Skip to content

Commit 0037064

Browse files
johljujohlju
authored
SqlPermission: Refactor to use new server permission commands (#2360)
1 parent 918557f commit 0037064

File tree

4 files changed

+399
-65
lines changed

4 files changed

+399
-65
lines changed

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
2121

2222
### Changed
2323

24+
- `SqlPermission`
25+
- Refactored to use the new object-based server permission commands
26+
(`Grant-SqlDscServerPermission`, `Deny-SqlDscServerPermission`,
27+
`Revoke-SqlDscServerPermission`, and `Get-SqlDscServerPermission`)
28+
instead of the deprecated `Set-SqlDscServerPermission` command
29+
([issue #2159](https://github.com/dsccommunity/SqlServerDsc/issues/2159)).
2430
- Updated comment-based help `.INPUTS` and `.OUTPUTS` sections across all public
2531
commands and private functions to comply with DSC community style guidelines
2632
([issue #2103](https://github.com/dsccommunity/SqlServerDsc/issues/2103)).

‎source/Classes/020.SqlPermission.ps1‎

Lines changed: 81 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -353,15 +353,16 @@ class SqlPermission : SqlResourceBase
353353
{
354354
$serverObject = $this.GetServerObject()
355355

356-
$testSqlDscIsLoginParameters = @{
356+
$testSqlDscIsPrincipalParameters = @{
357357
ServerObject = $serverObject
358358
Name = $this.Name
359359
}
360360

361-
# This will test wether the principal exist.
362-
$isLogin = Test-SqlDscIsLogin @testSqlDscIsLoginParameters
361+
# This will test whether the principal exist.
362+
$isLogin = Test-SqlDscIsLogin @testSqlDscIsPrincipalParameters
363+
$isRole = Test-SqlDscIsRole @testSqlDscIsPrincipalParameters
363364

364-
if (-not $isLogin)
365+
if (-not $isLogin -and -not $isRole)
365366
{
366367
$missingPrincipalMessage = $this.localizedData.NameIsMissing -f @(
367368
$this.Name,
@@ -371,6 +372,32 @@ class SqlPermission : SqlResourceBase
371372
New-InvalidOperationException -Message $missingPrincipalMessage
372373
}
373374

375+
# Get the principal object (Login or ServerRole)
376+
$principalObject = $null
377+
378+
if ($isLogin)
379+
{
380+
$principalObject = $serverObject | Get-SqlDscLogin -Name $this.Name -ErrorAction 'Stop'
381+
}
382+
else
383+
{
384+
$principalObject = $serverObject | Get-SqlDscRole -Name $this.Name -ErrorAction 'Stop'
385+
}
386+
387+
# Create splatting parameter for principal to avoid repeated if/else blocks
388+
$principalParameter = if ($isLogin)
389+
{
390+
@{
391+
Login = $principalObject
392+
}
393+
}
394+
else
395+
{
396+
@{
397+
ServerRole = $principalObject
398+
}
399+
}
400+
374401
# This holds each state and their permissions to be revoked.
375402
[ServerPermission[]] $permissionsToRevoke = @()
376403
[ServerPermission[]] $permissionsToGrantOrDeny = @()
@@ -455,32 +482,34 @@ class SqlPermission : SqlResourceBase
455482
#>
456483
foreach ($currentStateToRevoke in $permissionsToRevoke)
457484
{
458-
$revokePermissionSet = $currentStateToRevoke | ConvertFrom-SqlDscServerPermission
459-
460-
$setSqlDscServerPermissionParameters = @{
461-
ServerObject = $serverObject
462-
Name = $this.Name
463-
Permission = $revokePermissionSet
464-
State = 'Revoke'
465-
Force = $true
466-
}
485+
# Convert ServerPermission to array of SqlServerPermission enum values
486+
$permissionsToRevokeArray = $currentStateToRevoke.Permission
467487

468-
if ($currentStateToRevoke.State -eq 'GrantWithGrant')
488+
# Only revoke if there are permissions to revoke
489+
if ($permissionsToRevokeArray.Count -gt 0)
469490
{
470-
$setSqlDscServerPermissionParameters.WithGrant = $true
471-
}
491+
$revokeSqlDscServerPermissionParameters = @{
492+
Permission = $permissionsToRevokeArray
493+
Force = $true
494+
}
472495

473-
try
474-
{
475-
Set-SqlDscServerPermission @setSqlDscServerPermissionParameters
476-
}
477-
catch
478-
{
479-
$errorMessage = $this.localizedData.FailedToRevokePermissionFromCurrentState -f @(
480-
$this.Name
481-
)
496+
if ($currentStateToRevoke.State -eq 'GrantWithGrant')
497+
{
498+
$revokeSqlDscServerPermissionParameters.WithGrant = $true
499+
}
500+
501+
try
502+
{
503+
Revoke-SqlDscServerPermission @principalParameter @revokeSqlDscServerPermissionParameters
504+
}
505+
catch
506+
{
507+
$errorMessage = $this.localizedData.FailedToRevokePermissionFromCurrentState -f @(
508+
$this.Name
509+
)
482510

483-
New-InvalidOperationException -Message $errorMessage -ErrorRecord $_
511+
New-InvalidOperationException -Message $errorMessage -ErrorRecord $_
512+
}
484513
}
485514
}
486515
}
@@ -496,27 +525,42 @@ class SqlPermission : SqlResourceBase
496525
# If there is not an empty array, change permissions.
497526
if (-not [System.String]::IsNullOrEmpty($currentDesiredPermissionState.Permission))
498527
{
499-
$permissionSet = $currentDesiredPermissionState | ConvertFrom-SqlDscServerPermission
500-
501-
$setSqlDscServerPermissionParameters = @{
502-
ServerObject = $serverObject
503-
Name = $this.Name
504-
Permission = $permissionSet
505-
Force = $true
506-
}
528+
# Convert ServerPermission to array of SqlServerPermission enum values
529+
$permissionsArray = $currentDesiredPermissionState.Permission
507530

508531
try
509532
{
510533
switch ($currentDesiredPermissionState.State)
511534
{
535+
'Grant'
536+
{
537+
$grantParameters = @{
538+
Permission = $permissionsArray
539+
Force = $true
540+
}
541+
542+
Grant-SqlDscServerPermission @principalParameter @grantParameters
543+
}
544+
512545
'GrantWithGrant'
513546
{
514-
Set-SqlDscServerPermission @setSqlDscServerPermissionParameters -State 'Grant' -WithGrant
547+
$grantParameters = @{
548+
Permission = $permissionsArray
549+
WithGrant = $true
550+
Force = $true
551+
}
552+
553+
Grant-SqlDscServerPermission @principalParameter @grantParameters
515554
}
516555

517-
default
556+
'Deny'
518557
{
519-
Set-SqlDscServerPermission @setSqlDscServerPermissionParameters -State $currentDesiredPermissionState.State
558+
$denyParameters = @{
559+
Permission = $permissionsArray
560+
Force = $true
561+
}
562+
563+
Deny-SqlDscServerPermission @principalParameter @denyParameters
520564
}
521565
}
522566
}

‎source/en-US/SqlPermission.strings.psd1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ConvertFrom-StringData @'
1212
EvaluateServerPermissionForPrincipal = Evaluate the current permissions for the principal '{0}' on the instance '{1}'. (SP0001)
1313
DesiredPermissionAreAbsent = The desired permission '{0}' that shall be present are absent. (SP0002)
1414
DesiredAbsentPermissionArePresent = The desired permission '{0}' that shall be absent are present. (SP0003)
15-
NameIsMissing = The name '{0}' is not a login on the instance '{1}'. (SP0004)
15+
NameIsMissing = The name '{0}' is not a login or server role on the instance '{1}'. (SP0004)
1616
FailedToRevokePermissionFromCurrentState = Failed to revoke the permissions from the current state for the user '{0}'. (SP0005)
1717
FailedToSetPermission = Failed to set the desired permissions for the user '{0}'. (SP0006)
1818
DuplicatePermissionState = One or more permission states was added more than once. It is only allowed to specify one of each permission state. (SP0007)

0 commit comments

Comments
 (0)