#!/usr/bin/env pwsh
# Integrated, Linux-safe vCenter + Posh-ACME script
# - Uses Accept-Encoding: identity to avoid GZipDecompressedContent disposal bugs
# - Safe Show-Failure that won't try to read disposed streams
# - Option A: vCenter session POST with NO body
# - Defensive file/content reads and clearer logging

. /opt/idssys/nodemgmt/conf/powerwall/settings.ps1

# ----------------------------
# Global variables for troubleshooting
# ----------------------------
$global:helpme = $null
$global:responseBody = $null

# ----------------------------
# Error handler (robust across platforms)
# ----------------------------
function Show-Failure {
    param([System.Management.Automation.ErrorRecord]$ErrorRecord)

    $global:responseBody = "<No response body available>"

    try {
        $ex = $ErrorRecord.Exception

        # If the exception contains an HttpResponseMessage (PowerShell Core)
        if ($ex.Response -is [System.Net.Http.HttpResponseMessage]) {
            $resp = $ex.Response

            if ($resp -and $resp.Content) {
                try {
                    # Safe synchronous read of async task
                    $global:responseBody = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult()
                }
                catch {
                    # If content was disposed or unreadable, capture the message
                    $global:responseBody = "<Failed to read HTTP content: $($_.Exception.Message)>"
                }
            }
            else {
                $global:responseBody = "<HTTP response had no content>"
            }
        }
        # Legacy WebResponse (rare with pwsh, but handle anyway)
        elseif ($ex.Response -is [System.Net.WebResponse]) {
            try {
                $stream = $ex.Response.GetResponseStream()
                if ($stream) {
                    $reader = [System.IO.StreamReader]::new($stream)
                    $global:responseBody = $reader.ReadToEnd()
                }
                else {
                    $global:responseBody = "<WebResponse had no stream>"
                }
            }
            catch {
                $global:responseBody = "<Failed to read WebResponse: $($_.Exception.Message)>"
            }
        }
        else {
            # default to exception message if no response object present
            $global:responseBody = $ex.Message
        }
    }
    catch {
        $global:responseBody = "<Error extracting failure detail: $($_.Exception.Message)>"
    }

    # Save for later inspection
    $global:helpme = $global:responseBody

    Write-Host "----------------------------------------" -ForegroundColor Red
    Write-Host "Status: A system exception was caught." -ForegroundColor Red
    Write-Host $global:responseBody -ForegroundColor Red
    Write-Host "The request/response body has been saved to `$global:helpme" -ForegroundColor Red
    Write-Host "----------------------------------------" -ForegroundColor Red

    # Terminate script (consistent and explicit)
    exit 1
}

# ----------------------------
# Unified REST wrapper (TLS 1.2 + skip cert check + gzip-safe)
# ----------------------------
function Invoke-SafeRestMethod {
    param(
        [Parameter(Mandatory=$true)][string]$Uri,
        [string]$Method = 'Get',
        [hashtable]$Headers,
        $Body,
        [switch]$AsJson,
        [int]$TimeoutSec = 60
    )

    try {
        if (-not $Headers) { $Headers = @{} }

        # Force identity encoding to avoid GZip decompression disposal bugs on pwsh
        if (-not $Headers.ContainsKey('Accept-Encoding')) {
            $Headers['Accept-Encoding'] = 'identity'
        }

        $params = @{
            Uri                  = $Uri
            Method               = $Method
            Headers              = $Headers
            SslProtocol          = 'Tls12'
            SkipCertificateCheck = $true
            ErrorAction          = 'Stop'
            TimeoutSec           = $TimeoutSec
        }

        if ($PSBoundParameters.ContainsKey('Body') -and $Body -ne $null) {
            if ($AsJson) {
                # Convert to JSON with reasonable depth for certificates etc.
                $params.Body        = $Body | ConvertTo-Json -Depth 12 -Compress
                $params.ContentType = 'application/json'
            }
            else {
                $params.Body = $Body
            }
        }

        return Invoke-RestMethod @params
    }
    catch {
        # Provide the full ErrorRecord to Show-Failure
        Show-Failure -ErrorRecord $_
    }
}

# ----------------------------
# Variables (pulled from settings.ps1)
# ----------------------------
$vCenterURL   = $VCENTERHOST
$CommonName   = $VCENTERHOST
$EmailContact = $ACMEEMAIL

[PSCredential]$Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $VCENTERUSER, (ConvertTo-SecureString $VCENTERPASS -AsPlainText -Force)

$pArgs = @{
    PowerDNSApiHost     = $WDNSHOST
    PowerDNSApiKey      = $PDNSAPI    # keep as plain string for plugin
    PowerDNSUseTLS      = $true
    PowerDNSPort        = 443
    PowerDNSServerName  = 'localhost'
}

# ----------------------------
# Ensure Posh-ACME Module (install if missing, then import)
# ----------------------------
Write-Host "Checking for Required Module Posh-ACME" -ForegroundColor Green

if (Get-Module -ListAvailable -Name Posh-ACME) {
    Write-Host "Posh-ACME Module Already Installed" -ForegroundColor Green
} else {
    Write-Host "Posh-ACME Module Not Found, Installing..." -ForegroundColor Yellow
    Install-Module -Name Posh-ACME -Force -Confirm:$false -Scope AllUsers
    Write-Host "Posh-ACME installed. Continuing..." -ForegroundColor Green
}

# Try to import module (loop until available)
$importAttempts = 0
do {
    try {
        Import-Module Posh-ACME -ErrorAction Stop
    }
    catch {
        $importAttempts++
        if ($importAttempts -ge 6) {
            Write-Host "Unable to import Posh-ACME after multiple attempts." -ForegroundColor Red
            Show-Failure -ErrorRecord $_
        }
        Write-Host "Waiting for Posh-ACME module to become available..." -ForegroundColor Cyan
        Start-Sleep -Seconds 5
    }
} while (-not (Get-Module -Name Posh-ACME))

Write-Host "Posh-ACME module loaded." -ForegroundColor Green

# ----------------------------
# vCenter API Session (Option A: POST with NO body)
# ----------------------------
$loginUri = "https://$vCenterURL/rest/com/vmware/cis/session"

Write-Host "Connecting to vCenter at $vCenterURL ..." -ForegroundColor Cyan
$sessionResponse = Invoke-SafeRestMethod -Uri $loginUri -Method Post -Headers @{}
if (-not $sessionResponse) {
    Write-Error "Unable to get Session Token, Terminating Script"
    exit 1
}

$sessionToken = $sessionResponse.value
if (-not $sessionToken) {
    Write-Error "Unable to get Session Token value, Terminating Script"
    exit 1
}
Write-Host "Connected to vCenter API. Session established." -ForegroundColor Green

# ----------------------------
# Example: Retrieve VMs
# ----------------------------
$headers = @{ 'vmware-api-session-id' = $sessionToken }
$vmList  = Invoke-SafeRestMethod -Uri "https://$vCenterURL/rest/vcenter/vm" -Headers $headers
if ($vmList -and $vmList.value) {
    Write-Host "Retrieved VM list from vCenter:" -ForegroundColor Cyan
    $vmList.value | ForEach-Object { Write-Host " - $($_.name)" }
} else {
    Write-Host "No VMs returned or unable to retrieve VM list." -ForegroundColor Yellow
}

# ----------------------------
# PowerDNS Integration (via Posh-ACME plugin args)
# ----------------------------
Write-Host "Configuring PowerDNS plugin args for Posh-ACME" -ForegroundColor Green
$pArgs = @{
    PowerDNSApiHost     = $WDNSHOST
    PowerDNSApiKey      = $PDNSAPI
    PowerDNSUseTLS      = $true
    PowerDNSPort        = 443
    PowerDNSServerName  = 'localhost'
}

# ----------------------------
# Example ACME order with DNS plugin
# ----------------------------
$certName = "vcenter-cert"
Write-Host "Requesting certificate for $CommonName using PowerDNS plugin..." -ForegroundColor Cyan

# Wrap in try/catch to present friendly errors
try {
    New-PACertificate -Domain $CommonName -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $EmailContact -AcceptTOS -Verbose -Force
    Write-Host "ACME certificate request completed (or is present)." -ForegroundColor Green
}
catch {
    Show-Failure -ErrorRecord $_
}

# ----------------------------
# Collect certificate paths from current Posh-ACME account
# ----------------------------
try {
    $paAccount = Get-PAAccount
    if (-not $paAccount) {
        throw "Get-PAAccount returned no account information."
    }

    $certFolder = $paAccount.CertFolder
    $certPath  = Join-Path -Path $certFolder -ChildPath "$certName\cert.pem"
    $keyPath   = Join-Path -Path $certFolder -ChildPath "$certName\privkey.pem"
    $chainPath = Join-Path -Path $certFolder -ChildPath "$certName\chain.pem"

    foreach ($f in @($certPath, $keyPath, $chainPath)) {
        if (-not (Test-Path $f)) {
            throw "Required certificate file not found: $f"
        }
    }
}
catch {
    Show-Failure -ErrorRecord $_
}

# ----------------------------
# Push certificate back to vCenter (REST API expects JSON)
# ----------------------------
Write-Host "Uploading certificate to vCenter..." -ForegroundColor Cyan
try {
    $uploadUri = "https://$vCenterURL/rest/vcenter/certificate-management/vcenter/tls"
    $headers   = @{ 'vmware-api-session-id' = $sessionToken }

    $body = @{
        cert  = (Get-Content -Path $certPath -Raw)
        key   = (Get-Content -Path $keyPath -Raw)
        chain = (Get-Content -Path $chainPath -Raw)
    }

    Invoke-SafeRestMethod -Uri $uploadUri -Method Post -Headers $headers -Body $body -AsJson
    Write-Host "New TLS certificate uploaded to vCenter" -ForegroundColor Green
}
catch {
    Show-Failure -ErrorRecord $_
}

# ----------------------------
# Apply certificate to vCenter
# ----------------------------
try {
    Write-Host "Applying new TLS certificate to vCenter..." -ForegroundColor Cyan
    $applyUri = "https://$vCenterURL/rest/vcenter/certificate-management/vcenter/tls?action=apply"
    $headers  = @{ 'vmware-api-session-id' = $sessionToken }

    Invoke-SafeRestMethod -Uri $applyUri -Method Post -Headers $headers
    Write-Host "New TLS certificate applied to vCenter (action requested)." -ForegroundColor Green
}
catch {
    Show-Failure -ErrorRecord $_
}

# ----------------------------
# Restart vCenter Services (optional)
# ----------------------------
try {
    Write-Host "Restarting vCenter service (vpxd)..." -ForegroundColor Yellow
    $restartUri = "https://$vCenterURL/rest/appliance/system/services/vpxd?action=restart"
    $headers    = @{ 'vmware-api-session-id' = $sessionToken }

    Invoke-SafeRestMethod -Uri $restartUri -Method Post -Headers $headers
    Write-Host "vCenter service restart initiated (vpxd)." -ForegroundColor Yellow
    Write-Host "Note: UI/API may briefly be unavailable while services restart." -ForegroundColor Yellow
}
catch {
    Show-Failure -ErrorRecord $_
}

Write-Host "Script completed." -ForegroundColor Green