diff --git a/Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1 b/Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1 index 2d9f759..ab2b349 100644 --- a/Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1 +++ b/Hawk/functions/Tenant/Start-HawkTenantInvestigation.ps1 @@ -109,50 +109,12 @@ begin { if ($NonInteractive) { - ############################################################################## - # 0. Check if the user provided both StartDate AND DaysToLookBack - ############################################################################## - if ($PSBoundParameters.ContainsKey('DaysToLookBack') -and $PSBoundParameters.ContainsKey('StartDate')) { - # This is the new disallowed scenario - Stop-PSFFunction -Message "DaysToLookBack cannot be used together with StartDate in non-interactive mode." -EnableException $true - } - - ############################################################################## - # 1. SHORT-CIRCUIT CHECK: Must specify either StartDate or DaysToLookBack - ############################################################################## - if (-not $PSBoundParameters.ContainsKey('DaysToLookBack') -and -not $PSBoundParameters.ContainsKey('StartDate')) { - Stop-PSFFunction -Message "Either StartDate or DaysToLookBack must be specified in non-interactive mode" -EnableException $true - } - - ############################################################################## - # 2. If -DaysToLookBack was explicitly passed, validate it up front - ############################################################################## - if ($PSBoundParameters.ContainsKey('DaysToLookBack')) { - if ($DaysToLookBack -lt 1 -or $DaysToLookBack -gt 365) { - Stop-PSFFunction -Message "DaysToLookBack must be between 1 and 365" -EnableException $true - } - else { - # Check if user also provided EndDate (but no StartDate) - if ($PSBoundParameters.ContainsKey('EndDate') -and -not $PSBoundParameters.ContainsKey('StartDate')) { - # EndDate - DaysToLookBack = StartDate - # For example, if EndDate=3/1/2024 and DaysToLookBack=30 => StartDate=1/31/2024 - $EndDateUTC = $EndDate.ToUniversalTime() - $StartDateUTC = $EndDateUTC.AddDays(-$DaysToLookBack) - - $StartDate = $StartDateUTC - $EndDate = $EndDateUTC - } - else { - # Original: Convert DaysToLookBack to StartDate/EndDate from "today" - $ConvertedDates = Convert-HawkDaysToDate -DaysToLookBack $DaysToLookBack - $StartDate = $ConvertedDates.StartDate - $EndDate = $ConvertedDates.EndDate - } - } - } + $processedDates = Process-HawkDateParameter -PSBoundParameters $PSBoundParameters -StartDate $StartDate -EndDate $EndDate -DaysToLookBack $DaysToLookBack + $StartDate = $processedDates.StartDate + $EndDate = $processedDates.EndDate # Now call validation with updated StartDate/EndDate - $validation = Test-HawkInvestigationParameter ` + $validation = Test-HawkDateParameter ` -StartDate $StartDate -EndDate $EndDate ` -DaysToLookBack $DaysToLookBack -FilePath $FilePath -NonInteractive @@ -161,7 +123,7 @@ Stop-PSFFunction -Message $error -EnableException $true } } - + try { Initialize-HawkGlobalObject -StartDate $StartDate -EndDate $EndDate ` -DaysToLookBack $DaysToLookBack -FilePath $FilePath ` diff --git a/Hawk/internal/functions/Test-HawkDateParameter.ps1 b/Hawk/internal/functions/Test-HawkDateParameter.ps1 new file mode 100644 index 0000000..fe101ec --- /dev/null +++ b/Hawk/internal/functions/Test-HawkDateParameter.ps1 @@ -0,0 +1,133 @@ +Function Test-HawkDateParameter { + <# + .SYNOPSIS + Internal helper function that processes and validates date parameters for Hawk investigations. + + .DESCRIPTION + The Test-HawkDateParmeter function is an internal helper used by Start-HawkTenantInvestigation + and Start-HawkUserInvestigation to process date-related parameters. It handles both direct date + specifications and the DaysToLookBack parameter, performing initial validation and date conversions. + + The function: + - Validates the combination of provided date parameters + - Processes DaysToLookBack into concrete start/end dates + - Converts dates to UTC format + - Performs bounds checking on date ranges + - Handles both absolute dates and relative date calculations + + This is designed as an internal function and should not be called directly by end users. + + .PARAMETER PSBoundParameters + The PSBoundParameters hashtable from the calling function. Used to check which parameters + were explicitly passed to the parent function. Must contain information about whether + StartDate, EndDate, and/or DaysToLookBack were provided. + + .PARAMETER StartDate + The starting date for the investigation period, if specified directly. + Can be null if using DaysToLookBack instead. + When provided with EndDate, defines an explicit date range for the investigation. + + .PARAMETER EndDate + The ending date for the investigation period, if specified directly. + Can be null if using DaysToLookBack instead. + When provided with StartDate, defines an explicit date range for the investigation. + + .PARAMETER DaysToLookBack + The number of days to look back from either the current date or a specified EndDate. + Must be between 1 and 365. + Cannot be used together with StartDate. + + .OUTPUTS + PSCustomObject containing: + - StartDate [DateTime]: The calculated or provided start date in UTC + - EndDate [DateTime]: The calculated or provided end date in UTC + + .EXAMPLE + $dates = Test-HawkDateParmeter -PSBoundParameters $PSBoundParameters -DaysToLookBack 30 + + Processes a request to look back 30 days from the current date, returning appropriate + start and end dates in UTC format. + + .EXAMPLE + $dates = Test-HawkDateParmeter ` + -PSBoundParameters $PSBoundParameters ` + -StartDate "2024-01-01" ` + -EndDate "2024-01-31" + + Processes explicit start and end dates, validating them and converting to UTC format. + + .EXAMPLE + $dates = Test-HawkDateParmeter ` + -PSBoundParameters $PSBoundParameters ` + -DaysToLookBack 30 ` + -EndDate "2024-01-31" + + Processes a request to look back 30 days from a specific end date. + + .NOTES + Author: Jonathan Butler + Internal Function: This function is not meant to be called directly by users + Dependencies: Requires PSFramework module for error handling + Validation: Initial parameter validation only; complete validation is done by Test-HawkInvestigationParameter + + .LINK + Test-HawkInvestigationParameter + + .LINK + Start-HawkTenantInvestigation + + .LINK + Start-HawkUserInvestigation + #> + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [hashtable]$PSBoundParameters, + + [AllowNull()] + [Nullable[DateTime]]$StartDate, + + [AllowNull()] + [Nullable[DateTime]]$EndDate, + + [int]$DaysToLookBack + ) + + # Check if user provided both StartDate AND DaysToLookBack + if ($PSBoundParameters.ContainsKey('DaysToLookBack') -and $PSBoundParameters.ContainsKey('StartDate')) { + Stop-PSFFunction -Message "DaysToLookBack cannot be used together with StartDate in non-interactive mode." -EnableException $true + } + + # Must specify either StartDate or DaysToLookBack + if (-not $PSBoundParameters.ContainsKey('DaysToLookBack') -and -not $PSBoundParameters.ContainsKey('StartDate')) { + Stop-PSFFunction -Message "Either StartDate or DaysToLookBack must be specified in non-interactive mode" -EnableException $true + } + + # Process DaysToLookBack if provided + if ($PSBoundParameters.ContainsKey('DaysToLookBack')) { + if ($DaysToLookBack -lt 1 -or $DaysToLookBack -gt 365) { + Stop-PSFFunction -Message "DaysToLookBack must be between 1 and 365" -EnableException $true + } + else { + # Handle EndDate with DaysToLookBack but no StartDate + if ($PSBoundParameters.ContainsKey('EndDate') -and -not $PSBoundParameters.ContainsKey('StartDate')) { + $EndDateUTC = $EndDate.ToUniversalTime() + $StartDateUTC = $EndDateUTC.AddDays(-$DaysToLookBack) + + $StartDate = $StartDateUTC + $EndDate = $EndDateUTC + } + else { + # Convert DaysToLookBack to StartDate/EndDate from "today" + $ConvertedDates = Convert-HawkDaysToDate -DaysToLookBack $DaysToLookBack + $StartDate = $ConvertedDates.StartDate + $EndDate = $ConvertedDates.EndDate + } + } + } + + [PSCustomObject]@{ + StartDate = $StartDate + EndDate = $EndDate + } +} \ No newline at end of file