push

tests/Unit/ExitCodes.Tests.ps1

@@ -145,7 +145,17 @@ Describe 'Exit codes produced by the run loop' {
 Describe 'Target attribute unavailable - dev tenants without an app registration' {
 
     BeforeAll {
-        $script:unavailableError = "Response status code does not indicate success: 400 (Bad Request): Could not find a property named '$($script:target)' on type 'microsoft.graph.user'."
+        # Mirrors what Graph actually sends for a bad $select property: a 400 with
+        # an empty body. Invoke-MgGraphRequest's message then names no property and
+        # carries no digits at all ("BadRequest", not "400") - the status is only
+        # recoverable from the structured Response.StatusCode, never from text. A
+        # fixture that embedded "400" or the property name in the message text would
+        # test a shape Graph does not actually produce.
+        function New-PersonaGraphBadRequestError {
+            $ex = [System.Exception]::new('Response status code does not indicate success: BadRequest (Bad Request).')
+            $ex | Add-Member -MemberType NoteProperty -Name Response -Value ([pscustomobject]@{ StatusCode = 400 }) -Force
+            [System.Management.Automation.ErrorRecord]::new($ex, 'GraphError', [System.Management.Automation.ErrorCategory]::InvalidResult, $null)
+        }
     }
 
     BeforeEach {
@@ -157,7 +167,7 @@ Describe 'Target attribute unavailable - dev tenants without an app registration
     It 'continues in What-If mode, treating the attribute as null, when it is not registered' {
         Mock Get-PersonaUsers {
             param($SelectProperties, $UserObjectId, $PageSize)
-            if ($SelectProperties -ccontains $script:target) { throw $script:unavailableError }
+            if ($SelectProperties -ccontains $script:target) { throw (New-PersonaGraphBadRequestError) }
             @(New-TestPopulation -Count 5 -TargetAttribute $script:target)
         }
 
@@ -173,7 +183,7 @@ Describe 'Target attribute unavailable - dev tenants without an app registration
     It 'requests everything except the target attribute on the retry' {
         Mock Get-PersonaUsers {
             param($SelectProperties, $UserObjectId, $PageSize)
-            if ($SelectProperties -ccontains $script:target) { throw $script:unavailableError }
+            if ($SelectProperties -ccontains $script:target) { throw (New-PersonaGraphBadRequestError) }
             @(New-TestPopulation -Count 5 -TargetAttribute $script:target)
         }
 
@@ -183,8 +193,24 @@ Describe 'Target attribute unavailable - dev tenants without an app registration
         Should -Invoke Get-PersonaUsers -Times 1 -Exactly -ParameterFilter { $SelectProperties -cnotcontains $script:target }
     }
 
+    It 'also recovers for a single-user run (-UserObjectId)' {
+        Mock Get-PersonaUsers {
+            param($SelectProperties, $UserObjectId, $PageSize)
+            if ($SelectProperties -ccontains $script:target) { throw (New-PersonaGraphBadRequestError) }
+            @(New-TestPopulation -Count 1 -TargetAttribute $script:target)
+        }
+
+        $outcome = Invoke-PersonaEngineRun -Configuration (New-TestRuntimeConfiguration -TargetAttribute $script:target) `
+            -TargetAttribute $script:target -Context (New-TestAuditContext) -IsEnforcing:$false `
+            -UserObjectId '00000000-0000-0000-0000-000000000001'
+
+        $outcome.ExitCode | Should -Be 0
+        $outcome.Counters.Processed | Should -Be 1
+        Should -Invoke Get-PersonaUsers -Times 2 -Exactly -ParameterFilter { $UserObjectId -eq '00000000-0000-0000-0000-000000000001' }
+    }
+
     It 'still fails enumeration in enforcement mode - the fallback never applies to a real write run' {
-        Mock Get-PersonaUsers { throw $script:unavailableError }
+        Mock Get-PersonaUsers { throw (New-PersonaGraphBadRequestError) }
 
         $outcome = Invoke-PersonaEngineRun -Configuration (New-TestRuntimeConfiguration -TargetAttribute $script:target) `
             -TargetAttribute $script:target -Context (New-TestAuditContext -Mode 'Enforce') -IsEnforcing