Set-DbaNetworkCertificate - Fix restart credential passthrough (review of #10232)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: potatoqualitee

docs/trackers/features/commit-bug-review-TRACKER.md

@@ -117,8 +117,8 @@ Find real bugs (logic errors, null refs, incorrect behavior) and fix them. Skip
 | fb94490d9 | Install-DbaMaintenanceSolution - Fix AutoScheduleJobs schedule bugs (#10303) | DONE | Added AutoScheduleJobs validation for -InstallJobs and exactly one full schedule; added unit regression tests. |
 | 45e46e6ae | Copy-DbaAgentJob - Add AD group membership check for job owner login validation (#10297) | DONE | Reviewed AD group membership owner validation; no bugs found. |
 | daa4e306e | Invoke-DbaBalanceDataFiles - Add -TargetFileGroup parameter (#10296) | PENDING | |
-| 02ad1f092 | ConvertTo-DbaTimeline - Add support for Find-DbaDbGrowthEvent input (#10304) | DONE | Escaped growth-event database names before emitting JavaScript timeline rows; added unit regression coverage. |
-| 8987045a9 | Refactor Set-DbaNetworkCertificate (#10232) | PENDING | |
+| 02ad1f092 | ConvertTo-DbaTimeline - Add support for Find-DbaDbGrowthEvent input (#10304) | DONE | Escaped growth-event database names before emitting JavaScript timeline rows; added unit regression coverage. |
+| 8987045a9 | Refactor Set-DbaNetworkCertificate (#10232) | DONE | Passed Credential to Restart-DbaService when -RestartService is used; added unit regression coverage. |
 | 392fc9dea | Set-DbaDbCompression, Invoke-DbaBalanceDataFiles, Invoke-DbaDbPiiScan - Normalize table names via Get-ObjectNameParts (#10312) | PENDING | |
 | b2f217f47 | Invoke-TlsWebRequest - Auto-detect system proxy (#10310) | PENDING | |
 | 1662d73a6 | New-DbaDatabase - Support Azure Blob Storage paths for data and log files (#10315) | PENDING | |

public/Set-DbaNetworkCertificate.ps1

@@ -354,7 +354,16 @@ function Set-DbaNetworkCertificate {
                 if ($RestartService) {
                     Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Restarting SQL Server service for $instance"
                     try {
-                        $null = Restart-DbaService -SqlInstance $instance -Type Engine -Force -EnableException
+                        $splatRestartService = @{
+                            SqlInstance     = $instance
+                            Type            = "Engine"
+                            Force           = $true
+                            EnableException = $true
+                        }
+                        if ($Credential) {
+                            $splatRestartService.Credential = $Credential
+                        }
+                        $null = Restart-DbaService @splatRestartService
                     } catch {
                         $notes = "Failed to restart service"
                         Write-Message -Level Warning -Message "$notes for instance $instance."

tests/Set-DbaNetworkCertificate.Tests.ps1

@@ -1,6 +1,6 @@
 #Requires -Module @{ ModuleName="Pester"; ModuleVersion="5.0" }
 param(
-    $ModuleName  = "dbatools",
+    $ModuleName = "dbatools",
     $CommandName = "Set-DbaNetworkCertificate",
     $PSDefaultParameterValues = $TestConfig.Defaults
 )
@@ -22,6 +22,62 @@ Describe $CommandName -Tag UnitTests {
             Compare-Object -ReferenceObject $expectedParameters -DifferenceObject $hasParameters | Should -BeNullOrEmpty
         }
     }
+
+    InModuleScope dbatools {
+        Context "RestartService" {
+            BeforeEach {
+                $script:serviceCredential = New-Object System.Management.Automation.PSCredential(
+                    "sql1\svc-sql",
+                    (ConvertTo-SecureString "Password123!" -AsPlainText -Force)
+                )
+                $script:certificateThumbprint = "0123456789ABCDEF0123456789ABCDEF01234567"
+
+                Mock Test-FunctionInterrupt { $false }
+                Mock Test-DbaNetworkCertificate {
+                    [PSCustomObject]@{
+                        ComputerName                    = "sql1"
+                        InstanceName                    = "MSSQLSERVER"
+                        SqlInstance                     = "sql1"
+                        ConfiguredCertificateThumbprint = $null
+                        ConfiguredCertificateValid      = $false
+                        SuitableCertificateAvailable    = $true
+                        SuitableCertificateCount        = 1
+                        SuitableCertificates            = [PSCustomObject]@{
+                            Thumbprint = $script:certificateThumbprint
+                        }
+                    }
+                }
+                Mock Invoke-Command2 {
+                    [PSCustomObject]@{
+                        Verbose        = @()
+                        Exception      = $null
+                        ServiceAccount = "sql1\svc-sql"
+                    }
+                }
+                Mock Restart-DbaService { }
+            }
+
+            It "passes Credential to Restart-DbaService when RestartService is used" {
+                $splatSetNetworkCertificate = @{
+                    SqlInstance    = "sql1"
+                    Credential     = $script:serviceCredential
+                    RestartService = $true
+                    Confirm        = $false
+                }
+
+                $result = Set-DbaNetworkCertificate @splatSetNetworkCertificate
+
+                $result.CertificateThumbprint | Should -Be $script:certificateThumbprint
+                Assert-MockCalled -CommandName Restart-DbaService -Exactly 1 -Scope It -ModuleName dbatools -ParameterFilter {
+                    $SqlInstance.FullName -eq "sql1" -and
+                    $Credential -eq $script:serviceCredential -and
+                    $Type -eq "Engine" -and
+                    $Force -and
+                    $EnableException
+                }
+            }
+        }
+    }
 }
 
 Describe $CommandName -Tag IntegrationTests {