Skip to content

Enable resource manifest to specify requireSecurityContext per operation#1424

Open
SteveL-MSFT wants to merge 3 commits intoPowerShell:mainfrom
SteveL-MSFT:manifest-securitycontext
Open

Enable resource manifest to specify requireSecurityContext per operation#1424
SteveL-MSFT wants to merge 3 commits intoPowerShell:mainfrom
SteveL-MSFT:manifest-securitycontext

Conversation

@SteveL-MSFT
Copy link
Member

@SteveL-MSFT SteveL-MSFT commented Mar 7, 2026

PR Summary

Enable resource manifest to specify requireSecurityContext per operation. The value can be: elevated, restricted, or current. If not specified, current is implied. This new optional property can be specified for get, set, test, delete, and export.

For the tests, reusing an existing test resource, but since set and test rely on get under the covers to get the current state, need those to be successful, so have a separate test resource to validate get specifically.

PR Context

Fix #700

@SteveL-MSFT SteveL-MSFT requested review from Copilot and tgauth March 7, 2026 01:16
@SteveL-MSFT SteveL-MSFT added Doc-Impact Schema-Impact Change requires updating a canonical schema for configs or manifests labels Mar 7, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds per-operation security-context requirements to resource manifests so the engine can block running certain operations unless the caller is elevated/restricted/current, addressing scenarios like “read requires no elevation, set requires elevation”.

Changes:

  • Extend resource manifest method definitions to allow specifying requireSecurityContext on operations.
  • Enforce the required security context at runtime for command-based resources (get/set/test/delete/export) and surface a localized error message when unmet.
  • Add dsctest manifests and a new Pester test suite covering elevated/restricted/current behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 10 comments.

Show a summary per file
File Description
tools/dsctest/dsctest.dsc.manifests.json Adds test resource manifests with per-operation requireSecurityContext values for current/elevated/restricted scenarios.
lib/dsc-lib/src/dscresources/resource_manifest.rs Adds optional requireSecurityContext to method structs in the resource manifest model.
lib/dsc-lib/src/dscresources/command_resource.rs Enforces manifest-specified security context before invoking operations; adds helper for the checks.
lib/dsc-lib/locales/en-us.toml Adds localized error string for unmet security context requirements.
dsc/tests/dsc_resource_securitycontext.tests.ps1 Adds CLI-level tests validating security-context enforcement across operations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@SteveL-MSFT SteveL-MSFT changed the title Enable resource manifest to specify requiredSecurityContext per operation Enable resource manifest to specify requireSecurityContext per operation Mar 7, 2026
Steve Lee (POWERSHELL HE/HIM) (from Dev Box) and others added 2 commits March 6, 2026 17:32
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Doc-Impact Schema-Impact Change requires updating a canonical schema for configs or manifests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow resource manifest to specify required security context per method

2 participants