mirror of https://github.com/raandree/NTFSSecurity
Browse Source
- Decision 26: Add and Remove for access and audit declare no default parameter set, what that changes for a piped object, and what stays silent (a value that PowerShell cannot convert to a scope is ignored and the object is handled as one without AppliesTo). - Debugging insights: a piped property selects a parameter set only when the cmdlet has no default set whose mandatory parameters the object satisfies; PowerShell resets only the parameters that the previous piped object bound, so a field that the cmdlet writes itself reaches the next object; probe the route that the documentation shows and each form of a value, not the one that you tried; a sentence about what a test proves is a claim too. - Active context and progress: the state after the fix, three independent reviews and two checks, the acceptance of the final package in the labs, and the open items; the remaining-path inventory is that of 2112ee3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant <ai@example.com>pull/125/head
Raimund Andree
3 weeks ago
5 changed files with 167 additions and 82 deletions
@ -0,0 +1,49 @@ |
|||
--- |
|||
status: accepted |
|||
date: 2026-10-11 |
|||
last-verified: 2026-10-11 |
|||
owner: shared |
|||
source: maintainer decision of 2026-10-11 |
|||
--- |
|||
|
|||
# Decision 26: Add and Remove for access and audit declare no default parameter set |
|||
|
|||
- Choice: `Add-NTFSAccess`, `Remove-NTFSAccess`, `Add-NTFSAudit`, and |
|||
`Remove-NTFSAudit` declare no `DefaultParameterSetName` (maintainer, |
|||
2026-10-11; `93ed2c7`). An object piped with a path binds `PathSimple` when |
|||
it has `AppliesTo`, and `PathComplex` when it has `InheritanceFlags`, |
|||
`PropagationFlags`, or neither (the default scope). An object that has |
|||
`AppliesTo` and one of the flags fails with `AmbiguousParameterSet`, like the |
|||
same named parameters. |
|||
- Rationale: With `PathComplex` as the default, an object that satisfied its |
|||
mandatory parameters made the binder settle on it, and a piped `AppliesTo` |
|||
was dropped without a message (a silent change of the scope). `4b1abc9` had |
|||
made `AppliesTo` mandatory in the Simple sets, so the default no longer |
|||
decided any named call. |
|||
- Consequence: a script that piped objects with `AppliesTo` and the flags |
|||
together got the flags before and gets an error now; so does an object that |
|||
has both `Path` and `SecurityDescriptor`, where the path won. An |
|||
`AppliesTo` that is `$null` fails to bind for that object (a CSV row with |
|||
fewer fields than its header has `$null` there); a call with neither |
|||
`-Path` nor `-SecurityDescriptor` fails with `AmbiguousParameterSet` instead |
|||
of a missing-parameter error (CHANGELOG, Fixed). A value that PowerShell |
|||
cannot convert to a scope (the blank cell that `Import-Csv` reads, a typo) |
|||
is ignored silently, and the object is handled as one without `AppliesTo`: |
|||
its own flags, or the default scope when it has none. The binder swallows a |
|||
value that it cannot convert, so failing loudly needs a design change |
|||
(report, open item 3). Named calls, |
|||
`-SecurityDescriptor` calls without `AppliesTo`, and |
|||
`Get-NTFSAccess | Add-NTFSAccess -Path` do not change. The syntax lists |
|||
`PathSimple` first, because PowerShell orders the sets by declaration. |
|||
- Follow-up: the third independent review found that `ProcessRecord` wrote |
|||
the scope converted from `AppliesTo` into the fields behind the flag |
|||
parameters, which PowerShell does not reset between piped objects. The flags |
|||
of a record are locals since `9783d2a`; rc7 had the defect for piped |
|||
`-SecurityDescriptor` objects. The reviewer's checks found that "an empty |
|||
`AppliesTo` fails to bind" was true for `$null` only (`7bc7925`), and that |
|||
the sentence about unconvertible values was too narrow (`2112ee3`). |
|||
- Evidence: report `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md` |
|||
(decision 23; the section on the fix of the piped `AppliesTo`), the tests in |
|||
`Tests/ParameterSets.Access.Tests.ps1` and `Tests/ParameterSets.Audit.Tests.ps1` |
|||
(red before, green after, in four configurations), and |
|||
`.memory-bank/debugging-insights.md`. |
|||
Loading…
Reference in new issue