Add interactive API secret setup

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

src/functions/private/Auth/Test-DomeneshopSecret.ps1

@@ -4,7 +4,7 @@ function Test-DomeneshopSecret {
         Validate a Domeneshop API secret.
 
         .DESCRIPTION
-        Reject empty string and secure string values before credential storage.
+        Reject unsupported and empty values before credential storage.
 
         .EXAMPLE
         Test-DomeneshopSecret -Secret $secret
@@ -19,10 +19,10 @@ function Test-DomeneshopSecret {
         .OUTPUTS
         System.Boolean
 
-        True when the secret is not empty.
+        True when the secret has a supported type and is not empty.
 
         .NOTES
-        Secret type validation remains the responsibility of the calling command.
+        Supported values are String and SecureString.
     #>
     [OutputType([bool])]
     [CmdletBinding()]
@@ -33,6 +33,10 @@ function Test-DomeneshopSecret {
         [object] $Secret
     )
 
+    if ($Secret -isnot [string] -and $Secret -isnot [securestring]) {
+        throw 'Secret must be a SecureString or String value.'
+    }
+
     if (
         ($Secret -is [string] -and [string]::IsNullOrWhiteSpace($Secret)) -or
         ($Secret -is [securestring] -and $Secret.Length -eq 0)

src/functions/public/Auth/Connect-DomeneshopAccount.ps1

@@ -7,13 +7,19 @@ function Connect-DomeneshopAccount {
 
         .DESCRIPTION
         Stores Domeneshop API credentials using the Context module. The first stored context becomes the
-        default automatically, and Default replaces an existing default.
+        default automatically, and Default replaces an existing default. When Secret is omitted, opens the
+        Domeneshop API settings page and securely prompts for it.
 
         .EXAMPLE
         Connect-DomeneshopAccount -Token 'my-token' -Secret (Read-Host -AsSecureString)
 
         Store credentials in the default named context.
 
+        .EXAMPLE
+        Connect-DomeneshopAccount -Token 'my-token'
+
+        Open the Domeneshop API settings page and securely prompt for the API secret.
+
         .INPUTS
         None
 
@@ -43,9 +49,10 @@ function Connect-DomeneshopAccount {
         [string] $Token,
 
         # The Domeneshop API secret as a string or secure string.
-        [Parameter(Mandatory)]
+        [Parameter()]
         [ValidateNotNull()]
         [ValidateScript({ Test-DomeneshopSecret -Secret $_ })]
+        [Alias('Key')]
         [object] $Secret,
 
         # The name used to store and retrieve this credential context.
@@ -63,22 +70,28 @@ function Connect-DomeneshopAccount {
         [switch] $PassThru
     )
 
-    $secureSecret = switch ($Secret) {
-        { $_ -is [securestring] } { $_; break }
-        { $_ -is [string] } { ConvertTo-SecureString -AsPlainText $Secret -Force; break }
-        default { throw 'Secret must be a SecureString or String value.' }
-    }
+    if ($PSCmdlet.ShouldProcess("Domeneshop context [$Context]", 'Store API credentials')) {
+        if (-not $PSBoundParameters.ContainsKey('Secret')) {
+            Start-Process -FilePath 'https://domene.shop/admin?view=api'
+            $Secret = Read-Host -Prompt 'Enter the Domeneshop API secret' -AsSecureString
+            $null = Test-DomeneshopSecret -Secret $Secret
+        }
 
-    $contextObject = [ordered]@{
-        Name        = $Context
-        Token       = $Token
-        Secret      = $secureSecret
-        AuthType    = 'BasicAuth'
-        ApiBaseUri  = 'https://api.domeneshop.no/v0'
-        ConnectedAt = Get-Date
-    }
+        $secureSecret = if ($Secret -is [securestring]) {
+            $Secret
+        } else {
+            ConvertTo-SecureString -AsPlainText $Secret -Force
+        }
+
+        $contextObject = [ordered]@{
+            Name        = $Context
+            Token       = $Token
+            Secret      = $secureSecret
+            AuthType    = 'BasicAuth'
+            ApiBaseUri  = 'https://api.domeneshop.no/v0'
+            ConnectedAt = Get-Date
+        }
 
-    if ($PSCmdlet.ShouldProcess("Domeneshop context [$Context]", 'Store API credentials')) {
         $null = Set-Context -ID $Context -Vault 'Domeneshop' -Context $contextObject
 
         $config = Get-DomeneshopConfig

tests/Connect-DomeneshopAccount.Tests.ps1

@@ -21,6 +21,10 @@ Describe 'Connect-DomeneshopAccount' {
         Mock Get-DomeneshopConfig { [pscustomobject]@{ DefaultContext = $null } }
         Mock Set-DomeneshopDefaultContext {}
         Mock Get-DomeneshopContext { [pscustomobject]@{ ID = 'demo' } }
+        Mock Start-Process {}
+        Mock Read-Host { $script:PromptedSecret }
+        $script:PromptedSecret = [securestring]::new()
+        'prompted-secret'.ToCharArray() | ForEach-Object { $script:PromptedSecret.AppendChar($_) }
     }
 
     It 'stores credentials securely and sets the first context as default' {
@@ -44,6 +48,40 @@ Describe 'Connect-DomeneshopAccount' {
         Should -Invoke Set-DomeneshopDefaultContext -Times 0 -Exactly
     }
 
+    It 'opens API settings and securely prompts when Secret is omitted' {
+        Connect-DomeneshopAccount -Token 'token' -Context 'demo'
+
+        Should -Invoke Start-Process -Times 1 -Exactly -ParameterFilter {
+            $FilePath -eq 'https://domene.shop/admin?view=api'
+        }
+        Should -Invoke Read-Host -Times 1 -Exactly -ParameterFilter {
+            $Prompt -eq 'Enter the Domeneshop API secret' -and $AsSecureString
+        }
+        Should -Invoke Set-Context -Times 1 -Exactly -ParameterFilter {
+            $ID -eq 'demo' -and
+            $Vault -eq 'Domeneshop' -and
+            [object]::ReferenceEquals($Context.Secret, $script:PromptedSecret)
+        }
+    }
+
+    It 'does not open API settings or prompt when WhatIf omits Secret' {
+        Connect-DomeneshopAccount -Token 'token' -Context 'demo' -WhatIf
+
+        Should -Invoke Start-Process -Times 0 -Exactly
+        Should -Invoke Read-Host -Times 0 -Exactly
+        Should -Invoke Set-Context -Times 0 -Exactly
+    }
+
+    It 'accepts Key as an alias for an explicit secure secret' {
+        Connect-DomeneshopAccount -Token 'token' -Key $script:PromptedSecret -Context 'demo'
+
+        Should -Invoke Start-Process -Times 0 -Exactly
+        Should -Invoke Read-Host -Times 0 -Exactly
+        Should -Invoke Set-Context -Times 1 -Exactly -ParameterFilter {
+            [object]::ReferenceEquals($Context.Secret, $script:PromptedSecret)
+        }
+    }
+
     It 'rejects unsupported secret types' {
         { Connect-DomeneshopAccount -Token 'token' -Secret 42 -Context 'demo' } |
             Should -Throw '*Secret must be a SecureString or String value*'