InfisicalEndpointNames.ListProjects, "GET", "/api/v1/workspace")]
// /api/v1/workspace mounts Infisical's deprecated project router; /api/v1/projects is the current one
// and is preferred, with the deprecated route retained as a fallback candidate.
[InlineData(InfisicalEndpointNames.ListProjects, "GET", "/api/v1/projects")]
[InlineData(InfisicalEndpointNames.RetrieveProject, "GET", "/api/v1/workspace/{projectId}")]
[InlineData(InfisicalEndpointNames.CreateProject, "POST", "/api/v2/workspace")]
[InlineData(InfisicalEndpointNames.UpdateProject, "PATCH", "/api/v1/workspace/{projectId}")]
@@ -75,7 +77,9 @@ namespace PSInfisicalAPI.Tests
[InlineData(InfisicalEndpointNames.BulkUpdateSecret, "PATCH", "/api/v4/secrets/batch")]
[InlineData(InfisicalEndpointNames.BulkDeleteSecret, "DELETE", "/api/v4/secrets/batch")]
[InlineData(InfisicalEndpointNames.DuplicateSecret, "POST", "/api/v4/secrets/duplicate")]
[InlineData(InfisicalEndpointNames.ListOrganizations, "GET", "/api/v2/organizations")]
// /api/v2/organizations has no GET / route, only /:organizationId/* sub-routes, so the listing must
// prefer the singular v1 route; the v2 one is retained only as a fallback candidate.
[InlineData(InfisicalEndpointNames.ListOrganizations, "GET", "/api/v1/organization")]
[InlineData(InfisicalEndpointNames.RetrieveOrganization, "GET", "/api/v1/organization/{organizationId}")]
[InlineData(InfisicalEndpointNames.CreateOrganization, "POST", "/api/v2/organizations")]
[InlineData(InfisicalEndpointNames.UpdateOrganization, "PATCH", "/api/v1/organization/{organizationId}")]
src/PSInfisicalAPI.Tests/PkiWriteCmdletTests.cs
+280
View File
@@ -0,0 +1,280 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.Management.Automation;
using System.Reflection;
using Newtonsoft.Json;
using Xunit;
namespace PSInfisicalAPI.Tests
{
/// <summary>
/// The create/update/delete cmdlets for Certificate Manager configuration. Their bodies are built from
/// caller-supplied dictionaries, so the conversion into the exact JSON Infisical's schemas accept is what
/// these pin.
/// </summary>
public class PkiWriteCmdletTests
{
private static readonly Assembly ModuleAssembly = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly;
private static readonly string[] WriteCmdletTypes = new[]
{
"NewInfisicalCertificateAuthorityCmdlet", "SetInfisicalCertificateAuthorityCmdlet", "RemoveInfisicalCertificateAuthorityCmdlet",
"NewInfisicalCertificatePolicyCmdlet", "SetInfisicalCertificatePolicyCmdlet", "RemoveInfisicalCertificatePolicyCmdlet",
"NewInfisicalCertificateProfileCmdlet", "SetInfisicalCertificateProfileCmdlet", "RemoveInfisicalCertificateProfileCmdlet",
"NewInfisicalCertificateApplicationCmdlet", "SetInfisicalCertificateApplicationCmdlet", "RemoveInfisicalCertificateApplicationCmdlet",
"NewInfisicalPkiSubscriberCmdlet", "SetInfisicalPkiSubscriberCmdlet", "RemoveInfisicalPkiSubscriberCmdlet"
};
private static Dictionary<string, object> ToJsonObject(IDictionary source)
{
Type baseType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.InfisicalPkiWriteCmdletBase", true);
MethodInfo method = baseType.GetMethod("ToJsonObject", BindingFlags.NonPublic | BindingFlags.Static);
Assert.NotNull(method);
return (Dictionary<string, object>)method.Invoke(null, new object[] { source });
}
private static List<Dictionary<string, object>> ToJsonObjectList(IEnumerable source)
{
Type baseType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.InfisicalPkiWriteCmdletBase", true);
MethodInfo method = baseType.GetMethod("ToJsonObjectList", BindingFlags.NonPublic | BindingFlags.Static);
Assert.NotNull(method);
return (List<Dictionary<string, object>>)method.Invoke(null, new object[] { source });
}
[Fact]
public void Every_Write_Cmdlet_Declares_ShouldProcess()
{
List<string> offenders = new List<string>();
foreach (string typeName in WriteCmdletTypes)
{
Type type = ModuleAssembly.GetType(string.Concat("PSInfisicalAPI.Cmdlets.", typeName), true);
bool supportsShouldProcess = false;
foreach (CustomAttributeData attribute in type.GetCustomAttributesData())
{
if (attribute.AttributeType != typeof(CmdletAttribute)) { continue; }
foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
{
if (named.MemberName == "SupportsShouldProcess" && (bool)named.TypedValue.Value) { supportsShouldProcess = true; }
}
}
if (!supportsShouldProcess) { offenders.Add(typeName); }
}
Assert.Empty(offenders);
}
[Fact]
public void Every_Remove_Cmdlet_Defaults_To_High_Confirm_Impact()
{
List<string> offenders = new List<string>();
foreach (string typeName in WriteCmdletTypes)
{
if (!typeName.StartsWith("Remove", StringComparison.Ordinal)) { continue; }
Type type = ModuleAssembly.GetType(string.Concat("PSInfisicalAPI.Cmdlets.", typeName), true);
bool high = false;
foreach (CustomAttributeData attribute in type.GetCustomAttributesData())
{
if (attribute.AttributeType != typeof(CmdletAttribute)) { continue; }
foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
{
if (named.MemberName == "ConfirmImpact" && (ConfirmImpact)named.TypedValue.Value == ConfirmImpact.High) { high = true; }
}
}
if (!high) { offenders.Add(typeName); }
}
Assert.Empty(offenders);
}
[Fact]
public void Every_Write_Cmdlet_Resolves_The_Project_Instead_Of_Requiring_It()
{
List<string> offenders = new List<string>();
foreach (string typeName in WriteCmdletTypes)
{
Type type = ModuleAssembly.GetType(string.Concat("PSInfisicalAPI.Cmdlets.", typeName), true);
PropertyInfo projectId = type.GetProperty("ProjectId");
Assert.True(projectId != null, string.Concat(typeName, " has no ProjectId property"));
foreach (CustomAttributeData attribute in projectId.GetCustomAttributesData())
{
if (attribute.AttributeType != typeof(ParameterAttribute)) { continue; }
foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
{
if (named.MemberName == "Mandatory" && (bool)named.TypedValue.Value) { offenders.Add(typeName); }
}
}
}
Assert.Empty(offenders);
}
[Theory]
// PowerShell callers capitalise hashtable keys; Infisical's schema is lower case.
[InlineData("Required", "required")]
[InlineData("required", "required")]
[InlineData("Allowed", "allowed")]
[InlineData("DENIED", "denied")]
public void Constraint_Keys_Are_Emitted_In_The_Casing_The_Api_Requires(string supplied, string expected)
{
Hashtable source = new Hashtable { { supplied, new[] { "server_auth" } } };
Dictionary<string, object> result = ToJsonObject(source);
Assert.True(result.ContainsKey(expected), string.Concat("expected key '", expected, "' but got: ", JsonConvert.SerializeObject(result)));
}
[Fact]
public void Non_Constraint_Keys_Keep_Their_Camel_Case()
{
// Field names elsewhere in the body are camelCase and supplied verbatim; lowercasing them would
// silently drop settings the API would no longer recognise.
Hashtable source = new Hashtable { { "ttlDays", 90 }, { "keyAlgorithm", "RSA_2048" }, { "isCA", "denied" }, { "maxPathLength", 0 } };
Dictionary<string, object> result = ToJsonObject(source);
Assert.True(result.ContainsKey("ttlDays"));
Assert.True(result.ContainsKey("keyAlgorithm"));
Assert.True(result.ContainsKey("isCA"));
Assert.True(result.ContainsKey("maxPathLength"));
}
[Fact]
public void An_Empty_Collection_Is_Dropped_Rather_Than_Sent_As_Allow_Nothing()
{
Hashtable source = new Hashtable { { "Allowed", new string[0] }, { "Required", new[] { "server_auth" } } };
Dictionary<string, object> result = ToJsonObject(source);
Assert.False(result.ContainsKey("allowed"));
Assert.True(result.ContainsKey("required"));
}
[Fact]
public void A_Wholly_Empty_Constraint_Becomes_Null_So_It_Is_Omitted()
{
Assert.Null(ToJsonObject(new Hashtable()));
Assert.Null(ToJsonObject(new Hashtable { { "Allowed", new string[0] } }));
Assert.Null(ToJsonObject(null));
}
[Fact]
public void A_Constraint_List_Drops_Entries_That_Constrain_Nothing()
{
// An entry carrying only "type" is rejected by Infisical's refinement, and is what a caller writes
// when they meant to leave that dimension alone.
List<Hashtable> source = new List<Hashtable>
{
new Hashtable { { "Type", "dns_name" }, { "Allowed", new[] { "*.contoso.com" } } },
new Hashtable { { "Type", "ip_address" }, { "Allowed", new string[0] } }
};
List<Dictionary<string, object>> result = ToJsonObjectList(source);
Dictionary<string, object> only = Assert.Single(result);
Assert.Equal("dns_name", only["type"]);
Assert.True(only.ContainsKey("allowed"));
}
[Fact]
public void Nested_Dictionaries_Survive_Conversion()
{
Hashtable source = new Hashtable
{
{ "outer", new Hashtable { { "inner", new Hashtable { { "Required", new[] { "a" } } } } } }
};
Dictionary<string, object> result = ToJsonObject(source);
string json = JsonConvert.SerializeObject(result);
Assert.Contains("\"outer\"", json);
Assert.Contains("\"inner\"", json);
Assert.Contains("\"required\"", json);
}
[Fact]
public void Profile_Enrollment_Config_Is_Routed_To_The_Block_For_Its_Type()
{
Type cmdletType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.NewInfisicalCertificateProfileCmdlet", true);
MethodInfo build = cmdletType.GetMethod("BuildRequest", BindingFlags.NonPublic | BindingFlags.Static);
Assert.NotNull(build);
Hashtable config = new Hashtable { { "passphrase", "secret" } };
object estRequest = build.Invoke(null, new object[] { "slug", null, "ca", "policy", "est", "ca", false, null, null, config, false });
Assert.NotNull(estRequest.GetType().GetProperty("EstConfig").GetValue(estRequest));
Assert.Null(estRequest.GetType().GetProperty("ApiConfig").GetValue(estRequest));
object scepRequest = build.Invoke(null, new object[] { "slug", null, "ca", "policy", "scep", "ca", false, null, null, config, false });
Assert.NotNull(scepRequest.GetType().GetProperty("ScepConfig").GetValue(scepRequest));
object apiRequest = build.Invoke(null, new object[] { "slug", null, "ca", "policy", "api", "ca", true, 14, null, null, true });
object apiConfig = apiRequest.GetType().GetProperty("ApiConfig").GetValue(apiRequest);
Assert.NotNull(apiConfig);
Dictionary<string, object> typed = (Dictionary<string, object>)apiConfig;
Assert.Equal(true, typed["autoRenew"]);
Assert.Equal(14, typed["renewBeforeDays"]);
}
[Fact]
public void Auto_Renew_Is_Only_Sent_When_The_Caller_Asked_For_It()
{
// A switch parameter is always false when absent, so sending it unconditionally would silently
// disable renewal on an update that never mentioned it.
Type cmdletType = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.NewInfisicalCertificateProfileCmdlet", true);
MethodInfo build = cmdletType.GetMethod("BuildRequest", BindingFlags.NonPublic | BindingFlags.Static);
object unbound = build.Invoke(null, new object[] { "slug", null, "ca", "policy", "api", "ca", false, null, null, null, false });
Assert.Null(unbound.GetType().GetProperty("ApiConfig").GetValue(unbound));
object bound = build.Invoke(null, new object[] { "slug", null, "ca", "policy", "api", "ca", false, null, null, null, true });
Dictionary<string, object> config = (Dictionary<string, object>)bound.GetType().GetProperty("ApiConfig").GetValue(bound);
Assert.NotNull(config);
Assert.Equal(false, config["autoRenew"]);
}
[Fact]
public void Every_Management_Endpoint_Is_Registered()
{
string[] names = new[]
{
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.CreateInternalCertificateAuthority,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.UpdateInternalCertificateAuthority,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.DeleteInternalCertificateAuthority,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.GetCertificateAuthorityCsr,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.SignIntermediateCertificateAuthority,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.ImportCertificateAuthorityCertificate,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.CreateCertificatePolicy,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.UpdateCertificatePolicy,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.DeleteCertificatePolicy,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.CreateCertificateProfile,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.UpdateCertificateProfile,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.DeleteCertificateProfile,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.CreateCertificateApplication,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.UpdateCertificateApplication,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.DeleteCertificateApplication,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.AddCertificateApplicationProfiles,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.RemoveCertificateApplicationProfile,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.CreatePkiSubscriber,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.UpdatePkiSubscriber,
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.DeletePkiSubscriber
};
foreach (string name in names)
{
IReadOnlyList<PSInfisicalAPI.Endpoints.InfisicalEndpointDefinition> candidates =
PSInfisicalAPI.Endpoints.InfisicalEndpointRegistry.GetCandidates(name);
Assert.True(candidates.Count > 0, string.Concat(name, " is not registered"));
Assert.All(candidates, c => Assert.True(c.RequiresAuthorization, string.Concat(name, " should require authorization")));
}
}
}
}
src/PSInfisicalAPI.Tests/ProjectScopingTests.cs
+272
View File
@@ -0,0 +1,272 @@
using System;
using System.Collections.Generic;
using System.Management.Automation;
using System.Reflection;
using System.Security.Cryptography.X509Certificates;
using Xunit;
namespace PSInfisicalAPI.Tests
{
/// <summary>
/// The Infisical console never asks which Certificate Manager project to use when an organization has one,
/// because its resolver selects it implicitly. Requiring -ProjectId made the module stricter than the
/// service it wraps, so these pin the parameter as optional across the PKI surface.
/// </summary>
public class ProjectScopingTests
{
private static readonly Assembly ModuleAssembly = typeof(PSInfisicalAPI.Connections.InfisicalConnection).Assembly;
private static readonly string[] PkiCmdletTypes = new[]
{
"PSInfisicalAPI.Cmdlets.GetInfisicalCertificateApplicationCmdlet",
"PSInfisicalAPI.Cmdlets.GetInfisicalCertificateApplicationEnrollmentCmdlet",
"PSInfisicalAPI.Cmdlets.GetInfisicalCertificateAuthorityCmdlet",
"PSInfisicalAPI.Cmdlets.GetInfisicalCertificateCmdlet",
"PSInfisicalAPI.Cmdlets.GetInfisicalCertificatePolicyCmdlet",
"PSInfisicalAPI.Cmdlets.GetInfisicalCertificateProfileCmdlet",
"PSInfisicalAPI.Cmdlets.GetInfisicalPkiSubscriberCmdlet",
"PSInfisicalAPI.Cmdlets.RequestInfisicalCertificateCmdlet"
};
[Fact]
public void ProjectId_Is_Optional_On_Every_Pki_Cmdlet()
{
List<string> offenders = new List<string>();
foreach (string typeName in PkiCmdletTypes)
{
Type type = ModuleAssembly.GetType(typeName, true);
PropertyInfo projectId = type.GetProperty("ProjectId");
Assert.True(projectId != null, string.Concat(typeName, " has no ProjectId property"));
foreach (CustomAttributeData attribute in projectId.GetCustomAttributesData())
{
if (attribute.AttributeType != typeof(ParameterAttribute)) { continue; }
foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
{
if (named.MemberName == "Mandatory" && (bool)named.TypedValue.Value)
{
offenders.Add(type.Name);
}
}
}
}
Assert.Empty(offenders);
}
[Fact]
public void Every_Pki_Cmdlet_Resolves_The_Project_Rather_Than_Assuming_One()
{
// Optional without resolution would simply send an empty projectId, so confirm each cmdlet calls
// the resolver.
List<string> missing = new List<string>();
foreach (string typeName in PkiCmdletTypes)
{
Type type = ModuleAssembly.GetType(typeName, true);
MethodInfo processRecord = type.GetMethod("ProcessRecord", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly);
Assert.NotNull(processRecord);
if (!GetCalledMethodNames(processRecord).Contains("ResolveCertManagerProjectId"))
{
missing.Add(type.Name);
}
}
Assert.Empty(missing);
}
[Fact]
public void Resolver_Is_Available_To_Cmdlets_And_Returns_A_Project_Id()
{
MethodInfo resolver = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase)
.GetMethod("ResolveCertManagerProjectId", BindingFlags.NonPublic | BindingFlags.Instance);
Assert.NotNull(resolver);
Assert.Equal(typeof(string), resolver.ReturnType);
ParameterInfo[] parameters = resolver.GetParameters();
Assert.Equal(2, parameters.Length);
Assert.Equal(typeof(PSInfisicalAPI.Connections.InfisicalConnection), parameters[0].ParameterType);
Assert.Equal(typeof(string), parameters[1].ParameterType);
}
[Fact]
public void Resolution_Does_Not_Error_When_An_Organization_Has_Several_Projects()
{
// Certificate applications are served only from the organization's active project, so several
// Certificate Manager projects is a normal configuration rather than an ambiguity to reject.
MethodInfo resolver = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase)
.GetMethod("ResolveCertManagerProjectId", BindingFlags.NonPublic | BindingFlags.Instance);
List<string> called = GetCalledMethodNames(resolver);
Assert.Contains("FindActiveCertManagerProject", called);
MethodInfo finder = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase)
.GetMethod("FindActiveCertManagerProject", BindingFlags.NonPublic | BindingFlags.Instance);
Assert.NotNull(finder);
Assert.Equal(typeof(PSInfisicalAPI.Models.InfisicalProject), finder.ReturnType);
}
[Fact]
public void An_Organization_Without_Any_Cert_Manager_Project_Is_Not_An_Error()
{
// Nothing to list is an empty result, not a failure, so resolution returns null and each Get-*
// cmdlet returns quietly rather than surfacing "ProjectId is required" from deep in the client.
MethodInfo resolver = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase)
.GetMethod("ResolveCertManagerProjectId", BindingFlags.NonPublic | BindingFlags.Instance);
List<string> called = GetCalledMethodNames(resolver);
Assert.DoesNotContain("ThrowTerminatingForException", called);
Assert.DoesNotContain("WriteErrorForException", called);
List<string> ungarded = new List<string>();
foreach (string typeName in PkiCmdletTypes)
{
// Request-InfisicalCertificate can still issue through a profile without a project, so it is
// deliberately allowed to proceed.
if (typeName.EndsWith("RequestInfisicalCertificateCmdlet", StringComparison.Ordinal)) { continue; }
Type type = ModuleAssembly.GetType(typeName, true);
MethodInfo processRecord = type.GetMethod("ProcessRecord", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly);
if (!GetCalledMethodNames(processRecord).Contains("IsNullOrEmpty"))
{
ungarded.Add(type.Name);
}
}
Assert.Empty(ungarded);
}
[Fact]
public void The_Organizations_Active_Cert_Manager_Project_Is_Modelled()
{
PropertyInfo property = typeof(PSInfisicalAPI.Models.InfisicalOrganization)
.GetProperty("DefaultCertManagerProjectId");
Assert.NotNull(property);
Assert.Equal(typeof(string), property.PropertyType);
}
[Fact]
public void Project_Listing_Prefers_The_Current_Route_Over_The_Deprecated_One()
{
// /api/v1/workspace mounts Infisical's deprecated project router; /api/v1/projects is current.
IReadOnlyList<PSInfisicalAPI.Endpoints.InfisicalEndpointDefinition> candidates =
PSInfisicalAPI.Endpoints.InfisicalEndpointRegistry.GetCandidates(
PSInfisicalAPI.Endpoints.InfisicalEndpointNames.ListProjects);
Assert.True(candidates.Count >= 2, "both the current and deprecated routes should be registered");
Assert.Equal("/api/v1/projects", candidates[0].Template);
Assert.Contains(candidates, c => c.Template == "/api/v1/workspace");
}
[Fact]
public void An_Explicit_ProjectId_Short_Circuits_Resolution()
{
// Supplying the project must never trigger a lookup, so the explicit value has to be returned
// before any client is constructed.
PSInfisicalAPI.Cmdlets.GetInfisicalCertificateAuthorityCmdlet cmdlet =
new PSInfisicalAPI.Cmdlets.GetInfisicalCertificateAuthorityCmdlet();
MethodInfo resolver = typeof(PSInfisicalAPI.Cmdlets.InfisicalCmdletBase)
.GetMethod("ResolveCertManagerProjectId", BindingFlags.NonPublic | BindingFlags.Instance);
// A null connection would throw the moment a lookup was attempted; returning cleanly proves it did not.
string result = (string)resolver.Invoke(cmdlet, new object[] { null, "explicit-project-id" });
Assert.Equal("explicit-project-id", result);
}
[Fact]
public void Certificate_Retrieval_By_Serial_Does_Not_Resolve_A_Project()
{
// Addressing a certificate by serial needs no project, so the Single parameter set must not pay
// for a lookup.
Type type = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.GetInfisicalCertificateCmdlet", true);
PropertyInfo serialNumber = type.GetProperty("SerialNumber");
Assert.NotNull(serialNumber);
bool serialIsMandatoryOnSingle = false;
foreach (CustomAttributeData attribute in serialNumber.GetCustomAttributesData())
{
if (attribute.AttributeType != typeof(ParameterAttribute)) { continue; }
bool isSingle = false;
bool isMandatory = false;
foreach (CustomAttributeNamedArgument named in attribute.NamedArguments)
{
if (named.MemberName == "ParameterSetName" && (string)named.TypedValue.Value == "Single") { isSingle = true; }
if (named.MemberName == "Mandatory" && (bool)named.TypedValue.Value) { isMandatory = true; }
}
if (isSingle && isMandatory) { serialIsMandatoryOnSingle = true; }
}
Assert.True(serialIsMandatoryOnSingle);
}
[Fact]
public void Profiles_Can_Be_Filtered_To_An_Application_The_Way_The_Console_Groups_Them()
{
Type type = ModuleAssembly.GetType("PSInfisicalAPI.Cmdlets.GetInfisicalCertificateProfileCmdlet", true);
PropertyInfo applicationId = type.GetProperty("ApplicationId");
Assert.NotNull(applicationId);
Assert.Equal(typeof(string), applicationId.PropertyType);
PropertyInfo caId = type.GetProperty("CaId");
Assert.NotNull(caId);
}
[Fact]
public void Profile_Listing_Keeps_Its_Original_Overload_For_Existing_Callers()
{
Type clientType = ModuleAssembly.GetType("PSInfisicalAPI.Pki.InfisicalPkiClient", true);
MethodInfo original = clientType.GetMethod(
"ListCertificateProfiles",
BindingFlags.Public | BindingFlags.Instance,
null,
new[] { typeof(PSInfisicalAPI.Connections.InfisicalConnection), typeof(string), typeof(int?), typeof(int?), typeof(bool?) },
null);
Assert.NotNull(original);
MethodInfo filtered = clientType.GetMethod(
"ListCertificateProfiles",
BindingFlags.Public | BindingFlags.Instance,
null,
new[] { typeof(PSInfisicalAPI.Connections.InfisicalConnection), typeof(string), typeof(int?), typeof(int?), typeof(bool?), typeof(string), typeof(string) },
null);
Assert.NotNull(filtered);
}
private static List<string> GetCalledMethodNames(MethodInfo method)
{
List<string> names = new List<string>();
MethodBody body = method.GetMethodBody();
if (body == null) { return names; }
byte[] il = body.GetILAsByteArray();
if (il == null) { return names; }
const byte Call = 0x28;
const byte CallVirt = 0x6F;
for (int i = 0; i + 4 < il.Length; i++)
{
if (il[i] != Call && il[i] != CallVirt) { continue; }
int token = BitConverter.ToInt32(il, i + 1);
try
{
MethodBase resolved = method.Module.ResolveMethod(token);
if (resolved != null) { names.Add(resolved.Name); }
}
catch (ArgumentException)
{
}
}
return names;
}
}
}
src/PSInfisicalAPI/Cmdlets/CertificateApplicationWriteCmdlets.cs
+159
View File
@@ -0,0 +1,159 @@
using System;
using System.Management.Automation;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Pki;
namespace PSInfisicalAPI.Cmdlets
{
/// <summary>
/// Creates a certificate application: the grouping the Infisical console presents profiles, members, and
/// certificates under.
/// </summary>
[Cmdlet(VerbsCommon.New, "InfisicalCertificateApplication", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificateApplication))]
public sealed class NewInfisicalCertificateApplicationCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "NewInfisicalCertificateApplicationCmdlet";
[Parameter(Mandatory = true, Position = 0)] public string Name { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Description { get; set; }
/// <summary>Certificate profiles to attach on creation.</summary>
[Parameter] public string[] ProfileId { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(Name, "Create certificate application")) { return; }
InfisicalCertificateApplicationWriteRequestDto request = new InfisicalCertificateApplicationWriteRequestDto
{
Name = Name,
Description = Description,
ProfileIds = ToStringList(ProfileId)
};
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
WriteObject(client.WriteCertificateApplication(connection, ProjectId, null, request));
}
catch (Exception exception)
{
WriteErrorForException(Component, "CreateCertificateApplication", exception);
}
}
}
/// <summary>
/// Renames a certificate application or changes its description, and attaches or detaches profiles.
/// </summary>
[Cmdlet(VerbsCommon.Set, "InfisicalCertificateApplication", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificateApplication))]
public sealed class SetInfisicalCertificateApplicationCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "SetInfisicalCertificateApplicationCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id")]
public string ApplicationId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Name { get; set; }
[Parameter] public string Description { get; set; }
/// <summary>Certificate profiles to attach. Profiles already attached are left alone.</summary>
[Parameter] public string[] AddProfileId { get; set; }
/// <summary>Certificate profiles to detach.</summary>
[Parameter] public string[] RemoveProfileId { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(ApplicationId, "Update certificate application")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
InfisicalCertificateApplication updated = null;
// The application record and its profile attachments are separate endpoints, so the name and
// description update is skipped entirely when only profiles were supplied.
if (!string.IsNullOrEmpty(Name) || !string.IsNullOrEmpty(Description))
{
InfisicalCertificateApplicationWriteRequestDto request = new InfisicalCertificateApplicationWriteRequestDto
{
Name = Name,
Description = Description
};
updated = client.WriteCertificateApplication(connection, ProjectId, ApplicationId, request);
}
if (ToStringList(AddProfileId) != null)
{
client.AddCertificateApplicationProfiles(connection, ProjectId, ApplicationId, ToStringList(AddProfileId));
}
foreach (string profileId in ToStringList(RemoveProfileId) ?? new System.Collections.Generic.List<string>())
{
client.RemoveCertificateApplicationProfile(connection, ProjectId, ApplicationId, profileId);
}
if (PassThru.IsPresent && updated != null) { WriteObject(updated); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "UpdateCertificateApplication", exception);
}
}
}
/// <summary>
/// Deletes a certificate application.
/// </summary>
[Cmdlet(VerbsCommon.Remove, "InfisicalCertificateApplication", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
public sealed class RemoveInfisicalCertificateApplicationCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "RemoveInfisicalCertificateApplicationCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id")]
public string ApplicationId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(ApplicationId, "Delete certificate application")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
client.DeleteCertificateApplication(connection, ProjectId, ApplicationId);
if (PassThru.IsPresent) { WriteObject(ApplicationId); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "DeleteCertificateApplication", exception);
}
}
}
}
src/PSInfisicalAPI/Cmdlets/CertificateAuthorityWriteCmdlets.cs
+183
View File
@@ -0,0 +1,183 @@
using System;
using System.Management.Automation;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Pki;
namespace PSInfisicalAPI.Cmdlets
{
/// <summary>
/// Creates an internal certificate authority, signing a subordinate with its parent so it comes back ready
/// to issue.
/// </summary>
[Cmdlet(VerbsCommon.New, "InfisicalCertificateAuthority", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificateAuthority))]
public sealed class NewInfisicalCertificateAuthorityCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "NewInfisicalCertificateAuthorityCmdlet";
[Parameter(Mandatory = true, Position = 0)] public string Name { get; set; }
[Parameter(Mandatory = true)]
[ValidateSet("Root", "Intermediate")]
public string Type { get; set; }
[Parameter(Mandatory = true)] public string CommonName { get; set; }
/// <summary>Required for -Type Intermediate: the authority that signs this one.</summary>
[Parameter] public string ParentCaId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Organization { get; set; }
[Parameter] public string OrganizationalUnit { get; set; }
[Parameter] public string Country { get; set; }
[Parameter] public string State { get; set; }
[Parameter] public string Locality { get; set; }
[Parameter] public string FriendlyName { get; set; }
[Parameter]
[ValidateSet("RSA_2048", "RSA_3072", "RSA_4096", "EC_prime256v1", "EC_secp384r1", "EC_secp521r1")]
public string KeyAlgorithm { get; set; } = "RSA_2048";
/// <summary>Expiry. Defaults to ten years for a root and five for a subordinate.</summary>
[Parameter] public DateTimeOffset? NotAfter { get; set; }
[Parameter] public DateTimeOffset? NotBefore { get; set; }
/// <summary>Subordinate authorities permitted beneath this one. Defaults to 1 for a root, 0 otherwise.</summary>
[Parameter] public int? MaxPathLength { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
bool isRoot = string.Equals(Type, "Root", StringComparison.OrdinalIgnoreCase);
if (!isRoot && string.IsNullOrEmpty(ParentCaId))
{
throw new PSInfisicalAPI.Errors.InfisicalConfigurationException(
"-ParentCaId is required for an intermediate certificate authority; it names the authority that signs this one.");
}
if (!ShouldProcess(Name, string.Concat("Create ", Type.ToLowerInvariant(), " certificate authority"))) { return; }
DateTimeOffset expiry = NotAfter ?? DateTimeOffset.UtcNow.AddYears(isRoot ? 10 : 5);
int pathLength = MaxPathLength ?? (isRoot ? 1 : 0);
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
InfisicalCertificateAuthority created = client.CreateInternalCertificateAuthority(
connection, ProjectId, Name, isRoot ? "root" : "intermediate", CommonName,
Organization, OrganizationalUnit, Country, State, Locality, KeyAlgorithm, FriendlyName,
ToApiTimestamp(NotBefore), ToApiTimestamp(expiry), pathLength);
if (created == null)
{
throw new PSInfisicalAPI.Errors.InfisicalApiException("Creating the certificate authority returned no record.");
}
if (!isRoot)
{
// Infisical creates a subordinate pending a certificate; without this it exists but cannot
// sign anything.
Logger.Information(Component, string.Concat("Signing '", Name, "' with parent certificate authority '", ParentCaId, "'."));
client.CompleteSubordinateCertificateAuthority(connection, ProjectId, created.Id, ParentCaId, ToApiTimestamp(expiry), pathLength);
InfisicalPkiClient readClient = new InfisicalPkiClient(HttpClient, Logger);
InfisicalCertificateAuthority refreshed = readClient.GetInternalCertificateAuthority(connection, created.Id, ProjectId);
if (refreshed != null) { created = refreshed; }
}
WriteObject(created);
}
catch (Exception exception)
{
WriteErrorForException(Component, "CreateCertificateAuthority", exception);
}
}
}
/// <summary>
/// Renames an internal certificate authority or changes its status.
/// </summary>
[Cmdlet(VerbsCommon.Set, "InfisicalCertificateAuthority", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificateAuthority))]
public sealed class SetInfisicalCertificateAuthorityCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "SetInfisicalCertificateAuthorityCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id")]
public string CaId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Name { get; set; }
[Parameter]
[ValidateSet("active", "disabled")]
public string Status { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(CaId, "Update certificate authority")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
InfisicalCertificateAuthority updated = client.UpdateInternalCertificateAuthority(connection, ProjectId, CaId, Name, Status);
if (PassThru.IsPresent) { WriteObject(updated); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "UpdateCertificateAuthority", exception);
}
}
}
/// <summary>
/// Deletes an internal certificate authority.
/// </summary>
[Cmdlet(VerbsCommon.Remove, "InfisicalCertificateAuthority", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
public sealed class RemoveInfisicalCertificateAuthorityCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "RemoveInfisicalCertificateAuthorityCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id")]
public string CaId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(CaId, "Delete certificate authority")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
client.DeleteInternalCertificateAuthority(connection, ProjectId, CaId);
if (PassThru.IsPresent) { WriteObject(CaId); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "DeleteCertificateAuthority", exception);
}
}
}
}
src/PSInfisicalAPI/Cmdlets/CertificatePolicyWriteCmdlets.cs
+193
View File
@@ -0,0 +1,193 @@
using System;
using System.Collections;
using System.Management.Automation;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Pki;
namespace PSInfisicalAPI.Cmdlets
{
/// <summary>
/// Creates a certificate policy: the constraints a profile issues within.
/// </summary>
[Cmdlet(VerbsCommon.New, "InfisicalCertificatePolicy", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificatePolicy))]
public sealed class NewInfisicalCertificatePolicyCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "NewInfisicalCertificatePolicyCmdlet";
[Parameter(Mandatory = true, Position = 0)] public string Name { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Description { get; set; }
/// <summary>Maximum certificate lifetime, for example '90d', '12m', or '1y'.</summary>
[Parameter] public string MaxValidity { get; set; }
/// <summary>Permitted key algorithms, for example RSA_2048 or EC_secp384r1.</summary>
[Parameter] public string[] KeyAlgorithm { get; set; }
/// <summary>Permitted signature algorithms.</summary>
[Parameter] public string[] SignatureAlgorithm { get; set; }
/// <summary>Key usage constraint, as @{ Required = @('digital_signature'); Denied = @(...) }.</summary>
[Parameter] public IDictionary KeyUsage { get; set; }
/// <summary>Extended key usage constraint, as @{ Required = @('server_auth','client_auth') }.</summary>
[Parameter] public IDictionary ExtendedKeyUsage { get; set; }
/// <summary>Subject attribute constraints, as @( @{ Type = 'organization'; Allowed = @('Contoso') } ).</summary>
[Parameter] public IDictionary[] Subject { get; set; }
/// <summary>Subject alternative name constraints, as @( @{ Type = 'dns_name'; Allowed = @('*.contoso.com') } ).</summary>
[Parameter] public IDictionary[] SubjectAlternativeName { get; set; }
/// <summary>Basic constraints, as @{ isCA = 'denied'; maxPathLength = 0 }.</summary>
[Parameter] public IDictionary BasicConstraints { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(Name, "Create certificate policy")) { return; }
InfisicalCertificatePolicyWriteRequestDto request = new InfisicalCertificatePolicyWriteRequestDto
{
Name = Name,
Description = Description,
Subject = ToJsonObjectList(Subject),
Sans = ToJsonObjectList(SubjectAlternativeName),
KeyUsages = ToJsonObject(KeyUsage),
ExtendedKeyUsages = ToJsonObject(ExtendedKeyUsage),
BasicConstraints = ToJsonObject(BasicConstraints)
};
if (!string.IsNullOrEmpty(MaxValidity))
{
request.Validity = new System.Collections.Generic.Dictionary<string, object> { { "max", MaxValidity } };
}
System.Collections.Generic.Dictionary<string, object> algorithms = new System.Collections.Generic.Dictionary<string, object>();
if (ToStringList(KeyAlgorithm) != null) { algorithms["keyAlgorithm"] = ToStringList(KeyAlgorithm); }
if (ToStringList(SignatureAlgorithm) != null) { algorithms["signature"] = ToStringList(SignatureAlgorithm); }
if (algorithms.Count > 0) { request.Algorithms = algorithms; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
WriteObject(client.WriteCertificatePolicy(connection, ProjectId, null, request));
}
catch (Exception exception)
{
WriteErrorForException(Component, "CreateCertificatePolicy", exception);
}
}
}
/// <summary>
/// Updates a certificate policy. Only the supplied constraints are sent; the rest are left as they are.
/// </summary>
[Cmdlet(VerbsCommon.Set, "InfisicalCertificatePolicy", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificatePolicy))]
public sealed class SetInfisicalCertificatePolicyCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "SetInfisicalCertificatePolicyCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id")]
public string PolicyId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Name { get; set; }
[Parameter] public string Description { get; set; }
[Parameter] public string MaxValidity { get; set; }
[Parameter] public string[] KeyAlgorithm { get; set; }
[Parameter] public string[] SignatureAlgorithm { get; set; }
[Parameter] public IDictionary KeyUsage { get; set; }
[Parameter] public IDictionary ExtendedKeyUsage { get; set; }
[Parameter] public IDictionary[] Subject { get; set; }
[Parameter] public IDictionary[] SubjectAlternativeName { get; set; }
[Parameter] public IDictionary BasicConstraints { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(PolicyId, "Update certificate policy")) { return; }
InfisicalCertificatePolicyWriteRequestDto request = new InfisicalCertificatePolicyWriteRequestDto
{
Name = Name,
Description = Description,
Subject = ToJsonObjectList(Subject),
Sans = ToJsonObjectList(SubjectAlternativeName),
KeyUsages = ToJsonObject(KeyUsage),
ExtendedKeyUsages = ToJsonObject(ExtendedKeyUsage),
BasicConstraints = ToJsonObject(BasicConstraints)
};
if (!string.IsNullOrEmpty(MaxValidity))
{
request.Validity = new System.Collections.Generic.Dictionary<string, object> { { "max", MaxValidity } };
}
System.Collections.Generic.Dictionary<string, object> algorithms = new System.Collections.Generic.Dictionary<string, object>();
if (ToStringList(KeyAlgorithm) != null) { algorithms["keyAlgorithm"] = ToStringList(KeyAlgorithm); }
if (ToStringList(SignatureAlgorithm) != null) { algorithms["signature"] = ToStringList(SignatureAlgorithm); }
if (algorithms.Count > 0) { request.Algorithms = algorithms; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
InfisicalCertificatePolicy updated = client.WriteCertificatePolicy(connection, ProjectId, PolicyId, request);
if (PassThru.IsPresent) { WriteObject(updated); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "UpdateCertificatePolicy", exception);
}
}
}
/// <summary>
/// Deletes a certificate policy.
/// </summary>
[Cmdlet(VerbsCommon.Remove, "InfisicalCertificatePolicy", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
public sealed class RemoveInfisicalCertificatePolicyCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "RemoveInfisicalCertificatePolicyCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id")]
public string PolicyId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(PolicyId, "Delete certificate policy")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
client.DeleteCertificatePolicy(connection, ProjectId, PolicyId);
if (PassThru.IsPresent) { WriteObject(PolicyId); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "DeleteCertificatePolicy", exception);
}
}
}
}
src/PSInfisicalAPI/Cmdlets/CertificateProfileWriteCmdlets.cs
+213
View File
@@ -0,0 +1,213 @@
using System;
using System.Collections;
using System.Management.Automation;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Pki;
namespace PSInfisicalAPI.Cmdlets
{
/// <summary>
/// Creates a certificate profile, binding an issuing certificate authority to a certificate policy and
/// exposing it for enrollment.
/// </summary>
[Cmdlet(VerbsCommon.New, "InfisicalCertificateProfile", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificateProfile))]
public sealed class NewInfisicalCertificateProfileCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "NewInfisicalCertificateProfileCmdlet";
/// <summary>Lowercase letters, numbers, and hyphens only.</summary>
[Parameter(Mandatory = true, Position = 0)] public string Slug { get; set; }
[Parameter(Mandatory = true)] public string CertificatePolicyId { get; set; }
[Parameter] public string CaId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Description { get; set; }
[Parameter]
[ValidateSet("api", "est", "acme", "scep")]
public string EnrollmentType { get; set; } = "api";
[Parameter]
[ValidateSet("ca", "self-signed")]
public string IssuerType { get; set; } = "ca";
/// <summary>Renew issued certificates automatically.</summary>
[Parameter] public SwitchParameter AutoRenew { get; set; }
/// <summary>Days before expiry at which automatic renewal runs, 1 to 30.</summary>
[Parameter] public int? RenewBeforeDays { get; set; }
/// <summary>Issuance defaults, as @{ ttlDays = 90; keyAlgorithm = 'RSA_2048' }.</summary>
[Parameter] public IDictionary Defaults { get; set; }
/// <summary>Enrollment configuration for -EnrollmentType est, acme, or scep.</summary>
[Parameter] public IDictionary EnrollmentConfig { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(Slug, "Create certificate profile")) { return; }
InfisicalCertificateProfileWriteRequestDto request = BuildRequest(
Slug, Description, CaId, CertificatePolicyId, EnrollmentType, IssuerType,
AutoRenew.IsPresent, RenewBeforeDays, Defaults, EnrollmentConfig,
MyInvocation.BoundParameters.ContainsKey("AutoRenew"));
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
WriteObject(client.WriteCertificateProfile(connection, ProjectId, null, request));
}
catch (Exception exception)
{
WriteErrorForException(Component, "CreateCertificateProfile", exception);
}
}
/// <summary>
/// Routes the enrollment configuration to the block matching the enrollment type, so callers supply one
/// dictionary rather than choosing between four mutually exclusive parameters.
/// </summary>
internal static InfisicalCertificateProfileWriteRequestDto BuildRequest(
string slug, string description, string caId, string certificatePolicyId,
string enrollmentType, string issuerType, bool autoRenew, int? renewBeforeDays,
IDictionary defaults, IDictionary enrollmentConfig, bool autoRenewBound)
{
InfisicalCertificateProfileWriteRequestDto request = new InfisicalCertificateProfileWriteRequestDto
{
Slug = slug,
Description = description,
CaId = caId,
CertificatePolicyId = certificatePolicyId,
EnrollmentType = enrollmentType,
IssuerType = issuerType,
Defaults = ToJsonObject(defaults)
};
System.Collections.Generic.Dictionary<string, object> config = ToJsonObject(enrollmentConfig);
if (string.Equals(enrollmentType, "est", StringComparison.OrdinalIgnoreCase)) { request.EstConfig = config; }
else if (string.Equals(enrollmentType, "acme", StringComparison.OrdinalIgnoreCase)) { request.AcmeConfig = config; }
else if (string.Equals(enrollmentType, "scep", StringComparison.OrdinalIgnoreCase)) { request.ScepConfig = config; }
else
{
if (config == null && (autoRenewBound || renewBeforeDays.HasValue))
{
config = new System.Collections.Generic.Dictionary<string, object>();
}
if (config != null)
{
if (autoRenewBound) { config["autoRenew"] = autoRenew; }
if (renewBeforeDays.HasValue) { config["renewBeforeDays"] = renewBeforeDays.Value; }
}
request.ApiConfig = config;
}
return request;
}
}
/// <summary>
/// Updates a certificate profile. Only the supplied values are sent.
/// </summary>
[Cmdlet(VerbsCommon.Set, "InfisicalCertificateProfile", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalCertificateProfile))]
public sealed class SetInfisicalCertificateProfileCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "SetInfisicalCertificateProfileCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id", "CertificateProfileId")]
public string ProfileId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Slug { get; set; }
[Parameter] public string Description { get; set; }
[Parameter] public string CaId { get; set; }
[Parameter] public string CertificatePolicyId { get; set; }
[Parameter]
[ValidateSet("api", "est", "acme", "scep")]
public string EnrollmentType { get; set; }
[Parameter] public SwitchParameter AutoRenew { get; set; }
[Parameter] public int? RenewBeforeDays { get; set; }
[Parameter] public IDictionary Defaults { get; set; }
[Parameter] public IDictionary EnrollmentConfig { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(ProfileId, "Update certificate profile")) { return; }
InfisicalCertificateProfileWriteRequestDto request = NewInfisicalCertificateProfileCmdlet.BuildRequest(
Slug, Description, CaId, CertificatePolicyId,
string.IsNullOrEmpty(EnrollmentType) ? "api" : EnrollmentType,
null, AutoRenew.IsPresent, RenewBeforeDays, Defaults, EnrollmentConfig,
MyInvocation.BoundParameters.ContainsKey("AutoRenew"));
// Only sent when the caller asked for it; the API keeps the stored value otherwise.
if (!MyInvocation.BoundParameters.ContainsKey("EnrollmentType")) { request.EnrollmentType = null; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
InfisicalCertificateProfile updated = client.WriteCertificateProfile(connection, ProjectId, ProfileId, request);
if (PassThru.IsPresent) { WriteObject(updated); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "UpdateCertificateProfile", exception);
}
}
}
/// <summary>
/// Deletes a certificate profile.
/// </summary>
[Cmdlet(VerbsCommon.Remove, "InfisicalCertificateProfile", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
public sealed class RemoveInfisicalCertificateProfileCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "RemoveInfisicalCertificateProfileCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("Id", "CertificateProfileId")]
public string ProfileId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(ProfileId, "Delete certificate profile")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
client.DeleteCertificateProfile(connection, ProjectId, ProfileId);
if (PassThru.IsPresent) { WriteObject(ProfileId); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "DeleteCertificateProfile", exception);
}
}
}
}
src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateApplicationCmdlet.cs
+9 -1
View File
@@ -18,7 +18,7 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("Name")]
public string ApplicationName { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter(ParameterSetName = "List")] public int? Limit { get; set; }
@@ -29,6 +29,14 @@ namespace PSInfisicalAPI.Cmdlets
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
if (string.Equals(ParameterSetName, "ById", StringComparison.Ordinal))
src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateApplicationEnrollmentCmdlet.cs
+9 -1
View File
@@ -18,13 +18,21 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("CertificateProfileId")]
public string ProfileId { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
InfisicalCertificateApplicationEnrollment enrollment = client.GetCertificateApplicationEnrollment(connection, ApplicationId, ProfileId, ProjectId);
src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateAuthorityCmdlet.cs
+9 -1
View File
@@ -14,7 +14,7 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("Id")]
public string CaId { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter(ParameterSetName = "List")]
[ValidateSet("Internal", "Acme", "Any")]
@@ -25,6 +25,14 @@ namespace PSInfisicalAPI.Cmdlets
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
if (string.Equals(ParameterSetName, "ById", StringComparison.Ordinal))
src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateCmdlet.cs
+10 -1
View File
@@ -16,7 +16,7 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("Id", "Identifier")]
public string SerialNumber { get; set; }
[Parameter(ParameterSetName = "List", Mandatory = true)] public string ProjectId { get; set; }
[Parameter(ParameterSetName = "List")] public string ProjectId { get; set; }
[Parameter(ParameterSetName = "List")] public string CommonName { get; set; }
[Parameter(ParameterSetName = "List")] public string FriendlyName { get; set; }
[Parameter(ParameterSetName = "List")] public string Search { get; set; }
@@ -59,6 +59,7 @@ namespace PSInfisicalAPI.Cmdlets
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
// Retrieval by serial addresses the certificate directly, so it needs no project.
if (string.Equals(ParameterSetName, "Single", StringComparison.Ordinal))
{
InfisicalCertificate cert = client.RetrieveCertificate(connection, SerialNumber);
@@ -70,6 +71,14 @@ namespace PSInfisicalAPI.Cmdlets
return;
}
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalCertificateSearchQuery query = new InfisicalCertificateSearchQuery
{
ProjectId = ProjectId,
src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificatePolicyCmdlet.cs
+9 -1
View File
@@ -14,7 +14,7 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("Id", "CertificatePolicyId")]
public string PolicyId { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter(ParameterSetName = "List")] public int? Limit { get; set; }
@@ -25,6 +25,14 @@ namespace PSInfisicalAPI.Cmdlets
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
if (string.Equals(ParameterSetName, "ById", StringComparison.Ordinal))
src/PSInfisicalAPI/Cmdlets/GetInfisicalCertificateProfileCmdlet.cs
+27 -3
View File
@@ -14,7 +14,19 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("Id", "CertificateProfileId")]
public string ProfileId { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
/// <summary>
/// Narrows the listing to one certificate application, which is how the Infisical console groups
/// profiles. See Get-InfisicalCertificateApplication.
/// </summary>
[Parameter(ParameterSetName = "List", ValueFromPipelineByPropertyName = true)]
public string ApplicationId { get; set; }
/// <summary>
/// Narrows the listing to profiles issued by one certificate authority.
/// </summary>
[Parameter(ParameterSetName = "List")] public string CaId { get; set; }
[Parameter(ParameterSetName = "List")] public int? Limit { get; set; }
@@ -27,6 +39,14 @@ namespace PSInfisicalAPI.Cmdlets
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
if (string.Equals(ParameterSetName, "ById", StringComparison.Ordinal))
@@ -41,8 +61,12 @@ namespace PSInfisicalAPI.Cmdlets
}
bool? includeConfigs = MyInvocation.BoundParameters.ContainsKey("IncludeConfigs") ? (bool?)IncludeConfigs.IsPresent : null;
InfisicalCertificateProfile[] all = client.ListCertificateProfiles(connection, ProjectId, Limit, Offset, includeConfigs);
Logger.Information("Get-InfisicalCertificateProfile", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate profile(s)."));
InfisicalCertificateProfile[] all = client.ListCertificateProfiles(connection, ProjectId, Limit, Offset, includeConfigs, ApplicationId, CaId);
string scope = !string.IsNullOrEmpty(ApplicationId)
? string.Concat(" for application '", ApplicationId, "'")
: (!string.IsNullOrEmpty(CaId) ? string.Concat(" for certificate authority '", CaId, "'") : string.Empty);
Logger.Information("Get-InfisicalCertificateProfile", string.Concat("Returned ", all.Length.ToString(System.Globalization.CultureInfo.InvariantCulture), " certificate profile(s)", scope, "."));
foreach (InfisicalCertificateProfile profile in all)
{
WriteObject(profile);
src/PSInfisicalAPI/Cmdlets/GetInfisicalPkiSubscriberCmdlet.cs
+9 -1
View File
@@ -14,13 +14,21 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("SubscriberName", "Slug")]
public string Name { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
// No Certificate Manager project means nothing to list; that is an empty result, not a failure.
if (string.IsNullOrEmpty(ProjectId)) { return; }
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
if (string.Equals(ParameterSetName, "ByName", StringComparison.Ordinal))
src/PSInfisicalAPI/Cmdlets/InfisicalCmdletBase.cs
+132
View File
@@ -1,10 +1,14 @@
using System;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Globalization;
using System.Management.Automation;
using System.Runtime.ExceptionServices;
using System.Security.Cryptography.X509Certificates;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Organizations;
using PSInfisicalAPI.Projects;
using PSInfisicalAPI.Errors;
using PSInfisicalAPI.Http;
using PSInfisicalAPI.Logging;
@@ -13,9 +17,13 @@ namespace PSInfisicalAPI.Cmdlets
{
public abstract class InfisicalCmdletBase : PSCmdlet
{
private const string CertManagerProjectType = "cert-manager";
private IInfisicalLogger _logger;
private IInfisicalHttpClient _httpClient;
private bool? _isElevated;
private string _resolvedCertManagerProjectId;
private bool _certManagerProjectResolved;
protected IInfisicalLogger Logger
{
@@ -49,6 +57,130 @@ namespace PSInfisicalAPI.Cmdlets
return current != null && current.SkipCertificateCheck;
}
/// <summary>
/// Resolves the Certificate Manager project a PKI call should target.
/// <para>
/// The Infisical UI never asks which project to use: an organization with a single Certificate Manager
/// project has it selected implicitly, which is why the project appears only in the URL and everything
/// below it is presented as applications. The API behaves the same way - its own resolver takes the
/// single cert-manager project when there is exactly one - so requiring -ProjectId on every cmdlet made
/// the module stricter than the service it wraps.
/// </para>
/// <para>
/// This mirrors that rule client-side, which is necessary because several PKI endpoints carry the project
/// in the URL path and cannot defer to the server's resolver. Resolved once per cmdlet instance.
/// </para>
/// </summary>
/// <returns>
/// The project to use, or <c>null</c> when the organization has no Certificate Manager project. Callers
/// that cannot proceed without one should return quietly rather than failing: an organization that has
/// not set up Certificate Manager has nothing to list, which is an empty result and not an error.
/// </returns>
protected string ResolveCertManagerProjectId(InfisicalConnection connection, string explicitValue)
{
if (!string.IsNullOrEmpty(explicitValue)) { return explicitValue; }
if (_certManagerProjectResolved) { return _resolvedCertManagerProjectId; }
_certManagerProjectResolved = true;
InfisicalProjectClient client = new InfisicalProjectClient(HttpClient, Logger);
InfisicalProject[] projects = client.List(connection, CertManagerProjectType, false);
List<InfisicalProject> certManagerProjects = new List<InfisicalProject>();
if (projects != null)
{
foreach (InfisicalProject project in projects)
{
if (project == null) { continue; }
if (string.Equals(project.Type, CertManagerProjectType, StringComparison.OrdinalIgnoreCase))
{
certManagerProjects.Add(project);
}
}
}
if (certManagerProjects.Count == 0)
{
Logger.Verbose(GetType().Name, string.Concat(
"-ProjectId was not supplied and this organization has no Certificate Manager project, so there is ",
"nothing to resolve to. Create one in Infisical (Certificate Management), or pass -ProjectId to ",
"target a specific project."));
_resolvedCertManagerProjectId = null;
return null;
}
InfisicalProject chosen = certManagerProjects[0];
string reason = "the organization's only Certificate Manager project";
if (certManagerProjects.Count > 1)
{
// More than one is not an error. Infisical designates one of them as the organization's active
// Certificate Manager project, and certificate applications are only served from that one, so
// resolving to it is what makes an application-centric script work.
InfisicalProject active = FindActiveCertManagerProject(connection, certManagerProjects);
if (active != null)
{
chosen = active;
reason = "the organization's active Certificate Manager project";
}
else
{
reason = string.Concat(
"the first of ", certManagerProjects.Count.ToString(CultureInfo.InvariantCulture),
" Certificate Manager projects (no active project is set on the organization; pass -ProjectId to choose another)");
}
}
_resolvedCertManagerProjectId = chosen.Id;
Logger.Verbose(GetType().Name, string.Concat(
"-ProjectId was not supplied; resolved ", reason, ": '",
chosen.Name ?? chosen.Slug, "' (", _resolvedCertManagerProjectId, ")."));
return _resolvedCertManagerProjectId;
}
/// <summary>
/// Finds the organization's active Certificate Manager project among the candidates. Certificate
/// applications are served only from this project, so when several exist it is the one a PKI call
/// should target. Returns null when the organization designates none, leaving the caller to fall back.
/// </summary>
private InfisicalProject FindActiveCertManagerProject(InfisicalConnection connection, List<InfisicalProject> candidates)
{
try
{
InfisicalOrganizationClient organizationClient = new InfisicalOrganizationClient(HttpClient, Logger);
InfisicalOrganization[] organizations = organizationClient.List(connection);
if (organizations == null) { return null; }
string organizationId = connection != null ? connection.OrganizationId : null;
foreach (InfisicalOrganization organization in organizations)
{
if (organization == null || string.IsNullOrEmpty(organization.DefaultCertManagerProjectId)) { continue; }
if (!string.IsNullOrEmpty(organizationId)
&& !string.Equals(organization.Id, organizationId, StringComparison.OrdinalIgnoreCase))
{
continue;
}
foreach (InfisicalProject candidate in candidates)
{
if (string.Equals(candidate.Id, organization.DefaultCertManagerProjectId, StringComparison.OrdinalIgnoreCase))
{
return candidate;
}
}
}
}
catch (Exception exception)
{
if (IsPipelineControlException(exception)) { throw; }
Logger.Verbose(GetType().Name, string.Concat("Could not read the organization's active Certificate Manager project (continuing): ", exception.Message));
}
return null;
}
/// <summary>
/// Reports whether the host process is running elevated. Evaluated through the PowerShell engine rather
/// than WindowsIdentity directly, because the module targets netstandard2.0 and does not carry a
src/PSInfisicalAPI/Cmdlets/InfisicalPkiWriteCmdletBase.cs
+164
View File
@@ -0,0 +1,164 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.Globalization;
using System.Management.Automation;
namespace PSInfisicalAPI.Cmdlets
{
/// <summary>
/// Shared plumbing for the cmdlets that create, change, or remove Certificate Manager configuration.
/// <para>
/// Infisical's policy and profile bodies are deeply nested — allowed/required/denied constraint objects,
/// per-enrollment-type config blocks — and expressing every leaf as a parameter would produce cmdlets nobody
/// could read. Those structures are accepted as dictionaries instead, matching how <c>-Subject</c> and
/// <c>-Metadata</c> already work, and are converted here.
/// </para>
/// </summary>
public abstract class InfisicalPkiWriteCmdletBase : InfisicalCmdletBase
{
/// <summary>
/// Converts a caller's dictionary into the plain string-keyed form the serializer emits as a JSON
/// object. Nested dictionaries and collections are converted too, so a hashtable of hashtables round
/// trips into the nested body Infisical expects.
/// </summary>
/// <summary>
/// The constraint vocabulary Infisical expects in lower case. PowerShell callers naturally capitalise
/// hashtable keys, so <c>@{ Required = ... }</c> has to reach the API as <c>"required"</c> or the request
/// is rejected for a missing constraint. Every other key is passed through untouched, since the rest of
/// the body uses camelCase field names the caller supplies verbatim.
/// </summary>
private static readonly Dictionary<string, string> CanonicalKeys = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
{
{ "allowed", "allowed" },
{ "required", "required" },
{ "denied", "denied" },
{ "type", "type" }
};
internal static Dictionary<string, object> ToJsonObject(IDictionary source)
{
if (source == null) { return null; }
Dictionary<string, object> result = new Dictionary<string, object>(StringComparer.Ordinal);
foreach (DictionaryEntry entry in source)
{
if (entry.Key == null) { continue; }
string key = Convert.ToString(entry.Key, CultureInfo.InvariantCulture);
if (string.IsNullOrWhiteSpace(key)) { continue; }
key = key.Trim();
string canonical;
if (CanonicalKeys.TryGetValue(key, out canonical)) { key = canonical; }
object value = ToJsonValue(entry.Value);
// An empty list is dropped rather than sent. "allowed": [] does not read as "unconstrained" to
// Infisical, it reads as "allow nothing", which is never what a caller writing @{ Allowed = @() }
// intends; omitting the key leaves that dimension genuinely unconstrained.
List<object> asList = value as List<object>;
if (asList != null && asList.Count == 0) { continue; }
result[key] = value;
}
return result.Count > 0 ? result : null;
}
/// <summary>
/// Converts a list of dictionaries, which is the shape Infisical uses for policy subject and SAN
/// constraints.
/// </summary>
internal static List<Dictionary<string, object>> ToJsonObjectList(IEnumerable source)
{
if (source == null) { return null; }
List<Dictionary<string, object>> result = new List<Dictionary<string, object>>();
foreach (object item in source)
{
IDictionary dictionary = UnwrapDictionary(item);
if (dictionary == null) { continue; }
Dictionary<string, object> converted = ToJsonObject(dictionary);
if (converted == null) { continue; }
// An entry carrying only "type" states a dimension without constraining it, which Infisical
// rejects outright. Dropping it is what the caller meant by leaving the lists empty.
bool hasConstraint = converted.ContainsKey("allowed") || converted.ContainsKey("required") || converted.ContainsKey("denied");
if (!hasConstraint) { continue; }
result.Add(converted);
}
return result.Count > 0 ? result : null;
}
private static object ToJsonValue(object value)
{
if (value == null) { return null; }
IDictionary nested = UnwrapDictionary(value);
if (nested != null) { return ToJsonObject(nested); }
if (value is string) { return value; }
IEnumerable enumerable = UnwrapEnumerable(value);
if (enumerable != null)
{
List<object> items = new List<object>();
foreach (object item in enumerable) { items.Add(ToJsonValue(item)); }
return items;
}
return value;
}
/// <summary>
/// PowerShell hands parameters over wrapped in PSObject often enough that unwrapping has to happen at
/// every level, not only at the top.
/// </summary>
private static IDictionary UnwrapDictionary(object value)
{
if (value == null) { return null; }
if (value is IDictionary direct) { return direct; }
PSObject wrapper = value as PSObject;
if (wrapper != null && wrapper.BaseObject is IDictionary wrapped) { return wrapped; }
return null;
}
private static IEnumerable UnwrapEnumerable(object value)
{
if (value is IEnumerable direct) { return direct; }
PSObject wrapper = value as PSObject;
if (wrapper != null && wrapper.BaseObject is IEnumerable wrapped) { return wrapped; }
return null;
}
/// <summary>
/// Formats an expiry the way Infisical's date validator accepts it.
/// </summary>
internal static string ToApiTimestamp(DateTimeOffset? value)
{
if (!value.HasValue) { return null; }
return value.Value.ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ", CultureInfo.InvariantCulture);
}
internal static List<string> ToStringList(IEnumerable<string> values)
{
if (values == null) { return null; }
List<string> result = new List<string>();
foreach (string value in values)
{
if (!string.IsNullOrWhiteSpace(value)) { result.Add(value.Trim()); }
}
return result.Count > 0 ? result : null;
}
}
}
src/PSInfisicalAPI/Cmdlets/PkiSubscriberWriteCmdlets.cs
+189
View File
@@ -0,0 +1,189 @@
using System;
using System.Collections;
using System.Management.Automation;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Pki;
namespace PSInfisicalAPI.Cmdlets
{
/// <summary>
/// Creates a PKI subscriber: a named enrollment identity pinning one common name, its SAN allowlist, and its
/// key usages.
/// </summary>
[Cmdlet(VerbsCommon.New, "InfisicalPkiSubscriber", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalPkiSubscriber))]
public sealed class NewInfisicalPkiSubscriberCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "NewInfisicalPkiSubscriberCmdlet";
[Parameter(Mandatory = true, Position = 0)] public string Name { get; set; }
/// <summary>
/// The certificate signed for this subscriber must carry exactly this common name; Infisical rejects a
/// request whose CSR names anything else.
/// </summary>
[Parameter(Mandatory = true)] public string CommonName { get; set; }
[Parameter(Mandatory = true)] public string CaId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string Ttl { get; set; }
/// <summary>Allowlist of subject alternative names. A CSR naming anything outside it is rejected.</summary>
[Parameter] public string[] SubjectAlternativeName { get; set; }
[Parameter] public string[] KeyUsage { get; set; }
[Parameter] public string[] ExtendedKeyUsage { get; set; }
[Parameter]
[ValidateSet("active", "disabled")]
public string Status { get; set; } = "active";
[Parameter] public SwitchParameter EnableAutoRenewal { get; set; }
[Parameter] public int? AutoRenewalPeriodInDays { get; set; }
/// <summary>Additional subject attributes, as @{ organization = 'Contoso'; country = 'US' }.</summary>
[Parameter] public IDictionary Properties { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(Name, "Create PKI subscriber")) { return; }
InfisicalPkiSubscriberWriteRequestDto request = new InfisicalPkiSubscriberWriteRequestDto
{
Name = Name,
CommonName = CommonName,
CaId = CaId,
Status = Status,
Ttl = Ttl,
SubjectAlternativeNames = ToStringList(SubjectAlternativeName),
KeyUsages = ToStringList(KeyUsage),
ExtendedKeyUsages = ToStringList(ExtendedKeyUsage),
Properties = ToJsonObject(Properties)
};
if (MyInvocation.BoundParameters.ContainsKey("EnableAutoRenewal")) { request.EnableAutoRenewal = EnableAutoRenewal.IsPresent; }
if (AutoRenewalPeriodInDays.HasValue) { request.AutoRenewalPeriodInDays = AutoRenewalPeriodInDays.Value; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
WriteObject(client.WritePkiSubscriber(connection, ProjectId, null, request));
}
catch (Exception exception)
{
WriteErrorForException(Component, "CreatePkiSubscriber", exception);
}
}
}
/// <summary>
/// Updates a PKI subscriber. Only the supplied values are sent.
/// </summary>
[Cmdlet(VerbsCommon.Set, "InfisicalPkiSubscriber", SupportsShouldProcess = true)]
[OutputType(typeof(InfisicalPkiSubscriber))]
public sealed class SetInfisicalPkiSubscriberCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "SetInfisicalPkiSubscriberCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("SubscriberName", "Slug")]
public string Name { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public string NewName { get; set; }
[Parameter] public string CommonName { get; set; }
[Parameter] public string CaId { get; set; }
[Parameter] public string Ttl { get; set; }
[Parameter] public string[] SubjectAlternativeName { get; set; }
[Parameter] public string[] KeyUsage { get; set; }
[Parameter] public string[] ExtendedKeyUsage { get; set; }
[Parameter]
[ValidateSet("active", "disabled")]
public string Status { get; set; }
[Parameter] public SwitchParameter EnableAutoRenewal { get; set; }
[Parameter] public int? AutoRenewalPeriodInDays { get; set; }
[Parameter] public IDictionary Properties { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(Name, "Update PKI subscriber")) { return; }
InfisicalPkiSubscriberWriteRequestDto request = new InfisicalPkiSubscriberWriteRequestDto
{
Name = NewName,
CommonName = CommonName,
CaId = CaId,
Status = Status,
Ttl = Ttl,
SubjectAlternativeNames = ToStringList(SubjectAlternativeName),
KeyUsages = ToStringList(KeyUsage),
ExtendedKeyUsages = ToStringList(ExtendedKeyUsage),
Properties = ToJsonObject(Properties)
};
if (MyInvocation.BoundParameters.ContainsKey("EnableAutoRenewal")) { request.EnableAutoRenewal = EnableAutoRenewal.IsPresent; }
if (AutoRenewalPeriodInDays.HasValue) { request.AutoRenewalPeriodInDays = AutoRenewalPeriodInDays.Value; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
InfisicalPkiSubscriber updated = client.WritePkiSubscriber(connection, ProjectId, Name, request);
if (PassThru.IsPresent) { WriteObject(updated); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "UpdatePkiSubscriber", exception);
}
}
}
/// <summary>
/// Deletes a PKI subscriber.
/// </summary>
[Cmdlet(VerbsCommon.Remove, "InfisicalPkiSubscriber", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.High)]
public sealed class RemoveInfisicalPkiSubscriberCmdlet : InfisicalPkiWriteCmdletBase
{
private const string Component = "RemoveInfisicalPkiSubscriberCmdlet";
[Parameter(Mandatory = true, Position = 0, ValueFromPipelineByPropertyName = true)]
[Alias("SubscriberName", "Slug")]
public string Name { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public SwitchParameter PassThru { get; set; }
protected override void ProcessRecord()
{
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
if (string.IsNullOrEmpty(ProjectId)) { return; }
if (!ShouldProcess(Name, "Delete PKI subscriber")) { return; }
InfisicalPkiManagementClient client = new InfisicalPkiManagementClient(HttpClient, Logger);
client.DeletePkiSubscriber(connection, ProjectId, Name);
if (PassThru.IsPresent) { WriteObject(Name); }
}
catch (Exception exception)
{
WriteErrorForException(Component, "DeletePkiSubscriber", exception);
}
}
}
}
src/PSInfisicalAPI/Cmdlets/RequestInfisicalCertificateCmdlet.cs
+6 -1
View File
@@ -28,7 +28,7 @@ namespace PSInfisicalAPI.Cmdlets
[Alias("ProfileId")]
public string CertificateProfileId { get; set; }
[Parameter(Mandatory = true)] public string ProjectId { get; set; }
[Parameter] public string ProjectId { get; set; }
[Parameter] public IDictionary Subject { get; set; }
[Parameter] public string CommonName { get; set; }
[Parameter] public string Country { get; set; }
@@ -85,6 +85,11 @@ namespace PSInfisicalAPI.Cmdlets
try
{
InfisicalConnection connection = InfisicalSessionManager.RequireCurrent();
// The UI never asks which Certificate Manager project to use when an organization has only
// one; -ProjectId is optional here for the same reason. Assigned back so every call below
// sees the resolved value without threading a second variable through.
ProjectId = ResolveCertManagerProjectId(connection, ProjectId);
InfisicalPkiClient client = new InfisicalPkiClient(HttpClient, Logger);
// Resolved once so reuse detection looks in the same stores the install will write to.
src/PSInfisicalAPI/Endpoints/InfisicalEndpointNames.cs
+25
View File
@@ -62,6 +62,31 @@ namespace PSInfisicalAPI.Endpoints
public const string RetrieveCertificate = "RetrieveCertificate";
public const string GetCertificateBundle = "GetCertificateBundle";
public const string UpdateCertificateMetadata = "UpdateCertificateMetadata";
public const string CreateInternalCertificateAuthority = "CreateInternalCertificateAuthority";
public const string UpdateInternalCertificateAuthority = "UpdateInternalCertificateAuthority";
public const string DeleteInternalCertificateAuthority = "DeleteInternalCertificateAuthority";
public const string GetCertificateAuthorityCsr = "GetCertificateAuthorityCsr";
public const string SignIntermediateCertificateAuthority = "SignIntermediateCertificateAuthority";
public const string ImportCertificateAuthorityCertificate = "ImportCertificateAuthorityCertificate";
public const string CreateCertificatePolicy = "CreateCertificatePolicy";
public const string UpdateCertificatePolicy = "UpdateCertificatePolicy";
public const string DeleteCertificatePolicy = "DeleteCertificatePolicy";
public const string CreateCertificateProfile = "CreateCertificateProfile";
public const string UpdateCertificateProfile = "UpdateCertificateProfile";
public const string DeleteCertificateProfile = "DeleteCertificateProfile";
public const string CreateCertificateApplication = "CreateCertificateApplication";
public const string UpdateCertificateApplication = "UpdateCertificateApplication";
public const string DeleteCertificateApplication = "DeleteCertificateApplication";
public const string AddCertificateApplicationProfiles = "AddCertificateApplicationProfiles";
public const string RemoveCertificateApplicationProfile = "RemoveCertificateApplicationProfile";
public const string CreatePkiSubscriber = "CreatePkiSubscriber";
public const string UpdatePkiSubscriber = "UpdatePkiSubscriber";
public const string DeletePkiSubscriber = "DeletePkiSubscriber";
public const string SignCertificateBySubscriber = "SignCertificateBySubscriber";
public const string SignCertificateByCa = "SignCertificateByCa";
public const string IssueCertificateByProfile = "IssueCertificateByProfile";
src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs
+69 -2
View File
@@ -288,6 +288,18 @@ namespace PSInfisicalAPI.Endpoints
private static void RegisterProjects(Dictionary<string, List<InfisicalEndpointDefinition>> map)
{
// /api/v1/projects is the current route; /api/v1/workspace mounts Infisical's deprecated project
// router and is kept only as a fallback for older servers.
Add(map, new InfisicalEndpointDefinition
{
Name = InfisicalEndpointNames.ListProjects,
Resource = "Projects",
Version = "v1",
Method = "GET",
Template = "/api/v1/projects",
RequiresAuthorization = true
});
Add(map, new InfisicalEndpointDefinition
{
Name = InfisicalEndpointNames.ListProjects,
@@ -500,6 +512,19 @@ namespace PSInfisicalAPI.Endpoints
private static void RegisterOrganizations(Dictionary<string, List<InfisicalEndpointDefinition>> map)
{
Add(map, new InfisicalEndpointDefinition
{
// The listing lives on the singular v1 route. /api/v2/organizations mounts only
// /:organizationId/* sub-routes and has no GET /, so asking it for a list returns
// "Route GET:/api/v2/organizations not found". Kept as a fallback candidate all the same.
Name = InfisicalEndpointNames.ListOrganizations,
Resource = "Organizations",
Version = "v1",
Method = "GET",
Template = "/api/v1/organization",
RequiresAuthorization = true
});
Add(map, new InfisicalEndpointDefinition
{
Name = InfisicalEndpointNames.ListOrganizations,
@@ -656,6 +681,11 @@ namespace PSInfisicalAPI.Endpoints
RequiresAuthorization = true
});
// RetrieveCertificate and GetCertificateBundle deliberately lead with the older /api/v1/pki route:
// it resolves a certificate by SERIAL NUMBER, which is what callers supply. The newer
// /api/v1/cert-manager route takes a certificate ID and passes it straight through as
// getCert({ id }), so it cannot answer a serial. Both are registered so either identifier resolves;
// reordering these two would send every serial lookup to the route that cannot serve it.
Add(map, new InfisicalEndpointDefinition
{
Name = InfisicalEndpointNames.RetrieveCertificate,
@@ -698,6 +728,43 @@ namespace PSInfisicalAPI.Endpoints
ContainsSecretMaterialInResponse = true
});
#region PKI configuration management
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.CreateInternalCertificateAuthority, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/cert-manager/ca/internal", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.CreateInternalCertificateAuthority, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/pki/ca/internal", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.UpdateInternalCertificateAuthority, Resource = "Pki", Version = "v1", Method = "PATCH", Template = "/api/v1/cert-manager/ca/internal/{caId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.UpdateInternalCertificateAuthority, Resource = "Pki", Version = "v1", Method = "PATCH", Template = "/api/v1/pki/ca/internal/{caId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.DeleteInternalCertificateAuthority, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/cert-manager/ca/internal/{caId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.DeleteInternalCertificateAuthority, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/pki/ca/internal/{caId}", RequiresAuthorization = true });
// Standing up a subordinate takes three calls: Infisical creates it pending, then the CSR is signed
// by the parent and imported back.
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.GetCertificateAuthorityCsr, Resource = "Pki", Version = "v1", Method = "GET", Template = "/api/v1/pki/ca/{caId}/csr", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.SignIntermediateCertificateAuthority, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/pki/ca/{caId}/sign-intermediate", RequiresAuthorization = true, ContainsSecretMaterialInResponse = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.ImportCertificateAuthorityCertificate, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/pki/ca/{caId}/import-certificate", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.CreateCertificatePolicy, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/cert-manager/certificate-policies", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.UpdateCertificatePolicy, Resource = "Pki", Version = "v1", Method = "PATCH", Template = "/api/v1/cert-manager/certificate-policies/{policyId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.DeleteCertificatePolicy, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/cert-manager/certificate-policies/{policyId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.CreateCertificateProfile, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/cert-manager/certificate-profiles", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.UpdateCertificateProfile, Resource = "Pki", Version = "v1", Method = "PATCH", Template = "/api/v1/cert-manager/certificate-profiles/{profileId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.DeleteCertificateProfile, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/cert-manager/certificate-profiles/{profileId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.CreateCertificateApplication, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/cert-manager/applications", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.UpdateCertificateApplication, Resource = "Pki", Version = "v1", Method = "PATCH", Template = "/api/v1/cert-manager/applications/{applicationId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.DeleteCertificateApplication, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/cert-manager/applications/{applicationId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.AddCertificateApplicationProfiles, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/cert-manager/applications/{applicationId}/profiles", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.RemoveCertificateApplicationProfile, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/cert-manager/applications/{applicationId}/profiles/{profileId}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.CreatePkiSubscriber, Resource = "Pki", Version = "v1", Method = "POST", Template = "/api/v1/pki/subscribers", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.UpdatePkiSubscriber, Resource = "Pki", Version = "v1", Method = "PATCH", Template = "/api/v1/pki/subscribers/{subscriberName}", RequiresAuthorization = true });
Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.DeletePkiSubscriber, Resource = "Pki", Version = "v1", Method = "DELETE", Template = "/api/v1/pki/subscribers/{subscriberName}", RequiresAuthorization = true });
#endregion
Add(map, new InfisicalEndpointDefinition
{
Name = InfisicalEndpointNames.UpdateCertificateMetadata,
@@ -735,7 +802,7 @@ namespace PSInfisicalAPI.Endpoints
Resource = "Pki",
Version = "v1",
Method = "POST",
Template = "/api/v1/pki/ca/{caId}/sign-certificate",
Template = "/api/v1/cert-manager/ca/{caId}/sign-certificate",
RequiresAuthorization = true,
ContainsSecretMaterialInResponse = true
});
@@ -746,7 +813,7 @@ namespace PSInfisicalAPI.Endpoints
Resource = "Pki",
Version = "v1",
Method = "POST",
Template = "/api/v1/cert-manager/ca/{caId}/sign-certificate",
Template = "/api/v1/pki/ca/{caId}/sign-certificate",
RequiresAuthorization = true,
ContainsSecretMaterialInResponse = true
});
src/PSInfisicalAPI/Models/InfisicalOrganization.cs
+6
View File
@@ -9,6 +9,12 @@ namespace PSInfisicalAPI.Models
public string Slug { get; set; }
public string CustomerId { get; set; }
public bool AuthEnforced { get; set; }
/// <summary>
/// The organization's active Certificate Manager project. Certificate applications are only available on
/// this project, so it is what a PKI call resolves to when an organization has more than one.
/// </summary>
public string DefaultCertManagerProjectId { get; set; }
public bool ScimEnabled { get; set; }
public DateTimeOffset? CreatedAtUtc { get; set; }
public DateTimeOffset? UpdatedAtUtc { get; set; }
src/PSInfisicalAPI/Organizations/InfisicalOrganizationClient.cs
+1 -1
View File
@@ -33,7 +33,7 @@ namespace PSInfisicalAPI.Organizations
try
{
_logger.Information(Component, "Attempting to list Infisical organizations. Please Wait...");
InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.ListOrganizations, "ListOrganizations", null, null, null);
InfisicalHttpResponse response = _invoker.InvokeWithCandidateFallback(connection, InfisicalEndpointNames.ListOrganizations, "ListOrganizations", null, null, null);
InfisicalOrganizationListResponseDto dto = _serializer.Deserialize<InfisicalOrganizationListResponseDto>(response.Body);
response.Clear();
src/PSInfisicalAPI/Organizations/InfisicalOrganizationDtos.cs
+1
View File
@@ -11,6 +11,7 @@ namespace PSInfisicalAPI.Organizations
[JsonProperty("slug")] public string Slug { get; set; }
[JsonProperty("customerId")] public string CustomerId { get; set; }
[JsonProperty("authEnforced")] public bool AuthEnforced { get; set; }
[JsonProperty("defaultCertManagerProjectId", NullValueHandling = NullValueHandling.Ignore)] public string DefaultCertManagerProjectId { get; set; }
[JsonProperty("scimEnabled")] public bool ScimEnabled { get; set; }
[JsonProperty("createdAt")] public string CreatedAt { get; set; }
[JsonProperty("updatedAt")] public string UpdatedAt { get; set; }
src/PSInfisicalAPI/Organizations/InfisicalOrganizationMapper.cs
+1
View File
@@ -21,6 +21,7 @@ namespace PSInfisicalAPI.Organizations
Slug = dto.Slug,
CustomerId = dto.CustomerId,
AuthEnforced = dto.AuthEnforced,
DefaultCertManagerProjectId = dto.DefaultCertManagerProjectId,
ScimEnabled = dto.ScimEnabled,
CreatedAtUtc = ParseTimestamp(dto.CreatedAt),
UpdatedAtUtc = ParseTimestamp(dto.UpdatedAt)
src/PSInfisicalAPI/Pki/InfisicalPkiClient.cs
+12
View File
@@ -530,6 +530,16 @@ namespace PSInfisicalAPI.Pki
}
public InfisicalCertificateProfile[] ListCertificateProfiles(InfisicalConnection connection, string projectId, int? limit, int? offset, bool? includeConfigs)
{
return ListCertificateProfiles(connection, projectId, limit, offset, includeConfigs, null, null);
}
/// <summary>
/// Lists certificate profiles, optionally narrowed to one application or issuing CA. Applications are
/// how the UI groups profiles, so filtering by application is what makes a script read the way the
/// console does.
/// </summary>
public InfisicalCertificateProfile[] ListCertificateProfiles(InfisicalConnection connection, string projectId, int? limit, int? offset, bool? includeConfigs, string applicationId, string caId)
{
if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
if (string.IsNullOrEmpty(projectId)) { throw new InfisicalConfigurationException("ProjectId is required."); }
@@ -541,6 +551,8 @@ namespace PSInfisicalAPI.Pki
if (limit.HasValue) { query.Add(new KeyValuePair<string, string>("limit", limit.Value.ToString(CultureInfo.InvariantCulture))); }
if (offset.HasValue) { query.Add(new KeyValuePair<string, string>("offset", offset.Value.ToString(CultureInfo.InvariantCulture))); }
if (includeConfigs.HasValue) { query.Add(new KeyValuePair<string, string>("includeConfigs", includeConfigs.Value ? "true" : "false")); }
if (!string.IsNullOrEmpty(applicationId)) { query.Add(new KeyValuePair<string, string>("applicationId", applicationId)); }
if (!string.IsNullOrEmpty(caId)) { query.Add(new KeyValuePair<string, string>("caId", caId)); }
try
{
src/PSInfisicalAPI/Pki/InfisicalPkiManagementClient.cs
+443
View File
@@ -0,0 +1,443 @@
using System;
using System.Collections.Generic;
using PSInfisicalAPI.Connections;
using PSInfisicalAPI.Endpoints;
using PSInfisicalAPI.Errors;
using PSInfisicalAPI.Http;
using PSInfisicalAPI.Logging;
using PSInfisicalAPI.Models;
using PSInfisicalAPI.Serialization;
namespace PSInfisicalAPI.Pki
{
/// <summary>
/// Create, update, and delete operations for the objects that make up a Certificate Manager environment:
/// certificate authorities, policies, profiles, applications, and PKI subscribers.
/// <para>
/// Kept apart from <see cref="InfisicalPkiClient"/>, which reads and issues. These are the operations that
/// change how a project is configured rather than what it has issued.
/// </para>
/// </summary>
internal sealed class InfisicalPkiManagementClient
{
private const string Component = "PkiManagementClient";
private readonly InfisicalApiInvoker _invoker;
private readonly IInfisicalLogger _logger;
private readonly JsonInfisicalSerializer _serializer;
public InfisicalPkiManagementClient(IInfisicalHttpClient httpClient, IInfisicalLogger logger)
{
if (httpClient == null) { throw new ArgumentNullException(nameof(httpClient)); }
_logger = logger ?? NullInfisicalLogger.Instance;
_invoker = new InfisicalApiInvoker(httpClient);
_serializer = new JsonInfisicalSerializer();
}
#region Certificate authority
public InfisicalCertificateAuthority CreateInternalCertificateAuthority(
InfisicalConnection connection,
string projectId,
string name,
string type,
string commonName,
string organization,
string organizationalUnit,
string country,
string state,
string locality,
string keyAlgorithm,
string friendlyName,
string notBefore,
string notAfter,
int? maxPathLength)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(name)) { throw new InfisicalConfigurationException("Name is required."); }
if (string.IsNullOrEmpty(type)) { throw new InfisicalConfigurationException("Type is required."); }
bool isRoot = string.Equals(type, "root", StringComparison.OrdinalIgnoreCase);
InfisicalCreateInternalCaRequestDto request = new InfisicalCreateInternalCaRequestDto
{
ProjectId = projectId,
Name = name,
Status = "active",
Configuration = new InfisicalCreateInternalCaConfigurationDto
{
Type = type,
CommonName = commonName ?? string.Empty,
Organization = organization ?? string.Empty,
OrganizationalUnit = organizationalUnit ?? string.Empty,
Country = country ?? string.Empty,
State = state ?? string.Empty,
Locality = locality ?? string.Empty,
KeyAlgorithm = keyAlgorithm,
FriendlyName = friendlyName,
// Infisical self-signs on creation only for a root, and only when given an expiry. A
// subordinate is created pending a certificate and signed separately.
NotBefore = isRoot ? notBefore : null,
NotAfter = isRoot ? notAfter : null,
MaxPathLength = isRoot ? maxPathLength : null
}
};
return Execute(
connection,
InfisicalEndpointNames.CreateInternalCertificateAuthority,
null,
_serializer.Serialize(request),
string.Concat("create ", type, " certificate authority '", name, "'"),
body =>
{
InfisicalInternalCaSingleResponseDto dto = _serializer.Deserialize<InfisicalInternalCaSingleResponseDto>(body);
InfisicalInternalCaResponseDto inner = dto != null ? (dto.CertificateAuthority ?? dto.Ca) : null;
return InfisicalCaMapper.Map(inner, projectId);
});
}
public InfisicalCertificateAuthority UpdateInternalCertificateAuthority(InfisicalConnection connection, string projectId, string caId, string name, string status)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(caId)) { throw new InfisicalConfigurationException("CaId is required."); }
if (string.IsNullOrEmpty(name) && string.IsNullOrEmpty(status))
{
throw new InfisicalConfigurationException("Supply -Name or -Status; there is nothing else to update on an internal certificate authority.");
}
InfisicalUpdateInternalCaRequestDto request = new InfisicalUpdateInternalCaRequestDto { ProjectId = projectId, Name = name, Status = status };
return Execute(
connection,
InfisicalEndpointNames.UpdateInternalCertificateAuthority,
new Dictionary<string, string> { { "caId", caId } },
_serializer.Serialize(request),
string.Concat("update certificate authority '", caId, "'"),
body =>
{
InfisicalInternalCaSingleResponseDto dto = _serializer.Deserialize<InfisicalInternalCaSingleResponseDto>(body);
InfisicalInternalCaResponseDto inner = dto != null ? (dto.CertificateAuthority ?? dto.Ca) : null;
return InfisicalCaMapper.Map(inner, projectId);
});
}
public void DeleteInternalCertificateAuthority(InfisicalConnection connection, string projectId, string caId)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(caId)) { throw new InfisicalConfigurationException("CaId is required."); }
Execute<object>(
connection,
InfisicalEndpointNames.DeleteInternalCertificateAuthority,
new Dictionary<string, string> { { "caId", caId } },
null,
string.Concat("delete certificate authority '", caId, "'"),
body => null,
BuildProjectQuery(projectId));
}
/// <summary>
/// Signs a newly created subordinate with its parent and imports the result, taking it from
/// pending-certificate to active. Infisical creates a subordinate without a certificate and exposes no
/// single call that does this.
/// </summary>
public void CompleteSubordinateCertificateAuthority(InfisicalConnection connection, string projectId, string subordinateCaId, string parentCaId, string notAfter, int maxPathLength)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(subordinateCaId)) { throw new InfisicalConfigurationException("CaId is required."); }
if (string.IsNullOrEmpty(parentCaId)) { throw new InfisicalConfigurationException("ParentCaId is required."); }
if (string.IsNullOrEmpty(notAfter)) { throw new InfisicalConfigurationException("NotAfter is required to sign a subordinate certificate authority."); }
string csr = Execute(
connection,
InfisicalEndpointNames.GetCertificateAuthorityCsr,
new Dictionary<string, string> { { "caId", subordinateCaId } },
null,
string.Concat("read the certificate signing request for '", subordinateCaId, "'"),
body =>
{
InfisicalCaCsrResponseDto dto = _serializer.Deserialize<InfisicalCaCsrResponseDto>(body);
return dto != null ? dto.Csr : null;
});
if (string.IsNullOrEmpty(csr))
{
throw new InfisicalApiException(string.Concat("Certificate authority '", subordinateCaId, "' returned no certificate signing request to sign."));
}
InfisicalSignIntermediateRequestDto signRequest = new InfisicalSignIntermediateRequestDto
{
Csr = csr,
NotAfter = notAfter,
MaxPathLength = maxPathLength
};
InfisicalSignIntermediateResponseDto signed = Execute(
connection,
InfisicalEndpointNames.SignIntermediateCertificateAuthority,
new Dictionary<string, string> { { "caId", parentCaId } },
_serializer.Serialize(signRequest),
string.Concat("sign '", subordinateCaId, "' with '", parentCaId, "'"),
body => _serializer.Deserialize<InfisicalSignIntermediateResponseDto>(body));
if (signed == null || string.IsNullOrEmpty(signed.Certificate))
{
throw new InfisicalApiException("Signing the subordinate certificate authority returned no certificate.");
}
InfisicalImportCaCertificateRequestDto importRequest = new InfisicalImportCaCertificateRequestDto
{
Certificate = signed.Certificate,
CertificateChain = signed.CertificateChain
};
Execute<object>(
connection,
InfisicalEndpointNames.ImportCertificateAuthorityCertificate,
new Dictionary<string, string> { { "caId", subordinateCaId } },
_serializer.Serialize(importRequest),
string.Concat("import the signed certificate onto '", subordinateCaId, "'"),
body => null);
}
#endregion
#region Certificate policy
public InfisicalCertificatePolicy WriteCertificatePolicy(InfisicalConnection connection, string projectId, string policyId, InfisicalCertificatePolicyWriteRequestDto request)
{
Require(connection, projectId);
if (request == null) { throw new ArgumentNullException(nameof(request)); }
bool creating = string.IsNullOrEmpty(policyId);
request.ProjectId = projectId;
return Execute(
connection,
creating ? InfisicalEndpointNames.CreateCertificatePolicy : InfisicalEndpointNames.UpdateCertificatePolicy,
creating ? null : new Dictionary<string, string> { { "policyId", policyId } },
_serializer.Serialize(request),
creating ? string.Concat("create certificate policy '", request.Name, "'") : string.Concat("update certificate policy '", policyId, "'"),
body =>
{
InfisicalCertificatePolicySingleResponseDto dto = _serializer.Deserialize<InfisicalCertificatePolicySingleResponseDto>(body);
return InfisicalCertificatePolicyMapper.Map(dto != null ? dto.CertificatePolicy : null, projectId);
});
}
public void DeleteCertificatePolicy(InfisicalConnection connection, string projectId, string policyId)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(policyId)) { throw new InfisicalConfigurationException("PolicyId is required."); }
Execute<object>(
connection,
InfisicalEndpointNames.DeleteCertificatePolicy,
new Dictionary<string, string> { { "policyId", policyId } },
null,
string.Concat("delete certificate policy '", policyId, "'"),
body => null,
BuildProjectQuery(projectId));
}
#endregion
#region Certificate profile
public InfisicalCertificateProfile WriteCertificateProfile(InfisicalConnection connection, string projectId, string profileId, InfisicalCertificateProfileWriteRequestDto request)
{
Require(connection, projectId);
if (request == null) { throw new ArgumentNullException(nameof(request)); }
bool creating = string.IsNullOrEmpty(profileId);
request.ProjectId = projectId;
return Execute(
connection,
creating ? InfisicalEndpointNames.CreateCertificateProfile : InfisicalEndpointNames.UpdateCertificateProfile,
creating ? null : new Dictionary<string, string> { { "profileId", profileId } },
_serializer.Serialize(request),
creating ? string.Concat("create certificate profile '", request.Slug, "'") : string.Concat("update certificate profile '", profileId, "'"),
body =>
{
InfisicalCertificateProfileSingleResponseDto dto = _serializer.Deserialize<InfisicalCertificateProfileSingleResponseDto>(body);
return InfisicalCertificateProfileMapper.Map(dto != null ? dto.CertificateProfile : null, projectId);
});
}
public void DeleteCertificateProfile(InfisicalConnection connection, string projectId, string profileId)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(profileId)) { throw new InfisicalConfigurationException("ProfileId is required."); }
Execute<object>(
connection,
InfisicalEndpointNames.DeleteCertificateProfile,
new Dictionary<string, string> { { "profileId", profileId } },
null,
string.Concat("delete certificate profile '", profileId, "'"),
body => null,
BuildProjectQuery(projectId));
}
#endregion
#region Certificate application
public InfisicalCertificateApplication WriteCertificateApplication(InfisicalConnection connection, string projectId, string applicationId, InfisicalCertificateApplicationWriteRequestDto request)
{
Require(connection, projectId);
if (request == null) { throw new ArgumentNullException(nameof(request)); }
bool creating = string.IsNullOrEmpty(applicationId);
request.ProjectId = projectId;
return Execute(
connection,
creating ? InfisicalEndpointNames.CreateCertificateApplication : InfisicalEndpointNames.UpdateCertificateApplication,
creating ? null : new Dictionary<string, string> { { "applicationId", applicationId } },
_serializer.Serialize(request),
creating ? string.Concat("create certificate application '", request.Name, "'") : string.Concat("update certificate application '", applicationId, "'"),
body =>
{
InfisicalCertificateApplicationSingleResponseDto dto = _serializer.Deserialize<InfisicalCertificateApplicationSingleResponseDto>(body);
return InfisicalCertificateApplicationMapper.Map(dto != null ? dto.Application : null, projectId);
});
}
public void DeleteCertificateApplication(InfisicalConnection connection, string projectId, string applicationId)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(applicationId)) { throw new InfisicalConfigurationException("ApplicationId is required."); }
Execute<object>(
connection,
InfisicalEndpointNames.DeleteCertificateApplication,
new Dictionary<string, string> { { "applicationId", applicationId } },
null,
string.Concat("delete certificate application '", applicationId, "'"),
body => null,
BuildProjectQuery(projectId));
}
public void AddCertificateApplicationProfiles(InfisicalConnection connection, string projectId, string applicationId, IEnumerable<string> profileIds)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(applicationId)) { throw new InfisicalConfigurationException("ApplicationId is required."); }
List<string> ids = new List<string>();
if (profileIds != null) { foreach (string id in profileIds) { if (!string.IsNullOrEmpty(id)) { ids.Add(id); } } }
if (ids.Count == 0) { throw new InfisicalConfigurationException("At least one ProfileId is required."); }
InfisicalCertificateApplicationWriteRequestDto request = new InfisicalCertificateApplicationWriteRequestDto { ProjectId = projectId, ProfileIds = ids };
Execute<object>(
connection,
InfisicalEndpointNames.AddCertificateApplicationProfiles,
new Dictionary<string, string> { { "applicationId", applicationId } },
_serializer.Serialize(request),
string.Concat("attach ", ids.Count.ToString(System.Globalization.CultureInfo.InvariantCulture), " profile(s) to application '", applicationId, "'"),
body => null);
}
public void RemoveCertificateApplicationProfile(InfisicalConnection connection, string projectId, string applicationId, string profileId)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(applicationId)) { throw new InfisicalConfigurationException("ApplicationId is required."); }
if (string.IsNullOrEmpty(profileId)) { throw new InfisicalConfigurationException("ProfileId is required."); }
Execute<object>(
connection,
InfisicalEndpointNames.RemoveCertificateApplicationProfile,
new Dictionary<string, string> { { "applicationId", applicationId }, { "profileId", profileId } },
null,
string.Concat("detach profile '", profileId, "' from application '", applicationId, "'"),
body => null,
BuildProjectQuery(projectId));
}
#endregion
#region PKI subscriber
public InfisicalPkiSubscriber WritePkiSubscriber(InfisicalConnection connection, string projectId, string subscriberName, InfisicalPkiSubscriberWriteRequestDto request)
{
Require(connection, projectId);
if (request == null) { throw new ArgumentNullException(nameof(request)); }
bool creating = string.IsNullOrEmpty(subscriberName);
request.ProjectId = projectId;
return Execute(
connection,
creating ? InfisicalEndpointNames.CreatePkiSubscriber : InfisicalEndpointNames.UpdatePkiSubscriber,
creating ? null : new Dictionary<string, string> { { "subscriberName", subscriberName } },
_serializer.Serialize(request),
creating ? string.Concat("create PKI subscriber '", request.Name, "'") : string.Concat("update PKI subscriber '", subscriberName, "'"),
// The subscriber routes return the record unwrapped, matching how GetPkiSubscriber reads it.
body => InfisicalPkiSubscriberMapper.Map(_serializer.Deserialize<InfisicalPkiSubscriberResponseDto>(body), projectId));
}
public void DeletePkiSubscriber(InfisicalConnection connection, string projectId, string subscriberName)
{
Require(connection, projectId);
if (string.IsNullOrEmpty(subscriberName)) { throw new InfisicalConfigurationException("Name is required."); }
Execute<object>(
connection,
InfisicalEndpointNames.DeletePkiSubscriber,
new Dictionary<string, string> { { "subscriberName", subscriberName } },
null,
string.Concat("delete PKI subscriber '", subscriberName, "'"),
body => null,
BuildProjectQuery(projectId));
}
#endregion
#region Plumbing
private static void Require(InfisicalConnection connection, string projectId)
{
if (connection == null) { throw new ArgumentNullException(nameof(connection)); }
if (string.IsNullOrEmpty(projectId)) { throw new InfisicalConfigurationException("ProjectId is required."); }
}
private static List<KeyValuePair<string, string>> BuildProjectQuery(string projectId)
{
// DELETE carries no body, so the project has to travel on the query string for Infisical's
// project-injection middleware to see it.
return new List<KeyValuePair<string, string>> { new KeyValuePair<string, string>("projectId", projectId) };
}
private T Execute<T>(
InfisicalConnection connection,
string endpointName,
Dictionary<string, string> pathParameters,
string body,
string description,
Func<string, T> project,
List<KeyValuePair<string, string>> query = null)
{
try
{
_logger.Information(Component, string.Concat("Attempting to ", description, ". Please Wait..."));
InfisicalHttpResponse response = _invoker.InvokeWithCandidateFallback(connection, endpointName, endpointName, pathParameters, query, body);
string payload = response.Body;
response.Clear();
T result = project(payload);
_logger.Information(Component, string.Concat("Infisical operation succeeded: ", description, "."));
return result;
}
catch (Exception)
{
_logger.Error(Component, string.Concat("Infisical operation failed: ", description, "."));
throw;
}
}
#endregion
}
}
src/PSInfisicalAPI/Pki/InfisicalPkiManagementDtos.cs
+152
View File
@@ -0,0 +1,152 @@
using System.Collections.Generic;
using Newtonsoft.Json;
namespace PSInfisicalAPI.Pki
{
#region Certificate authority
internal sealed class InfisicalCreateInternalCaRequestDto
{
[JsonProperty("projectId", NullValueHandling = NullValueHandling.Ignore)] public string ProjectId { get; set; }
[JsonProperty("name")] public string Name { get; set; }
[JsonProperty("status")] public string Status { get; set; }
[JsonProperty("configuration")] public InfisicalCreateInternalCaConfigurationDto Configuration { get; set; }
}
internal sealed class InfisicalCreateInternalCaConfigurationDto
{
[JsonProperty("type")] public string Type { get; set; }
[JsonProperty("commonName")] public string CommonName { get; set; }
[JsonProperty("organization")] public string Organization { get; set; }
[JsonProperty("ou")] public string OrganizationalUnit { get; set; }
[JsonProperty("country")] public string Country { get; set; }
[JsonProperty("province")] public string State { get; set; }
[JsonProperty("locality")] public string Locality { get; set; }
[JsonProperty("keyAlgorithm")] public string KeyAlgorithm { get; set; }
[JsonProperty("friendlyName", NullValueHandling = NullValueHandling.Ignore)] public string FriendlyName { get; set; }
[JsonProperty("notBefore", NullValueHandling = NullValueHandling.Ignore)] public string NotBefore { get; set; }
[JsonProperty("notAfter", NullValueHandling = NullValueHandling.Ignore)] public string NotAfter { get; set; }
[JsonProperty("maxPathLength", NullValueHandling = NullValueHandling.Ignore)] public int? MaxPathLength { get; set; }
}
internal sealed class InfisicalUpdateInternalCaRequestDto
{
[JsonProperty("projectId", NullValueHandling = NullValueHandling.Ignore)] public string ProjectId { get; set; }
[JsonProperty("name", NullValueHandling = NullValueHandling.Ignore)] public string Name { get; set; }
[JsonProperty("status", NullValueHandling = NullValueHandling.Ignore)] public string Status { get; set; }
}
internal sealed class InfisicalCaCsrResponseDto
{
[JsonProperty("csr")] public string Csr { get; set; }
}
internal sealed class InfisicalSignIntermediateRequestDto
{
[JsonProperty("csr")] public string Csr { get; set; }
[JsonProperty("notBefore", NullValueHandling = NullValueHandling.Ignore)] public string NotBefore { get; set; }
[JsonProperty("notAfter")] public string NotAfter { get; set; }
[JsonProperty("maxPathLength")] public int MaxPathLength { get; set; }
}
internal sealed class InfisicalSignIntermediateResponseDto
{
[JsonProperty("certificate")] public string Certificate { get; set; }
[JsonProperty("certificateChain")] public string CertificateChain { get; set; }
[JsonProperty("issuingCaCertificate")] public string IssuingCaCertificate { get; set; }
[JsonProperty("serialNumber")] public string SerialNumber { get; set; }
}
internal sealed class InfisicalImportCaCertificateRequestDto
{
[JsonProperty("certificate")] public string Certificate { get; set; }
[JsonProperty("certificateChain")] public string CertificateChain { get; set; }
}
#endregion
#region Certificate policy
internal sealed class InfisicalCertificatePolicyWriteRequestDto
{
[JsonProperty("projectId", NullValueHandling = NullValueHandling.Ignore)] public string ProjectId { get; set; }
[JsonProperty("name", NullValueHandling = NullValueHandling.Ignore)] public string Name { get; set; }
[JsonProperty("description", NullValueHandling = NullValueHandling.Ignore)] public string Description { get; set; }
[JsonProperty("subject", NullValueHandling = NullValueHandling.Ignore)] public List<Dictionary<string, object>> Subject { get; set; }
[JsonProperty("sans", NullValueHandling = NullValueHandling.Ignore)] public List<Dictionary<string, object>> Sans { get; set; }
[JsonProperty("keyUsages", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> KeyUsages { get; set; }
[JsonProperty("extendedKeyUsages", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> ExtendedKeyUsages { get; set; }
[JsonProperty("algorithms", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> Algorithms { get; set; }
[JsonProperty("validity", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> Validity { get; set; }
[JsonProperty("basicConstraints", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> BasicConstraints { get; set; }
}
internal sealed class InfisicalCertificatePolicySingleResponseDto
{
[JsonProperty("certificatePolicy")] public InfisicalCertificatePolicyResponseDto CertificatePolicy { get; set; }
}
#endregion
#region Certificate profile
internal sealed class InfisicalCertificateProfileWriteRequestDto
{
[JsonProperty("projectId", NullValueHandling = NullValueHandling.Ignore)] public string ProjectId { get; set; }
[JsonProperty("slug", NullValueHandling = NullValueHandling.Ignore)] public string Slug { get; set; }
[JsonProperty("description", NullValueHandling = NullValueHandling.Ignore)] public string Description { get; set; }
[JsonProperty("caId", NullValueHandling = NullValueHandling.Ignore)] public string CaId { get; set; }
[JsonProperty("certificatePolicyId", NullValueHandling = NullValueHandling.Ignore)] public string CertificatePolicyId { get; set; }
[JsonProperty("enrollmentType", NullValueHandling = NullValueHandling.Ignore)] public string EnrollmentType { get; set; }
[JsonProperty("issuerType", NullValueHandling = NullValueHandling.Ignore)] public string IssuerType { get; set; }
[JsonProperty("apiConfig", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> ApiConfig { get; set; }
[JsonProperty("scepConfig", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> ScepConfig { get; set; }
[JsonProperty("estConfig", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> EstConfig { get; set; }
[JsonProperty("acmeConfig", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> AcmeConfig { get; set; }
[JsonProperty("defaults", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> Defaults { get; set; }
}
internal sealed class InfisicalCertificateProfileSingleResponseDto
{
[JsonProperty("certificateProfile")] public InfisicalCertificateProfileResponseDto CertificateProfile { get; set; }
}
#endregion
#region Certificate application
internal sealed class InfisicalCertificateApplicationWriteRequestDto
{
[JsonProperty("projectId", NullValueHandling = NullValueHandling.Ignore)] public string ProjectId { get; set; }
[JsonProperty("name", NullValueHandling = NullValueHandling.Ignore)] public string Name { get; set; }
[JsonProperty("description", NullValueHandling = NullValueHandling.Ignore)] public string Description { get; set; }
[JsonProperty("profileIds", NullValueHandling = NullValueHandling.Ignore)] public List<string> ProfileIds { get; set; }
}
internal sealed class InfisicalCertificateApplicationSingleResponseDto
{
[JsonProperty("application")] public InfisicalCertificateApplicationResponseDto Application { get; set; }
}
#endregion
#region PKI subscriber
internal sealed class InfisicalPkiSubscriberWriteRequestDto
{
[JsonProperty("projectId", NullValueHandling = NullValueHandling.Ignore)] public string ProjectId { get; set; }
[JsonProperty("caId", NullValueHandling = NullValueHandling.Ignore)] public string CaId { get; set; }
[JsonProperty("name", NullValueHandling = NullValueHandling.Ignore)] public string Name { get; set; }
[JsonProperty("commonName", NullValueHandling = NullValueHandling.Ignore)] public string CommonName { get; set; }
[JsonProperty("status", NullValueHandling = NullValueHandling.Ignore)] public string Status { get; set; }
[JsonProperty("ttl", NullValueHandling = NullValueHandling.Ignore)] public string Ttl { get; set; }
[JsonProperty("subjectAlternativeNames", NullValueHandling = NullValueHandling.Ignore)] public List<string> SubjectAlternativeNames { get; set; }
[JsonProperty("keyUsages", NullValueHandling = NullValueHandling.Ignore)] public List<string> KeyUsages { get; set; }
[JsonProperty("extendedKeyUsages", NullValueHandling = NullValueHandling.Ignore)] public List<string> ExtendedKeyUsages { get; set; }
[JsonProperty("enableAutoRenewal", NullValueHandling = NullValueHandling.Ignore)] public bool? EnableAutoRenewal { get; set; }
[JsonProperty("autoRenewalPeriodInDays", NullValueHandling = NullValueHandling.Ignore)] public int? AutoRenewalPeriodInDays { get; set; }
[JsonProperty("properties", NullValueHandling = NullValueHandling.Ignore)] public Dictionary<string, object> Properties { get; set; }
}
#endregion
}
src/PSInfisicalAPI/Projects/InfisicalProjectClient.cs
+1 -1
View File
@@ -45,7 +45,7 @@ namespace PSInfisicalAPI.Projects
try
{
_logger.Information(Component, "Attempting to list Infisical projects. Please Wait...");
InfisicalHttpResponse response = _invoker.Invoke(connection, InfisicalEndpointNames.ListProjects, "ListProjects", null, queryParameters, null);
InfisicalHttpResponse response = _invoker.InvokeWithCandidateFallback(connection, InfisicalEndpointNames.ListProjects, "ListProjects", null, queryParameters, null);
InfisicalProjectListResponseDto dto = _serializer.Deserialize<InfisicalProjectListResponseDto>(response.Body);
response.Clear();