Reject empty API secrets

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

src/functions/private/Auth/Test-DomeneshopSecret.ps1

@@ -0,0 +1,44 @@
+function Test-DomeneshopSecret {
+    <#
+        .SYNOPSIS
+        Validate a Domeneshop API secret.
+
+        .DESCRIPTION
+        Reject empty string and secure string values before credential storage.
+
+        .EXAMPLE
+        Test-DomeneshopSecret -Secret $secret
+
+        Confirm that the secret contains a value.
+
+        .INPUTS
+        None
+
+        You can't pipe objects to Test-DomeneshopSecret.
+
+        .OUTPUTS
+        System.Boolean
+
+        True when the secret is not empty.
+
+        .NOTES
+        Secret type validation remains the responsibility of the calling command.
+    #>
+    [OutputType([bool])]
+    [CmdletBinding()]
+    param(
+        # The proposed API secret.
+        [Parameter(Mandatory)]
+        [ValidateNotNull()]
+        [object] $Secret
+    )
+
+    if (
+        ($Secret -is [string] -and [string]::IsNullOrWhiteSpace($Secret)) -or
+        ($Secret -is [securestring] -and $Secret.Length -eq 0)
+    ) {
+        throw 'Secret cannot be empty or whitespace.'
+    }
+
+    $true
+}

src/functions/public/Auth/Connect-DomeneshopAccount.ps1

@@ -45,6 +45,7 @@ function Connect-DomeneshopAccount {
         # The Domeneshop API secret as a string or secure string.
         [Parameter(Mandatory)]
         [ValidateNotNull()]
+        [ValidateScript({ Test-DomeneshopSecret -Secret $_ })]
         [object] $Secret,
 
         # The name used to store and retrieve this credential context.

tests/Connect-DomeneshopAccount.Tests.ps1

@@ -49,6 +49,15 @@ Describe 'Connect-DomeneshopAccount' {
             Should -Throw '*Secret must be a SecureString or String value*'
     }
 
+    It 'rejects empty string and secure string secrets' {
+        { Connect-DomeneshopAccount -Token 'token' -Secret ' ' -Context 'demo' } |
+            Should -Throw '*Secret cannot be empty or whitespace*'
+        { Connect-DomeneshopAccount -Token 'token' -Secret ([securestring]::new()) -Context 'demo' } |
+            Should -Throw '*Secret cannot be empty or whitespace*'
+
+        Should -Invoke Set-Context -Times 0 -Exactly
+    }
+
     It 'rejects the reserved module configuration context name' {
         { Connect-DomeneshopAccount -Token 'token' -Secret 'secret' -Context '__Domeneshop.Config' } |
             Should -Throw '*reserved for Domeneshop module configuration*'