Summary
Every headline fix in 0.62.1 rides on the same test template: parameter surface + OutputType.Name assertion. None of the fixes has a runtime test that would catch regression to the pre-fix behavior. Specifically:
A future refactor could revert ConvertFrom-Json to Substring, revert camelCase to PascalCase, or make -Type mandatory again, and CI would pass.
Proposed fix
Introduce a mocked-Invoke-TssApi test pattern using Pester 5's Mock + Assert-VerifiableMock. For each headline fix, add a test that:
- Mocks
Invoke-TssApi to return a fixture response.
- Calls the cmdlet.
- Asserts on the JSON body sent, the return type, and/or the return shape (rather than only the parameter surface).
Fixture data for each:
Search-TssSecret: mock a records array with 0, 1, and 3 entries. Assert return is [Summary[]] in all cases; assert .Count matches.Get-TssSecretField: mock Content = '""', '"MyPassword"', '"Im\\\"P@ss\\\"word"', and empty Content. Assert decoded value matches expectation.New-TssSecretPermission: capture \$invokeParams.Body via mock parameter filter; assert JSON keys are secretAccessRoleName, secretId, username, groupName.Start-TssSecretChangePassword: call without -Type; assert the mocked body has PasswordType = 0 (Random).
This work would also standardize a pattern for future behavioral tests, which the module has largely avoided in favor of metadata-only checks.
Scope
This is a larger piece of work than a typical bug PR — likely worth a small sub-plan and its own release. Not a 0.62.1 blocker; the fixes are lab-verified end-to-end for the current release. But the next regression will be silent unless this coverage exists.
Discovery
Consolidated PR review of v0.62.0 → dev (0.62.1 candidate). Called out under FUNC-1 by the functionality attacker.
Summary
Every headline fix in 0.62.1 rides on the same test template: parameter surface +
OutputType.Nameassertion. None of the fixes has a runtime test that would catch regression to the pre-fix behavior. Specifically:Search-TssSecret(Search-TssSecretnot returning list typeThycotic.PowerShell.Secrets.Summarywith multiple records #459) — no test asserts the return is[Summary[]]at runtime, nor that 0/1/many results all yield an array.Get-TssSecretField(Bug in Get-TssSecretField: Substring, startIndex cannot be larger than length of string #370, Get-TssSecretField returns field value with escaped quotes #336) — no test asserts empty response returns''without exception, nor that"Im\"P@ss\"word"decodes toIm"P@ss"word.New-TssSecretPermission(New-TSSSecretPermission unable to determine which SecretAccessRole to use #326) — no test asserts the JSON body sent to the API uses camelCase keys.Start-TssSecretChangePassword(Start-TssSecretChangePassword: Default -Type parameter to 'Random' when not specified #444) — no test asserts-Typedefaults toRandomat runtime; only parameter existence is checked.Initialize-TssSdkClient(Initialize-TssSdkClient does not properly enclose rule names with spaces. #395) — no test exists.[OutputType]sweep (part of Test/cmdlet drift across 19 cmdlet test files (OutputType, parameters, context setup) #461) — 68 test files assert the new declaration string, but only as static metadata.A future refactor could revert
ConvertFrom-JsontoSubstring, revert camelCase to PascalCase, or make-Typemandatory again, and CI would pass.Proposed fix
Introduce a mocked-
Invoke-TssApitest pattern using Pester 5'sMock+Assert-VerifiableMock. For each headline fix, add a test that:Invoke-TssApito return a fixture response.Fixture data for each:
Search-TssSecret: mock arecordsarray with 0, 1, and 3 entries. Assert return is[Summary[]]in all cases; assert.Countmatches.Get-TssSecretField: mockContent = '""','"MyPassword"','"Im\\\"P@ss\\\"word"', and emptyContent. Assert decoded value matches expectation.New-TssSecretPermission: capture\$invokeParams.Bodyvia mock parameter filter; assert JSON keys aresecretAccessRoleName,secretId,username,groupName.Start-TssSecretChangePassword: call without-Type; assert the mocked body hasPasswordType = 0(Random).This work would also standardize a pattern for future behavioral tests, which the module has largely avoided in favor of metadata-only checks.
Scope
This is a larger piece of work than a typical bug PR — likely worth a small sub-plan and its own release. Not a 0.62.1 blocker; the fixes are lab-verified end-to-end for the current release. But the next regression will be silent unless this coverage exists.
Discovery
Consolidated PR review of v0.62.0 → dev (0.62.1 candidate). Called out under FUNC-1 by the functionality attacker.