Modules/AzureDevOpsDsc.Common/Resources/Functions/Public/AzDoBranchPolicy/Get-AzDoBranchPolicy.ps1

Function Get-AzDoBranchPolicy
{
    [CmdletBinding()]
    [OutputType([System.Management.Automation.PSObject[]])]
    param (
        [Parameter(Mandatory = $true)][string]$ProjectName,
        [Parameter(Mandatory = $true)][string]$RepositoryName,
        [Parameter(Mandatory = $true)][string]$BranchName,
        [Parameter(Mandatory = $true)][string]$PolicyType,
        [Parameter()][bool]$isEnabled = $true,
        [Parameter()][bool]$isBlocking = $true,
        [Parameter()][HashTable]$PolicySettings,
        [Parameter()][HashTable]$LookupResult,
        [Parameter()][Ensure]$Ensure,
        [Parameter()][System.Management.Automation.SwitchParameter]$Force
    )

    Write-Verbose "[Get-AzDoBranchPolicy] Started."

    $result = @{
        Ensure            = [Ensure]::Absent
        propertiesChanged = @()
        status            = $null
    }

    # Cache key: ProjectName\RepositoryName\BranchName\PolicyType
    $cacheKey = '{0}\{1}\{2}\{3}' -f $ProjectName, $RepositoryName, $BranchName, $PolicyType
    $policy = Get-CacheItem -Key $cacheKey -Type 'LiveBranchPolicies'

    if (-not $policy)
    {
        Write-Verbose "[Get-AzDoBranchPolicy] Policy not in cache — falling back to live API lookup."
        $OrgName  = Get-AzDoOrganizationName
        $repoCacheKey    = '{0}\{1}' -f $ProjectName, $RepositoryName
        $repositoryCache = Get-CacheItem -Key $repoCacheKey -Type 'LiveRepositories'
        if (-not $repositoryCache)
        {
            $allRepos        = Invoke-AzDevOpsApiRestMethod -Uri "https://dev.azure.com/$OrgName/$ProjectName/_apis/git/repositories?api-version=7.1-preview.1" -Method Get
            $repositoryCache = $allRepos.value | Where-Object { $_.name -eq $RepositoryName } | Select-Object -First 1
            if ($repositoryCache) { Add-CacheItem -Key $repoCacheKey -Value $repositoryCache -Type 'LiveRepositories' }
        }
        if ($repositoryCache)
        {
            # Live policies carry Azure DevOps' display name (e.g. 'Comment requirements'), not the
            # short code used in config (e.g. 'CommentRequirements') - translate before matching.
            $policyDisplayNameAliases = @{
                'MinimumReviewerCount' = 'Minimum number of reviewers'
                'BuildValidation'      = 'Build'
                'CommentRequirements'  = 'Comment requirements'
                'WorkItemLinking'      = 'Work item linking'
                'MergeStrategy'        = 'Require a merge strategy'
                'StatusCheck'          = 'Status'
            }
            $lookupDisplayName = if ($policyDisplayNameAliases.ContainsKey($PolicyType)) { $policyDisplayNameAliases[$PolicyType] } else { $PolicyType }

            $allPolicies = List-DevOpsBranchPolicies -ApiUri "https://dev.azure.com/$OrgName" -ProjectName $ProjectName -RepositoryId $repositoryCache.id -RefName ('refs/heads/{0}' -f $BranchName.TrimStart('refs/heads/'))
            $policy = $allPolicies | Where-Object { $_.type.displayName -eq $lookupDisplayName } | Select-Object -First 1
            if ($policy) { Add-CacheItem -Key $cacheKey -Value $policy -Type 'LiveBranchPolicies' }
        }
    }

    if ($policy)
    {
        Write-Verbose "[Get-AzDoBranchPolicy] Branch policy found."
        $result.liveCache = $policy

        # Compare key properties
        $changed = @()
        if ($policy.isEnabled  -ne $isEnabled)  { $changed += 'isEnabled' }
        if ($policy.isBlocking -ne $isBlocking) { $changed += 'isBlocking' }

        $result.propertiesChanged = $changed
        $result.status = if ($changed.Count -eq 0) { [DSCGetSummaryState]::Unchanged } else { [DSCGetSummaryState]::Changed }
    }
    else
    {
        Write-Verbose "[Get-AzDoBranchPolicy] Branch policy not found."
        $result.status = [DSCGetSummaryState]::NotFound
    }

    return $result
}