# 安装 SqlServer 模块（如尚未安装）
Install-Module SqlServer -Force -Scope CurrentUser

# 连接到本地默认实例（使用 Windows 集成身份验证）
$instance = Connect-SqlInstance -ServerInstance "localhost"

# 输出实例基本信息
[PSCustomObject]@{
    InstanceName   = $instance.Name
    Version        = $instance.VersionString
    Edition        = $instance.Edition
    ProductLevel   = $instance.ProductLevel
    Platform       = $instance.Platform
    HostName       = $instance.NetName
    Collation      = $instance.Collation
    LoginMode      = $instance.LoginMode
    IsClustered    = $instance.IsClustered
}

# 连接实例
$instance = Connect-SqlInstance -ServerInstance "localhost"

# 遍历所有用户数据库，收集状态和空间信息
$dbStats = foreach ($db in $instance.Databases) {
    # 跳过系统数据库（可选）
    if ($db.IsSystemObject) { continue }

    [PSCustomObject]@{
        DatabaseName    = $db.Name
        Status          = $db.Status
        RecoveryModel   = $db.RecoveryModel
        SizeMB          = [math]::Round($db.Size, 2)
        DataSpaceMB     = [math]::Round(
            ($db.FileGroups | ForEach-Object { $_.Files } |
                Measure-Object -Property Size -Sum).Sum / 1024, 2
        )
        LogSpaceMB      = [math]::Round(
            ($db.LogFiles | Measure-Object -Property Size -Sum).Sum / 1024, 2
        )
        LastBackupDate  = $db.LastBackupDate
        CreateDate      = $db.CreateDate
    }
}

# 按大小降序排列并输出
$dbStats | Sort-Object SizeMB -Descending | Format-Table -AutoSize

# 查询当前实例中活跃会话和阻塞情况
$query = @"
SELECT
    session_id,
    DB_NAME(database_id) AS DatabaseName,
    status,
    wait_type,
    wait_time_ms,
    blocking_session_id,
    cpu_time,
    reads,
    writes,
    logical_reads,
    start_time
FROM sys.dm_exec_requests
WHERE session_id > 50
ORDER BY start_time
"@

$results = Invoke-Sqlcmd -ServerInstance "localhost" -Query $query

# 筛选被阻塞的会话
$blocked = $results | Where-Object { $_.blocking_session_id -ne 0 }

if ($blocked) {
    Write-Host "检测到阻塞会话:" -ForegroundColor Yellow
    foreach ($row in $blocked) {
        [PSCustomObject]@{
            SessionId    = $row.session_id
            Database     = $row.DatabaseName
            Status       = $row.status
            WaitType     = $row.wait_type
            WaitTimeMs   = $row.wait_time_ms
            BlockedBy    = $row.blocking_session_id
            StartTime    = $row.start_time
        }
    }
} else {
    Write-Host "当前无阻塞会话" -ForegroundColor Green
}

# 连接实例并定义备份阈值（小时）
$instance = Connect-SqlInstance -ServerInstance "localhost"
$thresholdHours = 24
$cutoffTime = (Get-Date).AddHours(-$thresholdHours)

# 检查备份状态
$backupReport = foreach ($db in $instance.Databases) {
    if ($db.IsSystemObject) { continue }

    $lastFull    = $db.LastBackupDate
    $lastDiff    = $db.LastDifferentialBackupDate
    $lastLog     = $db.LastLogBackupDate
    $recoveryModel = $db.RecoveryModel.ToString()

    $riskLevel = "正常"
    if ($lastFull -eq [datetime]::MinValue) {
        $riskLevel = "高风险"
    } elseif ($lastFull -lt $cutoffTime) {
        $riskLevel = "警告"
    }

    [PSCustomObject]@{
        Database        = $db.Name
        RiskLevel       = $riskLevel
        RecoveryModel   = $recoveryModel
        LastFullBackup  = if ($lastFull -eq [datetime]::MinValue) { "从未备份" } else { $lastFull }
        LastDiffBackup  = if ($lastDiff -eq [datetime]::MinValue) { "无" } else { $lastDiff }
        LastLogBackup   = if ($lastLog -eq [datetime]::MinValue) { "无" } else { $lastLog }
    }
}

# 按风险等级排序输出
$backupReport | Sort-Object RiskLevel | Format-Table -AutoSize

# 连接 Azure 账户（如已登录可跳过）
Connect-AzAccount

# 搜索与"标签"相关的内置策略定义
$tagPolicies = Get-AzPolicyDefinition | Where-Object {
    $_.Properties.DisplayName -match "tag" -and
    $_.Properties.PolicyType -eq "BuiltIn"
}

# 输出策略名称和显示名
foreach ($policy in $tagPolicies) {
    [PSCustomObject]@{
        Name        = $policy.Name
        DisplayName = $policy.Properties.DisplayName
        Category    = $policy.Properties.Metadata.category
    }
}

# 获取目标资源组信息
$rg = Get-AzResourceGroup -Name "prod-app-rg"

# 获取内置策略定义（要求资源必须带有指定标签）
$policyDef = Get-AzPolicyDefinition | Where-Object {
    $_.Properties.DisplayName -eq "Require a tag on resources"
} | Select-Object -First 1

# 构造策略参数：指定必须存在的标签名为 "Environment"
$policyParam = @{
    tagName = "Environment"
}

# 分配策略到资源组
$assignment = New-AzPolicyAssignment `
    -Name "require-env-tag" `
    -DisplayName "要求所有资源带有 Environment 标签" `
    -PolicyDefinition $policyDef `
    -Scope $rg.ResourceId `
    -PolicyParameterObject $policyParam

Write-Host "策略已分配，AssignmentId: $($assignment.PolicyAssignmentId)"

# 获取当前订阅 ID
$subscriptionId = (Get-AzContext).Subscription.Id

# 查询最近一次策略评估的合规状态
$complianceStates = Get-AzPolicyState | Where-Object {
    $_.ComplianceState -eq "NonCompliant"
}

# 按策略分配分组统计不合规资源数量
$summary = @{}
foreach ($state in $complianceStates) {
    $key = $state.PolicyAssignmentName
    if (-not $summary.ContainsKey($key)) {
        $summary[$key] = 0
    }
    $summary[$key]++
}

foreach ($item in $summary.GetEnumerator() | Sort-Object Value -Descending) {
    [PSCustomObject]@{
        PolicyAssignment = $item.Key
        NonCompliantCount = $item.Value
    }
}

# 定义输出路径
$reportDate = Get-Date -Format "yyyyMMdd"
$csvPath = "$HOME/AzurePolicyReport_$reportDate.csv"

# 获取所有不合规状态记录
$nonCompliant = Get-AzPolicyState | Where-Object {
    $_.ComplianceState -eq "NonCompliant"
}

# 构造报告对象
$reportRows = foreach ($record in $nonCompliant) {
    [PSCustomObject]@{
        Timestamp          = $record.Timestamp
        ResourceId         = $record.ResourceId
        ResourceType       = $record.ResourceType
        ResourceGroup      = $record.ResourceGroup
        PolicyAssignment   = $record.PolicyAssignmentName
        PolicyDefinition   = $record.PolicyDefinitionName
        ComplianceState    = $record.ComplianceState
    }
}

# 导出为 CSV
$reportRows | Export-Csv -Path $csvPath -NoTypeInformation -Encoding UTF8

Write-Host "合规报告已导出: $csvPath"
Write-Host "共 $($reportRows.Count) 条不合规记录"

# 创建模块目录结构
$modulePath = Join-Path -Path $env:USERPROFILE -ChildPath "Documents\PowerShell\Modules\MyUtils"
if (-not (Test-Path -Path $modulePath)) {
    New-Item -Path $modulePath -ItemType Directory -Force | Out-Null
    Write-Host "已创建模块目录: $modulePath"
}

# 创建模块清单
$manifestParams = @{
    Path               = Join-Path -Path $modulePath -ChildPath "MyUtils.psd1"
    RootModule         = "MyUtils.psm1"
    ModuleVersion      = "1.0.0"
    Author             = "Your Name"
    CompanyName        = "Your Company"
    Description        = "A collection of utility functions for daily PowerShell tasks"
    PowerShellVersion  = "5.1"
    FunctionsToExport  = @("Get-SystemReport", "Invoke-HealthCheck")
    CmdletsToExport    = @()
    VariablesToExport  = @()
    AliasesToExport    = @()
    Tags               = @("Utility", "Automation", "Monitoring")
    ProjectUri         = "https://github.com/yourname/MyUtils"
    LicenseUri         = "https://github.com/yourname/MyUtils/blob/main/LICENSE"
    ReleaseNotes       = "Initial release with system report and health check functions."
}

New-ModuleManifest @manifestParams
Write-Host "模块清单已创建"

# 检查是否已配置 API Key 环境变量
if ($env:PSGALLERY_API_KEY) {
    Write-Host "API Key 已配置，长度: $($env:PSGALLERY_API_KEY.Length) 个字符"
}
else {
    Write-Host "尚未配置 PSGALLERY_API_KEY 环境变量"
    Write-Host "请按以下步骤操作："
    Write-Host "  1. 访问 https://www.powershellgallery.com/users/account/LogOn"
    Write-Host "  2. 登录后进入 API Keys 页面"
    Write-Host "  3. 点击 Create 生成新的 API Key"
    Write-Host "  4. 将 Key 保存为环境变量:"
    Write-Host '     [Environment]::SetEnvironmentVariable("PSGALLERY_API_KEY", "your-key-here", "User")'
}

# 永久保存 API Key 到用户级环境变量（只需执行一次）
# [Environment]::SetEnvironmentVariable("PSGALLERY_API_KEY", "your-api-key", "User")

# 发布前的预检查
$modulePath = Join-Path -Path $env:USERPROFILE -ChildPath "Documents\PowerShell\Modules\MyUtils"

# 验证清单文件
$manifest = Test-ModuleManifest -Path (Join-Path -Path $modulePath -ChildPath "MyUtils.psd1")
if ($manifest) {
    Write-Host "模块名称: $($manifest.Name)"
    Write-Host "版本号: $($manifest.Version)"
    Write-Host "导出函数: $($manifest.ExportedFunctions.Keys -join ', ')"
}

# 发布模块
$publishParams = @{
    Path        = $modulePath
    NuGetApiKey = $env:PSGALLERY_API_KEY
    Repository  = "PSGallery"
    Verbose     = $true
}

Publish-Module @publishParams
Write-Host "模块已成功发布到 PowerShell Gallery！"

# 通过命令行验证模块是否已上线
$published = Find-Module -Name "MyUtils" -Repository PSGallery

if ($published) {
    Write-Host "模块已上线！"
    Write-Host "  名称: $($published.Name)"
    Write-Host "  版本: $($published.Version)"
    Write-Host "  描述: $($published.Description)"
    Write-Host "  作者: $($published.Author)"
    Write-Host "  下载量: $($published.AdditionalMetadata['versionDownloadCount'])"
    Write-Host "  页面: https://www.powershellgallery.com/packages/$($published.Name)/$($published.Version)"
}
else {
    Write-Host "警告: 未在 Gallery 中找到模块，可能需要等待几分钟"
}

# 更新模块版本号和发布说明
$modulePath = Join-Path -Path $env:USERPROFILE -ChildPath "Documents\PowerShell\Modules\MyUtils"
$manifestPath = Join-Path -Path $modulePath -ChildPath "MyUtils.psd1"

# 读取当前版本并递增修订号
$currentManifest = Test-ModuleManifest -Path $manifestPath
$currentVersion = $currentManifest.Version
$newVersion = [version]::new(
    $currentVersion.Major,
    $currentVersion.Minor,
    $currentVersion.Build + 1
)

Write-Host "当前版本: $currentVersion → 新版本: $newVersion"

# 更新清单中的版本号和发布说明
$updateData = @{
    ModuleVersion = $newVersion.ToString()
    ReleaseNotes  = "Fixed edge case in Get-SystemReport when WMI service is stopped."
}
Update-ModuleManifest -Path $manifestPath @updateData

# 重新发布
Publish-Module -Path $modulePath -NuGetApiKey $env:PSGALLERY_API_KEY -Repository PSGallery
Write-Host "新版本 $newVersion 已发布"

# 适用于 CI/CD 管道的发布脚本
# 从 git tag 中提取版本号，确保版本号与代码提交严格对应
$gitTag = git describe --tags --abbrev=0 2>$null
if (-not $gitTag) {
    Write-Error "未找到 git tag，请先创建版本标签"
    return
}

# 从 tag 名称中解析版本号（例如 v1.2.3 → 1.2.3）
$versionStr = $gitTag -replace '^v', ""
$newVersion = [version]$versionStr

Write-Host "准备发布版本: $newVersion (from tag: $gitTag)"

# 更新清单
$manifestPath = "./src/MyUtils/MyUtils.psd1"
$releaseNotes = git log --pretty=format:"- %s" ("$($gitTag)~1"..HEAD) 2>$null
if (-not $releaseNotes) {
    $releaseNotes = "Release $newVersion"
}

Update-ModuleManifest -Path $manifestPath -ModuleVersion $newVersion.ToString() -ReleaseNotes $releaseNotes

# 验证清单完整性
$requiredFields = @("Description", "Author", "Tags", "ProjectUri", "LicenseUri")
$manifest = Test-ModuleManifest -Path $manifestPath
$warnings = @()
foreach ($field in $requiredFields) {
    $value = $manifest.$field
    if (-not $value) {
        $warnings += "缺少必填字段: $field"
    }
}

if ($warnings.Count -gt 0) {
    Write-Host "发布前检查警告:"
    foreach ($w in $warnings) {
        Write-Host "  [WARN] $w"
    }
}

# 发布
Publish-Module -Path "./src/MyUtils" -NuGetApiKey $env:PSGALLERY_API_KEY -Repository PSGallery
Write-Host "CI/CD 发布完成: v$newVersion"

# 安装 Az 监控相关模块
Install-Module -Name Az.Accounts, Az.Monitor, Az.Resources -Force -Scope CurrentUser

# 连接 Azure 账户
Connect-AzAccount

# 获取当前订阅信息
$context = Get-AzContext
$subscriptionId = $context.Subscription.Id
Write-Host ("当前订阅: {0} ({1})" -f $context.Subscription.Name, $subscriptionId)

# 查询目标资源组中的虚拟机
$resourceGroupName = "rg-production"
$vms = Get-AzVM -ResourceGroupName $resourceGroupName

Write-Host "`n===== 资源组中的虚拟机 =====" -ForegroundColor Cyan
foreach ($vm in $vms) {
    $status = (Get-AzVM -ResourceGroupName $resourceGroupName -Name $vm.Name -Status).Statuses[1].DisplayStatus
    Write-Host ("  {0,-30} {1}" -f $vm.Name, $status)
}

# 选取第一台虚拟机的资源 ID 作为后续示例
$targetResourceId = $vms[0].Id
Write-Host ("`n目标资源 ID: {0}" -f $targetResourceId)

# 定义告警规则参数
$alertRuleName = "cpu-high-vm-web-01"
$alertDescription = "虚拟机 CPU 使用率连续 5 分钟超过 85%，可能影响应用性能"
$windowSize = "PT5M"
$evaluationFrequency = "PT1M"
$threshold = 85
$operator = "GreaterThan"
$aggregation = "Average"
$severity = 2

# 获取目标虚拟机的资源 ID
$targetVm = Get-AzVM -ResourceGroupName $resourceGroupName -Name "vm-web-01"

# 创建告警条件
$condition = New-AzMetricAlertRuleV2Criteria `
    -MetricName "Percentage CPU" `
    -TimeAggregation $aggregation `
    -Operator $operator `
    -Threshold $threshold

# 创建告警规则
$alertRule = New-AzMetricAlertRuleV2 `
    -Name $alertRuleName `
    -ResourceGroupName $resourceGroupName `
    -WindowSize $windowSize `
    -Frequency $evaluationFrequency `
    -TargetResourceId $targetVm.Id `
    -Condition $condition `
    -Severity $severity `
    -Description $alertDescription `
    -Enabled

if ($alertRule) {
    Write-Host "指标告警规则创建成功!" -ForegroundColor Green
    Write-Host ("  规则名称: {0}" -f $alertRule.Name)
    Write-Host ("  目标资源: {0}" -f $targetVm.Name)
    Write-Host ("  监控指标: Percentage CPU")
    Write-Host ("  聚合方式: {0}" -f $aggregation)
    Write-Host ("  阈值: {0} {1}" -f $operator, $threshold)
    Write-Host ("  检测窗口: {0}" -f $windowSize)
    Write-Host ("  评估频率: {0}" -f $evaluationFrequency)
    Write-Host ("  严重级别: Sev{0}" -f $severity)
}

# 创建邮件接收人
$emailReceiver = New-AzActionGroupReceiver `
    -Name "ops-team-email" `
    -EmailAddress "ops-team@example.com"

# 创建 Webhook 接收（可对接企业 IM、事件管理平台）
$webhookReceiver = New-AzActionGroupReceiver `
    -Name "incident-webhook" `
    -WebhookUri "https://hooks.example.com/azure-alerts/incident"

# 创建操作组
$actionGroupName = "ag-production-critical"
$actionGroupShortName = "prod-crit"

$actionGroup = Set-AzActionGroup `
    -Name $actionGroupName `
    -ResourceGroupName $resourceGroupName `
    -ShortName $actionGroupShortName `
    -Receiver $emailReceiver, $webhookReceiver

if ($actionGroup) {
    Write-Host "操作组创建成功!" -ForegroundColor Green
    Write-Host ("  操作组名称: {0}" -f $actionGroup.Name)
    Write-Host ("  短名称: {0}" -f $actionGroup.ShortName)
    Write-Host ("  接收人数量: {0}" -f $actionGroup.Receivers.Count)
    Write-Host "`n  接收人详情:" -ForegroundColor Cyan
    foreach ($receiver in $actionGroup.Receivers) {
        Write-Host ("    - {0}: {1}" -f $receiver.Name, $receiver.EmailAddress)
    }
}

# 将操作组关联到告警规则
$actionGroupId = (Get-AzActionGroup -ResourceGroupName $resourceGroupName -Name $actionGroupName).Id

# 创建动作引用
$action = New-AzAlertRuleAction -ActionGroupId $actionGroupId

Write-Host "`n操作组已就绪，可关联到告警规则。" -ForegroundColor Green
Write-Host ("  Action Group ID: {0}" -f $actionGroupId)

# 查询资源组中所有指标告警规则
$alertRules = Get-AzMetricAlertRuleV2 -ResourceGroupName $resourceGroupName

Write-Host "===== 告警规则清单 =====" -ForegroundColor Cyan
Write-Host ("资源组: {0}" -f $resourceGroupName)
Write-Host ("规则总数: {0}" -f $alertRules.Count)
Write-Host ""

# 构建告警规则报告
$reportData = foreach ($rule in $alertRules) {
    $targetResources = @()
    foreach ($scope in $rule.Scopes) {
        $parts = $scope -split "/"
        $resourceName = $parts[-1]
        $targetResources += $resourceName
    }

    $criteria = $rule.Criteria
    $metricName = if ($criteria.AllOf) { $criteria.AllOf[0].MetricName } else { "N/A" }
    $thresholdValue = if ($criteria.AllOf) { $criteria.AllOf[0].Threshold } else { "N/A" }
    $operatorValue = if ($criteria.AllOf) { $criteria.AllOf[0].OperatorProperty } else { "N/A" }

    [PSCustomObject]@{
        规则名称   = $rule.Name
        严重级别   = "Sev{0}" -f $rule.Severity
        启用状态   = if ($rule.Enabled) { "已启用" } else { "已禁用" }
        监控指标   = $metricName
        阈值条件   = "{0} {1}" -f $operatorValue, $thresholdValue
        检测窗口   = $rule.WindowSize
        目标资源   = ($targetResources -join ", ")
        操作组     = if ($rule.Actions.Count -gt 0) { "已配置 ({0} 个)" -f $rule.Actions.Count } else { "未配置" }
    }
}

# 按严重级别排序并输出
$sortedReport = $reportData | Sort-Object 严重级别, 规则名称

foreach ($item in $sortedReport) {
    Write-Host "---" -ForegroundColor Gray
    Write-Host ("  规则名称: {0}" -f $item.规则名称)
    Write-Host ("  严重级别: {0}" -f $item.严重级别)
    Write-Host ("  启用状态: {0}" -f $item.启用状态)
    Write-Host ("  监控指标: {0}" -f $item.监控指标)
    Write-Host ("  阈值条件: {0}" -f $item.阈值条件)
    Write-Host ("  检测窗口: {0}" -f $item.检测窗口)
    Write-Host ("  目标资源: {0}" -f $item.目标资源)
    Write-Host ("  操作组:   {0}" -f $item.操作组)
}

# 导出 CSV 报告
$reportPath = Join-Path $env:TEMP "AlertRules-Report-{0:yyyyMMdd}.csv" -f (Get-Date)
$sortedReport | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
Write-Host ("`n报告已导出: {0}" -f $reportPath) -ForegroundColor Green

# 检查未配置操作组的规则
$noActionRules = $reportData | Where-Object { $_.操作组 -eq "未配置" }
if ($noActionRules) {
    Write-Host "`n[警告] 以下告警规则未配置操作组，触发后不会发送通知:" -ForegroundColor Yellow
    foreach ($rule in $noActionRules) {
        Write-Host ("  - {0}" -f $rule.规则名称) -ForegroundColor Yellow
    }
}

# 定义日志告警参数
$logAlertName = "anomalous-signin-detection"
$logAlertDescription = "检测 1 小时内同一账户从不同地区登录的行为，可能表示凭据泄露"
$workspaceResourceId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.OperationalInsights/workspaces/law-production"

# 构建 KQL 查询
$kqlQuery = @"
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType == 0
| summarize LoginCount = count(), DistinctLocations = dcount(Location),
    Locations = make_set(Location, 10) by UserPrincipalName
| where DistinctLocations > 2
| project TimeGenerated = now(), UserPrincipalName, LoginCount, DistinctLocations, Locations
| order by DistinctLocations desc
"@

# 创建日志查询告警的条件
$schedule = New-AzScheduledQueryRuleScheduleObject `
    -FrequencyInMinutes 15 `
    -TimeWindowInMinutes 60

$conditionObject = New-AzScheduledQueryRuleConditionObject `
    -Query $kqlQuery `
    -TimeWindow (New-TimeSpan -Minutes 60)

# 创建日志告警规则
$logAlert = New-AzScheduledQueryRule `
    -Name $logAlertName `
    -ResourceGroupName $resourceGroupName `
    -Location "eastus" `
    -DisplayName "异常登录行为检测" `
    -Description $logAlertDescription `
    -Severity 2 `
    -Enabled `
    -Schedule $schedule `
    -Condition $conditionObject `
    -Scope $workspaceResourceId

if ($logAlert) {
    Write-Host "日志查询告警规则创建成功!" -ForegroundColor Green
    Write-Host ("  规则名称: {0}" -f $logAlert.Name)
    Write-Host ("  显示名称: {0}" -f $logAlert.DisplayName)
    Write-Host ("  严重级别: Sev{0}" -f $logAlert.Severity)
    Write-Host ("  查询频率: 每 {0} 分钟" -f $schedule.FrequencyInMinutes)
    Write-Host ("  查询窗口: {0} 分钟" -f $schedule.TimeWindowInMinutes)
    Write-Host ("  目标工作区: {0}" -f ($workspaceResourceId -split "/")[-1])
}

# 方式一：交互式输入（推荐，最安全）
$securePwd = Read-Host -Prompt "请输入密码" -AsSecureString

# 方式二：从明文转换（仅用于测试或临时场景）
$plainText = "MySecretPass123!"
$securePwd = $plainText | ConvertTo-SecureString -AsPlainText -Force

# 方式三：从已加密的字符串还原（适合自动化）
$encryptedString = Get-Content -Path "C:\Vault\pwd.enc.txt" -Raw
$securePwd = $encryptedString | ConvertTo-SecureString

# 将密码安全地保存到文件
$cred = Get-Credential -Message "输入需要持久化的凭据"
$cred.Password | ConvertFrom-SecureString | Set-Content -Path "C:\Vault\encrypted_pwd.txt"

Write-Host "密码已加密保存到 C:\Vault\encrypted_pwd.txt"

# 生成 32 字节（256 位）的随机密钥
$key = New-Object byte[] 32
$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
$rng.GetBytes($key)

# 使用自定义密钥加密并保存
$plainText = "SuperSecretAPIKey2025!"
$securePwd = $plainText | ConvertTo-SecureString -AsPlainText -Force
$encrypted = $securePwd | ConvertFrom-SecureString -Key $key
$encrypted | Set-Content -Path "C:\Vault\api_key.enc.txt"

# 将密钥安全保存（实际场景中应使用密钥管理服务）
$key | Set-Content -Path "C:\Vault\aes_key.bin" -Encoding Byte

Write-Host "已使用 AES-256 密钥加密并保存"

# 在另一台机器上还原
$key = Get-Content -Path "C:\Vault\aes_key.bin" -Encoding Byte -ReadCount 0
$encrypted = Get-Content -Path "C:\Vault\api_key.enc.txt" -Raw
$securePwd = $encrypted | ConvertTo-SecureString -Key $key

# 还原为明文（仅用于需要明文的 API 调用场景）
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($securePwd)
$plainText = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

Write-Host "还原后的 API 密钥: $($plainText.Substring(0,8))..."

# 从持久化的加密文件构建凭据对象
$username = "DOMAIN\ServiceAccount"
$encryptedPwd = Get-Content -Path "C:\Vault\encrypted_pwd.txt" -Raw
$securePwd = $encryptedPwd | ConvertTo-SecureString

$credential = New-Object System.Management.Automation.PSCredential($username, $securePwd)

# 展示凭据信息
Write-Host "用户名: $($credential.UserName)"
Write-Host "密码长度: $($credential.GetNetworkCredential().Password.Length) 个字符"
Write-Host "是否已加密: $($credential.Password.IsReadOnly())"

# 使用凭据远程执行命令
$session = New-PSSession -ComputerName "SRV01" -Credential $credential
$result = Invoke-Command -Session $session -ScriptBlock {
    Get-Process | Sort-Object -Property WorkingSet64 -Descending | Select-Object -First 5
}
Remove-PSSession -Session $session

# 输出远程进程信息
foreach ($proc in $result) {
    Write-Host "$($proc.Name) - $([math]::Round($proc.WorkingSet64 / 1MB, 2)) MB"
}

# 定义服务凭据清单
$services = @(
    @{ Name = "DatabaseServer"; User = "sa"; EncryptedFile = "C:\Vault\db_pwd.txt" }
    @{ Name = "FileShare"; User = "fileadmin"; EncryptedFile = "C:\Vault\fs_pwd.txt" }
    @{ Name = "BackupService"; User = "backup"; EncryptedFile = "C:\Vault\bk_pwd.txt" }
)

# 批量构建凭据对象
$credentials = @{}
foreach ($svc in $services) {
    $encryptedPwd = Get-Content -Path $svc.EncryptedFile -Raw
    if ($encryptedPwd) {
        $securePwd = $encryptedPwd | ConvertTo-SecureString
        $cred = New-Object System.Management.Automation.PSCredential($svc.User, $securePwd)
        $credentials[$svc.Name] = $cred
        Write-Host "[OK] 已加载凭据: $($svc.Name) ($($svc.User))"
    }
    else {
        Write-Host "[WARN] 凭据文件为空: $($svc.EncryptedFile)"
    }
}

Write-Host "`n共加载 $($credentials.Count) 组凭据"

# 定义测试参数
$iterations = 1000
$arrayTimes = @()
$hashtableTimes = @()

for ($i = 1; $i -le $iterations; $i++) {
    # 测量数组追加操作
    $arrayTime = Measure-Command {
        $arr = @()
        foreach ($j in 1..500) {
            $arr += $j
        }
    }
    $arrayTimes += $arrayTime.TotalMilliseconds

    # 测量哈希表查找操作
    $ht = @{}
    foreach ($j in 1..500) {
        $ht[$j] = "value_$j"
    }
    $htTime = Measure-Command {
        $null = $ht[250]
    }
    $hashtableTimes += $htTime.TotalMilliseconds
}

# 计算平均耗时
$avgArray = ($arrayTimes | Measure-Object -Average).Average
$avgHash = ($hashtableTimes | Measure-Object -Average).Average

Write-Host ("数组追加 平均耗时: {0:N2} ms" -f $avgArray)
Write-Host ("哈希表查找 平均耗时: {0:N4} ms" -f $avgHash)

function Invoke-Benchmark {
    param(
        [hashtable]$Implementations,
        [int]$Iterations = 100
    )

    $results = @()

    foreach ($name in $Implementations.Keys) {
        $scriptBlock = $Implementations[$name]
        $timings = @()

        for ($i = 1; $i -le $Iterations; $i++) {
            $elapsed = Measure-Command -Expression $scriptBlock
            $timings += $elapsed.TotalMilliseconds
        }

        $stats = $timings | Measure-Object -Average -Minimum -Maximum

        $results += [PSCustomObject]@{
            Name     = $name
            AvgMs    = [math]::Round($stats.Average, 4)
            MinMs    = [math]::Round($stats.Minimum, 4)
            MaxMs    = [math]::Round($stats.Maximum, 4)
            Runs     = $Iterations
        }
    }

    # 按平均耗时排序并输出
    $results | Sort-Object AvgMs | Format-Table -AutoSize
}

# 定义三种字符串拼接方式的候选实现
$impls = @{
    '加号拼接' = {
        $s = ''
        foreach ($i in 1..200) {
            $s = $s + "item_$i"
        }
    }
    '格式化拼接' = {
        $s = ''
        foreach ($i in 1..200) {
            $s = '{0}{1}' -f $s, "item_$i"
        }
    }
    'StringBuilder' = {
        $sb = [System.Text.StringBuilder]::new()
        foreach ($i in 1..200) {
            $null = $sb.Append("item_$i")
        }
        $s = $sb.ToString()
    }
}

Invoke-Benchmark -Implementations $impls -Iterations 50

# 性能分析器的全局存储
$script:ProfileMarks = [System.Collections.Generic.List[PSObject]]::new()

function Start-ProfileBlock {
    param([string]$Label)
    $script:ProfileMarks.Add(
        [PSCustomObject]@{
            Label = $Label
            Time  = Get-Date
        }
    )
}

function Stop-ProfileSession {
    $totalMarks = $script:ProfileMarks.Count
    if ($totalMarks -lt 2) {
        Write-Warning "至少需要两个标记点才能计算耗时。"
        return
    }

    $segments = @()
    for ($i = 1; $i -lt $totalMarks; $i++) {
        $prev = $script:ProfileMarks[$i - 1]
        $curr = $script:ProfileMarks[$i]
        $duration = ($curr.Time - $prev.Time).TotalMilliseconds
        $segments += [PSCustomObject]@{
            Segment  = "$($prev.Label) -> $($curr.Label)"
            Label    = $prev.Label
            Duration = [math]::Round($duration, 2)
        }
    }

    $totalDuration = ($segments | Measure-Object -Property Duration -Sum).Sum

    foreach ($seg in $segments) {
        $seg | Add-Member -NotePropertyName 'Percent' `
              -NotePropertyValue ([math]::Round($seg.Duration / $totalDuration * 100, 1)) `
              -PassThru
    }

    $segments | Sort-Object Duration -Descending | Format-Table -AutoSize
    Write-Host ("总耗时: {0:N2} ms" -f $totalDuration)

    # 清理标记以便复用
    $script:ProfileMarks.Clear()
}

# ---- 模拟被分析的脚本 ----

Start-ProfileBlock -Label "开始"

# 第一段：读取 CSV 数据
$data = @(1..5000 | ForEach-Object {
    [PSCustomObject]@{
        Id     = $_
        Name   = "User_$_"
        Score  = Get-Random -Minimum 0 -Maximum 100
        Active = [bool](Get-Random -Minimum 0 -Maximum 2)
    }
})
Start-ProfileBlock -Label "数据生成"

# 第二段：过滤和排序
$filtered = @()
foreach ($item in $data) {
    if ($item.Active -and $item.Score -ge 50) {
        $filtered += $item
    }
}
$sorted = $filtered | Sort-Object Score -Descending
Start-ProfileBlock -Label "过滤排序"

# 第三段：输出报表
$report = $sorted | Select-Object -First 20 | Format-Table -AutoSize | Out-String
Write-Host $report
Start-ProfileBlock -Label "报表输出"

# 输出性能分析报告
Stop-ProfileSession

function New-AzureFunctionsProject {
    param(
        [Parameter(Mandatory)]
        [string]$ProjectName,

        [string]$Location = 'eastasia',
        [string]$Runtime = 'powershell',
        [string]$RootPath = $PWD.Path
    )

    $projectDir = Join-Path $RootPath $ProjectName

    if (Test-Path $projectDir) {
        Write-Output "项目目录已存在: $projectDir"
        return
    }

    Write-Output "=== 创建 Azure Functions 项目 ==="
    Write-Output "项目名称: $ProjectName"
    Write-Output "运行时:   $Runtime"
    Write-Output "区域:     $Location"
    Write-Output ""

    # 初始化 Functions 项目
    $null = New-Item -Path $projectDir -ItemType Directory -Force
    Push-Location $projectDir

    try {
        # 初始化项目（相当于 func init）
        $hostJson = @{
            version = '2.0'
            logging = @{
                applicationInsights = @{
                    samplingSettings = @{
                        isEnabled = $false
                    }
                }
            }
            extensionBundle = @{
                id      = 'Microsoft.Azure.Functions.ExtensionBundle'
                version = '[4.*, 5.0.0)'
            }
        }
        $hostJson | ConvertTo-Json -Depth 5 |
            Out-File -FilePath 'host.json' -Encoding UTF8

        # 创建 local.settings.json
        $localSettings = @{
            IsEncrypted               = $false
            Values                    = @{
                AzureWebJobsStorage           = 'UseDevelopmentStorage=true'
                FUNCTIONS_WORKER_RUNTIME      = 'powershell'
                FUNCTIONS_WORKER_RUNTIME_VERSION = '~7'
            }
        }
        $localSettings | ConvertTo-Json -Depth 5 |
            Out-File -FilePath 'local.settings.json' -Encoding UTF8

        # 创建 profile.ps1（模块加载和托管身份初始化）
        $profileContent = @'
# Azure Functions Profile
# 此文件在每次函数调用前自动执行

if ($env:MSI_SECRET) {
    Disable-AzContextAutosave -Scope Process | Out-Null
    Connect-AzAccount -Identity
}
'@
        $profileContent | Out-File -FilePath 'profile.ps1' -Encoding UTF8

        # 创建 requirements.psd1（PowerShell 模块依赖）
        $requirementsContent = @'
# 此文件声明函数所需的 PowerShell 模块
# Azure Functions 会在部署时自动安装这些模块
@{
    'Az' = '13.*'
    'Az.TableModule' = '0.*'
}
'@
        $requirementsContent | Out-File -FilePath 'requirements.psd1' -Encoding UTF8

        # 创建 HTTP 触发器函数
        $httpDir = Join-Path $projectDir 'Get-SystemStatus'
        $null = New-Item -Path $httpDir -ItemType Directory -Force

        $functionJson = @{
            bindings = @(
                @{
                    authLevel = 'function'
                    type      = 'httpTrigger'
                    direction = 'in'
                    name      = 'Request'
                    methods   = @('get')
                }
                @{
                    type      = 'http'
                    direction = 'out'
                    name      = 'Response'
                }
            )
        }
        $functionJson | ConvertTo-Json -Depth 5 |
            Out-File -FilePath (Join-Path $httpDir 'function.json') -Encoding UTF8

        $runPs1 = @'
using namespace System.Net

param($Request, $TriggerMetadata)

$status = [PSCustomObject]@{
    Timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    Machine   = $env:COMPUTERNAME
    Runtime   = $PSVersionTable.PSVersion.ToString()
    Platform  = $PSVersionTable.Platform
    Status    = 'Healthy'
}

Push-OutputBinding -Name Response -Value (
    [HttpResponseContext]@{
        StatusCode = [HttpStatusCode]::OK
        Body       = ($status | ConvertTo-Json)
        ContentType = 'application/json'
    }
)
'@
        $runPs1 | Out-File -FilePath (Join-Path $httpDir 'run.ps1') -Encoding UTF8

        # 创建定时触发器函数（每天早上 8 点执行）
        $timerDir = Join-Path $projectDir 'DailyHealthCheck'
        $null = New-Item -Path $timerDir -ItemType Directory -Force

        $timerJson = @{
            bindings = @(
                @{
                    type       = 'timerTrigger'
                    direction  = 'in'
                    name       = 'TimerInfo'
                    schedule   = '0 0 8 * * *'
                }
            )
        }
        $timerJson | ConvertTo-Json -Depth 5 |
            Out-File -FilePath (Join-Path $timerDir 'function.json') -Encoding UTF8

        $timerRun = @'
param($TimerInfo)

$timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
Write-Output "[$timestamp] 每日健康检查开始执行"

# 模拟检查逻辑
$checks = @(
    @{ Name = '存储账户连接'; Status = 'OK'; Detail = '响应时间 45ms' }
    @{ Name = '数据库可用性'; Status = 'OK'; Detail = '延迟 12ms' }
    @{ Name = 'API 网关状态'; Status = 'OK'; Detail = '成功率 99.97%' }
)

foreach ($check in $checks) {
    Write-Output "  [$($check.Status)] $($check.Name) - $($check.Detail)"
}

Write-Output "[$timestamp] 每日健康检查完成"
'@
        $timerRun | Out-File -FilePath (Join-Path $timerDir 'run.ps1') -Encoding UTF8

        # 列出项目结构
        Write-Output ""
        Write-Output "=== 项目结构 ==="
        $files = Get-ChildItem -Path $projectDir -Recurse -File
        foreach ($file in $files) {
            $relativePath = $file.FullName.Replace("$projectDir\", '')
            Write-Output "  $relativePath"
        }
        Write-Output ""
        Write-Output "项目创建完成: $projectDir"
    }
    finally {
        Pop-Location
    }
}

New-AzureFunctionsProject -ProjectName 'MyServerlessAutomation'