# 定义 WAC 安装参数
$wacInstallerPath = "C:\Install\WindowsAdminCenterPreview.msi"
$gatewayPort = 443
$certThumbprint = "A1B2C3D4E5F6789012345678901234567890ABCD"
$smiEnabled = $true

# 检查 WAC 是否已安装
$wacProduct = Get-WmiObject -Class Win32_Product |
    Where-Object { $_.Name -like "*Windows Admin Center*" }

if ($null -eq $wacProduct) {
    Write-Output "正在安装 Windows Admin Center..."

    # 构建 MSI 安装参数
    $msiArgs = @(
        "/i", $wacInstallerPath
        "/qn"
        "SME_PORT=$gatewayPort"
        "SSL_CERTIFICATE_OPTION=installed"
        "THUMBPRINT=$certThumbprint"
        "SME_INCLUDE_MANAGEMENT_TOOLS=$smiEnabled"
    )

    # 执行静默安装
    $process = Start-Process -FilePath "msiexec.exe" `
        -ArgumentList $msiArgs `
        -Wait -PassThru

    if ($process.ExitCode -eq 0) {
        Write-Output "WAC 安装成功"
    } else {
        Write-Error "WAC 安装失败，退出代码：$($process.ExitCode)"
    }
} else {
    Write-Output "WAC 已安装，版本：$($wacProduct.Version)"
}

# 验证网关服务状态
$service = Get-Service -Name "ServerManagementGateway" -ErrorAction SilentlyContinue

if ($service.Status -eq "Running") {
    Write-Output "WAC 网关服务运行正常（端口：$gatewayPort）"
} else {
    Write-Output "正在启动 WAC 网关服务..."
    Start-Service -Name "ServerManagementGateway"
}

# 配置角色权限（将安全组映射到 WAC 管理角色）
$gatewayServer = $env:COMPUTERNAME
$adminGroup = "CONTOSO\WAC-Admins"
$userGroup = "CONTOSO\WAC-Users"

# 使用 WAC 的配置命令行工具设置访问权限
$configTool = "${env:ProgramFiles}\Windows Admin Center\ConfigureWAC.exe"

if (Test-Path $configTool) {
    # 设置管理员组（完整权限）
    $null = & $configTool setRole `
        -Role Administrators `
        -Group $adminGroup 2>&1

    # 设置只读用户组
    $null = & $configTool setRole `
        -Role Users `
        -Group $userGroup 2>&1

    Write-Output "角色权限配置完成"
    Write-Output "  管理员组：$adminGroup"
    Write-Output "  只读用户组：$userGroup"
}

# 输出网关访问地址
$fqdn = [System.Net.Dns]::GetHostEntry($gatewayServer).HostName
Write-Output "网关访问地址：https://$fqdn"

# WAC 网关地址
$gateway = "https://wac.contoso.com"

# 方法一：从 Active Directory 获取服务器列表
Import-Module ActiveDirectory

$serverOUs = @{
    "域控制器" = "OU=Domain Controllers,DC=contoso,DC=com"
    "文件服务器" = "OU=File Servers,OU=Servers,DC=contoso,DC=com"
    "Web 服务器" = "OU=Web Servers,OU=Servers,DC=contoso,DC=com"
    "数据库服务器" = "OU=DB Servers,OU=Servers,DC=contoso,DC=com"
}

$allConnections = @()

foreach ($ouName in $serverOUs.Keys) {
    $ouPath = $serverOUs[$ouName]

    # 查询 OU 下启用的计算机账户
    $computers = Get-ADComputer -Filter { Enabled -eq $true } `
        -SearchBase $ouPath `
        -Properties Name, DNSHostName, OperatingSystem

    foreach ($computer in $computers) {
        $allConnections += [PSCustomObject]@{
            Name     = $computer.Name
            FQDN     = $computer.DNSHostName
            Type     = "Server"
            Group    = $ouName
            OS       = $computer.OperatingSystem
        }
    }
}

Write-Output "从 AD 发现 $($allConnections.Count) 台服务器"

# 方法二：从 CSV 文件补充导入（适用于工作组服务器）
$csvPath = "C:\Config\WorkgroupServers.csv"

if (Test-Path $csvPath) {
    $csvServers = Import-Csv -Path $csvPath -Encoding UTF8

    foreach ($srv in $csvServers) {
        $allConnections += [PSCustomObject]@{
            Name  = $srv.Name
            FQDN  = $srv.IPAddress
            Type  = "Server"
            Group = $srv.Group
            OS    = "Workgroup Server"
        }
    }

    Write-Output "从 CSV 补充导入 $($csvServers.Count) 台工作组服务器"
}

# 批量添加连接到 WAC 网关
$addedCount = 0
$failedCount = 0

foreach ($conn in $allConnections) {
    try {
        # 构造连接添加请求
        $body = @{
            name   = $conn.Name
            type   = $conn.Type
            group  = $conn.Group
            target = $conn.FQDN
        } | ConvertTo-Json

        $uri = "$gateway/api/connections"
        $null = Invoke-RestMethod -Uri $uri -Method Post `
            -Body $body -ContentType "application/json" `
            -UseDefaultCredentials -SkipCertificateCheck

        $addedCount++
    } catch {
        Write-Warning "添加失败：$($conn.Name) - $($_.Exception.Message)"
        $failedCount++
    }
}

Write-Output "`n导入结果汇总："
Write-Output "  成功：$addedCount 台"
Write-Output "  失败：$failedCount 台"
Write-Output "  总计：$($allConnections.Count) 台"

# 按分组统计
$allConnections | Group-Object -Property Group |
    ForEach-Object {
        [PSCustomObject]@{
            分组 = $_.Name
            数量 = $_.Count
        }
    } | Format-Table -AutoSize

# 第一步：准备扩展开发环境
$extensionName = "custom-disk-monitor"
$extensionDir = "C:\WACExtensions\$extensionName"

# 创建扩展项目目录结构
$directories = @(
    "$extensionDir\src"
    "$extensionDir\src\components"
    "$extensionDir\src\assets"
    "$extensionDir\manifest"
)

foreach ($dir in $directories) {
    $null = New-Item -Path $dir -ItemType Directory -Force
}

Write-Output "扩展项目目录已创建：$extensionDir"

# 生成扩展清单文件
$manifest = @{
    name           = $extensionName
    displayName    = "自定义磁盘监控"
    description    = "可视化展示服务器磁盘使用趋势"
    version        = "1.0.0"
    entryPoint     = "src/main.js"
    icon           = "assets/icon.svg"
    targetVersions = @("2.0", "2.1", "2.2")
} | ConvertTo-Json -Depth 3

$manifest | Set-Content -Path "$extensionDir\manifest\manifest.json" -Encoding UTF8
Write-Output "清单文件已生成"

# 第二步：封装 WAC REST API 调用函数
function Invoke-WacDiskQuery {
    param(
        [Parameter(Mandatory)]
        [string]$GatewayEndpoint,

        [Parameter(Mandatory)]
        [string]$ServerName,

        [int]$WarningThreshold = 80
    )

    $queryScript = @(
        "Get-CimInstance -ClassName Win32_LogicalDisk |"
        " Where-Object { `$_.DriveType -eq 3 } |"
        " ForEach-Object {"
        "   $pct = [math]::Round(($_.FreeSpace / $_.Size) * 100, 1)"
        "   $used = [math]::Round(($_.Size - $_.FreeSpace) / 1GB, 1)"
        "   $total = [math]::Round($_.Size / 1GB, 1)"
        "   [PSCustomObject]@{"
        "     Drive = $_.DeviceID"
        "     UsedGB = $used"
        "     TotalGB = $total"
        "     FreePct = $pct"
        "     Status = if ((100 - $pct) -gt $WarningThreshold)"
        "              { 'Warning' } else { 'OK' }"
        "   }"
        " }"
    ) -join "`n"

    $body = @{ command = $queryScript } | ConvertTo-Json

    $uri = "$GatewayEndpoint/api/connections/$ServerName/powershell"

    try {
        $response = Invoke-RestMethod -Uri $uri -Method Post `
            -Body $body -ContentType "application/json" `
            -UseDefaultCredentials -SkipCertificateCheck

        return $response.value
    } catch {
        Write-Error "查询 $ServerName 磁盘信息失败：$($_.Exception.Message)"
        return $null
    }
}

# 第三步：批量查询并生成 JSON 数据供扩展使用
$servers = @("SRV-FILE01", "SRV-WEB01", "SRV-DB01")
$diskData = @()

foreach ($server in $servers) {
    $disks = Invoke-WacDiskQuery -GatewayEndpoint $gateway `
        -ServerName $server -WarningThreshold 80

    if ($null -ne $disks) {
        foreach ($disk in $disks) {
            $diskData += [PSCustomObject]@{
                Server   = $server
                Drive    = $disk.Drive
                UsedGB   = $disk.UsedGB
                TotalGB  = $disk.TotalGB
                FreePct  = $disk.FreePct
                Status   = $disk.Status
            }
        }
    }
}

# 输出查询结果
$diskData | Format-Table -AutoSize

# 将数据序列化为 JSON 供前端扩展消费
$dataPath = "$extensionDir\src\assets\disk-data.json"
$diskData | ConvertTo-Json -Depth 3 |
    Set-Content -Path $dataPath -Encoding UTF8

Write-Output "磁盘数据已导出至：$dataPath"

# 将扩展注册到 WAC 网关
$registerBody = @{
    name    = $extensionName
    path    = $extensionDir
    enabled = $true
} | ConvertTo-Json

$null = Invoke-RestMethod -Uri "$gateway/api/extensions" `
    -Method Post -Body $registerBody `
    -ContentType "application/json" `
    -UseDefaultCredentials -SkipCertificateCheck

Write-Output "扩展已注册到 WAC 网关"

# 安装 Windows Admin Center 的 PowerShell 模块
# 注意：模块名称可能随版本更新变化，请以官方文档为准
Install-Module -Name WindowsAdminCenter -Scope CurrentUser -Force

# 定义 WAC 网关地址
$gateway = "https://wac.contoso.com"

# 获取网关信息，验证连通性
$gatewayInfo = Get-WacGateway -Endpoint $gateway

# 列出当前网关注册的所有服务器连接
$connections = Get-WacConnection -Endpoint $gateway

foreach ($conn in $connections) {
    [PSCustomObject]@{
        Name   = $conn.Name
        Type   = $conn.Type
        Status = $conn.ConnectionStatus
    }
}

# 定义目标服务器列表
$servers = @("SRV-DC01", "SRV-FILE01", "SRV-WEB01", "SRV-DB01")

# 存储结果
$results = @()

foreach ($server in $servers) {
    # 通过 WAC 获取单台服务器的系统信息
    $info = Invoke-WacCommand -Endpoint $gateway `
        -ConnectionName $server `
        -Command "Get-ComputerInfo" `
        -ErrorAction SilentlyContinue

    if ($null -ne $info) {
        $results += [PSCustomObject]@{
            ServerName  = $server
            OSVersion   = $info.WindowsProductName
            LastBoot    = $info.OsLastBootUpTime
            UptimeHours = [math]::Round(
                ((Get-Date) - $info.OsLastBootUpTime).TotalHours, 1
            )
        }
    } else {
        $results += [PSCustomObject]@{
            ServerName  = $server
            OSVersion   = "N/A"
            LastBoot    = "N/A"
            UptimeHours = "N/A"
        }
    }
}

# 输出结果表格
$results | Format-Table -AutoSize

# 配置 WAC REST API 参数
$gateway = "https://wac.contoso.com"
$token = Get-WacAccessToken -Endpoint $gateway

# 定义请求头
$headers = @{
    Authorization = "Bearer $token"
    "Content-Type" = "application/json"
}

# 目标服务器列表
$servers = @("SRV-DC01", "SRV-WEB01", "SRV-DB01")

# 阈值：30 天内即将过期的证书
$warningDays = 30
$expiryThreshold = (Get-Date).AddDays($warningDays)

# 收集即将过期的证书信息
$expiringCerts = @()

foreach ($server in $servers) {
    # 构造 PowerShell 命令，查询本地证书存储
    $script = "Get-ChildItem -Path Cert:\LocalMachine\My | " +
        "Where-Object { `$_.NotAfter -lt (Get-Date).AddDays($warningDays) } | " +
        "Select-Object Subject, NotAfter, Thumbprint"

    # 调用 WAC REST API 执行远程命令
    $body = @{
        command = $script
    } | ConvertTo-Json

    $uri = "$gateway/api/connections/$server/powershell"
    $response = Invoke-RestMethod -Uri $uri -Method Post `
        -Headers $headers -Body $body -SkipCertificateCheck

    # 解析返回结果
    foreach ($cert in $response.value) {
        $expiringCerts += [PSCustomObject]@{
            Server      = $server
            Subject     = $cert.Subject
            Expires     = [datetime]$cert.NotAfter
            Thumbprint  = $cert.Thumbprint
            DaysLeft    = [math]::Floor(
                ([datetime]$cert.NotAfter - (Get-Date)).TotalDays
            )
        }
    }
}

# 按剩余天数排序输出
$expiringCerts | Sort-Object DaysLeft | Format-Table -AutoSize

# 生成汇总报告
$reportPath = "C:\Reports\CertExpiryReport_$(Get-Date -Format 'yyyyMMdd').csv"
$expiringCerts | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
Write-Output "证书过期报告已保存至：$reportPath"

# 维护操作类型：Enable（进入维护）或 Disable（退出维护）
$action = "Enable"
$maintenanceTag = "UnderMaintenance"

# 获取所有服务器连接
$allServers = Get-WacConnection -Endpoint $gateway |
    Where-Object { $_.Type -eq "Server" }

# 选择需要维护的服务器（这里以名称包含 "WEB" 为例）
$targetServers = $allServers |
    Where-Object { $_.Name -match "WEB" }

foreach ($srv in $targetServers) {
    # 在注册表中写入维护标记
    $setCmd = "Set-ItemProperty -Path " +
        "'HKLM:\SOFTWARE\Operations\Maintenance' " +
        "-Name 'InMaintenance' -Value " +
        "$(if ($action -eq 'Enable') { '1' } else { '0' }) -Type DWord -Force"

    $null = Invoke-WacCommand -Endpoint $gateway `
        -ConnectionName $srv.Name `
        -Command $setCmd

    # 同时暂停 SCOM 监控（如果环境中有 SCOM）
    if ($action -eq "Enable") {
        Write-Output "[$($srv.Name)] 已进入维护模式"
    } else {
        Write-Output "[$($srv.Name)] 已退出维护模式"
    }
}

# 验证维护状态
Write-Output "`n--- 当前维护状态 ---"
foreach ($srv in $targetServers) {
    $checkCmd = "(Get-ItemProperty -Path " +
        "'HKLM:\SOFTWARE\Operations\Maintenance' " +
        "-Name 'InMaintenance' -ErrorAction SilentlyContinue).InMaintenance"

    $status = Invoke-WacCommand -Endpoint $gateway `
        -ConnectionName $srv.Name `
        -Command $checkCmd

    $state = if ($status -eq 1) { "维护中" } else { "正常" }
    Write-Output "  $($srv.Name): $state"
}