Problem
ConvertTo-SodiumSealedBox uses [Parameter(Mandatory)] for the -Message parameter, which causes PowerShell to reject empty strings ('') in addition to $null. This means users cannot encrypt an empty plaintext value through the public command, even though the underlying C# wrapper SealBase64 only rejects $null and would otherwise handle an empty string correctly.
Reproduction
$keyPair = New-SodiumKeyPair
ConvertTo-SodiumSealedBox -Message '' -PublicKey $keyPair.PublicKey
Actual: Cannot bind argument to parameter 'Message' because it is an empty string.
Expected: The command should return a valid base64-encoded sealed box representing an empty plaintext, consistent with libsodium's crypto_box_seal behavior.
Suggested fix
Add [AllowEmptyString()] to the -Message parameter so empty strings are accepted and passed through to the C# layer.
Related code
src/functions/public/ConvertTo-SodiumSealedBox.ps1PSModule/Sodium/Sodium.cs (SealBase64 method)
Notes
This came up while expanding test coverage. A test for empty-message round-trips was attempted but had to be changed to verify the current rejection behavior instead.
Problem
ConvertTo-SodiumSealedBoxuses[Parameter(Mandatory)]for the-Messageparameter, which causes PowerShell to reject empty strings ('') in addition to$null. This means users cannot encrypt an empty plaintext value through the public command, even though the underlying C# wrapperSealBase64only rejects$nulland would otherwise handle an empty string correctly.Reproduction
Actual:
Cannot bind argument to parameter 'Message' because it is an empty string.Expected: The command should return a valid base64-encoded sealed box representing an empty plaintext, consistent with libsodium's
crypto_box_sealbehavior.Suggested fix
Add
[AllowEmptyString()]to the-Messageparameter so empty strings are accepted and passed through to the C# layer.Related code
src/functions/public/ConvertTo-SodiumSealedBox.ps1PSModule/Sodium/Sodium.cs(SealBase64method)Notes
This came up while expanding test coverage. A test for empty-message round-trips was attempted but had to be changed to verify the current rejection behavior instead.