You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Docs/Create_new_ project.md
+12-1Lines changed: 12 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
Download the Visual Studio Template zipfile from [here](https://github.com/PowerCommands/PowerCommands2022/tree/main/Templates)
4
4
5
-
Copy the .zip file into the user project template directory. By default, this directory is %USERPROFILE%\Documents\Visual Studio <version>\Templates\ProjectTemplates.
5
+
Copy the .zip file into the user project template directory. By default, this directory is %USERPROFILE%\Documents\Visual Studio %version%\Templates\ProjectTemplates.
6
6
7
7
Open Visual Studio and write Power in the searchbox, you should find the PowerCommand template.
8
8
@@ -18,6 +18,17 @@ And this is what you should se!
Do not worry about all the drama that an empty demo input creates, demo command demonstrates who you can use options to design your command and add built in validation with.
22
+
The demo command has an design attribute that looks something like this:
23
+
24
+
```
25
+
[PowerCommandDesign( description: "Demo command just to try out how you could use the input...",
26
+
options: "!MANDATORY|!pause",
27
+
example: "//Must provide the MANDATORY option will trigger a validation error otherwise|demo MANDATORY|//Test the pause service|demo --pause 5 MANDATORY")]
28
+
```
29
+
30
+
Read more about designing your commands in the following steps.
31
+
21
32
Next step, create your first [PowerCommand](Create_new_command.md).
22
33
23
34
[Back to start](https://github.com/PowerCommands/PowerCommands2022/blob/main/Docs/README.md)
Copy file name to clipboardExpand all lines: Docs/PowerCommands Design Principles And Guidlines.md
+13-2Lines changed: 13 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -259,6 +259,9 @@ PowerCommands rely on reflection to find all existing PowerCommands that are val
259
259
PowerCommands handles export and imports of environment variables using YAML files it is the preferred way to store secrets. Do not store sensitive information inside the application path as it will be to easy to steal with a simple copy and paste operation, sensitive information should always be encrypted at rest.
260
260
261
261
## <aname='Usethesecretsbuiltinfunctionallity'></a>Use the secrets built in functionallity
262
+
Secret is initialized the fist time you startup a new power command project on your machine, the same keys for encryption/decryption is used by all your PowerCommands based applications on the same machine.
263
+
If you setup PowerCommands on a diffrent machine, a new key for encryption/decryption will be used, meaning you have to create the secrets again on that machine. But you can move the keys manually, but I do not think that you should do that.
264
+
262
265
Create secret with built in commands named secret, like this:
263
266
```
264
267
secret create "localDB"
@@ -268,16 +271,24 @@ In you command you could get the decrypted secret like this.
268
271
```
269
272
var cn = Configuration.Secret.DecryptSecret("Server=.;Database=timelineLocalDB;User Id=sa;Password=##localDB##;");
270
273
```
274
+
275
+
Another simple usa case where you decrypt your secret access token. Lets pretend that you have created a secret named **AWS_TOKEN**.
276
+
277
+
```
278
+
var accessToken = Configuration.Secret.DecryptSecret("##AWS_TOKEN##");
279
+
```
280
+
271
281
Sometimes you have to pass a configuration element to a thirdparty or custom module, then this could be usefull, it creates a new clone of the configuration and you pass that, its a good pattern ratcher then pass the runtime configuration instance that could lead to unpredictable result and in worst case revealing the decrypted secret by mistake.
272
282
```
273
283
var decryptedCloneConfiguration = Configuration.Secret.DecryptSecret(config.SourceSetting, nameof(config.SourceSetting.ConnectionString));
274
284
```
275
285
You pass in the configuration and the property name that has a tagged secret and you get a clone of the configuration back where the property value decrypted. In the example above it is the **ConnectionString** property that is decrypted.
276
286
277
-
## <aname='Becarefullwhendecryptingbesuretoprotectyoursecretsinruntime'></a>Be carefull when decrypting, be sure to protect your secrets in runtime
287
+
288
+
## Be carefull when decrypting, be sure to protect your secrets in runtime
278
289
It is very easy to expose a decrypted value by mistake, the decryption should be in the same scope or in very near scope of the usage. It should not be passed around with the other configuration values and reside in runtime as long as the application executes. The risk is that for example the decrypted value is logged for some reason you cant predict and the secret is logged as clear text, in other words it is revealed and must be changed.
279
290
280
-
### <aname='RecomendedpatternforcustomCompenentsusingsecretspasstheDecryptSecretfunction'></a>Recomended pattern for custom Compenents using secrets, pass the DecryptSecret function
291
+
### Recomended pattern for custom Compenents using secrets, pass the DecryptSecret function
281
292
A pattern to reduce this risk could be to send the DecryptSecret function to the target rather then send the decrypted configuration, like this example below. In this real world use case I using a Custom Component, I want to implement the secret handling as late as possible but avoid to create a depandancy between the custom component and PowerCommands. I have to modify the Custom component a bit but no dependancy is needed.
282
293
```
283
294
//First I add this to the class in the custom component that will use the connction string.
All you have to do is to run the same command with the --initialize option like this.
11
-
```
12
-
secret --initialize
13
-
```
14
-
Now your environment is ready to use Encryption with all your PowerCommands running on that machine. Please note that the name of the environment variable is configurable in the secret.yaml file, **_encryptionManager** is the default name. Also note that values that you encrypt on our machine can not be decrypted on another machine, unless you copy the encryption keys.
15
-
16
-
Now your environment is ready!
17
-
4
+
## Good to know
5
+
Secret is initialized the fist time you startup a new power command project on your machine, the same keys for encryption/decryption is used by all your PowerCommands based applications on the same machine.
6
+
If you setup PowerCommands on a diffrent machine, a new key for encryption/decryption will be used, meaning you have to create the secrets again on that machine. But you can move the keys manually, but I do not think that you should do that.
18
7
## Use the secrets built in functionallity
19
8
Create secret with built in commands named secret, like this:
20
9
```
@@ -25,12 +14,20 @@ In you command you could get the decrypted secret like this.
25
14
```
26
15
var cn = Configuration.Secret.DecryptSecret("Server=.;Database=timelineLocalDB;User Id=sa;Password=##localDB##;");
27
16
```
17
+
18
+
Another simple usa case where you decrypt your secret access token. Lets pretend that you have created a secret named **AWS_TOKEN**.
19
+
20
+
```
21
+
var accessToken = Configuration.Secret.DecryptSecret("##AWS_TOKEN##");
22
+
```
23
+
28
24
Sometimes you have to pass a configuration element to a thirdparty or custom module, then this could be usefull, it creates a new clone of the configuration and you pass that, its a good pattern ratcher then pass the runtime configuration instance that could lead to unpredictable result and in worst case revealing the decrypted secret by mistake.
29
25
```
30
26
var decryptedCloneConfiguration = Configuration.Secret.DecryptSecret(config.SourceSetting, nameof(config.SourceSetting.ConnectionString));
31
27
```
32
28
You pass in the configuration and the property name that has a tagged secret and you get a clone of the configuration back where the property value decrypted. In the example above it is the **ConnectionString** property that is decrypted.
33
29
30
+
34
31
## Be carefull when decrypting, be sure to protect your secrets in runtime
35
32
It is very easy to expose a decrypted value by mistake, the decryption should be in the same scope or in very near scope of the usage. It should not be passed around with the other configuration values and reside in runtime as long as the application executes. The risk is that for example the decrypted value is logged for some reason you cant predict and the secret is logged as clear text, in other words it is revealed and must be changed.
0 commit comments