#Requires -Version 5.1
<#
.SYNOPSIS
  Runs a one-shot, customer-local Power BI workspace metadata scan.
.DESCRIPTION
  Uses Microsoft's first-party Power BI PowerShell user sign-in. It makes only
  GET requests to the Power BI REST API and writes one JSON file on this
  computer. It does not call any web application or send data to a consultant.
.EXAMPLE
  ./Scan-PowerBI.ps1 -ListWorkspaces
.EXAMPLE
  ./Scan-PowerBI.ps1 -WorkspaceId '00000000-0000-0000-0000-000000000001' -OutputPath './powerbi-scan.json'
#>
[CmdletBinding(DefaultParameterSetName = 'Scan')]
param(
    [Parameter(Mandatory = $true, ParameterSetName = 'List')]
    [switch] $ListWorkspaces,

    [Parameter(Mandatory = $true, ParameterSetName = 'Scan')]
    [string[]] $WorkspaceId,

    [Parameter(Mandatory = $true, ParameterSetName = 'Scan')]
    [string] $OutputPath,

    [Parameter(ParameterSetName = 'Scan')]
    [string] $TenantName = 'Connected Power BI workspaces',

    [Parameter(ParameterSetName = 'Scan')]
    [switch] $ExcludeWorkspaceUsers,

    [Parameter(ParameterSetName = 'Scan')]
    [switch] $Force
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
$PageSize = 100
$MaxPages = 200
$MaxAttempts = 3
$MaxReports = 100
$MaxModels = 100
$MaxRefreshes = 6000
$MaxUsers = 5000
$MaxSnapshotBytes = 8 * 1024 * 1024

function Get-PropertyValue {
    param([object] $InputObject, [string] $Name)
    if ($null -eq $InputObject) { return $null }
    $property = $InputObject.PSObject.Properties[$Name]
    if ($null -eq $property) { return $null }
    return $property.Value
}

function Get-RequiredString {
    param([object] $InputObject, [string] $Name, [int] $MaximumLength = 500)
    $value = Get-PropertyValue $InputObject $Name
    if (($value -isnot [string]) -or [string]::IsNullOrWhiteSpace($value) -or $value.Trim().Length -gt $MaximumLength) {
        throw 'INVALID_RESPONSE'
    }
    return $value.Trim()
}

function Get-OptionalString {
    param([object] $InputObject, [string] $Name, [int] $MaximumLength = 500)
    $value = Get-PropertyValue $InputObject $Name
    if ($null -eq $value -or $value -eq '') { return $null }
    if (($value -isnot [string]) -or $value.Trim().Length -gt $MaximumLength) {
        throw 'INVALID_RESPONSE'
    }
    return $value.Trim()
}

function Get-EntityId {
    param([object] $InputObject, [string] $Name)
    # Power BI IDs are normally GUIDs. Canonicalizing GUIDs avoids false
    # cross-reference failures when different endpoints vary letter case.
    $value = Get-RequiredString $InputObject $Name 120
    $parsed = [guid]::Empty
    if ([guid]::TryParse($value, [ref] $parsed)) { return $parsed.ToString() }
    return $value.ToLowerInvariant()
}

function Get-RequiredDate {
    param([object] $InputObject, [string] $Name)
    $value = Get-PropertyValue $InputObject $Name
    try {
        if ($value -is [DateTimeOffset]) { return $value }
        if ($value -is [DateTime]) {
            if ($value.Kind -eq [DateTimeKind]::Unspecified) { throw 'INVALID_RESPONSE' }
            return [DateTimeOffset] $value
        }
        if ($value -is [string] -and $value.Length -le 80 -and $value -match '(?:[zZ]|[+-]\d{2}:\d{2})$') {
            return [DateTimeOffset]::Parse($value, [Globalization.CultureInfo]::InvariantCulture)
        }
    } catch { }
    throw 'INVALID_RESPONSE'
}

function Assert-UniqueIds {
    param([object[]] $Items)
    $seen = @{}
    foreach ($item in $Items) {
        if ($seen.ContainsKey($item.id)) { throw 'INVALID_RESPONSE' }
        $seen[$item.id] = $true
    }
}

function Get-HttpStatus {
    param([System.Management.Automation.ErrorRecord] $Failure)
    $exception = $Failure.Exception
    for ($depth = 0; ($null -ne $exception) -and ($depth -lt 5); $depth++) {
        $response = Get-PropertyValue $exception 'Response'
        $status = Get-PropertyValue $response 'StatusCode'
        if ($null -ne $status) {
            try { return [int] $status } catch { }
        }
        $exception = $exception.InnerException
    }

    # Some Power BI module versions include the HTTP status only in the
    # exception text. Read it for classification, never copy the text to output.
    $message = [string] $Failure.Exception.Message
    $match = [regex]::Match($message, '(?<!\d)(401|403|404|429|500|502|503|504)(?!\d)')
    if ($match.Success) { return [int] $match.Groups[1].Value }
    return 0
}

function Get-SafeFailure {
    param([System.Management.Automation.ErrorRecord] $Failure)
    $status = Get-HttpStatus $Failure
    if ($status -eq 403) { return @{ status = 'forbidden'; httpStatus = 403; errorCode = 'HTTP_403' } }
    if ($status -gt 0) { return @{ status = 'error'; httpStatus = $status; errorCode = "HTTP_$status" } }
    $knownCodes = @('INVALID_RESPONSE', 'PAGE_LIMIT_EXCEEDED', 'ITEM_LIMIT_EXCEEDED', 'UNSUPPORTED_REFRESH_STATUS')
    if ($Failure.Exception.Message -in $knownCodes) {
        return @{ status = 'error'; errorCode = $Failure.Exception.Message }
    }
    return @{ status = 'error'; errorCode = 'REQUEST_FAILED' }
}

function Invoke-ReadJson {
    param([string] $Path)
    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
        try {
            $raw = Invoke-PowerBIRestMethod -Url $Path -Method Get -TimeoutSec 30 -ErrorAction Stop
            $body = ConvertFrom-Json -InputObject $raw -ErrorAction Stop
            if ($null -eq $body) { throw 'INVALID_RESPONSE' }
            return $body
        } catch {
            $status = Get-HttpStatus $_
            if (($attempt -lt $MaxAttempts) -and ($status -in @(429, 500, 502, 503, 504))) {
                Start-Sleep -Seconds ([math]::Pow(2, $attempt - 1))
                continue
            }
            throw
        }
    }
}

function Get-ApiItems {
    param([string] $Path)
    $body = Invoke-ReadJson $Path
    # Read the property directly: a PowerShell function would otherwise
    # enumerate an array return value (and collapse one/zero-item lists).
    $property = $body.PSObject.Properties['value']
    if ($null -eq $property -or $property.Value -isnot [array]) { throw 'INVALID_RESPONSE' }
    return ,$property.Value
}

function Get-PagedItems {
    param([string] $Path)
    $all = New-Object 'System.Collections.Generic.List[object]'
    $seen = New-Object 'System.Collections.Generic.HashSet[string]'
    for ($page = 0; $page -lt $MaxPages; $page++) {
        $separator = if ($Path.Contains('?')) { '&' } else { '?' }
        $pagePath = $Path + $separator + '$top=' + $PageSize + '&$skip=' + ($page * $PageSize)
        $items = Get-ApiItems $pagePath
        foreach ($item in $items) {
            # Repeated pages must not silently turn into a complete inventory.
            $identifier = Get-PropertyValue $item 'id'
            if ($null -eq $identifier) {
                $identifier = Get-PropertyValue $item 'identifier'
                $kind = Get-PropertyValue $item 'principalType'
                if ($kind -is [string]) { $identifier = "${kind}:${identifier}" }
            }
            if ($identifier -isnot [string] -or [string]::IsNullOrWhiteSpace($identifier)) { throw 'INVALID_RESPONSE' }
            if (-not $seen.Add($identifier.ToLowerInvariant())) { throw 'INVALID_RESPONSE' }
            $all.Add($item)
        }
        if ($items.Count -lt $PageSize) { return ,$all.ToArray() }
    }
    throw 'PAGE_LIMIT_EXCEEDED'
}

function Add-Coverage {
    param(
        [string] $Resource,
        [string] $Workspace,
        [string] $Model,
        [string] $Status,
        [System.Management.Automation.ErrorRecord] $Failure
    )
    $entry = @{ resource = $Resource; status = $Status }
    if ($Workspace) { $entry.workspaceId = $Workspace }
    if ($Model) { $entry.semanticModelId = $Model }
    if ($null -ne $Failure) {
        $safe = Get-SafeFailure $Failure
        $entry.status = $safe.status
        $entry.errorCode = $safe.errorCode
        if ($safe.ContainsKey('httpStatus')) { $entry.httpStatus = $safe.httpStatus }
    }
    $script:coverage.Add($entry)
}

function Get-RefreshErrorCode {
    param([object] $Refresh)
    $raw = Get-PropertyValue $Refresh 'serviceExceptionJson'
    if ($raw -isnot [string] -or [string]::IsNullOrWhiteSpace($raw)) { return $null }
    try {
        $parsed = ConvertFrom-Json -InputObject $raw -ErrorAction Stop
        $code = Get-PropertyValue $parsed 'errorCode'
        if ($code -is [string] -and $code.Length -le 100 -and $code -match '^[A-Za-z0-9_.-]+$') {
            return $code
        }
    } catch { }
    # Raw serviceExceptionJson can contain gateway/source details. Omit it.
    return $null
}

function Get-NormalizedRefresh {
    param([object] $Item, [string] $Workspace, [string] $Model)
    $status = Get-RequiredString $Item 'status'
    if ($status -eq 'Unknown') { return $null } # In progress; no end time.
    if ($status -eq 'Disabled') { throw 'UNSUPPORTED_REFRESH_STATUS' }
    if ($status -notin @('Completed', 'Failed', 'Cancelled')) { throw 'INVALID_RESPONSE' }

    $startAt = Get-RequiredDate $Item 'startTime'
    $endAt = Get-RequiredDate $Item 'endTime'
    if ($endAt -lt $startAt) { throw 'INVALID_RESPONSE' }
    $requestId = Get-OptionalString $Item 'requestId' 200
    if ($requestId -isnot [string] -or [string]::IsNullOrWhiteSpace($requestId)) {
        $requestId = "$Model-$($startAt.ToUniversalTime().Ticks)"
    }
    $record = @{
        id = $requestId
        workspaceId = $Workspace
        semanticModelId = $Model
        status = $status
        startTime = $startAt.ToUniversalTime().ToString('o')
        endTime = $endAt.ToUniversalTime().ToString('o')
        durationSeconds = [math]::Max(0, ($endAt - $startAt).TotalSeconds)
    }
    $errorCode = Get-RefreshErrorCode $Item
    if ($errorCode) { $record.error = $errorCode }
    return $record
}

if (-not (Get-Module -ListAvailable -Name MicrosoftPowerBIMgmt.Profile)) {
    throw 'MicrosoftPowerBIMgmt.Profile is not installed. Ask IT to approve it or run Install-Module -Name MicrosoftPowerBIMgmt.Profile -Scope CurrentUser.'
}
Import-Module MicrosoftPowerBIMgmt.Profile -ErrorAction Stop

$selectedIds = @()
$finalPath = $null
if ($PSCmdlet.ParameterSetName -eq 'Scan') {
    if ($WorkspaceId.Count -gt 3) { throw 'Select at most 3 workspace IDs per scan.' }
    foreach ($candidate in $WorkspaceId) {
        $parsed = [guid]::Empty
        if (-not [guid]::TryParse($candidate, [ref] $parsed)) {
            throw 'Each WorkspaceId must be a GUID copied from a Power BI workspace URL.'
        }
        $selectedIds += $parsed.ToString()
    }
    $selectedIds = @($selectedIds | Select-Object -Unique)
    if ([string]::IsNullOrWhiteSpace($TenantName) -or $TenantName.Trim().Length -gt 500) {
        throw 'TenantName must contain 1 to 500 characters.'
    }
    if ($OutputPath -match '^[a-zA-Z]+://' -or $OutputPath.StartsWith('\\')) {
        throw 'OutputPath must be a local file path, not a URL or UNC path.'
    }
    $finalPath = [IO.Path]::GetFullPath($OutputPath)
    if ([IO.Path]::GetExtension($finalPath).ToLowerInvariant() -ne '.json') {
        throw 'OutputPath must end in .json.'
    }
    if (-not (Test-Path -LiteralPath ([IO.Path]::GetDirectoryName($finalPath)) -PathType Container)) {
        throw 'The output directory does not exist.'
    }
    if ((Test-Path -LiteralPath $finalPath) -and (-not $Force)) {
        throw 'Output file already exists. Choose a different path or pass -Force to replace it.'
    }
    if (Test-Path -LiteralPath $finalPath) {
        $existing = Get-Item -LiteralPath $finalPath -Force
        if ($existing.PSIsContainer -or ($existing.Attributes -band [IO.FileAttributes]::ReparsePoint)) {
            throw 'OutputPath must be a regular JSON file, not a directory or symbolic link.'
        }
    }
}

$coverage = New-Object 'System.Collections.Generic.List[object]'
$authenticated = $false
try {
    try {
        Connect-PowerBIServiceAccount -ErrorAction Stop | Out-Null
        $authenticated = $true
    } catch {
        throw 'Microsoft Power BI sign-in failed. Check your organization sign-in policy and try again.'
    }

    try {
        $workspaceItems = Get-PagedItems 'groups'
        $workspaces = New-Object 'System.Collections.Generic.List[object]'
        foreach ($item in $workspaceItems) {
            $id = Get-EntityId $item 'id'
            $name = Get-RequiredString $item 'name'
            $capacity = 'Unknown'
            $dedicated = Get-PropertyValue $item 'isOnDedicatedCapacity'
            if ($dedicated -eq $true) { $capacity = 'Dedicated' }
            if ($dedicated -eq $false) { $capacity = 'Shared' }
            $workspaces.Add(@{
                id = $id
                name = $name
                description = ''
                state = 'Unknown'
                capacity = $capacity
            })
        }
        Add-Coverage -Resource 'workspaces' -Status 'ok'
    } catch {
        # Without an inventory the requested allowlist cannot be verified.
        $failure = Get-SafeFailure $_
        throw "Could not list accessible workspaces ($($failure.errorCode)). No scan file was written; check Power BI access and retry."
    }

    if ($ListWorkspaces) {
        $workspaces.ToArray() | Sort-Object name | Select-Object id, name
        Write-Host 'Copy only the workspace IDs explicitly approved for this scan.'
        return
    }

    $selected = New-Object 'System.Collections.Generic.List[object]'
    foreach ($id in $selectedIds) {
        $found = @($workspaces.ToArray() | Where-Object { $_.id -eq $id })
        if ($found.Count -ne 1) {
            throw "Workspace ID $id is not accessible to this signed-in user. No scan file was written."
        }
        $selected.Add($found[0])
    }

    $reports = New-Object 'System.Collections.Generic.List[object]'
    $models = New-Object 'System.Collections.Generic.List[object]'
    $refreshes = New-Object 'System.Collections.Generic.List[object]'
    $users = New-Object 'System.Collections.Generic.List[object]'

    foreach ($workspace in $selected) {
        $id = $workspace.id
        Write-Host "Scanning workspace $id"

        try {
            $items = Get-ApiItems "groups/$id/reports"
            $normalized = New-Object 'System.Collections.Generic.List[object]'
            foreach ($item in $items) {
                $report = @{
                    id = (Get-EntityId $item 'id')
                    workspaceId = $id
                    name = (Get-RequiredString $item 'name' 250)
                }
                $modelId = Get-OptionalString $item 'datasetId' 120
                if ($modelId) { $report.semanticModelId = $modelId.ToLowerInvariant() }
                $normalized.Add($report)
            }
            if ($reports.Count + $normalized.Count -gt $MaxReports) { throw 'ITEM_LIMIT_EXCEEDED' }
            foreach ($report in $normalized) { $reports.Add($report) }
            Add-Coverage -Resource 'reports' -Workspace $id -Status 'ok'
        } catch {
            Add-Coverage -Resource 'reports' -Workspace $id -Failure $_
        }

        $workspaceModels = New-Object 'System.Collections.Generic.List[object]'
        try {
            $items = Get-ApiItems "groups/$id/datasets"
            foreach ($item in $items) {
                $model = @{
                    id = (Get-EntityId $item 'id')
                    workspaceId = $id
                    name = (Get-RequiredString $item 'name')
                }
                $configuredBy = Get-OptionalString $item 'configuredBy' 500
                if ($configuredBy) {
                    $model.configuredBy = $configuredBy
                }
                $refreshable = Get-PropertyValue $item 'isRefreshable'
                if ($refreshable -is [bool]) { $model.isRefreshable = $refreshable }
                $workspaceModels.Add($model)
            }
            if ($models.Count + $workspaceModels.Count -gt $MaxModels) { throw 'ITEM_LIMIT_EXCEEDED' }
            foreach ($model in $workspaceModels) { $models.Add($model) }
            Add-Coverage -Resource 'semanticModels' -Workspace $id -Status 'ok'
        } catch {
            # Do not request refreshes for a partially parsed model list.
            $workspaceModels.Clear()
            Add-Coverage -Resource 'semanticModels' -Workspace $id -Failure $_
        }

        if ($ExcludeWorkspaceUsers) {
            Add-Coverage -Resource 'workspaceUsers' -Workspace $id -Status 'skipped'
        } else {
            try {
                $items = Get-PagedItems "groups/$id/users"
                $normalized = New-Object 'System.Collections.Generic.List[object]'
                foreach ($item in $items) {
                    $right = Get-RequiredString $item 'groupUserAccessRight'
                    if ($right -eq 'None') { continue }
                    if ($right -notin @('Admin', 'Member', 'Contributor', 'Viewer')) { throw 'INVALID_RESPONSE' }
                    $principalType = Get-RequiredString $item 'principalType'
                    if ($principalType -notin @('User', 'Group', 'App')) { throw 'INVALID_RESPONSE' }
                    $userId = Get-RequiredString $item 'identifier' 200
                    $displayName = Get-OptionalString $item 'displayName' 500
                    $email = Get-OptionalString $item 'emailAddress' 300
                    if ($null -eq $email) { $email = '' }
                    if (-not $displayName) {
                        $displayName = if ($email.Length -gt 0) { $email } else { $userId }
                    }
                    $normalized.Add(@{
                        id = "${id}:${principalType}:${userId}"
                        userId = $userId
                        workspaceId = $id
                        displayName = $displayName
                        email = $email
                        principalType = $principalType
                        accessRight = $right
                    })
                }
                if ($users.Count + $normalized.Count -gt $MaxUsers) { throw 'ITEM_LIMIT_EXCEEDED' }
                foreach ($user in $normalized) { $users.Add($user) }
                Add-Coverage -Resource 'workspaceUsers' -Workspace $id -Status 'ok'
            } catch {
                Add-Coverage -Resource 'workspaceUsers' -Workspace $id -Failure $_
            }
        }

        foreach ($model in $workspaceModels) {
            if ($model.ContainsKey('isRefreshable') -and $model.isRefreshable -eq $false) {
                Add-Coverage -Resource 'refreshHistory' -Workspace $id -Model $model.id -Status 'skipped'
                continue
            }
            try {
                $items = Get-ApiItems ('groups/' + $id + '/datasets/' + $model.id + '/refreshes?$top=60')
                $normalized = New-Object 'System.Collections.Generic.List[object]'
                foreach ($item in $items) {
                    $record = Get-NormalizedRefresh $item $id $model.id
                    if ($null -ne $record) { $normalized.Add($record) }
                }
                if ($refreshes.Count + $normalized.Count -gt $MaxRefreshes) { throw 'ITEM_LIMIT_EXCEEDED' }
                foreach ($record in $normalized) { $refreshes.Add($record) }
                Add-Coverage -Resource 'refreshHistory' -Workspace $id -Model $model.id -Status 'ok'
            } catch {
                Add-Coverage -Resource 'refreshHistory' -Workspace $id -Model $model.id -Failure $_
            }
        }
    }

    # Never produce a file that the browser rejects because of duplicate IDs.
    Assert-UniqueIds -Items ($reports.ToArray())
    Assert-UniqueIds -Items ($models.ToArray())
    Assert-UniqueIds -Items ($users.ToArray())

    $timestamp = [DateTimeOffset]::UtcNow.ToString('o')
    $snapshot = @{
        schemaVersion = 1
        source = 'powerbi-local'
        snapshotAt = $timestamp
        tenantName = $TenantName.Trim()
        scope = @{ workspaceIds = @($selectedIds) }
        environment = @{
            snapshotAt = $timestamp
            tenantName = $TenantName.Trim()
            workspaces = $selected.ToArray()
            reports = $reports.ToArray()
            semanticModels = $models.ToArray()
            refreshHistory = $refreshes.ToArray()
            directoryUsers = @()
            workspaceUsers = $users.ToArray()
        }
        coverage = $coverage.ToArray()
    }

    $json = ConvertTo-Json -InputObject $snapshot -Depth 12 -Compress
    if ([System.Text.Encoding]::UTF8.GetByteCount($json) -gt $MaxSnapshotBytes) {
        throw 'Scan exceeds the 8 MiB browser import limit. No file was written. Select fewer workspaces or use -ExcludeWorkspaceUsers, then retry.'
    }
    $directory = [IO.Path]::GetDirectoryName($finalPath)
    $temporaryPath = [IO.Path]::Combine($directory, ([IO.Path]::GetRandomFileName() + '.json'))
    try {
        [IO.File]::WriteAllText($temporaryPath, $json, [System.Text.UTF8Encoding]::new($false))
        Move-Item -LiteralPath $temporaryPath -Destination $finalPath -Force:$Force -ErrorAction Stop
    } finally {
        if (Test-Path -LiteralPath $temporaryPath) { Remove-Item -LiteralPath $temporaryPath -Force }
    }
    Write-Host "Saved local scan: $finalPath"
    Write-Host ("{0} workspaces; {1} endpoint results (including skipped/failed checks)." -f $selected.Count, $coverage.Count)
    Write-Host 'Review this JSON before choosing whether to share it. It may contain names and email addresses.'
} finally {
    if ($authenticated) {
        Disconnect-PowerBIServiceAccount -ErrorAction SilentlyContinue | Out-Null
    }
}