#!/usr/bin/env pwsh

[CmdletBinding()]
param(
    [Alias("n")]
    [string]$AppName,
    [Alias("h")]
    [switch]$Help
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

function Show-Usage {
    Write-Host "Usage: ./New-PublicClientApplication.ps1 -AppName <name>"
    Write-Host "Options:"
    Write-Host "  -AppName, -n <name>  Application display name (required)"
    Write-Host "  -Help, -h            Show this help message and exit"
}

function Get-RequiredResourceAccess {
    param(
        [Parameter(Mandatory = $true)]
        [string]$M365GraphAppId,
        [Parameter(Mandatory = $true)]
        [string]$M365GraphScopeId,
        [Parameter(Mandatory = $true)]
        [string]$AzureDevOpsAppId,
        [Parameter(Mandatory = $true)]
        [string]$AzureDevOpsScopeId,
        [Parameter(Mandatory = $true)]
        [string]$AzureServiceMgmtAppId,
        [Parameter(Mandatory = $true)]
        [string]$AzureServiceMgmtScopeId
    )

    return @(
        @{
            resourceAppId = $M365GraphAppId
            resourceAccess = @(
                @{
                    id = $M365GraphScopeId
                    type = "Scope"
                }
            )
        },
        @{
            resourceAppId = $AzureDevOpsAppId
            resourceAccess = @(
                @{
                    id = $AzureDevOpsScopeId
                    type = "Scope"
                }
            )
        },
        @{
            resourceAppId = $AzureServiceMgmtAppId
            resourceAccess = @(
                @{
                    id = $AzureServiceMgmtScopeId
                    type = "Scope"
                }
            )
        }
    )
}

if ($Help) {
    Show-Usage
    exit 0
}

if ([string]::IsNullOrWhiteSpace($AppName)) {
    Write-Error "Application name is required."
    Show-Usage
    exit 1
}

$m365GraphAppId = "00000003-0000-0000-c000-000000000000"
$m365GraphScopeId = "0e263e50-5827-48a4-b97c-d940288653c7"
$azureServiceMgmtAppId = "797f4846-ba00-4fd7-ba43-dac1f8f63013"
$azureServiceMgmtScopeId = "41094075-9dad-400e-a0bd-54e686782033"
$azureDevOpsAppId = "499b84ac-1321-427f-aa17-267ca6975798"
$azureDevOpsScopeId = "ee69721e-6c3a-468f-a9ec-302d16a4c599"

if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
    throw "Azure CLI 'az' is required."
}

# Find the app by name
$existingAppId = az ad app list --display-name $AppName --query "[0].appId" -o tsv
if ($LASTEXITCODE -ne 0) {
    throw "Failed to query existing applications."
}
if (-not [string]::IsNullOrWhiteSpace($existingAppId)) {
    Write-Error "Application '$AppName' already exists."
    exit 1
}

# Create the app
$appId = az ad app create --display-name $AppName --query "appId" -o tsv
if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($appId)) {
    throw "Failed to create application '$AppName'."
}

$requiredResourceAccess = Get-RequiredResourceAccess `
    -M365GraphAppId $m365GraphAppId `
    -M365GraphScopeId $m365GraphScopeId `
    -AzureDevOpsAppId $azureDevOpsAppId `
    -AzureDevOpsScopeId $azureDevOpsScopeId `
    -AzureServiceMgmtAppId $azureServiceMgmtAppId `
    -AzureServiceMgmtScopeId $azureServiceMgmtScopeId | ConvertTo-Json -Depth 10 -Compress

$publicClientRedirectUris = @(
    "http://localhost",
    "msal${appId}://auth"
) | ConvertTo-Json -Compress

# Configure app to match "Azure Node Playground Public".
az ad app update `
    --id $appId `
    --set `
    "signInAudience=AzureADMyOrg" `
    "isFallbackPublicClient=true" `
    "requiredResourceAccess=$requiredResourceAccess" `
    "publicClient.redirectUris=$publicClientRedirectUris" `
    "web.implicitGrantSettings.enableAccessTokenIssuance=true" `
    "web.implicitGrantSettings.enableIdTokenIssuance=true" | Out-Null

if ($LASTEXITCODE -ne 0) {
    throw "Failed to configure application '$AppName'."
}

# Azure CLI is used to grant admin consent.

# Ensure service principal exists before granting tenant-wide admin consent.
az ad sp create --id $appId | Out-Null
if ($LASTEXITCODE -ne 0) {
    throw "Failed to ensure service principal exists for '$AppName' ($appId)."
}

# Grant admin consent for configured delegated permissions.
az ad app permission admin-consent --id $appId | Out-Null
if ($LASTEXITCODE -ne 0) {
    throw "Failed to grant admin consent for '$AppName' ($appId)."
}

Write-Host "Created application '$AppName'"
Write-Host "appId: $appId"