Honor -ErrorAction, fix pipeline-stop noise, and correct certificate request paths #18

2026-07-30T21:54:56Z

gsadmin commented

2026-07-30 21:54:56 +00:00

Summary

Fixes reported against Request-InfisicalCertificate and Get-InfisicalCertificateAuthority, plus the module-wide error-handling contract.

Breaking

Operation failures are now non-terminating errors, so -ErrorAction (and $ErrorActionPreference) decides the outcome. Previously every failure was terminating and ignored -ErrorAction entirely.

try/catch around these cmdlets now requires -ErrorAction Stop or $ErrorActionPreference = 'Stop'.
A failing pipeline item no longer aborts the batch.
Start-InfisicalProcess reports an unacceptable exit code the same way.

Verified under Windows PowerShell 5.1: SilentlyContinue suppresses but still populates $Error/-ErrorVariable; Ignore records nothing; Stop is caught by try/catch; $ErrorActionPreference = 'Stop' is honored from script body, nested functions, pipelines, and script blocks.

Fixed

"The pipeline has been stopped." reported as an error. Select-Object -First, and Where-Object feeding it, stop the upstream cmdlet by design. The shared error path in InfisicalCmdletBase now lets pipeline-control exceptions propagate untouched. Affected all 53 cmdlets.
Error diagnostics occupied the warning stream. Every Logger.Error call site logs then throws, so the failure already reaches the caller as an ErrorRecord. Emitting it again as eight warning lines put failures under -WarningAction instead of -ErrorAction. Measured 8 warning lines -> 0, error stream unchanged at 1.
-CommonName double-prefixed. CN=WEB01 produced a CN=CN=WEB01 subject plus a bogus DNS SAN. A leading CN= is now stripped.
IP addresses became malformed DNS SANs. Get-InfisicalSANList returns host names and IPs in one list, and the documented usage splats it into -DnsName. IP literals now become iPAddress SAN entries.
The CA signing path sends the normalized common name instead of the raw parameter value.

Added

Request-InfisicalCertificate resolves and reports its issuance path before generating a keypair, naming the subscriber, CA, or profile on the verbose stream and in the -WhatIf target.
The -CertificateAuthorityId path fails fast when the CA has direct issuance disabled, with guidance naming -PkiSubscriberSlug and -CertificateProfileId, instead of building a CSR and surfacing a bare 400 Certificate template or subscriber is required for issuance.
Get-InfisicalCertificateAuthority table output gains a DirectIssue column (EnableDirectIssuance).

No -CertificateTemplateId parameter was added: Infisical's REST API exposes no template-based issuance route (certificate-template-router.ts is absent across v1/v2/v3; templates are internal to EST and subscribers), so the reachable answers are a subscriber, a profile, or enabling direct issuance.

Docs

README gains an -ErrorAction table, subscriber discovery, and direct-issuance setup steps; about_PSInfisicalAPI gains an ERROR HANDLING AND STREAMS section; cmdlet help notes updated. The README end-to-end example previously failed as written and now issues via a PKI subscriber.

Tests

268 pass (up from 255). New coverage for pipeline-stop propagation, logger stream routing, SAN splitting, common-name normalization, direct-issuance guidance, and an IL-scanning test asserting no cmdlet reports operation failures as terminating. Full build.ps1 -RunTests green, including module import, manifest, and help validation across 53 cmdlets.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Generated with Claude Code

## Summary Fixes reported against `Request-InfisicalCertificate` and `Get-InfisicalCertificateAuthority`, plus the module-wide error-handling contract. ## Breaking Operation failures are now **non-terminating** errors, so `-ErrorAction` (and `$ErrorActionPreference`) decides the outcome. Previously every failure was terminating and ignored `-ErrorAction` entirely. - `try`/`catch` around these cmdlets now requires `-ErrorAction Stop` or `$ErrorActionPreference = 'Stop'`. - A failing pipeline item no longer aborts the batch. - `Start-InfisicalProcess` reports an unacceptable exit code the same way. Verified under Windows PowerShell 5.1: `SilentlyContinue` suppresses but still populates `$Error`/`-ErrorVariable`; `Ignore` records nothing; `Stop` is caught by `try`/`catch`; `$ErrorActionPreference = 'Stop'` is honored from script body, nested functions, pipelines, and script blocks. ## Fixed - **"The pipeline has been stopped." reported as an error.** `Select-Object -First`, and `Where-Object` feeding it, stop the upstream cmdlet by design. The shared error path in `InfisicalCmdletBase` now lets pipeline-control exceptions propagate untouched. Affected all 53 cmdlets. - **Error diagnostics occupied the warning stream.** Every `Logger.Error` call site logs then throws, so the failure already reaches the caller as an `ErrorRecord`. Emitting it again as eight warning lines put failures under `-WarningAction` instead of `-ErrorAction`. Measured 8 warning lines -> 0, error stream unchanged at 1. - **`-CommonName` double-prefixed.** `CN=WEB01` produced a `CN=CN=WEB01` subject plus a bogus DNS SAN. A leading `CN=` is now stripped. - **IP addresses became malformed DNS SANs.** `Get-InfisicalSANList` returns host names and IPs in one list, and the documented usage splats it into `-DnsName`. IP literals now become `iPAddress` SAN entries. - The CA signing path sends the normalized common name instead of the raw parameter value. ## Added - `Request-InfisicalCertificate` resolves and reports its issuance path before generating a keypair, naming the subscriber, CA, or profile on the verbose stream and in the `-WhatIf` target. - The `-CertificateAuthorityId` path fails fast when the CA has direct issuance disabled, with guidance naming `-PkiSubscriberSlug` and `-CertificateProfileId`, instead of building a CSR and surfacing a bare `400 Certificate template or subscriber is required for issuance`. - `Get-InfisicalCertificateAuthority` table output gains a `DirectIssue` column (`EnableDirectIssuance`). No `-CertificateTemplateId` parameter was added: Infisical's REST API exposes no template-based issuance route (`certificate-template-router.ts` is absent across v1/v2/v3; templates are internal to EST and subscribers), so the reachable answers are a subscriber, a profile, or enabling direct issuance. ## Docs README gains an `-ErrorAction` table, subscriber discovery, and direct-issuance setup steps; `about_PSInfisicalAPI` gains an ERROR HANDLING AND STREAMS section; cmdlet help notes updated. The README end-to-end example previously failed as written and now issues via a PKI subscriber. ## Tests 268 pass (up from 255). New coverage for pipeline-stop propagation, logger stream routing, SAN splitting, common-name normalization, direct-issuance guidance, and an IL-scanning test asserting no cmdlet reports operation failures as terminating. Full `build.ps1 -RunTests` green, including module import, manifest, and help validation across 53 cmdlets. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Generated with [Claude Code](https://claude.com/claude-code)

gsadmin added 1 commit 2026-07-30 21:54:56 +00:00

Honor -ErrorAction, fix pipeline-stop noise, and correct certificate request paths

Publish to PowerShell Gallery / build (pull_request) Successful in 43s

Details

Publish to PowerShell Gallery / release (pull_request) Successful in 18s

Details

Publish to PowerShell Gallery / publish (pull_request) Successful in 14s

Details

f62b3e90b1

BREAKING: operation failures are now non-terminating errors, so -ErrorAction
(and $ErrorActionPreference) decides the outcome. try/catch around these cmdlets
now requires -ErrorAction Stop or $ErrorActionPreference = 'Stop'. A failing
pipeline item no longer aborts the batch.

Cmdlets no longer report "The pipeline has been stopped." as an error.
Select-Object -First, and Where-Object feeding it, stop the upstream cmdlet by
design; the shared error path in InfisicalCmdletBase now lets pipeline-control
exceptions propagate untouched instead of logging them and raising an error.

Error-level diagnostics moved off the warning stream to verbose. Every
Logger.Error call site logs and then throws, so the failure already reaches the
caller as an ErrorRecord; emitting it again as eight warning lines put failures
under -WarningAction instead of -ErrorAction. One error per failure now.

Request-InfisicalCertificate:
- -CommonName accepts the RDN form (CN=WEB01) and reduces it to the bare value,
  which previously produced a CN=CN=WEB01 subject plus a bogus DNS SAN.
- -DnsName routes IP literals to iPAddress SAN entries, so the mixed output of
  Get-InfisicalSANList can be splatted in as documented.
- The CA path sends the normalized common name to the signing endpoint.
- The issuance path is resolved and reported before a keypair is generated, and
  a CA with direct issuance disabled fails fast with guidance naming
  -PkiSubscriberSlug and -CertificateProfileId. Infisical exposes no
  template-based issuance route, so no -CertificateTemplateId is added.

Get-InfisicalCertificateAuthority table output gains a DirectIssue column
(EnableDirectIssuance) so CAs eligible for -CertificateAuthorityId are visible.

README, about_PSInfisicalAPI, and cmdlet help document the stream/-ErrorAction
contract, subscriber discovery, and direct-issuance setup. Adds regression tests
for pipeline-stop propagation, logger stream routing, SAN splitting, common-name
normalization, and the non-terminating convention across all cmdlets.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

gsadmin merged commit 8b6823344f into main

2026-07-30 21:56:28 +00:00

gsadmin referenced this issue from a commit

2026-07-30 22:40:22 +00:00

Correct issuance-path guidance: profiles for fleets, subscribers are per-identity

gsadmin referenced this pull request

2026-07-30 22:40:50 +00:00

Correct issuance-path guidance: profiles for fleets, subscribers are per-identity #19

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: gsadmin/PSInfisicalAPI#18