Phase6-Output¶

Synopsis¶

Phase 6 helpers for AD Permissions Analyzer: streaming detail CSV writer plus the (ACE x effective-trustee) join, RFC-4180 field escaper, the incremental pivot accumulator, and the pivot CSV writer.

Description¶

Implements §11 / §12 from docs/AD-Permissions-Analyzer-Plan.md. The detail CSV is written via a [StreamWriter] with manual escaping rather than Export-Csv — pipeline overhead at a worst-case ~5M rows would dominate runtime. Pivot statistics accumulate per emitted detail row into the supplied -PivotStats dictionary, then Write-PivotCsv consumes the populated dictionary directly with no second pass over $aceRecords.

Phase 6 is the first phase whose hot loop runs once per (ACE x effective trustee) tuple — at the design ceiling that's ~5M iterations. The primitives are intentionally narrow and pure so unit tests can drive them from in-memory fixtures with no IO and no LDAP.

NamingContext label for each row is derived by longest-suffix match of ObjectDN (upper-invariant) against the supplied NC list; the result is memoised per ObjectDN inside Write-DetailCsv so the cost is paid once per distinct object even when an object has hundreds of ACEs.

Inputs¶

None.

Outputs¶

None.