Enable public Azure Files roaming deployment

tests/UserRoaming.Tests.ps1

@@ -77,6 +77,16 @@ Describe 'SGU Azure user-roaming infrastructure' {
 }
 
 Describe 'SGU role-specific roaming policies' {
+    It 'supports an explicitly selected public SMB endpoint while keeping private as the default' {
+        (((Get-Command $configurationPath).Parameters['EndpointAccess'].Attributes |
+            Where-Object { $_ -is [Management.Automation.ValidateSetAttribute] }).ValidValues -join ',') |
+            Should Be 'Private,Public'
+        $source = Get-Content -LiteralPath $configurationPath -Raw
+        $source | Should Match ([regex]::Escape("[string]`$EndpointAccess = 'Private'"))
+        $source | Should Match ([regex]::Escape("`$EndpointAccess -eq 'Private'"))
+        $source | Should Match 'selected \$EndpointAccess endpoint'
+    }
+
     It 'uses an AD computer identity with AES-256 Kerberos' {
         $source = Get-Content -LiteralPath $configurationPath -Raw
         $source | Should Match "DomainAccountType = 'ComputerAccount'"
@@ -90,6 +100,9 @@ Describe 'SGU role-specific roaming policies' {
         $source | Should Match "SecurityIdentifier\]::new\('S-1-3-0'\)"
         $source | Should Match 'PropagationFlags\]::InheritOnly'
         $source | Should Match 'SetAccessRuleProtection\(\$true, \$false\)'
+        $source | Should Match '\$perUserRootRights'
+        $source | Should Match 'CreateDirectories'
+        $source | Should Match 'ContributorRights \$perUserRootRights'
     }
 
     It 'redirects only the student Desktop and Documents folders' {
@@ -118,11 +131,11 @@ Describe 'SGU role-specific roaming policies' {
 
     It 'derives valid deterministic AD names for long storage account names' {
         $name = Get-SguStorageSamAccountName -StorageName 'abcdefghijklmnopqrstuvwx'
-        $name.Length | Should Be 20
-        $name | Should Match '^sgufs[0-9a-f]{15}$'
+        $name.Length | Should Be 15
+        $name | Should Match '^sgufs[0-9a-f]{10}$'
         (Get-SguStorageSamAccountName -StorageName 'abcdefghijklmnopqrstuvwx') | Should Be $name
-        (Get-SguStorageSamAccountName -StorageName 'sguroam1234567890123') |
-            Should Be 'sguroam1234567890123'
+        (Get-SguStorageSamAccountName -StorageName 'sguroam1234567') |
+            Should Be 'sguroam1234567'
     }
 }