function New-AzMetricAlertRule {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [Parameter(Mandatory)]
        [string]$TargetResourceId,

        [Parameter(Mandatory)]
        [string]$AlertName,

        [Parameter(Mandatory)]
        [string]$MetricName,

        [Parameter(Mandatory)]
        [double]$Threshold,

        [Parameter()]
        [string]$Operator = 'GreaterThan',

        [Parameter()]
        [string]$TimeAggregation = 'Average',

        [Parameter()]
        [string]$WindowSize = 'PT5M',

        [Parameter()]
        [string]$EvaluationFrequency = 'PT1M',

        [Parameter()]
        [string]$Severity = '2'
    )

    $condition = New-AzMetricAlertRuleV2Criteria `
        -MetricName $MetricName `
        -TimeAggregation $TimeAggregation `
        -Operator $Operator `
        -Threshold $Threshold

    $params = @{
        ResourceGroupName     = $ResourceGroupName
        Name                  = $AlertName
        TargetResourceId      = $TargetResourceId
        Criterion             = $condition
        WindowSize            = $WindowSize
        EvaluationFrequency   = $EvaluationFrequency
        Severity              = $Severity
        AutoMitigate          = $true
    }

    if ($PSCmdlet.ShouldProcess($AlertName, '创建指标告警规则')) {
        Add-AzMetricAlertRuleV2 @params
    }
}

# 定义标准告警模板
$alertTemplates = @(
    @{
        Name       = 'cpu-high'
        Metric     = 'Percentage CPU'
        Threshold  = 85
        Window     = 'PT5M'
        Severity   = '2'
    }
    @{
        Name       = 'memory-high'
        Metric     = 'Available Memory Bytes'
        Threshold  = 1073741824  # 1 GB
        Window     = 'PT5M'
        Severity   = '2'
    }
    @{
        Name       = 'disk-read-latency'
        Metric     = 'Average Read Latency'
        Threshold  = 30  # 毫秒
        Window     = 'PT10M'
        Severity   = '3'
    }
)

# 获取目标资源并批量创建告警
$vms = Get-AzVM -ResourceGroupName 'prod-rg'
foreach ($vm in $vms) {
    $resourceId = $vm.Id
    foreach ($template in $alertTemplates) {
        New-AzMetricAlertRule `
            -ResourceGroupName 'prod-rg' `
            -TargetResourceId $resourceId `
            -AlertName "$($vm.Name)-$($template.Name)" `
            -MetricName $template.Metric `
            -Threshold $template.Threshold `
            -WindowSize $template.Window `
            -Severity $template.Severity
    }
    Write-Host "已为 VM [$($vm.Name)] 创建 $($alertTemplates.Count) 条告警规则"
}

function New-AzLogAlertWithActionGroup {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [Parameter(Mandatory)]
        [string]$AlertName,

        [Parameter(Mandatory)]
        [string]$Query,

        [Parameter(Mandatory)]
        [string]$WorkspaceId,

        [Parameter(Mandatory)]
        [string]$ActionGroupId,

        [Parameter()]
        [int]$ThresholdValue = 0,

        [Parameter()]
        [string]$Operator = 'GreaterThan',

        [Parameter()]
        [string]$TimeRange = 'PT1H',

        [Parameter()]
        [string]$EvaluationFrequency = 'PT30M',

        [Parameter()]
        [string]$Severity = '2'
    )

    # 创建日志查询计划
    $schedule = New-AzScheduledQueryRuleScheduleObject `
        -FrequencyInMinutes ([int]$EvaluationFrequency.TrimStart('PT','M')) `
        -TimeWindowInMinutes ([int]$TimeRange.TrimStart('PT','H') * 60)

    # 创建评估条件
    $condition = New-AzScheduledQueryRuleConditionObject `
        -Query $Query `
        -TimeAggregationMethod 'Count' `
        -Operator $Operator `
        -Threshold $ThresholdValue

    # 创建告警规则并关联动作组
    $params = @{
        ResourceGroupName = $ResourceGroupName
        Name              = $AlertName
        Scopes            = @($WorkspaceId)
        Severity          = $Severity
        Enabled           = $true
        EvaluationSchedule = $schedule
        ConditionAllOf     = $condition
        ActionGroupId      = $ActionGroupId
    }

    New-AzScheduledQueryRule @params
}

# 创建动作组（邮件 + Webhook 通知）
$actionEmail = @{
    Name         = 'notify-ops-team'
    EmailAddress = 'ops-team@contoso.com'
}
$actionWebhook = @{
    Name       = 'trigger-incident-system'
    ServiceUri = 'https://hooks.incident.contoso.com/api/alert'
}

$actionGroup = Set-AzActionGroup `
    -ResourceGroupName 'monitoring-rg' `
    -Name 'ops-oncall-action-group' `
    -EmailReceiver $actionEmail `
    -WebhookReceiver $actionWebhook

# 检测 HTTP 5xx 错误激增的日志告警
$errorQuery = @"
let threshold = 50;
AppRequests
| where TimeGenerated > ago(1h)
| where ResultCode startswith '5'
| summarize ErrorCount = count() by bin(TimeGenerated, 5m)
| where ErrorCount > threshold
| order by TimeGenerated desc
"@

New-AzLogAlertWithActionGroup `
    -ResourceGroupName 'monitoring-rg' `
    -AlertName 'http-5xx-spike-detection' `
    -Query $errorQuery `
    -WorkspaceId '/subscriptions/xxxx/resourceGroups/monitoring-rg/providers/Microsoft.OperationalInsights/workspaces/prod-la' `
    -ActionGroupId $actionGroup.Id `
    -ThresholdValue 0 `
    -Operator 'GreaterThan' `
    -TimeRange 'PT1H' `
    -EvaluationFrequency 'PT15M' `
    -Severity '1'

Write-Host "日志告警规则已创建，动作组 ID: $($actionGroup.Id)"

function Get-AzAlertHealthReport {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ResourceGroupName,

        [Parameter()]
        [datetime]$Since = (Get-Date).AddDays(-7)
    )

    # 查询近期的告警历史
    $alerts = Get-AzAlert -ResourceGroupName $ResourceGroupName `
        -TimeRange "Custom" `
        -StartTime $Since `
        -EndTime (Get-Date)

    $summary = $alerts | Group-Object Severity | ForEach-Object {
        [PSCustomObject]@{
            Severity = switch ($_.Name) {
                'Sev0' { 'Critical'; break }
                'Sev1' { 'Error'; break }
                'Sev2' { 'Warning'; break }
                'Sev3' { 'Informational'; break }
                default { $_.Name }
            }
            Count    = $_.Count
        }
    }

    # 获取所有告警规则并检查合规性
    $rules = Get-AzMetricAlertRuleV2 -ResourceGroupName $ResourceGroupName
    $compliantRules = $rules | Where-Object {
        $_.Criteria.AllOf.Count -gt 0 -and
        $_.WindowSize -match '^PT[0-9]+M$' -and
        $_.Actions.Count -gt 0
    }

    [PSCustomObject]@{
        Period              = "$($Since.ToString('yyyy-MM-dd')) ~ $((Get-Date).ToString('yyyy-MM-dd'))"
        TotalAlerts         = $alerts.Count
        SeverityBreakdown   = $summary
        TotalRules          = $rules.Count
        CompliantRules      = $compliantRules.Count
        ComplianceRate      = if ($rules.Count -gt 0) {
            [math]::Round($compliantRules.Count / $rules.Count * 100, 1)
        } else { 0 }
    }
}

# 批量静默告警（用于计划维护窗口）
function Disable-AzAlertRulesForMaintenance {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [Parameter(Mandatory)]
        [string[]]$ResourceGroupNames,

        [Parameter()]
        [string]$Reason = '计划维护窗口'
    )

    $disabledRules = @()

    foreach ($rg in $ResourceGroupNames) {
        $rules = Get-AzMetricAlertRuleV2 -ResourceGroupName $rg
        foreach ($rule in $rules) {
            if ($PSCmdlet.ShouldProcess($rule.Name, "禁用告警规则（$Reason）")) {
                Update-AzMetricAlertRuleV2 `
                    -ResourceGroupName $rg `
                    -Name $rule.Name `
                    -Enabled $false
                $disabledRules += $rule.Name
            }
        }
    }

    Write-Host "已禁用 $($disabledRules.Count) 条告警规则。原因：$Reason"
    Write-Host "维护完成后请运行 Enable-AzAlertRulesForMaintenance 重新启用。"

    return $disabledRules
}

# 生成健康报告
$report = Get-AzAlertHealthReport -ResourceGroupName 'prod-rg'
$report | Format-List

Write-Host "`n--- 告警严重级别分布 ---"
$report.SeverityBreakdown | Format-Table -AutoSize

# 定义 DSC v3 配置文档（JSON 格式）
$configDocument = @{
    '$schema' = 'https://raw.githubusercontent.com/PowerShell/DSC/main/schemas/2024/04/config/document.json'
    contentVersion = '1.0.0'
    resources = @(
        @{
            type = 'Microsoft.Windows/Registry'
            name = 'EnableLongPaths'
            properties = @{
                keyPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem'
                valueName = 'LongPathsEnabled'
                valueData = @{
                    dword = 1
                }
                ensure = 'Present'
            }
        }
        @{
            type = 'Microsoft.Windows/Feature'
            name = 'InstallSSH'
            properties = @{
                name = 'OpenSSH.Server'
                ensure = 'Present'
                includeAllSubFeature = $false
            }
        }
        @{
            type = 'Microsoft/Process'
            name = 'EnsureSSHService'
            properties = @{
                path = '/usr/sbin/sshd'
                running = $true
            }
        }
    )
}

# 将配置保存为 JSON 文件
$configPath = Join-Path $env:TEMP 'dsc-v3-server-config.json'
$configDocument | ConvertTo-Json -Depth 10 | Set-Content -Path $configPath -Encoding UTF8

Write-Host "配置文档已保存至: $configPath"

# 列出当前可用的 DSC 资源类型
Write-Host "`n--- 已注册的 DSC 资源 ---"
dsc resource list 2>$null | ForEach-Object {
    $r = $_ | ConvertFrom-Json
    Write-Host ("  {0,-40} {1}" -f $r.type, $r.version)
}

# 验证配置文档的合法性
Write-Host "`n--- 验证配置文档 ---"
$validation = dsc config validate -p $configPath 2>&1
if ($LASTEXITCODE -eq 0) {
    Write-Host "配置文档验证通过" -ForegroundColor Green
    $validation | ConvertFrom-Json | ForEach-Object {
        Write-Host ("  资源: {0} -> 状态: {1}" -f $_.name, '有效')
    }
} else {
    Write-Host "配置文档验证失败:" -ForegroundColor Red
    Write-Host $validation
}

# 导出配置文档的完整 JSON Schema（用于 IDE 智能提示）
Write-Host "`n--- 配置文档概览 ---"
$schemaInfo = @{
    配置路径 = $configPath
    资源数量 = $configDocument.resources.Count
    资源清单 = $configDocument.resources | ForEach-Object { "$($_.type)[$($_.name)]" }
    版本 = $configDocument.contentVersion
}
$schemaInfo | Format-Table -AutoSize

# 定义自定义 DSC 资源的清单文件（manifest）
$resourceManifest = @{
    '$schema' = 'https://raw.githubusercontent.com/PowerShell/DSC/main/schemas/2024/04/resource/manifest.json'
    type = 'Contoso.UserProfile'
    version = '1.0.0'
    description = '管理用户环境配置文件'
    get = @{
        executable = 'pwsh'
        args = @(
            '-NoLogo', '-NonInteractive', '-NoProfile', '-Command'
            "Import-Module 'Contoso.DscResources'; Get-TargetResource"
        )
    }
    set = @{
        executable = 'pwsh'
        args = @(
            '-NoLogo', '-NonInteractive', '-NoProfile', '-Command'
            "Import-Module 'Contoso.DscResources'; Set-TargetResource"
        )
        preTest = $true
    }
    test = @{
        executable = 'pwsh'
        args = @(
            '-NoLogo', '-NonInteractive', '-NoProfile', '-Command'
            "Import-Module 'Contoso.DscResources'; Test-TargetResource"
        )
    }
    schema = @{
        embedded = @{
            type = 'object'
            properties = @{
                UserName = @{ type = 'string'; description = '用户名' }
                HomeDirectory = @{ type = 'string'; description = '主目录路径' }
                Shell = @{ type = 'string'; description = '默认 Shell' }
                Ensure = @{
                    type = 'string'
                    enum = @('Present', 'Absent')
                    description = '确保状态'
                }
            }
            required = @('UserName')
        }
    }
}

# 保存资源清单
$manifestPath = Join-Path $env:TEMP 'Contoso.UserProfile.dsc.resource.json'
$resourceManifest | ConvertTo-Json -Depth 10 | Set-Content -Path $manifestPath -Encoding UTF8

# 编写 PowerShell 脚本资源实现
$scriptResource = @'
[CmdletBinding()]
param(
    [Parameter(Mandatory)]
    [string]$UserName,

    [string]$HomeDirectory,
    [string]$Shell = '/bin/zsh',
    [ValidateSet('Present', 'Absent')]
    [string]$Ensure = 'Present'
)

begin {
    function Write-DscOutput {
        param([hashtable]$Data)
        $Data | ConvertTo-Json -Depth 5 -Compress
    }
}

process {
    # 获取当前状态的实际值
    $actualUser = Get-LocalUser -Name $UserName -ErrorAction SilentlyContinue
    $actualHome = $actualUser ? (Get-ADUserResultantHomePath $UserName) : $null

    # 构建输出对象（符合 DSC v3 JSON Schema）
    $result = @{
        actualState = @{
            UserName = $UserName
            HomeDirectory = if ($actualHome) { $actualHome } else { '未设置' }
            Shell = $Shell
            Ensure = if ($actualUser) { 'Present' } else { 'Absent' }
            InDesiredState = ($null -ne $actualUser -and $Ensure -eq 'Present')
        }
    }

    Write-DscOutput -Data $result
}
'@

$resourceScript = Join-Path $env:TEMP 'Contoso.DscResources.psm1'
$scriptResource | Set-Content -Path $resourceScript -Encoding UTF8

# 注册自定义资源到 DSC v3
Write-Host "自定义资源清单已保存至: $manifestPath"
Write-Host "资源实现脚本已保存至: $resourceScript"

# 在配置文档中引用自定义资源
$customConfig = @{
    '$schema' = 'https://raw.githubusercontent.com/PowerShell/DSC/main/schemas/2024/04/config/document.json'
    contentVersion = '1.0.0'
    resources = @(
        @{
            type = 'Contoso.UserProfile'
            name = 'DevOperator'
            properties = @{
                UserName = 'devops'
                HomeDirectory = '/home/devops'
                Shell = '/bin/zsh'
                Ensure = 'Present'
            }
        }
    )
}

$customConfigPath = Join-Path $env:TEMP 'dsc-v3-custom-config.json'
$customConfig | ConvertTo-Json -Depth 10 | Set-Content -Path $customConfigPath -Encoding UTF8

Write-Host "`n自定义资源配置文档已保存至: $customConfigPath"
Write-Host "资源类型: Contoso.UserProfile v1.0.0"
Write-Host "包含属性: UserName, HomeDirectory, Shell, Ensure"

# 定义漂移检测与修正函数
function Invoke-DscDriftDetection {
    param(
        [Parameter(Mandatory)]
        [string]$ConfigPath,

        [switch]$AutoRemediate,

        [switch]$DetailedReport
    )

    $report = [System.Collections.Generic.List[PSObject]]::new()
    $timestamp = Get-Date -Format 'yyyy-MM-ddTHH:mm:ssK'

    # 步骤 1: 获取当前状态（dsc config get）
    Write-Host "[$timestamp] 正在获取当前配置状态..." -ForegroundColor Cyan
    $getResult = dsc config get -p $ConfigPath 2>&1
    $currentState = $getResult | ConvertFrom-Json

    # 步骤 2: 测试配置漂移（dsc config test）
    Write-Host "[$timestamp] 正在检测配置漂移..." -ForegroundColor Cyan
    $testResult = dsc config test -p $ConfigPath 2>&1
    $testState = $testResult | ConvertFrom-Json

    $driftCount = 0
    $inSpecCount = 0

    foreach ($resource in $testState.results) {
        $entry = [ordered]@{
            Timestamp = $timestamp
            ResourceType = $resource.type
            ResourceName = $resource.name
            InDesiredState = $resource.inDesiredState
            DriftDetails = $null
        }

        if (-not $resource.inDesiredState) {
            $driftCount++
            # 提取漂移的具体属性差异
            $diffs = @()
            if ($resource.differences) {
                foreach ($diff in $diff) {
                    $diffs += "{0}: 期望='{1}', 实际='{2}'" -f @(
                        $diff.property
                        $diff.expected
                        $diff.actual
                    )
                }
            } else {
                $diffs = @('状态不匹配')
            }
            $entry.DriftDetails = $diffs -join '; '
            Write-Host ("  [漂移] {0}[{1}]: {2}" -f @(
                $resource.type, $resource.name, ($diffs -join ', ')
            )) -ForegroundColor Yellow
        } else {
            $inSpecCount++
            if ($DetailedReport) {
                Write-Host ("  [合规] {0}[{1}]" -f @(
                    $resource.type, $resource.name
                )) -ForegroundColor Green
            }
        }

        $report.Add([PSCustomObject]$entry)
    }

    # 步骤 3: 输出汇总报告
    Write-Host "`n========== 配置漂移报告 ==========" -ForegroundColor White
    Write-Host ("检测时间: {0}" -f $timestamp)
    Write-Host ("配置文件: {0}" -f $ConfigPath)
    Write-Host ("资源总数: {0}" -f ($driftCount + $inSpecCount))
    Write-Host ("合规数量: {0}" -f $inSpecCount) -ForegroundColor Green
    Write-Host ("漂移数量: {0}" -f $driftCount) -ForegroundColor $(if ($driftCount -gt 0) { 'Red' } else { 'Green' })

    # 步骤 4: 自动修正（如果启用）
    if ($driftCount -gt 0 -and $AutoRemediate) {
        Write-Host "`n[$(Get-Date -Format 'yyyy-MM-ddTHH:mm:ssK')] 正在执行自动修正..." -ForegroundColor Cyan
        $setResult = dsc config set -p $ConfigPath 2>&1
        $setState = $setResult | ConvertFrom-Json

        $remediated = 0
        foreach ($resource in $setState.results) {
            if ($resource.rebootRequired) {
                Write-Host ("  [注意] {0}[{1}] 需要重启" -f @(
                    $resource.type, $resource.name
                )) -ForegroundColor Magenta
            }
            $remediated++
        }

        Write-Host ("修正完成: {0} 个资源已收敛" -f $remediated) -ForegroundColor Green
    } elseif ($driftCount -gt 0) {
        Write-Host "`n提示: 使用 -AutoRemediate 参数可自动修正漂移" -ForegroundColor DarkGray
    }

    Write-Host "=================================="

    # 返回结构化报告
    return $report
}

# 执行漂移检测（仅检测，不修正）
$serverConfig = Join-Path $env:TEMP 'dsc-v3-server-config.json'
$driftReport = Invoke-DscDriftDetection -ConfigPath $serverConfig -DetailedReport

# 将漂移报告导出为 JSON（供 CI/CD 流水线消费）
$reportPath = Join-Path $env:TEMP "drift-report-$(Get-Date -Format 'yyyyMMdd-HHmmss').json"
$driftReport | ConvertTo-Json -Depth 5 | Set-Content -Path $reportPath -Encoding UTF8
Write-Host "`n漂移报告已导出至: $reportPath"

class ServerInfo {
    # 类型化的属性
    [string]$Name
    [string]$IPAddress
    [int]$Port
    [string]$Environment
    [datetime]$LastChecked

    # 默认构造函数
    ServerInfo() {
        $this.Port = 443
        $this.Environment = 'Development'
        $this.LastChecked = Get-Date
    }

    # 带参数的构造函数
    ServerInfo([string]$Name, [string]$IPAddress, [int]$Port) {
        $this.Name = $Name
        $this.IPAddress = $IPAddress
        $this.Port = $Port
        $this.Environment = 'Production'
        $this.LastChecked = Get-Date
    }

    # 方法：获取连接地址
    [string] GetEndpoint() {
        return "$($this.IPAddress):$($this.Port)"
    }

    # 方法：检查端口是否可达
    [bool] TestConnection() {
        try {
            $tcp = [System.Net.Sockets.TcpClient]::new()
            $connect = $tcp.BeginConnect($this.IPAddress, $this.Port, $null, $null)
            $wait = $connect.AsyncWaitHandle.WaitOne(3000, $false)
            if ($wait) {
                $tcp.EndConnect($connect)
                $this.LastChecked = Get-Date
                return $true
            }
            return $false
        }
        finally {
            $tcp.Dispose()
        }
    }

    # 重写 ToString 方法
    [string] ToString() {
        return "[$($this.Environment)] $($this.Name) ($($this.GetEndpoint()))"
    }
}

# 使用默认构造函数
$devServer = [ServerInfo]::new()
$devServer.Name = 'DEV-WEB-01'
$devServer.IPAddress = '192.168.1.100'
Write-Host $devServer.ToString()

# 使用带参数的构造函数
$prodServer = [ServerInfo]::new('PROD-WEB-01', '10.0.0.50', 8443)
Write-Host "服务器: $($prodServer.Name)"
Write-Host "端点: $($prodServer.GetEndpoint())"
Write-Host "环境: $($prodServer.Environment)"
Write-Host "上次检查: $($prodServer.LastChecked.ToString('yyyy-MM-dd HH:mm:ss'))"

# 基类：部署任务
class DeploymentTask {
    [string]$TaskName
    [string]$TargetServer
    [datetime]$StartTime
    [datetime]$EndTime
    [string]$Status = 'Pending'

    DeploymentTask([string]$TaskName, [string]$TargetServer) {
        $this.TaskName = $TaskName
        $this.TargetServer = $TargetServer
    }

    # 虚方法：执行部署（子类应重写）
    [void] Execute() {
        $this.StartTime = Get-Date
        Write-Host "正在执行任务: $($this.TaskName)"
    }

    # 标记完成
    [void] Complete() {
        $this.EndTime = Get-Date
        $this.Status = 'Completed'
        $duration = ($this.EndTime - $this.StartTime).TotalSeconds
        Write-Host "任务完成: $($this.TaskName) (耗时 $([math]::Round($duration, 2)) 秒)"
    }

    # 标记失败
    [void] Fail([string]$Reason) {
        $this.EndTime = Get-Date
        $this.Status = "Failed: $Reason"
        Write-Host "任务失败: $($this.TaskName) - $Reason"
    }

    # 获取摘要信息
    [hashtable] GetSummary() {
        return @{
            TaskName     = $this.TaskName
            TargetServer = $this.TargetServer
            Status       = $this.Status
            Duration     = if ($this.StartTime -and $this.EndTime) {
                ($this.EndTime - $this.StartTime).TotalSeconds
            } else { 0 }
        }
    }
}

# 子类：Web 应用部署
class WebAppDeployment : DeploymentTask {
    [string]$AppPoolName
    [string]$SiteName
    [string]$PackagePath

    WebAppDeployment(
        [string]$TargetServer,
        [string]$SiteName,
        [string]$PackagePath
    ) : base("Deploy-WebApp-$SiteName", $TargetServer) {
        $this.SiteName = $SiteName
        $this.AppPoolName = "$SiteName-Pool"
        $this.PackagePath = $PackagePath
    }

    # 重写 Execute 方法
    [void] Execute() {
        ([DeploymentTask]$this).Execute()
        Write-Host "  停止应用池: $($this.AppPoolName)"
        Write-Host "  备份当前版本..."
        Write-Host "  解压部署包: $($this.PackagePath)"
        Write-Host "  配置站点: $($this.SiteName)"
        Write-Host "  启动应用池: $($this.AppPoolName)"
        $this.Complete()
    }
}

# 子类：数据库迁移部署
class DatabaseMigration : DeploymentTask {
    [string]$DatabaseName
    [string]$MigrationScript
    [bool]$BackupBeforeMigration = $true

    DatabaseMigration(
        [string]$TargetServer,
        [string]$DatabaseName,
        [string]$MigrationScript
    ) : base("DB-Migration-$DatabaseName", $TargetServer) {
        $this.DatabaseName = $DatabaseName
        $this.MigrationScript = $MigrationScript
    }

    # 重写 Execute 方法
    [void] Execute() {
        ([DeploymentTask]$this).Execute()
        Write-Host "  目标数据库: $($this.DatabaseName)"
        if ($this.BackupBeforeMigration) {
            Write-Host "  正在备份数据库..."
        }
        Write-Host "  执行迁移脚本: $($this.MigrationScript)"
        Write-Host "  验证迁移结果..."
        $this.Complete()
    }
}

# 多态调用：统一执行不同类型的部署任务
$tasks = @(
    [WebAppDeployment]::new('WEB-SVR-01', 'CustomerPortal', 'D:\Packages\v2.5.0.zip')
    [DatabaseMigration]::new('DB-SVR-01', 'CustomerDB', 'v2.5.0_schema_update.sql')
)

foreach ($task in $tasks) {
    Write-Host "`n--- 部署任务 ---"
    $task.Execute()
    $summary = $task.GetSummary()
    Write-Host "摘要: $($summary.Status)"
}

# 验证属性类
class ValidateRangeAttribute : System.Management.Automation.ValidateArgumentsAttribute {
    [int]$MinValue
    [int]$MaxValue

    ValidateRangeAttribute([int]$Min, [int]$Max) {
        $this.MinValue = $Min
        $this.MaxValue = $Max
    }

    [void] Validate([object]$arguments, [System.Management.Automation.EngineIntrinsics]$engineIntrinsics) {
        $val = [int]$arguments
        if ($val -lt $this.MinValue -or $val -gt $this.MaxValue) {
            throw "值 $val 不在允许范围 ($($this.MinValue) - $($this.MaxValue)) 内"
        }
    }
}

# 服务器管理基类
class ManagedServer {
    [ValidateNotNullOrEmpty()][string]$HostName
    [string]$IPAddress
    [string]$Role
    [string]$DataCenter
    [bool]$IsMonitored = $false

    # 静态属性：已注册的服务器列表
    static [System.Collections.Generic.List[ManagedServer]]$Registry =
        [System.Collections.Generic.List[ManagedServer]]::new()

    ManagedServer([string]$HostName, [string]$IPAddress) {
        $this.HostName = $HostName
        $this.IPAddress = $IPAddress
        [ManagedServer]::Registry.Add($this)
    }

    # 转换为 JSON
    [string] ToJson() {
        $ordered = [ordered]@{
            hostName    = $this.HostName
            ipAddress   = $this.IPAddress
            role        = $this.Role
            dataCenter  = $this.DataCenter
            isMonitored = $this.IsMonitored
        }
        return $ordered | ConvertTo-Json -Depth 3
    }

    # 从 JSON 创建实例
    static [ManagedServer] FromJson([string]$Json) {
        $data = $Json | ConvertFrom-Json
        $server = [ManagedServer]::new($data.hostName, $data.ipAddress)
        $server.Role = $data.role
        $server.DataCenter = $data.dataCenter
        $server.IsMonitored = $data.isMonitored
        return $server
    }

    # 获取所有已注册服务器
    static [array] GetRegisteredServers() {
        return [ManagedServer]::Registry.ToArray()
    }
}

# 托管 Web 服务器
class ManagedWebServer : ManagedServer {
    [string[]]$BoundUrls = @()
    [int]$WorkerProcesses = 4
    [string]$RuntimeVersion = '8.0'
    [hashtable]$HealthMetrics = @{}

    ManagedWebServer([string]$HostName, [string]$IPAddress) : base($HostName, $IPAddress) {
        $this.Role = 'WebServer'
    }

    # 健康检查
    [hashtable] CheckHealth() {
        $result = @{
            Server    = $this.HostName
            Timestamp = Get-Date -Format 'o'
            Checks    = @()
        }

        $checks = @(
            @{ Name = 'CPU'; Value = (Get-Random -Min 10 -Max 95); Unit = '%' }
            @{ Name = 'Memory'; Value = (Get-Random -Min 30 -Max 90); Unit = '%' }
            @{ Name = 'Disk'; Value = (Get-Random -Min 20 -Max 85); Unit = '%' }
        )

        foreach ($check in $checks) {
            $status = if ($check.Value -gt 80) { 'Warning' } else { 'OK' }
            $result.Checks += @{
                Name   = $check.Name
                Value  = $check.Value
                Unit   = $check.Unit
                Status = $status
            }
        }

        $this.HealthMetrics = $result
        $this.IsMonitored = $true
        return $result
    }

    # 重写 ToJson 以包含扩展属性
    [string] ToJson() {
        $ordered = [ordered]@{
            hostName        = $this.HostName
            ipAddress       = $this.IPAddress
            role            = $this.Role
            dataCenter      = $this.DataCenter
            isMonitored     = $this.IsMonitored
            boundUrls       = $this.BoundUrls
            workerProcesses = $this.WorkerProcesses
            runtimeVersion  = $this.RuntimeVersion
        }
        return $ordered | ConvertTo-Json -Depth 3
    }
}

# --- 使用示例 ---

# 创建并注册服务器
$web1 = [ManagedWebServer]::new('WEB-PROD-01', '10.1.0.10')
$web1.DataCenter = 'EastAsia'
$web1.BoundUrls = @('https://portal.contoso.com', 'https://api.contoso.com')

$web2 = [ManagedWebServer]::new('WEB-PROD-02', '10.1.0.11')
$web2.DataCenter = 'EastAsia'
$web2.BoundUrls = @('https://portal.contoso.com')
$web2.WorkerProcesses = 8

Write-Host "已注册服务器数量: $([ManagedServer]::Registry.Count)"
Write-Host "`n--- $web1 健康检查 ---"
$health = $web1.CheckHealth()
foreach ($check in $health.Checks) {
    Write-Host ("  {0,-10} {1}{2,-5} [{3}]" -f $check.Name, $check.Value, $check.Unit, $check.Status)
}

Write-Host "`n--- JSON 序列化 ---"
Write-Host $web1.ToJson()

function Initialize-NewYearEnvironment {
    <#
    .SYNOPSIS
    执行新年环境初始化：创建目录、重置计数器、更新版权年份
    .PARAMETER Year
    目标年份，默认为当前年份
    .PARAMETER LogBasePath
    日志根目录路径
    .PARAMETER ConfigPath
    年度配置 JSON 文件路径
    #>
    param(
        [int]$Year = (Get-Date).Year,
        [string]$LogBasePath = "C:\Logs",
        [string]$ConfigPath = "C:\Scripts\config\annual-config.json"
    )

    $results = @()

    # ---- 1. 创建年度日志目录结构（按月和类别） ----
    $categories = @("System", "Security", "Application", "Backup", "Audit")
    $createdDirs = @()

    foreach ($category in $categories) {
        1..12 | ForEach-Object {
            $month = "{0:D2}" -f $_
            $dirPath = Join-Path $LogBasePath "$Year\$category\$month"
            if (-not (Test-Path $dirPath)) {
                New-Item -Path $dirPath -ItemType Directory -Force | Out-Null
                $createdDirs += $dirPath
            }
        }
    }
    $results += "[目录] 已创建 $($createdDirs.Count) 个日志目录 ($LogBasePath\$Year\)"

    # ---- 2. 重置年度配置计数器 ----
    if (Test-Path $ConfigPath) {
        $config = Get-Content -Path $ConfigPath -Raw -Encoding UTF8 | ConvertFrom-Json

        # 重置核心计数器
        $config.Year = $Year
        $config.Counters.IncidentNumber = 0
        $config.Counters.ChangeRequestNumber = 0
        $config.Counters.BackupJobCount = 0
        $config.Counters.LastResetDate = (Get-Date -Format "yyyy-MM-dd")
        $config.Counters.PreviousYearTotal = $config.Counters.YearlyTotal
        $config.Counters.YearlyTotal = 0

        # 更新维护窗口配置
        $config.MaintenanceWindows.NextScheduled = "$Year-01-05T02:00:00"

        $config | ConvertTo-Json -Depth 10 | Set-Content -Path $ConfigPath -Encoding UTF8
        $results += "[配置] 已重置年度计数器: $ConfigPath"
    } else {
        # 首次运行，创建默认配置
        $defaultConfig = [PSCustomObject]@{
            Year = $Year
            Counters = @{
                IncidentNumber = 0
                ChangeRequestNumber = 0
                BackupJobCount = 0
                YearlyTotal = 0
                PreviousYearTotal = 0
                LastResetDate = (Get-Date -Format "yyyy-MM-dd")
            }
            MaintenanceWindows = @{
                NextScheduled = "$Year-01-05T02:00:00"
                DefaultDurationHours = 4
            }
        }
        $dirName = Split-Path $ConfigPath -Parent
        if (-not (Test-Path $dirName)) {
            New-Item -Path $dirName -ItemType Directory -Force | Out-Null
        }
        $defaultConfig | ConvertTo-Json -Depth 10 | Set-Content -Path $ConfigPath -Encoding UTF8
        $results += "[配置] 已创建默认年度配置: $ConfigPath"
    }

    # ---- 3. 批量更新脚本文件的版权年份 ----
    $scriptPaths = @(
        "C:\Scripts\Automation\*.ps1"
        "C:\Scripts\Maintenance\*.ps1"
        "C:\Scripts\Monitoring\*.ps1"
    )

    $updatedFiles = 0
    $oldYear = $Year - 1
    foreach ($path in $scriptPaths) {
        if (Test-Path (Split-Path $path)) {
            Get-ChildItem -Path $path -File | ForEach-Object {
                $content = Get-Content $_.FullName -Raw -Encoding UTF8
                if ($content -match "Copyright.*$oldYear") {
                    $content = $content -replace "(Copyright\s*(?:\(c\)\s*)?)$oldYear", "`${1}$Year"
                    Set-Content -Path $_.FullName -Value $content -Encoding UTF8 -NoNewline
                    $updatedFiles++
                }
            }
        }
    }
    $results += "[版权] 已更新 $updatedFiles 个脚本的版权年份 ($oldYear -> $Year)"

    # ---- 4. 输出初始化报告 ----
    $summary = [PSCustomObject]@{
        初始化年份 = $Year
        执行时间 = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        创建目录数 = $createdDirs.Count
        更新文件数 = $updatedFiles
        配置文件 = $ConfigPath
    }

    Write-Host "`n=== 新年环境初始化完成 ===" -ForegroundColor Green
    $results | ForEach-Object { Write-Host "  $_" -ForegroundColor Cyan }
    Write-Host ""
    return $summary
}

# 执行 2026 年环境初始化
$initResult = Initialize-NewYearEnvironment -Year 2026
$initResult | Format-List

function Invoke-NewYearSecurityAudit {
    <#
    .SYNOPSIS
    执行新年安全基线审计：密码策略、服务账户、证书到期
    .PARAMETER DomainName
    Active Directory 域名，为空则检查本地安全策略
    .PARAMETER CertWarningDays
    证书到期提前告警天数，默认 90 天
    #>
    param(
        [string]$DomainName,
        [int]$CertWarningDays = 90
    )

    $auditTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $findings = @()
    $criticalCount = 0
    $warningCount = 0

    # ---- 1. 密码策略审计 ----
    Write-Host "`n[1/3] 正在检查密码策略..." -ForegroundColor Yellow

    try {
        if ($DomainName) {
            $secPolicy = Get-ADDefaultDomainPasswordPolicy -Identity $DomainName -ErrorAction Stop
            $policy = [PSCustomObject]@{
                最小密码长度 = $secPolicy.MinPasswordLength
                密码最长期限天 = $secPolicy.MaxPasswordAge.Days
                密码最短期限天 = $secPolicy.MinPasswordAge.Days
                密码历史记录数 = $secPolicy.PasswordHistoryCount
                账户锁定阈值 = $secPolicy.LockoutThreshold
                锁定持续时间分 = $secPolicy.LockoutDuration.TotalMinutes
            }
        } else {
            # 本地安全策略通过 secedit 导出分析
            $tempDb = Join-Path $env:TEMP "secedit-$(Get-Random).sdb"
            $tempCfg = Join-Path $env:TEMP "secedit-$(Get-Random).cfg"
            $tempInf = Join-Path $env:TEMP "secedit-$(Get-Random).inf"

            secedit /export /cfg $tempCfg /quiet 2>$null
            $policyContent = Get-Content $tempCfg -Encoding Unicode -ErrorAction SilentlyContinue

            $minLen = ($policyContent | Select-String "MinimumPasswordLength").ToString().Split("=")[-1].Trim()
            $maxAge = ($policyContent | Select-String "MaximumPasswordAge").ToString().Split("=")[-1].Trim()

            $policy = [PSCustomObject]@{
                最小密码长度 = [int]$minLen
                密码最长期限天 = [int]$maxAge
                密码最短期限天 = "N/A (本地策略)"
                密码历史记录数 = "N/A (本地策略)"
                账户锁定阈值 = "N/A (本地策略)"
                锁定持续时间分 = "N/A (本地策略)"
            }

            Remove-Item $tempCfg -Force -ErrorAction SilentlyContinue
        }

        # 检查合规性
        if ($policy.最小密码长度 -lt 12) {
            $findings += "[严重] 密码最小长度为 $($policy.最小密码Length) 位，建议至少 12 位"
            $criticalCount++
        }
        if ($policy.密码最长期限天 -gt 90 -or $policy.密码最长期限天 -eq 0) {
            $findings += "[警告] 密码最长期限为 $($policy.密码最长期限天) 天，建议不超过 90 天"
            $warningCount++
        }
    } catch {
        $findings += "[信息] 无法读取密码策略: $($_.Exception.Message)"
    }

    # ---- 2. 服务账户密码过期检查 ----
    Write-Host "[2/3] 正在检查服务账户状态..." -ForegroundColor Yellow

    try {
        if ($DomainName) {
            $serviceAccounts = Get-ADUser -Filter {
                Enabled -eq $true -and PasswordNeverExpires -eq $true
            } -Properties Name, SamAccountName, PasswordLastSet, LastLogonDate -ErrorAction Stop

            foreach ($acct in $serviceAccounts) {
                $daysSincePwdSet = if ($acct.PasswordLastSet) {
                    ((Get-Date) - $acct.PasswordLastSet).Days
                } else { -1 }

                if ($daysSincePwdSet -gt 365 -or $daysSincePwdSet -eq -1) {
                    $status = if ($daysSincePwdSet -eq -1) { "从未设置" } else { "$daysSincePwdSet 天" }
                    $findings += "[警告] 服务账户 $($acct.SamAccountName) 密码已 $status 未更新 (密码永不过期)"
                    $warningCount++
                }
            }
            $findings += "[信息] 发现 $($serviceAccounts.Count) 个设置了'密码永不过期'的账户"
        } else {
            # 本地检查：获取非内置的本地用户
            $localUsers = Get-LocalUser | Where-Object {
                $_.Enabled -and $_.PasswordNeverExpires -and $_.Name -notmatch "^(Administrator|Guest|DefaultAccount|WDAGUtilityAccount)$"
            }

            foreach ($user in $localUsers) {
                $findings += "[警告] 本地用户 $($user.Name) 设置了密码永不过期"
                $warningCount++
            }
        }
    } catch {
        $findings += "[信息] 服务账户检查受限: $($_.Exception.Message)"
    }

    # ---- 3. 证书到期扫描 ----
    Write-Host "[3/3] 正在扫描证书到期时间..." -ForegroundColor Yellow

    $certStores = @("Cert:\LocalMachine\My", "Cert:\LocalMachine\Root")
    $expiringCerts = @()

    foreach ($store in $certStores) {
        if (Test-Path $store) {
            Get-ChildItem $store | ForEach-Object {
                $daysUntilExpiry = ($_.NotAfter - (Get-Date)).Days
                if ($daysUntilExpiry -le $CertWarningDays) {
                    $severity = if ($daysUntilExpiry -le 0) { "已过期" } elseif ($daysUntilExpiry -le 30) { "即将过期" } else { "即将到期" }
                    $expiringCerts += [PSCustomObject]@{
                        严重程度 = $severity
                        剩余天数 = $daysUntilExpiry
                        主题 = $_.Subject
                        到期时间 = $_.NotAfter.ToString("yyyy-MM-dd")
                        指纹 = $_.Thumbprint.Substring(0, 8) + "..."
                    }

                    if ($daysUntilExpiry -le 0) {
                        $criticalCount++
                    } else {
                        $warningCount++
                    }
                }
            }
        }
    }

    if ($expiringCerts.Count -gt 0) {
        $findings += "[证书] 发现 $($expiringCerts.Count) 个需要关注的证书:"
        $expiringCerts | Sort-Object 剩余天数 | ForEach-Object {
            $findings += "  - [$($_.严重程度)] $($_.主题) (剩余 $($_.剩余天数) 天, 到期 $($_.到期时间))"
        }
    } else {
        $findings += "[证书] 未发现即将到期的证书 ($CertWarningDays 天阈值)"
    }

    # ---- 输出审计报告 ----
    $report = [PSCustomObject]@{
        审计时间 = $auditTime
        审计范围 = if ($DomainName) { $DomainName } else { "本地计算机" }
        严重问题数 = $criticalCount
        警告问题数 = $warningCount
        检查项目数 = 3
        密码策略 = $policy
        到期证书 = $expiringCerts
        详细发现 = $findings
    }

    Write-Host "`n=== 安全基线审计结果 ===" -ForegroundColor Green
    Write-Host "  严重问题: $criticalCount 个" -ForegroundColor Red
    Write-Host "  警告问题: $warningCount 个" -ForegroundColor Yellow
    Write-Host "  详细发现:" -ForegroundColor Cyan
    $findings | ForEach-Object { Write-Host "    $_" -ForegroundColor Gray }

    return $report
}

# 执行新年安全基线审计
$auditReport = Invoke-NewYearSecurityAudit -CertWarningDays 90