<#
.SYNOPSIS
    WPSecure Signature Inserter — Setup Verification Script
.DESCRIPTION
    Verifies that all components of the WPSecure Outlook Web Add-in are correctly
    configured. Checks the Azure Web App, App Registration, Blob Storage, and
    Entra ID groups. Produces a colour-coded pass/fail report.
.NOTES
    Legal entity : OSD365 Limited
    Product      : WPSecure Signature Inserter
    Website      : https://www.wpsecure.shop
    Requires     : Az, Microsoft.Graph PowerShell modules
#>


$ErrorActionPreference = 'Stop'

# ─────────────────────────────────────────────────────────────────────────────
# COLOUR HELPERS
# ─────────────────────────────────────────────────────────────────────────────
function Write-Pass   { param([string]$msg) Write-Host "  [PASS] $msg" -ForegroundColor Green  }
function Write-Fail   { param([string]$msg) Write-Host "  [FAIL] $msg" -ForegroundColor Red    }
function Write-Warn   { param([string]$msg) Write-Host "  [WARN] $msg" -ForegroundColor Yellow }
function Write-Info   { param([string]$msg) Write-Host "  [INFO] $msg" -ForegroundColor Cyan   }
function Write-Header { param([string]$msg) Write-Host "`n$msg" -ForegroundColor White         }
function Write-Sep    { Write-Host ("─" * 72) -ForegroundColor DarkGray }

$script:PassCount = 0
$script:FailCount = 0
$script:WarnCount = 0

function Add-Pass { $script:PassCount++; Write-Pass @args }
function Add-Fail { $script:FailCount++; Write-Fail @args }
function Add-Warn { $script:WarnCount++; Write-Warn @args }

# ─────────────────────────────────────────────────────────────────────────────
# BANNER
# ─────────────────────────────────────────────────────────────────────────────
Clear-Host
Write-Host ""
Write-Host "  ╔══════════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host "  ║        WPSecure Signature Inserter — Setup Verification         ║" -ForegroundColor Cyan
Write-Host "  ║        OSD365 Limited  |  www.wpsecure.shop                     ║" -ForegroundColor Cyan
Write-Host "  ╚══════════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
Write-Host ""

# ─────────────────────────────────────────────────────────────────────────────
# COLLECT INPUT
# ─────────────────────────────────────────────────────────────────────────────
Write-Host "  Enter the domain of your WPSecure Azure Web App." -ForegroundColor White
Write-Host "  Example: wpsecure-outlook-webaddin-7000.azurewebsites.net" -ForegroundColor DarkGray
Write-Host ""
$inputDomain = (Read-Host "  Web App Domain").Trim().TrimEnd('/').ToLower()

# Strip https:// if the user included it anyway
$inputDomain = $inputDomain -replace '^https?://', ''

if ([string]::IsNullOrWhiteSpace($inputDomain)) {
    Write-Host "`n  [ERROR] No domain entered." -ForegroundColor Red
    exit 1
}

# Build the full URL and derive the Web App name
$rawUrl     = "https://$inputDomain"
$webAppName = $inputDomain.Split('.')[0]

Write-Host ""
Write-Info "Web App name detected: $webAppName"
Write-Sep

# ─────────────────────────────────────────────────────────────────────────────
# MODULE CHECK
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 0 ] Checking required PowerShell modules"
Write-Sep

foreach ($mod in @('Az.Websites', 'Az.Storage', 'Microsoft.Graph.Applications', 'Microsoft.Graph.Groups')) {
    if (Get-Module -ListAvailable -Name $mod) {
        Add-Pass "Module available: $mod"
    } else {
        Add-Fail "Module not found: $mod  (Install-Module $mod)"
    }
}

# ─────────────────────────────────────────────────────────────────────────────
# AZURE CONNECTION
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 1 ] Connecting to Azure"
Write-Sep

try {
    Write-Info "A browser window will open for you to sign in to Azure."
    Write-Info "Please complete the sign-in including any MFA prompts."
    Write-Host ""
    Clear-AzContext -Force -ErrorAction SilentlyContinue | Out-Null
    Connect-AzAccount -ErrorAction Stop | Out-Null
    $azCtx = Get-AzContext -ErrorAction Stop

    if (-not $azCtx -or [string]::IsNullOrEmpty($azCtx.Account)) {
        Add-Fail "Sign-in succeeded but no context was returned. Please try again."
        exit 1
    }

    Add-Pass "Signed in as: $($azCtx.Account.Id)"

    # List all accessible subscriptions and let the user choose if more than one
    $allSubs = Get-AzSubscription -ErrorAction Stop | Sort-Object Name
    if ($allSubs.Count -eq 1) {
        $chosenSub = $allSubs[0]
        Write-Info "One subscription found — auto-selected: $($chosenSub.Name)"
    } else {
        Write-Host ""
        Write-Host "  Multiple subscriptions found. Please choose one:" -ForegroundColor White
        Write-Host ""
        for ($i = 0; $i -lt $allSubs.Count; $i++) {
            Write-Host ("  [{0}] {1}  ({2})" -f ($i + 1), $allSubs[$i].Name, $allSubs[$i].Id) -ForegroundColor Cyan
        }
        Write-Host ""
        $subChoice = Read-Host "  Enter number"
        $subIndex  = [int]$subChoice - 1
        if ($subIndex -lt 0 -or $subIndex -ge $allSubs.Count) {
            Add-Fail "Invalid selection: $subChoice"
            exit 1
        }
        $chosenSub = $allSubs[$subIndex]
    }

    Set-AzContext -SubscriptionId $chosenSub.Id -TenantId $azCtx.Tenant.Id -ErrorAction Stop | Out-Null
    $azCtx = Get-AzContext
    Add-Pass "Subscription: $($azCtx.Subscription.Name) ($($azCtx.Subscription.Id))"
} catch {
    Add-Fail "Could not connect to Azure: $_"
    exit 1
}

# ─────────────────────────────────────────────────────────────────────────────
# FIND WEB APP
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 2 ] Locating Azure Web App: $webAppName"
Write-Sep

$webApp = $null
$resourceGroup = $null

# List all Web Apps in the subscription and find by name
Write-Info "Listing all Web Apps in subscription: $((Get-AzContext).Subscription.Name)..."
try {
    $subId = (Get-AzContext).Subscription.Id
    $allWebApps = Get-AzWebApp -DefaultProfile (Get-AzContext) -ErrorAction Stop
    $webApp = $allWebApps | Where-Object { $_.Name -eq $webAppName } | Select-Object -First 1
} catch {
    # Fallback: try Get-AzResource to locate it
    Write-Info "Falling back to Get-AzResource..."
    try {
        $res = Get-AzResource -ResourceType "Microsoft.Web/sites" -ErrorAction Stop | Where-Object { $_.Name -eq $webAppName } | Select-Object -First 1
        if ($res) {
            $webApp = Get-AzWebApp -ResourceGroupName $res.ResourceGroupName -Name $res.Name -ErrorAction Stop
            $allWebApps = @($webApp)
        }
    } catch {
        Add-Fail "Could not list Web Apps: $_"
        exit 1
    }
}

if (-not $webApp) {
    Add-Fail "Web App '$webAppName' not found in subscription: $((Get-AzContext).Subscription.Name)"
    Add-Fail "Verify the URL is correct and your account has Reader access to the subscription."
    Write-Info "Web Apps found in this subscription:"
    $allWebApps | ForEach-Object { Write-Info "  - $($_.Name)  [$($_.ResourceGroup)]" }
    exit 1
}

$resourceGroup = $webApp.ResourceGroup
Add-Pass "Web App found: $webAppName"
Add-Pass "Resource group: $resourceGroup"
Add-Pass "Subscription: $((Get-AzContext).Subscription.Name)"

# Reload with full config (Get-AzWebApp list doesn't always include SiteConfig)
try {
    $webApp = Get-AzWebApp -ResourceGroupName $resourceGroup -Name $webAppName -ErrorAction Stop
} catch {
    Add-Warn "Could not reload full Web App config: $_"
}

# State
if ($webApp.State -eq 'Running') {
    Add-Pass "Web App state: Running"
} else {
    Add-Fail "Web App state: $($webApp.State) — expected Running"
}

# Runtime (.NET 10)
$runtime = $webApp.SiteConfig.LinuxFxVersion
if ([string]::IsNullOrEmpty($runtime)) { $runtime = $webApp.SiteConfig.WindowsFxVersion }
if ([string]::IsNullOrEmpty($runtime)) { $runtime = "" }
if ($runtime -match "DOTNET.*10" -or $runtime -match "10\.") {
    Add-Pass "Runtime stack: $runtime"
} else {
    if ([string]::IsNullOrEmpty($runtime)) {
        Add-Warn "Runtime stack: could not determine — verify .NET 10 (LTS) is configured in Azure Portal"
    } else {
        Add-Fail "Runtime stack: $runtime — expected .NET 10 (LTS)"
    }
}

# HTTPS only
if ($webApp.HttpsOnly) {
    Add-Pass "HTTPS Only: enabled"
} else {
    Add-Warn "HTTPS Only: not enforced — recommended to enable in Azure Portal → Configuration → General settings"
}

# Application Insights
$aiKey = $webApp.SiteConfig.AppSettings | Where-Object { $_.Name -eq 'APPINSIGHTS_INSTRUMENTATIONKEY' -or $_.Name -eq 'APPLICATIONINSIGHTS_CONNECTION_STRING' }
if ($aiKey) {
    Add-Pass "Application Insights: configured"
} else {
    Add-Warn "Application Insights: not detected — enable via Azure Portal for log stream monitoring"
}

# ─────────────────────────────────────────────────────────────────────────────
# ENVIRONMENT VARIABLES
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 3 ] Verifying Environment Variables"
Write-Sep

# Get all app settings
$appSettings = @{}
try {
    $slot = Get-AzWebAppSlot -ResourceGroupName $resourceGroup -Name $webAppName -Slot production -ErrorAction SilentlyContinue
    if ($slot -and $slot.SiteConfig -and $slot.SiteConfig.AppSettings) {
        $rawSettings = $slot.SiteConfig.AppSettings
    } else {
        $rawSettings = $webApp.SiteConfig.AppSettings
    }
    foreach ($s in $rawSettings) { $appSettings[$s.Name] = $s.Value }
} catch {
    # Fallback
    foreach ($s in $webApp.SiteConfig.AppSettings) { $appSettings[$s.Name] = $s.Value }
}

# Required ENV vars
$required = @('CLIENTID','TENANTID','AUDIENCE_APPIDURI','CLIENTSECRET','BLOB_CONNECTION_STRING','BLOB_CONTAINER_NAME','SUPPORTED_OUTLOOK_SURFACE')
foreach ($key in $required) {
    if ($appSettings.ContainsKey($key) -and -not [string]::IsNullOrWhiteSpace($appSettings[$key])) {
        # Mask secrets in output
        if ($key -in @('CLIENTSECRET','BLOB_CONNECTION_STRING')) {
            Add-Pass "ENV var present: $key = [value masked]"
        } else {
            Add-Pass "ENV var present: $key = $($appSettings[$key])"
        }
    } else {
        Add-Fail "ENV var missing or empty: $key"
    }
}

# Optional ENV vars — warn if missing
$optional = @(
    'AUTHORITYHOST','GRAPH_BASEURL','GRAPH_SCOPES','CID_PLATFORMS',
    'MAX_SIGNATURE_ITEMS','MAX_TOTAL_SIGNATURE_SIZE_KB','SIGNATURE_BLANK_LINES_ON_TOP',
    'SIGNATURE_REFRESH_PERIOD_IN_MINUTES','USE_OFFICERUNTIME_STORAGE_ON_DESKTOP',
    'SIGNATURES_DISABLED','DISABLED_ENTRA_GROUP_ID',
    'AUTOMATIC_SIGNATURE_INSERTION_DISABLED','AUTOMATIC_SIGNATURE_INSERTION_DISABLED_ENTRA_GROUP_ID'
)
foreach ($key in $optional) {
    if ($appSettings.ContainsKey($key) -and -not [string]::IsNullOrWhiteSpace($appSettings[$key])) {
        Add-Pass "ENV var present (optional): $key = $($appSettings[$key])"
    } else {
        Add-Warn "ENV var not set (optional): $key"
    }
}

# Extract values for later checks
$clientId      = $appSettings['CLIENTID']
$tenantId      = $appSettings['TENANTID']
$audienceUri   = $appSettings['AUDIENCE_APPIDURI']
$blobConnStr   = $appSettings['BLOB_CONNECTION_STRING']
$blobContainer = $appSettings['BLOB_CONTAINER_NAME']
$disabledGrpId = $appSettings['DISABLED_ENTRA_GROUP_ID']
$autoInsGrpId  = $appSettings['AUTOMATIC_SIGNATURE_INSERTION_DISABLED_ENTRA_GROUP_ID']

# Format validation
if ($clientId -and [System.Guid]::TryParse($clientId, [ref][System.Guid]::Empty)) {
    Add-Pass "CLIENTID is a valid GUID"
} elseif ($clientId) {
    Add-Fail "CLIENTID does not appear to be a valid GUID: $clientId"
}

if ($tenantId -and [System.Guid]::TryParse($tenantId, [ref][System.Guid]::Empty)) {
    Add-Pass "TENANTID is a valid GUID"
} elseif ($tenantId) {
    Add-Fail "TENANTID does not appear to be a valid GUID: $tenantId"
}

# AUDIENCE_APPIDURI format: api://<domain>/<guid>
if ($audienceUri) {
    if ($audienceUri -match "^api://[^/]+/[0-9a-fA-F\-]{36}$") {
        Add-Pass "AUDIENCE_APPIDURI format valid: $audienceUri"
    } else {
        Add-Fail "AUDIENCE_APPIDURI format unexpected: $audienceUri — expected api://<domain>/<client-id>"
    }
    # Domain portion should match the Web App URL
    if ($audienceUri -match [regex]::Escape($uri.Host)) {
        Add-Pass "AUDIENCE_APPIDURI domain matches Web App URL"
    } else {
        Add-Warn "AUDIENCE_APPIDURI domain does not match Web App URL — verify this is intentional"
    }
}

# SUPPORTED_OUTLOOK_SURFACE value validation
$validSurfaces   = @('newOutlookWindows', 'OutlookWebApp')
$invalidSurfaces = @('classicWin32', 'classicMac', 'newOutlookMac', 'OutlookIOS', 'OutlookAndroid')
$surfaceEnvVal   = $appSettings['SUPPORTED_OUTLOOK_SURFACE']

if (-not [string]::IsNullOrWhiteSpace($surfaceEnvVal)) {
    $surfaceList = $surfaceEnvVal -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }
    $surfaceOk   = $true

    foreach ($s in $surfaceList) {
        if ($validSurfaces -contains $s) {
            Add-Pass "SUPPORTED_OUTLOOK_SURFACE: '$s' is a supported surface"
        } elseif ($invalidSurfaces -contains $s) {
            Add-Fail "SUPPORTED_OUTLOOK_SURFACE: '$s' is listed as unsupported in the documentation — remove it"
            $surfaceOk = $false
        } else {
            Add-Fail "SUPPORTED_OUTLOOK_SURFACE: '$s' is not a recognised surface identifier — check for typos (values are case-sensitive)"
            $surfaceOk = $false
        }
    }

    if ($surfaceOk -and $surfaceList.Count -gt 0) {
        Add-Pass "SUPPORTED_OUTLOOK_SURFACE: all $($surfaceList.Count) surface(s) are valid"
    }
}

# ─────────────────────────────────────────────────────────────────────────────
# BLOB STORAGE
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 4 ] Verifying Azure Blob Storage"
Write-Sep

if ($blobConnStr -and $blobContainer) {
    try {
        $storageCtx = New-AzStorageContext -ConnectionString $blobConnStr -ErrorAction Stop
        Add-Pass "Blob Storage: connection string is valid"

        # Check container exists
        $container = Get-AzStorageContainer -Name $blobContainer -Context $storageCtx -ErrorAction SilentlyContinue
        if ($container) {
            Add-Pass "Blob container exists: $blobContainer"
        } else {
            Add-Fail "Blob container not found: $blobContainer"
        }

        # Write probe — upload a temp file and delete it
        $probeName = "__wpsecure_verify_probe__"
        $probeTempFile = [System.IO.Path]::GetTempFileName()
        try {
            [System.IO.File]::WriteAllText($probeTempFile, "wpsecure-probe")
            Set-AzStorageBlobContent -Container $blobContainer -Blob $probeName -File $probeTempFile -Context $storageCtx -Force -ErrorAction Stop | Out-Null
            Remove-AzStorageBlob -Container $blobContainer -Blob $probeName -Context $storageCtx -Force -ErrorAction Stop
            Add-Pass "Blob Storage write probe: upload and delete succeeded"
        } catch {
            Add-Fail "Blob Storage write probe failed: $_ — check storage account permissions"
        } finally {
            if (Test-Path $probeTempFile) { Remove-Item $probeTempFile -Force -ErrorAction SilentlyContinue }
        }
    } catch {
        Add-Fail "Blob Storage: could not connect with provided connection string — $_"
    }
} else {
    Add-Warn "Blob Storage: skipped — BLOB_CONNECTION_STRING or BLOB_CONTAINER_NAME not set"
}

# ─────────────────────────────────────────────────────────────────────────────
# MICROSOFT GRAPH CONNECTION
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 5 ] Connecting to Microsoft Graph"
Write-Sep

try {
    Write-Info "A browser window will open for you to sign in to Microsoft Graph."
    Write-Info "Please complete the sign-in including any MFA prompts."
    Write-Host ""
    Connect-MgGraph -TenantId $tenantId -Scopes "Application.Read.All","Group.Read.All" -NoWelcome -ErrorAction Stop | Out-Null
    $mgCtx = Get-MgContext -ErrorAction Stop
    Add-Pass "Connected to Microsoft Graph as: $($mgCtx.Account)"
} catch {
    Add-Fail "Could not connect to Microsoft Graph: $_"
    Add-Warn "Skipping App Registration and Entra group checks."
    $mgCtx = $null
}

# ─────────────────────────────────────────────────────────────────────────────
# APP REGISTRATION
# ─────────────────────────────────────────────────────────────────────────────
if ($mgCtx -and $clientId) {
    Write-Header "[ 6 ] Verifying Entra ID App Registration"
    Write-Sep

    $app = $null
    try {
        $app = Get-MgApplication -Filter "appId eq '$clientId'" -ErrorAction Stop
    } catch {
        Add-Fail "Could not query App Registration: $_"
    }

    if ($app) {
        Add-Pass "App Registration found: $($app.DisplayName)"

        # Application ID URI
        if ($app.IdentifierUris -contains $audienceUri) {
            Add-Pass "Application ID URI matches AUDIENCE_APPIDURI"
        } else {
            Add-Fail "Application ID URI not found in App Registration — expected: $audienceUri  Found: $($app.IdentifierUris -join ', ')"
        }

        # Cross-check: CLIENTID in ENV must match the appId on the App Registration
        if ($app.AppId -eq $clientId) {
            Add-Pass "CLIENTID in ENV vars matches App Registration appId"
        } else {
            Add-Fail "CLIENTID mismatch — ENV var: '$clientId'  App Registration appId: '$($app.AppId)'"
        }

        # Cross-check: AUDIENCE_APPIDURI must end with the CLIENTID as the path segment
        if ($audienceUri -and $audienceUri.EndsWith("/$clientId")) {
            Add-Pass "AUDIENCE_APPIDURI path segment matches CLIENTID"
        } elseif ($audienceUri) {
            Add-Fail "AUDIENCE_APPIDURI path segment does not match CLIENTID — expected URI to end with '/$clientId'"
        }

        # Cross-check: TENANTID in ENV must match the connected tenant
        if ($mgCtx.TenantId -eq $tenantId) {
            Add-Pass "TENANTID in ENV vars matches connected tenant"
        } else {
            Add-Fail "TENANTID mismatch — ENV var: '$tenantId'  Connected Graph tenant: '$($mgCtx.TenantId)'"
        }

        # access_as_user scope
        $scope = $app.Api.Oauth2PermissionScopes | Where-Object { $_.Value -eq 'access_as_user' }
        if ($scope) {
            Add-Pass "API scope 'access_as_user' exists"
            if ($scope.IsEnabled) { Add-Pass "Scope 'access_as_user' is enabled" }
            else { Add-Fail "Scope 'access_as_user' is disabled" }
        } else {
            Add-Fail "API scope 'access_as_user' not found — required under Expose an API"
        }

        # Authorized client application — Microsoft Office (ea5a67f6-b6f3-4338-b240-c655ddc3cc8e)
        $officeClientId = 'ea5a67f6-b6f3-4338-b240-c655ddc3cc8e'
        $authClient = $app.Api.PreAuthorizedApplications | Where-Object { $_.AppId -eq $officeClientId }
        if ($authClient) {
            Add-Pass "Authorized client application registered: $officeClientId (Microsoft Office)"
        } else {
            Add-Fail "Authorized client application not found: $officeClientId — required under Expose an API → Authorized client applications"
        }

        # Client secret — exists, expiry check, and at least one must be active
        $secrets = $app.PasswordCredentials
        if ($secrets -and $secrets.Count -gt 0) {
            Add-Pass "Client secret(s) exist: $($secrets.Count) found"
            $activeSecrets  = 0
            $expiredSecrets = 0
            foreach ($secret in $secrets) {
                $daysLeft = ($secret.EndDateTime - (Get-Date)).Days
                if ($daysLeft -lt 0) {
                    Add-Fail "Client secret '$($secret.DisplayName)' has EXPIRED ($([Math]::Abs($daysLeft)) days ago) — create a new secret and update CLIENTSECRET in the Web App ENV vars"
                    $expiredSecrets++
                } elseif ($daysLeft -lt 30) {
                    Add-Warn "Client secret '$($secret.DisplayName)' expires in $daysLeft days — renew soon and update CLIENTSECRET in the Web App ENV vars"
                    $activeSecrets++
                } else {
                    Add-Pass "Client secret '$($secret.DisplayName)' — valid for $daysLeft days"
                    $activeSecrets++
                }
            }
            # At least one active secret must exist for the Web App to authenticate
            if ($activeSecrets -eq 0) {
                Add-Fail "All client secrets have expired — the Web App cannot authenticate. Create a new secret in Entra ID and update CLIENTSECRET in the Web App ENV vars immediately."
            } else {
                Add-Pass "$activeSecrets active client secret(s) — Web App can authenticate"
            }
        } else {
            Add-Fail "No client secrets found on App Registration — create one and add the value to CLIENTSECRET in the Web App ENV vars"
        }

        # API permissions + admin consent (via service principal)
        # Admin consent = ConsentType of 'AllPrincipals' on the OAuth2 grant.
        # User consent = ConsentType of 'Principal' — not sufficient for production.
        # All 5 permissions must be present and have AllPrincipals consent.
        try {
            $sp = Get-MgServicePrincipal -Filter "appId eq '$clientId'" -ErrorAction Stop
            $grants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue

            # Build a lookup: scope name -> ConsentType for every granted scope
            $consentMap = @{}
            foreach ($grant in $grants) {
                $scopeNames = $grant.Scope -split '\s+' | Where-Object { $_ -ne '' }
                foreach ($scope in $scopeNames) {
                    # AllPrincipals wins over Principal if the same scope appears in multiple grants
                    if (-not $consentMap.ContainsKey($scope) -or $grant.ConsentType -eq 'AllPrincipals') {
                        $consentMap[$scope] = $grant.ConsentType
                    }
                }
            }

            # The 5 permissions that must all have admin consent (AllPrincipals)
            $requiredPerms = @('openid', 'profile', 'User.Read', 'Files.Read', 'GroupMember.Read.All')

            foreach ($perm in $requiredPerms) {
                if ($consentMap.ContainsKey($perm)) {
                    if ($consentMap[$perm] -eq 'AllPrincipals') {
                        Add-Pass "Admin consent granted: $perm"
                    } else {
                        Add-Fail "Permission '$perm' exists but has USER consent only — admin consent required. Go to Azure Portal → App Registration → API permissions → Grant admin consent."
                    }
                } else {
                    Add-Fail "Permission '$perm' not found in grants — add it and grant admin consent in Azure Portal → App Registration → API permissions."
                }
            }

            # Summary
            $adminConsentedCount = ($requiredPerms | Where-Object { $consentMap[$_] -eq 'AllPrincipals' }).Count
            if ($adminConsentedCount -eq $requiredPerms.Count) {
                Add-Pass "All $($requiredPerms.Count) permissions have admin consent (AllPrincipals) — correct"
            } else {
                Add-Fail "$adminConsentedCount of $($requiredPerms.Count) permissions have admin consent — $($requiredPerms.Count - $adminConsentedCount) missing"
            }

        } catch {
            Add-Warn "Could not verify API permission grants: $_ — check manually in Azure Portal"
        }

    } else {
        Add-Fail "App Registration with appId '$clientId' not found in tenant"
    }
}

# ─────────────────────────────────────────────────────────────────────────────
# ENTRA ID GROUPS
# ─────────────────────────────────────────────────────────────────────────────
if ($mgCtx) {
    Write-Header "[ 7 ] Verifying Entra ID Groups"
    Write-Sep

    foreach ($pair in @(
        @{ Id = $disabledGrpId;  Label = "Signature disable group (DISABLED_ENTRA_GROUP_ID)" },
        @{ Id = $autoInsGrpId;   Label = "Auto-insert disable group (AUTOMATIC_SIGNATURE_INSERTION_DISABLED_ENTRA_GROUP_ID)" }
    )) {
        $grpId    = $pair.Id
        $grpLabel = $pair.Label

        if ([string]::IsNullOrWhiteSpace($grpId)) {
            Add-Warn "$grpLabel not configured — optional, skip if not required"
            continue
        }

        if (-not [System.Guid]::TryParse($grpId, [ref][System.Guid]::Empty)) {
            Add-Fail "$grpLabel — value is not a valid GUID: $grpId"
            continue
        }

        try {
            $grp = Get-MgGroup -GroupId $grpId -ErrorAction Stop
            Add-Pass "$grpLabel found: $($grp.DisplayName)"

            # Must be a Security group, not Microsoft 365
            if ($grp.SecurityEnabled -eq $true -and $grp.MailEnabled -eq $false) {
                Add-Pass "$grpLabel is a Security group (correct type)"
            } elseif ($grp.SecurityEnabled -eq $true -and $grp.MailEnabled -eq $true) {
                Add-Warn "$grpLabel is a mail-enabled Security group — transitive membership check will work but consider a standard Security group"
            } else {
                Add-Fail "$grpLabel is a Microsoft 365 group — must be a Security group for GroupMember.Read.All transitive check to work"
            }
        } catch {
            Add-Fail "$grpLabel — group with Object ID '$grpId' not found in tenant"
        }
    }
}

# ─────────────────────────────────────────────────────────────────────────────
# WEB APP ENDPOINT SMOKE TEST
# ─────────────────────────────────────────────────────────────────────────────
Write-Header "[ 8 ] Web App Reachability Check"
Write-Sep

# Check three known static files that must exist on a correctly deployed Web App
$probeTargets = @(
    @{ Path = "/wpsecure.html";         Label = "Add-in HTML (wpsecure.html)" },
    @{ Path = "/wpsecure.manifest.xml"; Label = "Manifest file (wpsecure.manifest.xml)" },
    @{ Path = "/config.json";           Label = "Config file (config.json)" }
)

$configJson = $null

foreach ($probe in $probeTargets) {
    $probeUrl = "$rawUrl$($probe.Path)"
    try {
        $resp = Invoke-WebRequest -Uri $probeUrl -Method Get -TimeoutSec 15 -UseBasicParsing -ErrorAction Stop
        Add-Pass "$($probe.Label) — reachable (HTTP $($resp.StatusCode))"

        # Parse config.json for further validation
        if ($probe.Path -eq "/config.json") {
            try {
                $configJson = $resp.Content | ConvertFrom-Json
            } catch {
                Add-Warn "config.json — could not parse JSON content: $_"
            }
        }

        # Parse manifest.xml and count domain occurrences
        if ($probe.Path -eq "/wpsecure.manifest.xml") {
            $manifestContent = $resp.Content
            $occurrences = ([regex]::Matches($manifestContent, [regex]::Escape($inputDomain))).Count
            if ($occurrences -eq 20) {
                Add-Pass "Manifest file — domain '$inputDomain' found exactly 20 times (correct)"
            } elseif ($occurrences -gt 0) {
                Add-Fail "Manifest file — domain '$inputDomain' found $occurrences times — expected 20. Re-run find and replace in wpsecure.manifest.xml."
            } else {
                Add-Fail "Manifest file — domain '$inputDomain' not found. The manifest may not have been updated from the template placeholder."
            }
        }

    } catch {
        if ($_.Exception.Response) {
            $statusCode = [int]$_.Exception.Response.StatusCode
            if ($statusCode -eq 404) {
                Add-Fail "$($probe.Label) — HTTP 404 Not Found. File may not have been deployed to the Web App."
            } elseif ($statusCode -eq 503) {
                Add-Fail "$($probe.Label) — HTTP 503 Service Unavailable. Web App may be stopped or starting."
            } else {
                Add-Warn "$($probe.Label) — HTTP $statusCode"
            }
        } else {
            Add-Fail "$($probe.Label) — not reachable: $_"
        }
    }
}

# Validate config.json BACKEND_BASE_URL
if ($configJson) {
    $backendUrl = $configJson.BACKEND_BASE_URL
    if ([string]::IsNullOrWhiteSpace($backendUrl)) {
        Add-Fail "config.json — BACKEND_BASE_URL is empty"
    } elseif ($backendUrl -eq $rawUrl -or $backendUrl -eq "$rawUrl/") {
        Add-Pass "config.json — BACKEND_BASE_URL is correct: $backendUrl"
    } elseif ($backendUrl -match [regex]::Escape($inputDomain)) {
        Add-Pass "config.json — BACKEND_BASE_URL contains the correct domain: $backendUrl"
    } else {
        Add-Fail "config.json — BACKEND_BASE_URL mismatch. Found: '$backendUrl'  Expected domain: '$inputDomain'"
    }
} elseif ($configJson -eq $null) {
    Add-Warn "config.json — could not validate BACKEND_BASE_URL (file not retrieved or not parseable)"
}

# ─────────────────────────────────────────────────────────────────────────────
# FINAL REPORT
# ─────────────────────────────────────────────────────────────────────────────
Write-Host ""
Write-Sep
Write-Host ""
Write-Host "  VERIFICATION COMPLETE" -ForegroundColor White
Write-Host ""
Write-Host "  $($script:PassCount) passed    $($script:FailCount) failed    $($script:WarnCount) warnings" -ForegroundColor White
Write-Host ""

if ($script:FailCount -eq 0 -and $script:WarnCount -eq 0) {
    Write-Host "  ✅  All checks passed. Your WPSecure setup looks good." -ForegroundColor Green
} elseif ($script:FailCount -eq 0) {
    Write-Host "  ⚠️  No failures but $($script:WarnCount) warnings. Review warnings above." -ForegroundColor Yellow
} else {
    Write-Host "  ❌  $($script:FailCount) check(s) failed. Review failures above before going live." -ForegroundColor Red
}

Write-Host ""
Write-Host "  Documentation : https://wpsecure.shop/documentation" -ForegroundColor DarkGray
Write-Host "  Support       : https://wpsecure.shop/contact" -ForegroundColor DarkGray
Write-Host ""
Write-Sep