Fix PS7 cycle failure and CreateSecret template permissions

- Fix variable shadowing bug in Start-ROCycle: [string]$User parameter
  silently coerced loop variable $user to string in PS7, losing all
  object properties. Renamed loop var to $roUser.
- Fix CreateSecret action: query secret-templates-list for templates
  the user can actually use instead of hardcoding IDs 2/9.
- Remove unnecessary PS 5.1 Security module preload from psm1.
- Bump module version to 0.3.0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jagger

Private/Actions/Invoke-ROCreateSecret.ps1

@@ -6,8 +6,16 @@ function Invoke-ROCreateSecret {
     )
 
     try {
-        # Use Password (2) or Web Password (9) templates
-        $templateId = Get-Random -InputObject @(2, 9)
+        # Query templates the user is actually allowed to create
+        $templates = Invoke-ROApi -Session $Session -Endpoint "secret-templates-list?take=500"
+        if (-not $templates.records -or $templates.records.Count -eq 0) {
+            return [PSCustomObject]@{
+                Action = 'CreateSecret'; TargetType = 'Secret'; TargetId = $null
+                TargetName = $null; Success = $false; ErrorMessage = 'No secret templates available to this user'
+            }
+        }
+        $template = $templates.records | Get-Random
+        $templateId = $template.id
 
         # Get a folder - prefer personal folder for write access
         $folders = Invoke-ROApi -Session $Session -Endpoint "folders?take=50"
@@ -55,7 +63,7 @@ function Invoke-ROCreateSecret {
             Action       = 'CreateSecret'
             TargetType   = 'Secret'
             TargetId     = $result.id
-            TargetName   = "$secretName (template: $($stub.secretTemplateName))"
+            TargetName   = "$secretName (template: $($template.name))"
             Success      = $true
             ErrorMessage = $null
         }

Public/Start-ROCycle.ps1

@@ -57,33 +57,33 @@ function Start-ROCycle {
 
     if ($User) {
         # Single-user mode
-        $simUser = Get-ROUser -Username $User -ShowPassword
-        if (-not $simUser) {
+        $roUser = Get-ROUser -Username $User -ShowPassword
+        if (-not $roUser) {
             throw "User '$User' not found"
         }
-        if (-not $simUser.IsEnabled) {
+        if (-not $roUser.IsEnabled) {
             throw "User '$User' is not enabled"
         }
 
         # Check active hours
-        $isActive = Test-ROActiveHours -ActiveHourStart $simUser.ActiveHourStart -ActiveHourEnd $simUser.ActiveHourEnd
+        $isActive = Test-ROActiveHours -ActiveHourStart $roUser.ActiveHourStart -ActiveHourEnd $roUser.ActiveHourEnd
         if (-not $isActive -and -not $Force) {
-            Write-Warning "User '$User' is outside active hours ($($simUser.ActiveHourStart) - $($simUser.ActiveHourEnd)). Use -Force to override."
+            Write-Warning "User '$User' is outside active hours ($($roUser.ActiveHourStart) - $($roUser.ActiveHourEnd)). Use -Force to override."
             return
         }
         if (-not $isActive -and $Force) {
             Write-ROLog -Message "User '$User' is outside active hours - running anyway (-Force)" -Level WARN -Component 'Cycle'
         }
 
         $allUsers = 1
-        $activeUsers = @($simUser)
+        $activeUsers = @($roUser)
 
         if (-not $PSCmdlet.ShouldProcess("user '$User'", 'Run simulation cycle')) {
             return
         }
 
         try {
-            $result = Invoke-ROUserCycle -User $simUser -BaseUrl $baseUrl -MinActions $minActions -MaxActions $maxActions
+            $result = Invoke-ROUserCycle -User $roUser -BaseUrl $baseUrl -MinActions $minActions -MaxActions $maxActions
             $totalActions += $result.Actions
             $totalErrors += $result.Errors
         }
@@ -123,14 +123,14 @@ VALUES (@Start, @End, @Total, 0, 0, 0)
             return
         }
 
-        foreach ($user in $activeUsers) {
+        foreach ($roUser in $activeUsers) {
             try {
-                $result = Invoke-ROUserCycle -User $user -BaseUrl $baseUrl -MinActions $minActions -MaxActions $maxActions
+                $result = Invoke-ROUserCycle -User $roUser -BaseUrl $baseUrl -MinActions $minActions -MaxActions $maxActions
                 $totalActions += $result.Actions
                 $totalErrors += $result.Errors
             }
             catch {
-                Write-ROLog -Message "User cycle failed for '$($user.Username)': $_" -Level ERROR -Component 'Cycle'
+                Write-ROLog -Message "User cycle failed for '$($roUser.Username)': $_" -Level ERROR -Component 'Cycle'
                 $totalErrors++
             }
         }

RobOtters.psd1

@@ -1,6 +1,6 @@
 @{
     RootModule        = 'RobOtters.psm1'
-    ModuleVersion     = '0.2.0'
+    ModuleVersion     = '0.3.0'
     GUID              = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890'
     Author            = 'jagger'
     Description       = 'Secret Server user activity simulator for lab environments'