<#
.SYNOPSIS
    One-time setup for Entra Config Baseline (https://baseline.hsystems.network).

.DESCRIPTION
    Run this as a Global Administrator of the Hulsman Systems tenant
    (fe753ce1-dbf2-4e22-b5ca-232f4884c037). It creates the two app
    registrations the tool needs and prints the values to paste into
    https://baseline.hsystems.network/setup — no manual portal clicking
    required. Nothing is sent anywhere by this script; the values only
    appear in this console.

    App 1 - Login: single-tenant, delegated User.Read only, used to sign
    in to the tool itself.

    App 2 - Graph connector: multi-tenant, application permissions
    (Policy.Read.All, Policy.ReadWrite.SecurityDefaults), used to read/
    compare Entra settings across every tenant you connect afterwards
    from inside the tool (each of those tenants grants consent
    separately via the "Verbinden" button - this script only creates
    the app itself).

.NOTES
    Requires the Microsoft.Graph.Applications and Microsoft.Graph.Authentication
    PowerShell modules (installed automatically below if missing).
#>

$ErrorActionPreference = 'Stop'

$AppUrl = 'https://baseline.hsystems.network'
$HulsmanTenantId = 'fe753ce1-dbf2-4e22-b5ca-232f4884c037'
$GraphResourceAppId = '00000003-0000-0000-c000-000000000000' # Microsoft Graph

foreach ($module in 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Applications', 'Microsoft.Graph.Identity.SignIns') {
    if (-not (Get-Module -ListAvailable -Name $module)) {
        Write-Host "Installing $module ..."
        Install-Module $module -Scope CurrentUser -Force -AllowClobber
    }
}

Write-Host "Signing in as a Global Administrator of $HulsmanTenantId ..."
Connect-MgGraph -TenantId $HulsmanTenantId -Scopes 'Application.ReadWrite.All' -NoWelcome

function Get-ScopeId {
    param([string]$Name, [ValidateSet('Delegated', 'Application')][string]$Type)
    $match = Find-MgGraphPermission -SearchString $Name -PermissionType $Type -ExactMatch
    if (-not $match) { throw "Could not resolve Graph permission '$Name' ($Type)." }
    return $match.Id
}

# ---------------------------------------------------------------------------
# App 1: Login (single-tenant, delegated)
# ---------------------------------------------------------------------------
Write-Host "`nCreating login app registration ..."

$userReadId = Get-ScopeId -Name 'User.Read' -Type Delegated

$loginApp = New-MgApplication -DisplayName 'Entra Config Baseline - Login' `
    -SignInAudience 'AzureADMyOrg' `
    -Web @{ RedirectUris = @("$AppUrl/auth/microsoft/callback") } `
    -RequiredResourceAccess @(
        @{
            ResourceAppId  = $GraphResourceAppId
            ResourceAccess = @(@{ Id = $userReadId; Type = 'Scope' })
        }
    )

$loginSecret = Add-MgApplicationPassword -ApplicationId $loginApp.Id -PasswordCredential @{ DisplayName = 'setup' }
New-MgServicePrincipal -AppId $loginApp.AppId | Out-Null

# ---------------------------------------------------------------------------
# App 2: Graph connector (multi-tenant, application permissions)
# ---------------------------------------------------------------------------
Write-Host "Creating Graph connector app registration ..."

$policyReadId = Get-ScopeId -Name 'Policy.Read.All' -Type Application
$policySecDefId = Get-ScopeId -Name 'Policy.ReadWrite.SecurityDefaults' -Type Application

$connectorApp = New-MgApplication -DisplayName 'Entra Config Baseline - Graph Connector' `
    -SignInAudience 'AzureADMultipleOrgs' `
    -Web @{ RedirectUris = @("$AppUrl/tenants/consent/callback") } `
    -RequiredResourceAccess @(
        @{
            ResourceAppId  = $GraphResourceAppId
            ResourceAccess = @(
                @{ Id = $policyReadId; Type = 'Role' }
                @{ Id = $policySecDefId; Type = 'Role' }
            )
        }
    )

$connectorSecret = Add-MgApplicationPassword -ApplicationId $connectorApp.Id -PasswordCredential @{ DisplayName = 'setup' }
New-MgServicePrincipal -AppId $connectorApp.AppId | Out-Null

# ---------------------------------------------------------------------------
Write-Host "`n=========================================================="
Write-Host "Done. Paste these into $AppUrl/setup :"
Write-Host "=========================================================="
Write-Host "Login tenant ID:          $HulsmanTenantId"
Write-Host "Login client ID:          $($loginApp.AppId)"
Write-Host "Login client secret:      $($loginSecret.SecretText)"
Write-Host "Connector client ID:      $($connectorApp.AppId)"
Write-Host "Connector client secret:  $($connectorSecret.SecretText)"
Write-Host "=========================================================="
Write-Host "The secrets are shown once only - copy them now."