Protect reserved context configuration

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

src/functions/private/Auth/Set-DomeneshopDefaultContext.ps1

@@ -35,6 +35,7 @@ function Set-DomeneshopDefaultContext {
         # The name of an existing Domeneshop context.
         [Parameter(Mandatory)]
         [ValidateNotNullOrEmpty()]
+        [ValidateScript({ Test-DomeneshopContextName -Context $_ })]
         [string] $Context
     )
 

src/functions/private/Auth/Test-DomeneshopContextName.ps1

@@ -0,0 +1,41 @@
+function Test-DomeneshopContextName {
+    <#
+        .SYNOPSIS
+        Validate a Domeneshop credential context name.
+
+        .DESCRIPTION
+        Reject names reserved for internal Domeneshop module configuration.
+
+        .EXAMPLE
+        Test-DomeneshopContextName -Context 'production'
+
+        Confirm that production can be used as a credential context name.
+
+        .INPUTS
+        None
+
+        You can't pipe objects to Test-DomeneshopContextName.
+
+        .OUTPUTS
+        System.Boolean
+
+        True when the context name is available for credentials.
+
+        .NOTES
+        Throws when the context name is reserved.
+    #>
+    [OutputType([bool])]
+    [CmdletBinding()]
+    param(
+        # The proposed credential context name.
+        [Parameter(Mandatory)]
+        [ValidateNotNullOrEmpty()]
+        [string] $Context
+    )
+
+    if ($Context -eq '__Domeneshop.Config') {
+        throw "Context name [$Context] is reserved for Domeneshop module configuration."
+    }
+
+    $true
+}

src/functions/public/Auth/Connect-DomeneshopAccount.ps1

@@ -6,7 +6,8 @@ function Connect-DomeneshopAccount {
         Stores Domeneshop API credentials in a secure context.
 
         .DESCRIPTION
-        Stores Domeneshop API credentials using the Context module and optionally sets the context as default.
+        Stores Domeneshop API credentials using the Context module. The first stored context becomes the
+        default automatically, and Default replaces an existing default.
 
         .EXAMPLE
         Connect-DomeneshopAccount -Token 'my-token' -Secret (Read-Host -AsSecureString)
@@ -49,9 +50,10 @@ function Connect-DomeneshopAccount {
         # The name used to store and retrieve this credential context.
         [Parameter()]
         [ValidateNotNullOrEmpty()]
+        [ValidateScript({ Test-DomeneshopContextName -Context $_ })]
         [string] $Context = 'default',
 
-        # Set this context as the default for commands that omit Context.
+        # Replace the default context; the first stored context becomes the default automatically.
         [Parameter()]
         [switch] $Default,
 

src/functions/public/Auth/Get-DomeneshopContext.ps1

@@ -40,6 +40,7 @@ function Get-DomeneshopContext {
         # The name of a specific stored context.
         [Parameter(Mandatory, ParameterSetName = 'Get named')]
         [ValidateNotNullOrEmpty()]
+        [ValidateScript({ Test-DomeneshopContextName -Context $_ })]
         [string] $Context,
 
         # List every stored Domeneshop credential context.

tests/Connect-DomeneshopAccount.Tests.ps1

@@ -48,4 +48,11 @@ Describe 'Connect-DomeneshopAccount' {
         { Connect-DomeneshopAccount -Token 'token' -Secret 42 -Context 'demo' } |
             Should -Throw '*Secret must be a SecureString or String value*'
     }
+
+    It 'rejects the reserved module configuration context name' {
+        { Connect-DomeneshopAccount -Token 'token' -Secret 'secret' -Context '__Domeneshop.Config' } |
+            Should -Throw '*reserved for Domeneshop module configuration*'
+
+        Should -Invoke Set-Context -Times 0 -Exactly
+    }
 }

tests/Domeneshop.Private.Tests.ps1

@@ -43,6 +43,11 @@ Describe 'Domeneshop private helpers' {
             Should -Throw '*invalid API base URI*'
     }
 
+    It 'rejects the reserved module configuration name as a default context' {
+        { Set-DomeneshopDefaultContext -Context '__Domeneshop.Config' -Confirm:$false } |
+            Should -Throw '*reserved for Domeneshop module configuration*'
+    }
+
     It 'uses basic authentication and terminating transport errors' {
         Mock Invoke-RestMethod { [pscustomobject]@{ ok = $true } }
 

tests/Get-DomeneshopContext.Tests.ps1

@@ -34,6 +34,11 @@ Describe 'Get-DomeneshopContext' {
         { Get-DomeneshopContext } | Should -Throw '*No default Domeneshop context found*'
     }
 
+    It 'rejects an explicit request for the reserved module configuration context' {
+        { Get-DomeneshopContext -Context '__Domeneshop.Config' } |
+            Should -Throw '*reserved for Domeneshop module configuration*'
+    }
+
     It 'excludes the module configuration when listing contexts' {
         Mock Get-Context {
             @(