Fixing second notScopes bug

Azure · May 6, 2024 · f23b32c · f23b32c
1 parent 25849ea
commit f23b32c
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 9 deletions.
diff --git a/Docs/policy-assignments.md b/Docs/policy-assignments.md
@@ -187,7 +187,7 @@ Both `scope` and `notScope` are specific to an [EPAC Environment using the pacSe
 `notScope` works the same. In addition `"*"` means all EPAC Environments.
 
 ```json
-"notScope": {
+"notScopes": {
     "*": [
         "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-pattern*"
     ],

diff --git a/Schemas/policy-assignment-schema.json b/Schemas/policy-assignment-schema.json
@@ -270,7 +270,7 @@
                 }
             }
         },
-        "notScope": {
+        "notScopes": {
             "type": "object",
             "properties": {
                 "patternProperties": {

diff --git a/Scripts/Helpers/Build-AssignmentDefinitionNode.ps1 b/Scripts/Helpers/Build-AssignmentDefinitionNode.ps1
@@ -311,12 +311,12 @@ function Build-AssignmentDefinitionNode {
     }
     else {
         # may define notScope or notScopes
-        $definitionNotScopesList = $definition.notScopesList
         if ($DefinitionNode.notScope) {
-            $definition.notScopesList = Add-SelectedPacArray -InputObject $DefinitionNode.notScope -PacSelector $pacSelector -ExistingList $definitionNotScopesList
+            Write-Warning "    Node $($nodeName): notScope is legacy, consider using notScopes instead."
+            $definition.notScopesList = Add-SelectedPacArray -InputObject $DefinitionNode.notScope -PacSelector $pacSelector -ExistingList $definition.notScopesList
         }
         if ($DefinitionNode.notScopes) {
-            $definition.notScopesList = Add-SelectedPacArray -InputObject $DefinitionNode.notScopes -PacSelector $pacSelector -ExistingList $definitionNotScopesList
+            $definition.notScopesList = Add-SelectedPacArray -InputObject $DefinitionNode.notScopes -PacSelector $pacSelector -ExistingList $definition.notScopesList
         }
         if ($DefinitionNode.scope) {
             ## Found a scope list - process scope notScopes
@@ -343,7 +343,7 @@ function Build-AssignmentDefinitionNode {
                     $thisScopeChildren = $thisScopeDetails.childrenTable
                     $thisScopeGlobalNotScopeList = $thisScopeDetails.notScopesList
                     $thisScopeGlobalNotScopeTable = $thisScopeDetails.notScopesTable
-                    foreach ($notScope in $definitionNotScopesList) {
+                    foreach ($notScope in $definition.notScopesList) {
                         if (-not $thisScopeGlobalNotScopeTable.ContainsKey($notScope)) {
                             if ($thisScopeChildren.ContainsKey($notScope)) {
                                 $null = $thisNotScopeList.Add($notScope)
@@ -355,9 +355,6 @@ function Build-AssignmentDefinitionNode {
                                     }
                                 }
                             }
-                            else {
-                                continue
-                            }
                         }
                     }
                     $null = $thisNotScopeList.AddRange($thisScopeGlobalNotScopeList)