Tests setup

[peetrike]

There are many Access Denied errors with tests.

It seems that being owner on folder is not enough for creating folder. Or there are some missing permissions. The same problem seems to be with reports tests.

Get-TssSecretField tests end with following error even when additional template is imported and secret (created from that template) present:

WARNING: Issue getting field [attached-file] on secret [24]
System.Management.Automation.RuntimeException: An error has occurred in Secret Server. Please contact your administrator.
at <ScriptBlock><Process>, C:\Program Files\WindowsPowerShell\Modules\Thycotic.SecretServer\0.29.0\parts\ErrorHandling.ps1: line 9
at Get-SecretField<Process>, C:\Program Files\WindowsPowerShell\Modules\Thycotic.SecretServer\0.29.0\functions\secrets\Get-SecretField.ps1: line 148
at <ScriptBlock>, C:\Projects\GitHub\thycotic.secretserver\tests\secrets\Get-TssSecretField.Tests.ps1: line 48

The following tests get HTTP 400 error:

• Get-TssSecretStub
• New-TssSecret
• Set-TssSecret

[wsmelton]

API applies RBAC controls just like the UI and for the most part the UI uses the same endpoint API calls.

[wsmelton]

What version of Secret Secret are you running the tests against?

[peetrike]

The Secret Server version

PS ❯ Get-TssVersion -TssSession $session

Version
-------
10.9.000033

[peetrike]

Maybe it would help if tests could have tags to skip tests that require more permissions than regular user.

I will gradually look at tests and try to understand, what causes the errors. It just takes some time.

[wsmelton]

Tests are not written for the module to be skipped. I need all tests to run in order to know a pull request by a contributor is not affecting anything used by other commands.

The module is not meant to work necessarily like Windows or say SQL Server does (with dbatools module). Outside of getting and modifying secrets and folders will require more than a basic user role has in Secret Server. That is the primary reason I mention in the contributing guide to test this on a test installation of Secret Server.

At some point down the road as I have time, I plan on moving many tests to utilizee mocking instead and get rid of the integration tests so they are more easily run by anyone.

[peetrike]

then there should be a documentation page about what permissions are required to perform tests. Because I can fix all other problems when overviewing tests, but Access Denied errors require some changes on Secret Server side.

[wsmelton]

I'll update the contribution guide to note that admin role is required.

[peetrike]

Using admin rights is possible, but I would prefer less privieges.

For folder tests, user must have role with Administer Folders permission. By default only Administrator role has that permission.

Other tests probably have similar dependencies.