# WEF 收集器初始化函数
function Initialize-WEFCollector {
    [CmdletBinding()]
    param(
        [string]$CollectorName = $env:COMPUTERNAME,
        [string[]]$SourceComputers = @('SRV-DC01', 'SRV-APP01', 'SRV-FILE01', 'SRV-WEB01')
    )

    # 步骤 1：启用并配置 Windows 事件收集器服务
    $wecsvc = Get-Service -Name 'wecsvc' -ErrorAction SilentlyContinue
    if ($wecsvc.Status -ne 'Running') {
        Start-Service -Name 'wecsvc' -ErrorAction Stop
        Set-Service -Name 'wecsvc' -StartupType Automatic
        Write-Host '[OK] Windows 事件收集器服务已启动并设为自动' -ForegroundColor Green
    } else {
        Write-Host '[SKIP] 收集器服务已在运行' -ForegroundColor Yellow
    }

    # 步骤 2：配置收集器服务参数
    wecutil qc /quiet:true 2>$null
    Write-Host '[OK] 收集器快速配置完成' -ForegroundColor Green

    # 步骤 3：创建源计算机计算机组（供 GPO 使用）
    $ouPath = "OU=Servers,DC=vichamp,DC=com"
    Write-Host "[INFO] 建议在 Active Directory 中创建计算机组 'WEF-SourceComputers'" -ForegroundColor Cyan
    Write-Host "       组织单元路径: $ouPath" -ForegroundColor Cyan
    Write-Host "       成员计算机: $($SourceComputers -join ', ')" -ForegroundColor Cyan

    # 步骤 4：生成 GPO 导入用的注册表策略文件
    $gpoContent = @"
Windows Registry Editor Version 5.00

; WEF 源计算机 GPO 设置
; 路径: Computer Configuration -> Administrative Templates ->
;       Windows Components -> Event Forwarding

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager]
"1"="Server=http://$CollectorName:5985/wsman/SubscriptionManager/WEC,Refresh=60"
"@
    $gpoPath = Join-Path $env:TEMP 'WEF-SourceGPO.reg'
    $gpoContent | Set-Content -Path $gpoPath -Encoding Unicode
    Write-Host "[OK] GPO 注册表文件已生成: $gpoPath" -ForegroundColor Green

    # 步骤 5：验证 WinRM 监听器
    $listeners = Get-WSManInstance -ResourceURI winrm/config/Listener -Enumerate
    $httpListener = $listeners | Where-Object { $_.Transport -eq 'HTTP' -and $_.Enabled -eq 'true' }

    if ($httpListener) {
        Write-Host "[OK] WinRM HTTP 监听器已启用" -ForegroundColor Green
    } else {
        Write-Host '[WARN] 未检测到 WinRM HTTP 监听器，尝试启用...' -ForegroundColor Yellow
        Enable-PSRemoting -Force -SkipNetworkProfileCheck
        Write-Host '[OK] WinRM 已启用' -ForegroundColor Green
    }

    # 步骤 6：配置防火墙规则
    $fwRule = Get-NetFirewallRule -DisplayName 'Windows Event Forwarding HTTP' -ErrorAction SilentlyContinue
    if (-not $fwRule) {
        New-NetFirewallRule -DisplayName 'Windows Event Forwarding HTTP' `
            -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5985 `
            -Profile Domain, Private
        Write-Host '[OK] 防火墙规则已创建（TCP 5985 入站）' -ForegroundColor Green
    }

    Write-Host "`n=== 收集器初始化完成 ===" -ForegroundColor Cyan
    Write-Host "收集器: $CollectorName" -ForegroundColor White
    Write-Host "源计算机数: $($SourceComputers.Count)" -ForegroundColor White
    Write-Host "下一步: 将 GPO 注册表文件导入组策略并应用到源计算机 OU" -ForegroundColor White
}

Initialize-WEFCollector -SourceComputers @('SRV-DC01', 'SRV-APP01', 'SRV-FILE01', 'SRV-WEB01')

# WEF 订阅管理函数
function Register-WEFSubscription {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$SubscriptionId,

        [Parameter(Mandatory)]
        [string]$Description,

        [Parameter(Mandatory)]
        [string[]]$Queries,

        [ValidateSet('ForwardedEvents', 'SecurityAudit')]
        [string]$LogFile = 'ForwardedEvents'
    )

    # 将查询数组拼接为 CDATA 段
    $queryBlock = ($Queries | ForEach-Object { "        $_" }) -join "`n"

    $deliveryMode = 'Push'
    $maxItems = 50
    $maxLatency = 300000
    $heartbeat = 1800000

    $subscriptionXml = @"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>$SubscriptionId</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>$Description</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>Custom</ConfigurationMode>
  <Delivery Mode="$deliveryMode">
    <Batching>
      <MaxItems>$maxItems</MaxItems>
      <MaxLatencyTime>$maxLatency</MaxLatencyTime>
    </Batching>
    <PushSettings>
      <Heartbeat Interval="$heartbeat"/>
    </PushSettings>
  </Delivery>
  <ContentFormat>
    <RenderedText/>
  </ContentFormat>
  <LogFile>$LogFile</LogFile>
  <Query><![CDATA[
    <QueryList>
$queryBlock
    </QueryList>
  ]]></Query>
  <ReadExistingEvents>false</ReadExistingEvents>
</Subscription>
"@

    $configPath = Join-Path $env:TEMP "$SubscriptionId.xml"
    $subscriptionXml | Set-Content $configPath -Encoding UTF8

    try {
        wecutil cs $configPath 2>&1
        Write-Host "[OK] 订阅 '$SubscriptionId' 已创建" -ForegroundColor Green

        # 启用订阅并显示状态
        wecutil ss $SubscriptionId /e:true 2>$null
        $status = wecutil gs $SubscriptionId 2>$null
        if ($status -match 'State:\s*(\w+)') {
            Write-Host "     状态: $($Matches[1])" -ForegroundColor Cyan
        }
    } catch {
        Write-Host "[FAIL] 创建订阅失败: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# 订阅 1：登录成功与失败事件
# XPath 过滤：仅转发 4624（登录成功）和 4625（登录失败），且排除系统账户
Register-WEFSubscription -SubscriptionId 'Sec-LogonEvents' `
    -Description '登录事件集中收集（成功+失败）' `
    -Queries @(
        '<Query Path="Security">'
        '  <Select>'
        '    *[System[(EventID=4624 or EventID=4625)]]'
        '    and '
        '    *[EventData[Data[@Name=''TargetUserName''] != ''SYSTEM'']]'
        '    and '
        '    *[EventData[Data[@Name=''TargetUserName''] != ''LOCAL SERVICE'']]'
        '  </Select>'
        '</Query>'
    )

# 订阅 2：权限提升与敏感操作
# 包含：4672（特殊权限分配）、4673（特权服务调用）、4688（进程创建）
Register-WEFSubscription -SubscriptionId 'Sec-PrivilegeEscalation' `
    -Description '权限提升与敏感操作监控' `
    -Queries @(
        '<Query Path="Security">'
        '  <Select>'
        '    *[System[(EventID=4672 or EventID=4673 or EventID=4688)]]'
        '  </Select>'
        '</Query>'
    )

# 订阅 3：账户与策略变更
# 包含：4720（创建用户）、4726（删除用户）、4732（添加到本地组）、4713（策略变更）
Register-WEFSubscription -SubscriptionId 'Sec-AccountChanges' `
    -Description '账户与安全策略变更审计' `
    -LogFile 'ForwardedEvents' `
    -Queries @(
        '<Query Path="Security">'
        '  <Select>'
        '    *[System[(EventID=4720 or EventID=4726 or EventID=4732 or EventID=4713)]]'
        '  </Select>'
        '</Query>',
        '<Query Path="System">'
        '  <Select>'
        '    *[System[(Level=1 or Level=2)]]'
        '  </Select>'
        '</Query>'
    )

# 查看所有订阅状态
Write-Host "`n=== 当前订阅列表 ===" -ForegroundColor Yellow
wecutil es 2>$null

# WEF 集中分析引擎
function Invoke-WEFSecurityAnalysis {
    [CmdletBinding()]
    param(
        [int]$AnalysisHours = 24,
        [int]$BruteForceThreshold = 10,
        [int]$NewAccountAlertHours = 48
    )

    $startTime = (Get-Date).AddHours(-$AnalysisHours)
    $alertCount = 0

    Write-Host "`n========== WEF 安全分析报告 ==========" -ForegroundColor Yellow
    Write-Host "分析时段: $($startTime.ToString('yyyy-MM-dd HH:mm')) ~ $((Get-Date).ToString('yyyy-MM-dd HH:mm'))" -ForegroundColor White
    Write-Host "暴力破解阈值: 单 IP ${BruteForceThreshold} 次失败/小时" -ForegroundColor White

    # --- 分析 1：暴力破解检测 ---
    $failedLogons = Get-WinEvent -FilterHashtable @{
        LogName   = 'ForwardedEvents'
        Id        = 4625
        StartTime = $startTime
    } -ErrorAction SilentlyContinue

    if ($failedLogons) {
        $logonReport = foreach ($event in $failedLogons) {
            $xml = [xml]$event.ToXml()
            $data = @{}
            $xml.Event.EventData.Data | ForEach-Object { $data[$_.Name] = $_.'#text' }

            [PSCustomObject]@{
                Time     = $event.TimeCreated
                Computer = $event.MachineName
                Target   = $data['TargetUserName']
                SourceIP = $data['IpAddress']
                LogonType = $data['LogonType']
            }
        }

        # 按来源 IP 聚合，检测暴力破解
        $ipGroups = $logonReport | Group-Object SourceIP | Sort-Object Count -Descending

        Write-Host "`n[!] 暴力破解检测" -ForegroundColor Red
        Write-Host "    登录失败总数: $($logonReport.Count)" -ForegroundColor White

        $suspiciousIPs = $ipGroups | Where-Object { $_.Count -ge $BruteForceThreshold }
        if ($suspiciousIPs) {
            $alertCount += $suspiciousIPs.Count
            Write-Host "    发现 $($suspiciousIPs.Count) 个可疑 IP（超过阈值 ${BruteForceThreshold} 次）：" -ForegroundColor Red
            foreach ($ip in $suspiciousIPs) {
                $targets = ($ip.Group | Select-Object -ExpandProperty Target -Unique) -join ', '
                Write-Host "      $($ip.Name) -> $($ip.Count) 次失败，目标账户: $targets" -ForegroundColor Yellow
            }
        } else {
            Write-Host "    未发现暴力破解行为" -ForegroundColor Green
        }
    }

    # --- 分析 2：特权账户登录监控 ---
    $adminLogons = Get-WinEvent -FilterHashtable @{
        LogName   = 'ForwardedEvents'
        Id        = 4624
        StartTime = $startTime
    } -ErrorAction SilentlyContinue

    if ($adminLogons) {
        $adminReport = foreach ($event in $adminLogons) {
            $xml = [xml]$event.ToXml()
            $data = @{}
            $xml.Event.EventData.Data | ForEach-Object { $data[$_.Name] = $_.'#text' }

            $userName = $data['TargetUserName']
            $logonType = $data['LogonType']
            $sourceIP = $data['IpAddress']

            [PSCustomObject]@{
                Time     = $event.TimeCreated
                Computer = $event.MachineName
                User     = $userName
                Type     = $logonType
                SourceIP = $sourceIP
                IsAdmin  = $userName -match 'admin|administrator|sa|root'
            }
        }

        $adminOnly = $adminReport | Where-Object { $_.IsAdmin }
        if ($adminOnly) {
            Write-Host "`n[!] 特权账户登录记录（共 $($adminOnly.Count) 条）" -ForegroundColor Red
            $adminOnly | Select-Object Time, Computer, User, Type, SourceIP |
                Format-Table -AutoSize
            $alertCount++
        }
    }

    # --- 分析 3：账户变更审计 ---
    $accountChanges = Get-WinEvent -FilterHashtable @{
        LogName   = 'ForwardedEvents'
        Id        = @(4720, 4726, 4732)
        StartTime = $startTime
    } -ErrorAction SilentlyContinue

    if ($accountChanges) {
        $changeMap = @{ 4720 = '创建用户'; 4726 = '删除用户'; 4732 = '添加到管理员组' }

        Write-Host "`n[!] 账户变更记录" -ForegroundColor Red
        foreach ($event in $accountChanges) {
            $xml = [xml]$event.ToXml()
            $data = @{}
            $xml.Event.EventData.Data | ForEach-Object { $data[$_.Name] = $_.'#text' }

            $action = $changeMap[[int]$event.Id]
            $target = $data['TargetUserName']
            $subject = $data['SubjectUserName']
            Write-Host "    [$action] 目标: $target，操作者: $subject，计算机: $($event.MachineName)" -ForegroundColor Yellow
        }
        $alertCount++
    }

    # --- 汇总与告警 ---
    Write-Host "`n========== 分析结果汇总 ==========" -ForegroundColor Yellow
    Write-Host "告警数量: $alertCount" -ForegroundColor $(if ($alertCount -gt 0) { 'Red' } else { 'Green' })

    if ($alertCount -gt 0) {
        # 生成告警摘要并发送通知（这里以写文件和事件日志为例）
        $alertSummary = @{
            Timestamp    = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
            AnalysisSpan = "$AnalysisHours 小时"
            AlertCount   = $alertCount
            SuspiciousIPs = if ($suspiciousIPs) { $suspiciousIPs.Name -join ', ' } else { '无' }
        }

        $alertJson = $alertSummary | ConvertTo-Json -Compress
        $alertPath = Join-Path $env:TEMP "WEF-Alert-$(Get-Date -Format 'yyyyMMdd-HHmmss').json"
        $alertJson | Set-Content $alertPath -Encoding UTF8
        Write-Host "告警详情已保存: $alertPath" -ForegroundColor Cyan

        # 写入本地事件日志供 SIEM 抓取
        Write-EventLog -LogName Application -Source 'WEF-Analytics' `
            -EntryType Warning -EventId 9001 -Message $alertJson `
            -ErrorAction SilentlyContinue
    }
}

Invoke-WEFSecurityAnalysis -AnalysisHours 24 -BruteForceThreshold 10

function Invoke-SafeOperation {
    [CmdletBinding()]
    param(
        [scriptblock]$Operation,
        [string]$OperationName = "Unnamed Operation",
        [switch]$ContinueOnError
    )

    # 保存原始偏好设置
    $originalEAP = $ErrorActionPreference
    $savedErrors = @()

    try {
        # 将 ErrorActionPreference 设为 Stop，使非终止性错误也能被 try/catch 捕获
        $ErrorActionPreference = 'Stop'

        Write-Verbose "[$OperationName] 开始执行操作"
        $result = & $Operation
        Write-Verbose "[$OperationName] 操作成功完成"

        return $result
    }
    catch {
        $savedErrors += $_
        $errorRecord = $_.Exception
        $errorType = $_.FullyQualifiedErrorId

        # 构建结构化错误信息
        $errorDetail = [PSCustomObject]@{
            Timestamp     = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
            Operation     = $OperationName
            ErrorType     = $errorType
            Message       = $_.Exception.Message
            Category      = $_.CategoryInfo.Category
            Target        = $_.TargetObject
            StackTrace    = $_.ScriptStackTrace
        }

        Write-Warning "[$OperationName] 操作失败: $($_.Exception.Message)"
        Write-Warning "[$OperationName] 错误类型: $errorType"
        Write-Warning "[$OperationName] 错误分类: $($_.CategoryInfo.Category)"

        if ($ContinueOnError) {
            Write-Verbose "[$OperationName] ContinueOnError 已启用，继续执行"
            return $errorDetail
        }
        else {
            # 将原始错误重新抛出为终止性错误
            throw $errorDetail
        }
    }
    finally {
        # 恢复原始偏好设置
        $ErrorActionPreference = $originalEAP
        Write-Verbose "[$OperationName] ErrorActionPreference 已恢复为: $originalEAP"
    }
}

# 示例：捕获非终止性错误
$files = Invoke-SafeOperation -OperationName "读取配置文件" -ContinueOnError -Verbose {
    Get-Content -Path "C:\nonexistent\config.json" -ErrorAction Stop
}

# 示例：捕获终止性错误
try {
    Invoke-SafeOperation -OperationName "数据库连接" {
        throw "无法连接到数据库服务器 db01.internal:1433"
    }
}
catch {
    Write-Host "捕获到终止性错误: $($_.Message)" -ForegroundColor Red
    Write-Host "操作名称: $($_.Operation)" -ForegroundColor Yellow
    Write-Host "错误分类: $($_.Category)" -ForegroundColor Yellow
}

function Invoke-WithRetry {
    [CmdletBinding()]
    param(
        [scriptblock]$ScriptBlock,
        [string]$OperationName = "Operation",
        [int]$MaxRetries = 3,
        [int]$BaseDelaySeconds = 2,
        [double]$BackoffMultiplier = 2.0,
        [int]$MaxDelaySeconds = 60,
        [int]$CircuitBreakerThreshold = 5
    )

    # 断路器状态（脚本作用域）
    if (-not (Get-Variable -Name '__CircuitBreakerState' -Scope Script -ErrorAction SilentlyContinue)) {
        $script:__CircuitBreakerState = @{}
    }

    $cbKey = $OperationName
    if (-not $script:__CircuitBreakerState.ContainsKey($cbKey)) {
        $script:__CircuitBreakerState[$cbKey] = @{
            FailureCount = 0
            IsOpen       = $false
            LastFailure  = $null
        }
    }

    $cb = $script:__CircuitBreakerState[$cbKey]

    # 检查断路器状态
    if ($cb.IsOpen) {
        $timeSinceFailure = (Get-Date) - $cb.LastFailure
        if ($timeSinceFailure.TotalSeconds -lt 300) {
            throw "[断路器] 操作 '$OperationName' 的断路器已断开（连续失败 $($cb.FailureCount) 次），" +
                  "将在 $([int](300 - $timeSinceFailure.TotalSeconds)) 秒后重置。"
        }
        else {
            Write-Verbose "[断路器] 冷却时间已过，半开状态，允许尝试"
            $cb.IsOpen = $false
        }
    }

    $attempt = 0
    $lastError = $null

    while ($attempt -lt $MaxRetries) {
        $attempt++
        try {
            Write-Verbose "[$OperationName] 第 $attempt/$MaxRetries 次尝试"
            $result = & $ScriptBlock

            # 成功则重置断路器
            $cb.FailureCount = 0
            $cb.IsOpen = $false
            Write-Verbose "[$OperationName] 第 $attempt 次尝试成功"
            return $result
        }
        catch {
            $lastError = $_
            $cb.FailureCount++
            $cb.LastFailure = Get-Date

            Write-Warning "[$OperationName] 第 $attempt/$MaxRetries 次尝试失败: $($_.Exception.Message)"

            # 检查是否触发断路器
            if ($cb.FailureCount -ge $CircuitBreakerThreshold) {
                $cb.IsOpen = $true
                Write-Warning "[断路器] 连续失败 $($cb.FailureCount) 次，断路器已断开"
            }

            if ($attempt -lt $MaxRetries) {
                # 计算指数退避延迟
                $delay = [Math]::Min(
                    $BaseDelaySeconds * [Math]::Pow($BackoffMultiplier, $attempt - 1),
                    $MaxDelaySeconds
                )
                # 添加随机抖动，防止多个客户端同时重试（雷群效应）
                $jitter = Get-Random -Minimum 0 -Maximum ($delay * 0.3)
                $totalDelay = $delay + $jitter

                Write-Verbose "[$OperationName] 等待 $([Math]::Round($totalDelay, 1)) 秒后重试..."
                Start-Sleep -Seconds $totalDelay
            }
        }
    }

    throw "[$OperationName] 达到最大重试次数 ($MaxRetries)。最后一次错误: $($lastError.Exception.Message)"
}

# 示例：模拟不稳定的服务调用
$attemptCounter = 0
$result = Invoke-WithRetry -OperationName "调用用户API" -MaxRetries 4 -Verbose {
    $script:attemptCounter++
    if ($script:attemptCounter -lt 3) {
        throw "HTTP 503 - 服务暂时不可用 (第 $script:attemptCounter 次调用)"
    }
    return @{ Status = "OK"; Users = @("Alice", "Bob", "Charlie") }
}

Write-Host "最终结果: $($result | ConvertTo-Json -Compress)"

class ErrorReport {
    [string]$ScriptName
    [datetime]$StartTime
    [datetime]$EndTime
    [System.Collections.Generic.List[PSObject]]$Errors
    [System.Collections.Generic.List[string]]$Warnings
    [bool]$Success

    ErrorReport([string]$ScriptName) {
        $this.ScriptName = $ScriptName
        $this.StartTime = Get-Date
        $this.Errors = [System.Collections.Generic.List[PSObject]]::new()
        $this.Warnings = [System.Collections.Generic.List[string]]::new()
        $this.Success = $true
    }

    [void] AddError([string]$Context, [System.Management.Automation.ErrorRecord]$ErrorRecord) {
        $this.Success = $false
        $this.Errors.Add([PSCustomObject]@{
            Timestamp  = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
            Context    = $Context
            Message    = $ErrorRecord.Exception.Message
            Category   = $ErrorRecord.CategoryInfo.Category.ToString()
            ErrorId    = $ErrorRecord.FullyQualifiedErrorId
            Target     = if ($ErrorRecord.TargetObject) { $ErrorRecord.TargetObject.ToString() } else { "N/A" }
            StackTrace = $ErrorRecord.ScriptStackTrace
        })
    }

    [void] AddWarning([string]$Message) {
        $this.Warnings.Add("[$((Get-Date).ToString('HH:mm:ss'))] $Message")
    }

    [string] ToJson() {
        $this.EndTime = Get-Date
        $duration = ($this.EndTime - $this.StartTime).ToString('hh\:mm\:ss')
        $report = [PSCustomObject]@{
            ScriptName  = $this.ScriptName
            StartTime   = $this.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
            EndTime     = $this.EndTime.ToString('yyyy-MM-dd HH:mm:ss')
            Duration    = $duration
            Success     = $this.Success
            ErrorCount  = $this.Errors.Count
            WarningCount = $this.Warnings.Count
            Errors      = $this.Errors
            Warnings    = $this.Warnings
        }
        return ($report | ConvertTo-Json -Depth 5)
    }

    [void] Save([string]$OutputPath) {
        $json = $this.ToJson()
        $dir = Split-Path -Parent $OutputPath
        if ($dir -and -not (Test-Path $dir)) {
            New-Item -ItemType Directory -Path $dir -Force | Out-Null
        }
        $json | Out-File -FilePath $OutputPath -Encoding UTF8
    }

    [void] SendWebhook([string]$WebhookUrl, [string]$Status) {
        $color = if ($this.Success) { "36a64f" } else { "ff0000" }
        $summary = if ($this.Success) {
            "脚本 $($this.ScriptName) 执行成功"
        } else {
            "脚本 $($this.ScriptName) 执行失败，共 $($this.Errors.Count) 个错误"
        }

        $body = @{
            text = $summary
        } | ConvertTo-Json -Depth 3

        try {
            Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $body `
                -ContentType "application/json" -TimeoutSec 10
        }
        catch {
            Write-Warning "Webhook 通知发送失败: $($_.Exception.Message)"
        }
    }
}

# 使用示例：模拟一个批量运维任务
$report = [ErrorReport]::new("ServerMaintenance")

$report.AddWarning("磁盘清理将在非工作时间执行")

# 模拟处理多台服务器
$servers = @("web01", "web02", "db01", "cache01")
foreach ($server in $servers) {
    try {
        $ErrorActionPreference = 'Stop'
        # 模拟远程操作（db01 模拟失败）
        if ($server -eq "db01") {
            throw "连接超时: $server 端口 5432 无响应"
        }
        $report.AddWarning("$server 操作完成")
    }
    catch {
        $report.AddError("服务器维护 - $server", $_)
    }
}

# 生成报告
$reportPath = Join-Path $env:TEMP "error-report-$(Get-Date -Format 'yyyyMMdd-HHmmss').json"
$report.Save($reportPath)

Write-Host "=== 执行摘要 ==="
Write-Host "脚本: $($report.ScriptName)"
Write-Host "成功: $($report.Success)"
Write-Host "错误数: $($report.Errors.Count)"
Write-Host "警告数: $($report.Warnings.Count)"
Write-Host "报告已保存至: $reportPath"

# 连接 Azure 并选择订阅
Connect-AzAccount -Subscription 'MySubscription'

# 定义变量
$resourceGroup = 'rg-frontdoor-demo'
$location = 'global'
$frontDoorName = 'fd-demo-001'

# 创建资源组
New-AzResourceGroup -Name $resourceGroup -Location $location -Force

# 定义后端地址池
$backend1 = New-AzFrontDoorBackendObject `
    -Address 'app-eastasia.azurewebsites.net' `
    -HttpPort 80 `
    -HttpsPort 443 `
    -Priority 1 `
    -Weight 50

$backend2 = New-AzFrontDoorBackendObject `
    -Address 'app-eastus.azurewebsites.net' `
    -HttpPort 80 `
    -HttpsPort 443 `
    -Priority 2 `
    -Weight 50

$backendPool = New-AzFrontDoorBackendPoolObject `
    -Name 'primaryPool' `
    -FrontDoorName $frontDoorName `
    -ResourceGroupName $resourceGroup `
    -Backend $backend1, $backend2

# 定义健康探测
$healthProbe = New-AzFrontDoorHealthProbeSettingObject `
    -Name 'appHealthProbe' `
    -Path '/health' `
    -Protocol Https `
    -IntervalInSeconds 30

# 定义负载均衡设置
$loadBalancing = New-AzFrontDoorLoadBalancingSettingObject `
    -Name 'appLoadBalancing' `
    -SampleSize 4 `
    -SuccessfulSamplesRequired 2

# 定义前端端点
$frontendEndpoint = New-AzFrontDoorFrontendEndpointObject `
    -Name 'frontendEndpoint1' `
    -HostName "$frontDoorName.azurefd.net"

# 定义路由规则
$routingRule = New-AzFrontDoorRoutingRuleObject `
    -Name 'defaultRouting' `
    -FrontDoorName $frontDoorName `
    -ResourceGroupName $resourceGroup `
    -FrontendEndpointName 'frontendEndpoint1' `
    -BackendPoolName 'primaryPool' `
    -AcceptedProtocol Https `
    -PatternsToMatch '/*' `
    -EnabledState Enabled

# 创建 Front Door 实例
$frontDoor = New-AzFrontDoor `
    -ResourceGroupName $resourceGroup `
    -Name $frontDoorName `
    -BackendPool $backendPool `
    -HealthProbeSetting $healthProbe `
    -LoadBalancingSetting $loadBalancing `
    -FrontendEndpoint $frontendEndpoint `
    -RoutingRule $routingRule

Write-Host "Front Door 创建完成：$($frontDoor.Name)"
Write-Host "前端访问地址：https://$frontDoorName.azurefd.net"

# 定义 WAF 策略变量
$wafPolicyName = 'waf-demo-policy'
$resourceGroup = 'rg-frontdoor-demo'

# 创建自定义规则：阻断特定恶意 User-Agent
$customRule1 = New-AzFrontDoorWafCustomRuleObject `
    -Name 'blockBadBots' `
    -RuleType MatchRule `
    -MatchCondition @{
        MatchVariable     = 'RequestHeader'
        Selector          = 'User-Agent'
        OperatorProperty  = 'Contains'
        MatchValue        = @('BadBot', 'Scraper', 'MaliciousCrawler')
        NegateCondition   = $false
    } `
    -Action Block `
    -Priority 100

# 创建自定义规则：仅允许特定国家/地区访问
$customRule2 = New-AzFrontDoorWafCustomRuleObject `
    -Name 'geoFilterRule' `
    -RuleType MatchRule `
    -MatchCondition @{
        MatchVariable     = 'SocketAddr'
        OperatorProperty  = 'GeoMatch'
        MatchValue        = @('CN', 'HK', 'TW', 'SG', 'JP')
        NegateCondition   = $true
    } `
    -Action Block `
    -Priority 200

# 创建速率限制规则：防止暴力破解
$rateLimitRule = New-AzFrontDoorWafCustomRuleObject `
    -Name 'rateLimitLogin' `
    -RuleType RateLimitRule `
    -MatchCondition @{
        MatchVariable     = 'RequestUri'
        OperatorProperty  = 'Contains'
        MatchValue        = @('/api/login', '/api/auth')
    } `
    -RateLimitDurationInMinutes 1 `
    -RateLimitThreshold 20 `
    -Action Block `
    -Priority 300

# 创建托管规则集（OWASP Top 10 防护）
$managedRuleSet = New-AzFrontDoorWafManagedRuleObject `
    -Type 'Microsoft_DefaultRuleSet' `
    -Version '2.1'

$botRuleSet = New-AzFrontDoorWafManagedRuleObject `
    -Type 'Microsoft_BotManagerRuleSet' `
    -Version '1.0'

# 组合创建 WAF 策略
$wafPolicy = New-AzFrontDoorWafPolicy `
    -ResourceGroupName $resourceGroup `
    -Name $wafPolicyName `
    -CustomRule $customRule1, $customRule2, $rateLimitRule `
    -ManagedRule $managedRuleSet, $botRuleSet `
    -EnabledState Enabled `
    -Mode Prevention

Write-Host "WAF 策略创建完成：$($wafPolicy.Name)"
Write-Host "运行模式：$($wafPolicy.Mode)"
Write-Host "自定义规则数量：$($wafPolicy.CustomRules.Count)"
Write-Host "托管规则集数量：$($wafPolicy.ManagedRules.Count)"

# 将 WAF 策略关联到 Front Door 前端端点
$frontDoorName = 'fd-demo-001'
$frontendEndpoint = Get-AzFrontDoorFrontendEndpoint `
    -ResourceGroupName $resourceGroup `
    -FrontDoorName $frontDoorName `
    -Name 'frontendEndpoint1'

# 更新前端端点以关联 WAF 策略
$wafPolicyId = $wafPolicy.Id
Update-AzFrontDoorFrontendEndpoint `
    -ResourceGroupName $resourceGroup `
    -FrontDoorName $frontDoorName `
    -Name 'frontendEndpoint1' `
    -WebApplicationFirewallPolicyLink $wafPolicyId

Write-Host "WAF 策略已关联到前端端点"

# 定义变量
$resourceGroup = 'rg-frontdoor-demo'
$frontDoorName = 'fd-demo-001'

# 获取当前 Front Door 配置
$frontDoor = Get-AzFrontDoor `
    -ResourceGroupName $resourceGroup `
    -Name $frontDoorName

# 创建带缓存的路由规则（静态资源）
$cachedBackendPool = $frontDoor.BackendPools[0]
$cachedFrontend = $frontDoor.FrontendEndpoints[0]

# 更新路由规则，添加缓存配置
$routingRuleWithCache = New-AzFrontDoorRoutingRuleObject `
    -Name 'staticAssetsRouting' `
    -FrontDoorName $frontDoorName `
    -ResourceGroupName $resourceGroup `
    -FrontendEndpointName $cachedFrontend.Name `
    -BackendPoolName $cachedBackendPool.Name `
    -AcceptedProtocol Http, Https `
    -PatternsToMatch '/static/*', '/images/*', '/css/*', '/js/*' `
    -EnabledState Enabled `
    -DefaultCacheBehavior `
    -CacheDuration 'P30D' `
    -ForwardingProtocol HttpsOnly `
    -CacheKeyQueryParameterStripAll

# 创建 API 路径的动态缓存规则
$apiCacheRule = New-AzFrontDoorRoutingRuleObject `
    -Name 'apiCacheRouting' `
    -FrontDoorName $frontDoorName `
    -ResourceGroupName $resourceGroup `
    -FrontendEndpointName $cachedFrontend.Name `
    -BackendPoolName $cachedBackendPool.Name `
    -AcceptedProtocol Https `
    -PatternsToMatch '/api/products/*', '/api/catalog/*' `
    -EnabledState Enabled `
    -DefaultCacheBehavior `
    -CacheDuration 'PT5M' `
    -ForwardingProtocol HttpsOnly

# 查看当前 Front Door 的流量统计
$endTime = Get-Date
$startTime = $endTime.AddDays(-7)

# 获取 Front Door 的指标数据
$metrics = Get-AzMetric `
    -ResourceId $frontDoor.Id `
    -MetricName 'RequestCount', 'BackendRequestLatency', 'CacheHitRatio' `
    -StartTime $startTime `
    -EndTime $endTime `
    -TimeGrain 'PT1H' `
    -AggregationType Total, Average

# 生成流量分析报告
$report = [PSCustomObject]@{
    时间范围       = "$startTime ~ $endTime"
    总请求数       = ($metrics | Where-Object { $_.Name -eq 'RequestCount' } |
                        ForEach-Object { $_.Timeseries.Data.TimeseriesDataValues } |
                        Measure-Object -Property Total -Sum).Sum
    平均延迟ms     = [math]::Round(
        ($metrics | Where-Object { $_.Name -eq 'BackendRequestLatency' } |
            ForEach-Object { $_.Timeseries.Data.TimeseriesDataValues } |
            Measure-Object -Property Average -Average).Average, 2)
    缓存命中率pct  = [math]::Round(
        ($metrics | Where-Object { $_.Name -eq 'CacheHitRatio' } |
            ForEach-Object { $_.Timeseries.Data.TimeseriesDataValues } |
            Measure-Object -Property Average -Average).Average * 100, 2)
}

Write-Host "`n=== Front Door 周报 ==="
$report | Format-List

# 列出所有路由规则及缓存状态
Write-Host "`n=== 当前路由规则 ==="
foreach ($rule in $frontDoor.RoutingRules) {
    $cacheStatus = if ($rule.Properties.RoutingRuleProperties.CacheConfiguration) {
        "已启用 (有效期: $($rule.Properties.RoutingRuleProperties.CacheConfiguration.CacheDuration))"
    } else {
        '未启用'
    }
    [PSCustomObject]@{
        规则名称    = $rule.Name
        匹配路径    = ($rule.Properties.RoutingRuleProperties.PatternsToMatch -join ', ')
        缓存状态    = $cacheStatus
        协议        = $rule.Properties.RoutingRuleProperties.AcceptedProtocols -join ', '
    } | Format-Table -AutoSize
}

# K8s 集群管理辅助函数集

function Get-K8sContexts {
    <# 获取所有可用的 K8s 上下文 #>
    $Raw = kubectl config get-contexts -o name 2>$null
    if ($LASTEXITCODE -ne 0) {
        Write-Error "无法获取 K8s 上下文，请确认 kubeconfig 已配置"
        return @()
    }
    return $Raw | Where-Object { $_.Trim() }
}

function Switch-K8sContext {
    param([Parameter(Mandatory)][string]$ContextName)
    kubectl config use-context $ContextName 2>$null | Out-Null
    if ($LASTEXITCODE -eq 0) {
        Write-Host "已切换到上下文: $ContextName" -ForegroundColor Green
    } else {
        Write-Error "切换上下文失败: $ContextName"
    }
}

function Get-K8sResourceSummary {
    param(
        [string]$Namespace = 'default',
        [string]$Context
    )

    if ($Context) { Switch-K8sContext $Context }

    # 查询 Pod 状态汇总
    $Pods = kubectl get pods -n $Namespace -o json 2>$null |
        ConvertFrom-Json

    $PodSummary = $Pods.items | Group-Object status.phase |
        Select-Object @{N='Phase'; E={$_.Name}}, Count

    # 查询 Deployment 状态
    $Deployments = kubectl get deployments -n $Namespace -o json 2>$null |
        ConvertFrom-Json

    $DeployStatus = $Deployments.items | ForEach-Object {
        $Replicas = $_.status.replicas ?? 0
        $Ready = $_.status.readyReplicas ?? 0
        $Updated = $_.status.updatedReplicas ?? 0
        [PSCustomObject]@{
            Name      = $_.metadata.name
            Replicas  = $Replicas
            Ready     = $Ready
            Updated   = $Updated
            Available = $_.status.availableReplicas ?? 0
            Status    = if ($Ready -eq $Replicas -and $Replicas -gt 0) { 'Healthy' } else { 'Degraded' }
        }
    }

    # 查询 Service 端点
    $Services = kubectl get services -n $Namespace -o json 2>$null |
        ConvertFrom-Json

    $SvcInfo = $Services.items | ForEach-Object {
        $Ports = ($_.spec.ports | ForEach-Object { "$($_.port):$($_.targetPort)/$($_.protocol)" }) -join ', '
        [PSCustomObject]@{
            Name  = $_.metadata.name
            Type  = $_.spec.type
            Ports = $Ports
            IP    = if ($_.spec.type -eq 'LoadBalancer') {
                $_.status.loadBalancer.ingress[0].ip ?? 'Pending'
            } else {
                $_.spec.clusterIP
            }
        }
    }

    Write-Host "`n=== Pod 状态汇总 (Namespace: $Namespace) ===" -ForegroundColor Cyan
    $PodSummary | Format-Table -AutoSize

    Write-Host "=== Deployment 状态 ===" -ForegroundColor Cyan
    $DeployStatus | Format-Table -AutoSize

    Write-Host "=== Service 列表 ===" -ForegroundColor Cyan
    $SvcInfo | Format-Table -AutoSize
}

# 使用示例
Write-Host "当前可用上下文:" -ForegroundColor Yellow
Get-K8sContexts

# 切换到生产集群并查看资源概况
Get-K8sResourceSummary -Namespace 'production' -Context 'prod-cluster'

# K8s 部署自动化工具

function New-K8sDeploymentManifest {
    param(
        [Parameter(Mandatory)][string]$AppName,
        [Parameter(Mandatory)][string]$Image,
        [int]$Replicas = 2,
        [int]$Port = 8080,
        [hashtable]$Labels = @{},
        [string]$Namespace = 'default'
    )

    $AllLabels = @{ app = $AppName } + $Labels

    $Manifest = @{
        apiVersion = 'apps/v1'
        kind       = 'Deployment'
        metadata   = @{
            name      = $AppName
            namespace = $Namespace
            labels    = $AllLabels
        }
        spec       = @{
            replicas = $Replicas
            selector = @{ matchLabels = @{ app = $AppName } }
            template = @{
                metadata = @{ labels = $AllLabels }
                spec     = @{
                    containers = @(
                        @{
                            name  = $AppName
                            image = $Image
                            ports = @(@{ containerPort = $Port })
                            resources = @{
                                requests = @{ cpu = '100m'; memory = '128Mi' }
                                limits   = @{ cpu = '500m'; memory = '512Mi' }
                            }
                            readinessProbe = @{
                                httpGet       = @{ path = '/health'; port = $Port }
                                initialDelaySeconds = 5
                                periodSeconds       = 10
                            }
                            livenessProbe = @{
                                httpGet       = @{ path = '/health'; port = $Port }
                                initialDelaySeconds = 15
                                periodSeconds       = 20
                            }
                        }
                    )
                }
            }
        }
    }

    return $Manifest
}

function Start-K8sRollingUpdate {
    param(
        [Parameter(Mandatory)][string]$AppName,
        [Parameter(Mandatory)][string]$NewImage,
        [string]$Namespace = 'default',
        [int]$TimeoutSeconds = 300
    )

    Write-Host "开始滚动更新: $AppName -> $NewImage" -ForegroundColor Cyan

    # 设置新镜像
    kubectl set image "deployment/$AppName" `
        "$AppName=$NewImage" -n $Namespace 2>$null | Out-Null

    if ($LASTEXITCODE -ne 0) {
        Write-Error "设置镜像失败"
        return $false
    }

    # 等待滚动更新完成
    Write-Host "等待滚动更新完成 (超时: ${TimeoutSeconds}s)..." -ForegroundColor Yellow
    $Deadline = (Get-Date).AddSeconds($TimeoutSeconds)

    while ((Get-Date) -lt $Deadline) {
        $Status = kubectl rollout status "deployment/$AppName" `
            -n $Namespace --timeout=30s 2>&1

        if ($LASTEXITCODE -eq 0) {
            Write-Host "滚动更新成功: $AppName" -ForegroundColor Green
            return $true
        }

        # 显示当前 Pod 状态
        $Pods = kubectl get pods -n $Namespace -l "app=$AppName" -o json 2>$null |
            ConvertFrom-Json

        $Pods.items | ForEach-Object {
            $Phase = $_.status.phase
            $Containers = $_.status.containerStatuses
            $Ready = ($Containers | Where-Object { $_.ready }).Count
            $Total = $Containers.Count
            Write-Host "  Pod: $($_.metadata.name) | Phase: $Phase | Ready: $Ready/$Total"
        }

        Start-Sleep -Seconds 5
    }

    Write-Warning "滚动更新超时，准备回滚..."
    Undo-K8sRollout -AppName $AppName -Namespace $Namespace
    return $false
}

function Undo-K8sRollout {
    param(
        [Parameter(Mandatory)][string]$AppName,
        [string]$Namespace = 'default',
        [int]$Revision = 0
    )

    if ($Revision -eq 0) {
        Write-Host "回滚到上一版本: $AppName" -ForegroundColor Yellow
        kubectl rollout undo "deployment/$AppName" -n $Namespace 2>$null
    } else {
        Write-Host "回滚到修订版本 $Revision: $AppName" -ForegroundColor Yellow
        kubectl rollout undo "deployment/$AppName" -n $Namespace --to-revision=$Revision 2>$null
    }

    if ($LASTEXITCODE -eq 0) {
        Write-Host "回滚成功" -ForegroundColor Green
        # 查看部署历史
        kubectl rollout history "deployment/$AppName" -n $Namespace
    } else {
        Write-Error "回滚失败"
    }
}

# 生成部署清单并应用
$Manifest = New-K8sDeploymentManifest `
    -AppName 'web-frontend' `
    -Image 'registry.example.com/web-frontend:v2.3.0' `
    -Replicas 3 `
    -Port 8080 `
    -Labels @{ tier = 'frontend'; env = 'production' } `
    -Namespace 'production'

$YamlPath = '/tmp/web-frontend-deployment.yaml'
$Manifest | ConvertTo-Json -Depth 10 | Set-Content $YamlPath
kubectl apply -f $YamlPath

# 执行滚动更新
Start-K8sRollingUpdate `
    -AppName 'web-frontend' `
    -NewImage 'registry.example.com/web-frontend:v2.4.0' `
    -Namespace 'production' `
    -TimeoutSeconds 300