AZMAN BizRule

Setup-And-Test-ConfirmBizRule.ps1

#Requires -Version 5.1
<#
    Setup-And-Test-ConfirmBizRule.ps1

    Creates a new AzMan store with a minimal application, attaches a
    BizRule that checks a UserConfirmed parameter, then runs a test
    AccessCheck.

    AzMan's BizRule script host runs sandboxed with no UI or process
    launch access, so calling Shell or launching an executable from
    inside a BizRule will not work reliably. This script works around
    that by having PowerShell launch a confirmation process (Notepad
    as a placeholder) before calling AccessCheck, mapping its exit code
    to a UserConfirmed parameter that the BizRule reads. Swap the
    Notepad launch for your real app once this is confirmed working.

    Single file version: the BizRule VBScript is embedded below rather
    than loaded from a separate .vbs file.

    Run this elevated.

    Usage:
        .\Setup-And-Test-ConfirmBizRule.ps1 -StorePath "C:\AzManStores\ConfirmTest.xml"
#>

param(
    [Parameter(Mandatory)]
    [string]$StorePath,

    [string]$AppName  = "ConfirmTestApp",
    [string]$TaskName = "ConfirmTask"
)

# ---------------------------------------------------------------------------
# Embedded BizRule
#
# This rule does not show any UI itself. It only reads a UserConfirmed
# parameter that PowerShell passes in via AccessCheck, after the actual
# confirmation dialog has already been shown and answered.
# ---------------------------------------------------------------------------

$bizRuleBody = @'
Dim confirmed

confirmed = AzBizRuleContext.GetParameter("UserConfirmed")

If confirmed = "Yes" Then
    AzBizRuleContext.SetBusinessRuleResult(True)
Else
    AzBizRuleContext.SetBusinessRuleResult(False)
End If
'@

# ---------------------------------------------------------------------------
# Guards
# ---------------------------------------------------------------------------

$currentPrincipal = New-Object System.Security.Principal.WindowsPrincipal(
    [System.Security.Principal.WindowsIdentity]::GetCurrent()
)
$isElevated = $currentPrincipal.IsInRole(
    [System.Security.Principal.WindowsBuiltInRole]::Administrator
)

if (-not $isElevated) {
    throw "This script must run elevated. Re-launch PowerShell as Administrator."
}

if (Test-Path $StorePath) {
    throw "A file already exists at $StorePath. Choose a new path or remove the existing file first."
}

$storeFolder = Split-Path -Path $StorePath -Parent
if ($storeFolder -and -not (Test-Path $storeFolder)) {
    New-Item -Path $storeFolder -ItemType Directory -Force | Out-Null
}

# Fail fast: stop on the first COM error instead of cascading into a
# string of null reference errors on every line that follows it.
$ErrorActionPreference = "Stop"

try {
    # -----------------------------------------------------------------------
    # Create the store, application, operation, task
    # -----------------------------------------------------------------------

    Write-Host "Creating store at $StorePath"

    $store = New-Object -ComObject AzRoles.AzAuthorizationStore

    # Flag 1 = AZ_AZSTORE_FLAG_CREATE. 0 means open an existing store,
    # which is why a mismatched flag here throws FileNotFound on a
    # path that does not exist yet.
    $store.Initialize(1, "msxml://$StorePath")
    $store.Submit(0)

    Write-Host "Creating application $AppName"

    $app = $store.CreateApplication($AppName, 0)
    $app.Submit(0)

    Write-Host "Creating operation ConfirmOperation"

    $operation = $app.CreateOperation("ConfirmOperation", 0)
    $operation.OperationID = 1
    $operation.Submit(0)

    Write-Host "Creating task $TaskName and attaching Confirm BizRule"

    $task = $app.CreateTask($TaskName, 0)
    $task.AddOperation("ConfirmOperation")

    $task.BizRuleLanguage = "VBScript"
    $task.BizRule = $bizRuleBody
    $task.Submit(0)

    Write-Host "Setup complete."
    Write-Host ""

    # -----------------------------------------------------------------------
    # Test activation: run a live AccessCheck against the operation
    # This is what actually triggers the BizRule and pops the message box
    # -----------------------------------------------------------------------

    Write-Host "Running test AccessCheck."

    # Launch the confirmation process and wait for it to close.
    # Notepad is a placeholder here, swap the path/args for your real
    # app once this flow is confirmed working end to end.
    #
    # Exit code mapping: 0 means confirmed, anything else means denied.
    # Notepad always exits 0 on a normal close, so this will always
    # grant as written, it is only here to prove the plumbing works.
    # Your real app should return a nonzero exit code on decline.
    $confirmProcess = Start-Process -FilePath "notepad.exe" -Wait -PassThru

    $userConfirmed = if ($confirmProcess.ExitCode -eq 0) { "Yes" } else { "No" }

    Write-Host "Confirmation process exit code: $($confirmProcess.ExitCode) -> UserConfirmed = $userConfirmed"

    $currentUser = "$env:USERDOMAIN\$env:USERNAME"
    $clientContext = $app.InitializeClientContextFromName($currentUser, 0)

    $results = $clientContext.AccessCheck(
        "ConfirmTest",
        @(""),
        @(1),
        @("UserConfirmed"),
        @($userConfirmed),
        @(),
        @(),
        @()
    )

    Write-Host ""
    if ($results[0] -eq 0) {
        Write-Host "Result: GRANTED (user clicked Yes)"
    } else {
        Write-Host "Result: DENIED (user clicked No, or closed the box)"
    }
}
catch {
    Write-Host ""
    Write-Host "Setup or test activation failed:"
    Write-Host $_.Exception.Message
    throw
}