Boolean Operator Issues in Policy Checks: Potential for Incorrect Results

[PTMohr]

Adding to #558, further investigation has revealed that there are likely more instances of problematic boolean operators in the policy checks across various tests. Although no resulting bugs have been identified yet, it is recommended to prefer the -contains or -notcontains operator in most cases to ensure accurate results.

A specific example can be found in the Test-MtCaEnforceSignInFrequency.ps1 script, where the line at https://github.com/maester365/maester/blob/d702367e73e38d94254bb6d2c84386fef8df75a2/powershell/public/Test-MtCaEnforceSignInFrequency.ps1#L63C22-L63C69 attempts to check if the string "All" is included in the collection. However, this implementation returns an empty collection (and thus $false) when "All" is not included, and a collection containing "All" (and thus $true) when it is included. While the test still passes in this case, the code is not ideal and may lead to issues in the future.

Additional Information:

• The -ne operator filters out the right-hand side of the comparison and returns the remaining elements in the collection.
• The -eq operator returns only the elements that match the right-hand side of the comparison.
• When the collection is empty, both operators return an empty collection, which is always considered $false.
• By using the -contains or -notcontains operator instead, we can ensure that the check always returns a boolean value, correctly handling cases where the includeUsers collection is empty.

[merill]

This is a valid concern.

I'm thinking we should include this guidance in https://maester.dev/docs/contributing#checklist-for-writing-good-tests and call out favouring the use of -contains and -notcontains when there is a chance the item can be a collection.

Would you like to submit a PR for the doc?

PS: Will move to discussion since it's not an open issue.