Write cmdlets: add typed body/query parameters for 56 New-*/Update-* cmdlets

Private/ConvertTo-PfbQueryString.ps1

@@ -24,7 +24,10 @@ function ConvertTo-PfbQueryString {
             continue
         }
 
-        if ($value -is [array]) {
+        if ($value -is [bool]) {
+            $value = $value.ToString().ToLowerInvariant()
+        }
+        elseif ($value -is [array]) {
             $value = $value -join ','
         }
 

Public/Admin/New-PfbApiToken.ps1

@@ -4,25 +4,33 @@ function New-PfbApiToken {
         Creates a new API token for a FlashBlade administrator.
     .DESCRIPTION
         The New-PfbApiToken cmdlet generates a new API token for an administrator account on the
-        connected Pure Storage FlashBlade. The administrator is identified by name or ID. Optional
-        attributes can be provided to configure token properties. Supports ShouldProcess for
-        confirmation prompts.
+        connected Everpure FlashBlade. The administrator is identified by name or ID. Supports
+        ShouldProcess for confirmation prompts.
+
+        Note that `POST /admins/api-tokens` takes no request body at all -- every field this
+        endpoint accepts is a query parameter.
     .PARAMETER Name
-        The name of the administrator account for which to create an API token.
+        The name of the administrator account for which to create an API token. Sent as the
+        `admin_names` query parameter. Also accepts the alias -AdminNames.
     .PARAMETER Id
-        The ID of the administrator account for which to create an API token.
+        The ID of the administrator account for which to create an API token. Sent as the
+        `admin_ids` query parameter. Also accepts the alias -AdminIds.
+    .PARAMETER Timeout
+        The duration of API token validity, in milliseconds.
     .PARAMETER Attributes
-        A hashtable of token attributes to set (e.g., timeout duration).
+        Retained for backward compatibility only. `POST /admins/api-tokens` accepts no request
+        body, so nothing supplied here is sent to the array. Use -Timeout to set the token's
+        validity period.
     .PARAMETER Array
         The FlashBlade connection object. If not specified, the default connection is used.
     .EXAMPLE
         New-PfbApiToken -Name "pureuser"
 
         Creates a new API token for the administrator named "pureuser".
     .EXAMPLE
-        New-PfbApiToken -Name "ops-admin" -Attributes @{ timeout = 86400000 }
+        New-PfbApiToken -Name "ops-admin" -Timeout 86400000
 
-        Creates a new API token with a custom timeout for the specified administrator.
+        Creates a new API token for "ops-admin" that is valid for 24 hours.
     .EXAMPLE
         New-PfbApiToken -Id "10314f42-020d-7080-8013-000ddt400012"
 
@@ -31,8 +39,14 @@ function New-PfbApiToken {
     [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')]
     param(
         [Parameter(ParameterSetName = 'ByName', ValueFromPipelineByPropertyName)]
+        [Alias('AdminNames')]
         [string]$Name,
-        [Parameter(ParameterSetName = 'ById')] [string]$Id,
+
+        [Parameter(ParameterSetName = 'ById')]
+        [Alias('AdminIds')]
+        [string]$Id,
+
+        [Parameter()] [long]$Timeout,
         [Parameter()] [hashtable]$Attributes,
         [Parameter()] [PSCustomObject]$Array
     )
@@ -42,9 +56,14 @@ function New-PfbApiToken {
     }
 
     process {
+        # POST /admins/api-tokens accepts admin_names/admin_ids, NOT names/ids. The cmdlet
+        # previously sent names/ids, which the array silently ignored, so -Name and -Id had
+        # no effect at all.
         $queryParams = @{}
-        if ($Name) { $queryParams['names'] = $Name }
-        if ($Id)   { $queryParams['ids']   = $Id }
+        if ($Name) { $queryParams['admin_names'] = $Name }
+        if ($Id)   { $queryParams['admin_ids']   = $Id }
+        if ($PSBoundParameters.ContainsKey('Timeout')) { $queryParams['timeout'] = $Timeout }
+
         $target = if ($Name) { $Name } else { $Id }
         $body = if ($Attributes) { $Attributes } else { @{} }
 

Public/Admin/Update-PfbAdmin.ps1

@@ -4,36 +4,92 @@ function Update-PfbAdmin {
         Updates a FlashBlade administrator account.
     .DESCRIPTION
         The Update-PfbAdmin cmdlet modifies attributes of an existing administrator account
-        on the connected Pure Storage FlashBlade. The target administrator can be identified
-        by name or ID. Common updates include role changes and password resets. Supports
-        pipeline input and ShouldProcess for confirmation prompts.
+        on the connected Everpure FlashBlade. The target administrator can be identified
+        by name or ID. Common updates include password resets and access-policy changes.
+        Supports pipeline input and ShouldProcess for confirmation prompts.
+
+        The individual typed parameters and the raw -Attributes hashtable are mutually
+        exclusive: they live in separate parameter sets, so PowerShell rejects a mixed
+        invocation at bind time rather than letting -Attributes silently override an
+        explicitly supplied value.
     .PARAMETER Name
         The name of the administrator account to update. Accepts pipeline input by property name.
     .PARAMETER Id
         The ID of the administrator account to update.
+    .PARAMETER AuthorizationModel
+        The location for access policies mapping.
+    .PARAMETER Locked
+        If set to $false, the specified user is unlocked.
+    .PARAMETER ManagementAccessPolicies
+        Names of the management access policies associated with the statically-authorized
+        administrator.
+    .PARAMETER OldPassword
+        Old user password.
+    .PARAMETER Password
+        New user password.
+    .PARAMETER PublicKey
+        Public key for SSH access.
     .PARAMETER Attributes
-        A hashtable of administrator attributes to modify (e.g., role, password).
+        A hashtable of administrator attributes to modify. Mutually exclusive with the
+        individual typed parameters above.
     .PARAMETER Array
         The FlashBlade connection object. If not specified, the default connection is used.
     .EXAMPLE
-        Update-PfbAdmin -Name "pureuser" -Attributes @{ role = @{ name = "array_admin" } }
+        Update-PfbAdmin -Name "ops-admin" -Password "N3wP@ssw0rd!" -Locked $false
+
+        Resets the password for "ops-admin" and unlocks the account using typed parameters.
+    .EXAMPLE
+        Update-PfbAdmin -Name "ops-admin" -ManagementAccessPolicies "array-admin","readonly"
 
-        Assigns the array_admin role to the administrator account named "pureuser".
+        Assigns two management access policies to the administrator named "ops-admin".
     .EXAMPLE
         Update-PfbAdmin -Name "ops-admin" -Attributes @{ password = "N3wP@ssw0rd!" }
 
         Updates the password for the administrator account named "ops-admin".
     .EXAMPLE
-        Update-PfbAdmin -Id "10314f42-020d-7080-8013-000ddt400012" -Attributes @{ role = @{ name = "readonly" } }
+        Update-PfbAdmin -Id "10314f42-020d-7080-8013-000ddt400012" -Attributes @{ locked = $false }
 
-        Changes the role of the administrator identified by ID to readonly.
+        Unlocks the administrator identified by ID.
     #>
-    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')]
+    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium',
+                   DefaultParameterSetName = 'ByNameIndividual')]
     param(
-        [Parameter(ParameterSetName = 'ByName', Mandatory, ValueFromPipelineByPropertyName)]
+        [Parameter(ParameterSetName = 'ByNameIndividual', Mandatory, ValueFromPipelineByPropertyName)]
+        [Parameter(ParameterSetName = 'ByNameAttributes',  Mandatory, ValueFromPipelineByPropertyName)]
         [string]$Name,
-        [Parameter(ParameterSetName = 'ById', Mandatory)] [string]$Id,
-        [Parameter(Mandatory)] [hashtable]$Attributes,
+
+        [Parameter(ParameterSetName = 'ByIdIndividual', Mandatory)]
+        [Parameter(ParameterSetName = 'ByIdAttributes',  Mandatory)]
+        [string]$Id,
+
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [string]$AuthorizationModel,
+
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [Nullable[bool]]$Locked,
+
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [string[]]$ManagementAccessPolicies,
+
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [string]$OldPassword,
+
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [string]$Password,
+
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [string]$PublicKey,
+
+        [Parameter(ParameterSetName = 'ByNameAttributes', Mandatory)]
+        [Parameter(ParameterSetName = 'ByIdAttributes',   Mandatory)]
+        [hashtable]$Attributes,
+
         [Parameter()] [PSCustomObject]$Array
     )
     begin {
@@ -44,9 +100,46 @@ function Update-PfbAdmin {
         $queryParams = @{}
         if ($Name) { $queryParams['names'] = $Name }
         if ($Id)   { $queryParams['ids']   = $Id }
+
+        if ($PSCmdlet.ParameterSetName -like '*Attributes') {
+            $body = $Attributes
+        }
+        else {
+            # EVERY value-carrying parameter -- body OR query -- is guarded by
+            # $PSBoundParameters.ContainsKey, never by truthiness. `if ($X)` silently discards
+            # any legitimate falsy value the caller explicitly supplied: $false, 0, '' and an
+            # empty array all fail a truthiness test. So `-Locked $false` would never unlock,
+            # an integer field could never be set to a meaningful 0, and
+            # `-ManagementAccessPolicies @()` could never clear a list. ContainsKey asks the
+            # only correct question -- did the caller supply this parameter at all?
+            #
+            # The one exemption is a MANDATORY [string] selector like -Name/-Id above: the
+            # binder rejects '' for those before any guard runs, so their falsy branch is
+            # unreachable and `if ($Name)` is safe. That exemption is about mandatory-ness,
+            # not about being a query parameter -- an OPTIONAL query parameter still needs
+            # ContainsKey (see -Timeout in New-PfbApiToken.ps1).
+            #
+            # No [bool] cast on $Locked either: constraint 7 forbids it (it breaks the
+            # wire-name trace) and [Nullable[bool]] + ContainsKey already sends an explicit
+            # $false correctly.
+            $body = @{}
+            if ($PSBoundParameters.ContainsKey('AuthorizationModel')) { $body['authorization_model'] = $AuthorizationModel }
+            if ($PSBoundParameters.ContainsKey('Locked'))             { $body['locked']              = $Locked }
+            if ($PSBoundParameters.ContainsKey('OldPassword'))        { $body['old_password']        = $OldPassword }
+            if ($PSBoundParameters.ContainsKey('Password'))           { $body['password']            = $Password }
+            if ($PSBoundParameters.ContainsKey('PublicKey'))          { $body['public_key']          = $PublicKey }
+
+            # Constraint 8(b): management_access_policies is an ARRAY OF REFERENCES (item
+            # schema is {id, name, resource_type}), so the parameter is [string[]] and the
+            # projection is assigned INLINE -- constraint 7 forbids a $policyRefs local.
+            if ($PSBoundParameters.ContainsKey('ManagementAccessPolicies')) {
+                $body['management_access_policies'] = @($ManagementAccessPolicies | ForEach-Object { @{ name = $_ } })
+            }
+        }
+
         $target = if ($Name) { $Name } else { $Id }
         if ($PSCmdlet.ShouldProcess($target, 'Update admin')) {
-            Invoke-PfbApiRequest -Array $Array -Method PATCH -Endpoint 'admins' -Body $Attributes -QueryParams $queryParams
+            Invoke-PfbApiRequest -Array $Array -Method PATCH -Endpoint 'admins' -Body $body -QueryParams $queryParams
         }
     }
 }

Public/Admin/Update-PfbApiClient.ps1

@@ -4,38 +4,58 @@ function Update-PfbApiClient {
         Updates an API client on the FlashBlade.
     .DESCRIPTION
         The Update-PfbApiClient cmdlet modifies an existing API client on the connected
-        Pure Storage FlashBlade. Properties that can be updated include the public key,
-        maximum role, and enabled state.
+        Everpure FlashBlade.
+
+        Note that `PATCH /api-clients` reuses the full ApiClient resource schema. Of its nine
+        properties, seven are read-only and `max_role` is deprecated rather than read-only,
+        which leaves `enabled` as the only settable field this cmdlet exposes as a typed
+        parameter.
+
+        The individual typed parameters and the raw -Attributes hashtable are mutually
+        exclusive: they live in separate parameter sets, so PowerShell rejects a mixed
+        invocation at bind time rather than letting -Attributes silently override an
+        explicitly supplied value.
     .PARAMETER Name
         The name of the API client to update.
     .PARAMETER Id
         The ID of the API client to update.
+    .PARAMETER Enabled
+        If $true, the API client is permitted to exchange ID Tokens for access tokens.
     .PARAMETER Attributes
-        A hashtable of properties to update on the API client.
+        A hashtable of properties to update on the API client. Mutually exclusive with the
+        individual typed parameters above.
     .PARAMETER Array
         The FlashBlade connection object. If not specified, the default connection is used.
     .EXAMPLE
-        Update-PfbApiClient -Name 'automation-client' -Attributes @{ enabled = $true }
+        Update-PfbApiClient -Name 'automation-client' -Enabled $true
 
-        Enables the API client named 'automation-client'.
+        Enables the API client named 'automation-client' using a typed parameter.
     .EXAMPLE
-        Update-PfbApiClient -Name 'automation-client' -Attributes @{ max_role = @{ name = 'readonly' } }
+        Update-PfbApiClient -Name 'automation-client' -Attributes @{ enabled = $true }
 
-        Changes the maximum role of the API client to read-only.
+        Enables the API client named 'automation-client'.
     .EXAMPLE
-        Update-PfbApiClient -Id '12345678-abcd-efgh-ijkl-123456789012' -Attributes @{ public_key = $newKey }
+        Update-PfbApiClient -Id '12345678-abcd-efgh-ijkl-123456789012' -Enabled $false
 
-        Updates the public key of an API client by ID.
+        Disables an API client by ID.
     #>
-    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')]
+    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium',
+                   DefaultParameterSetName = 'ByNameIndividual')]
     param(
-        [Parameter(ParameterSetName = 'ByName', Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
+        [Parameter(ParameterSetName = 'ByNameIndividual', Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
+        [Parameter(ParameterSetName = 'ByNameAttributes',  Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
         [string]$Name,
 
-        [Parameter(ParameterSetName = 'ById', Mandatory)]
+        [Parameter(ParameterSetName = 'ByIdIndividual', Mandatory)]
+        [Parameter(ParameterSetName = 'ByIdAttributes',  Mandatory)]
         [string]$Id,
 
-        [Parameter(Mandatory)]
+        [Parameter(ParameterSetName = 'ByNameIndividual')]
+        [Parameter(ParameterSetName = 'ByIdIndividual')]
+        [Nullable[bool]]$Enabled,
+
+        [Parameter(ParameterSetName = 'ByNameAttributes', Mandatory)]
+        [Parameter(ParameterSetName = 'ByIdAttributes',   Mandatory)]
         [hashtable]$Attributes,
 
         [Parameter()] [PSCustomObject]$Array
@@ -46,13 +66,23 @@ function Update-PfbApiClient {
     }
 
     process {
-        $target = if ($Name) { $Name } else { $Id }
         $queryParams = @{}
         if ($Name) { $queryParams['names'] = $Name }
         if ($Id)   { $queryParams['ids']   = $Id }
 
+        if ($PSCmdlet.ParameterSetName -like '*Attributes') {
+            $body = $Attributes
+        }
+        else {
+            # Every body parameter is guarded by ContainsKey, never by truthiness -- see the
+            # canonical explanation in Update-PfbAdmin.ps1.
+            $body = @{}
+            if ($PSBoundParameters.ContainsKey('Enabled')) { $body['enabled'] = $Enabled }
+        }
+
+        $target = if ($Name) { $Name } else { $Id }
         if ($PSCmdlet.ShouldProcess($target, 'Update API client')) {
-            Invoke-PfbApiRequest -Array $Array -Method PATCH -Endpoint 'api-clients' -Body $Attributes -QueryParams $queryParams
+            Invoke-PfbApiRequest -Array $Array -Method PATCH -Endpoint 'api-clients' -Body $body -QueryParams $queryParams
         }
     }
 }