# List repository contents (PowerShell)
Get-ChildItem -Force

# Expected output should include:
# - config/ directory with environment files
# - docs/ directory with documentation
# - scripts/ directory with automation scripts
# - .github/ directory with workflows

# Check PowerShell version
$PSVersionTable.PSVersion

# Install Azure PowerShell modules if not present
Install-Module -Name Az -Scope CurrentUser -Force

# Connect to Azure (you will be prompted for credentials)
Connect-AzAccount

.\scripts\common\utilities\tools\Create-AzureResourceGroup.ps1

<#
.SYNOPSIS
    Creates Azure resource group for Azure Local deployment.

.DESCRIPTION
    Creates a dedicated resource group for Azure Local ZTP deployment
    using configuration values from environment.yaml.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Create-AzureResourceGroup.ps1

    Creates the resource group defined in config/environment.yaml

.EXAMPLE
    .\Create-AzureResourceGroup.ps1 -Force

    Creates the resource group without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Azure CLI installed and configured
    - AzureLocalConfig.psm1 module for configuration loading
    - Valid Azure subscription with proper permissions
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
$subscriptionId = $config.GetValue('azure.mgmt_subscription_id')
$resourceGroup = $config.GetValue('resources.cluster_resource_group')
$region = $config.GetValue('azure.region')

# Confirm operation if not forced
if (!$Force) {
    Write-Host "About to create resource group:" -ForegroundColor Yellow
    Write-Host "  Subscription: $subscriptionId" -ForegroundColor Gray
    Write-Host "  Resource Group: $resourceGroup" -ForegroundColor Gray
    Write-Host "  Region: $region" -ForegroundColor Gray
    Write-Host ""

    $confirmation = Read-Host "Continue? (y/N)"
    if ($confirmation -ne 'y' -and $confirmation -ne 'Y') {
        Write-Host "Operation cancelled." -ForegroundColor Yellow
        exit 0
    }
}

Write-Host "Setting Azure subscription context..." -ForegroundColor Cyan
az account set --subscription $subscriptionId
if ($LASTEXITCODE -ne 0) {
    throw "Failed to set Azure subscription context"
}

Write-Host "Creating resource group '$resourceGroup' in '$region'..." -ForegroundColor Cyan
az group create --name $resourceGroup --location $region
if ($LASTEXITCODE -ne 0) {
    throw "Failed to create resource group"
}

Write-Host "✓ Resource group '$resourceGroup' created successfully" -ForegroundColor Green

# Verify the resource group was created
Write-Host "Verifying resource group..." -ForegroundColor Cyan
$rgInfo = az group show --name $resourceGroup --output json | ConvertFrom-Json
Write-Host "✓ Resource group verified: $($rgInfo.name) in $($rgInfo.location)" -ForegroundColor Green

.\scripts\common\utilities\tools\Test-ZTPConfig.ps1

# Load configuration and verify subscription details
Import-Module ".\scripts\common\AzureLocalConfig.psm1"
$config = Get-AzureLocalConfig

# Get current Azure context
$context = Get-AzContext
Write-Host "Current Account: $($context.Account.Id)" -ForegroundColor Cyan
Write-Host "Subscription: $($context.Subscription.Name) ($($context.Subscription.Id))" -ForegroundColor Cyan
Write-Host "Tenant: $($context.Tenant.Id)" -ForegroundColor Cyan

# Expected values from config/environment.yaml:
# Subscription ID: $($config.GetValue('azure.mgmt_subscription_id'))
# Tenant ID: $($config.GetValue('azure.tenant_id'))
# Resource Group: $($config.GetValue('resources.cluster_resource_group'))
# Cluster Name: $($config.GetValue('resources.cluster_name'))

.\scripts\common\utilities\tools\Download-ZTPTools.ps1

<#
.SYNOPSIS
    Downloads Azure Local maintenance environment ISO.

.DESCRIPTION
    Downloads the Azure Local maintenance environment ISO and USB preparation tools
    from Microsoft official channels using configuration values.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Download-ZTPTools.ps1

    Downloads ZTP tools to the configured download directory

.EXAMPLE
    .\Download-ZTPTools.ps1 -Force

    Downloads without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Internet connectivity
    - AzureLocalConfig.psm1 module for configuration loading
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
$downloadDir = $config.GetValue('ztp.download_directory')
$maintenanceVer = $config.GetValue('ztp.maintenance_version')

# Confirm operation if not forced
if (!$Force) {
    Write-Host "About to download Azure Local ZTP tools:" -ForegroundColor Yellow
    Write-Host "  Download Directory: $downloadDir" -ForegroundColor Gray
    Write-Host "  Maintenance Version: $maintenanceVer" -ForegroundColor Gray
    Write-Host ""

    $confirmation = Read-Host "Continue? (y/N)"
    if ($confirmation -ne 'y' -and $confirmation -ne 'Y') {
        Write-Host "Download cancelled." -ForegroundColor Yellow
        exit 0
    }
}

Write-Host "Creating download directory..." -ForegroundColor Cyan
New-Item -ItemType Directory -Path $downloadDir -Force

Write-Host "Downloading maintenance environment from Microsoft..." -ForegroundColor Cyan
$downloadUrl = "https://aka.ms/aep/installeros/$maintenanceVer"
$zipFile = Join-Path $downloadDir "maintenance-env.zip"

Invoke-WebRequest -Uri $downloadUrl -OutFile $zipFile

Write-Host "✓ Download completed successfully" -ForegroundColor Green

# Verify download
$zipInfo = Get-Item $zipFile
Write-Host "Downloaded file: $($zipInfo.Name) ($([math]::Round($zipInfo.Length / 1MB, 2)) MB)" -ForegroundColor Green

.\scripts\common\utilities\tools\Download-ConfiguratorApp.ps1

.\scripts\common\utilities\tools\Unblock-ZTPFiles.ps1

<#
.SYNOPSIS
    Unblocks downloaded Azure Local ZTP files.

.DESCRIPTION
    Removes the "downloaded from internet" security flag from Azure Local ZTP files
    to allow execution and processing.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Unblock-ZTPFiles.ps1

    Unblocks all ZTP files in download and extracted directories

.EXAMPLE
    .\Unblock-ZTPFiles.ps1 -Force

    Unblocks without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Downloaded and extracted ZTP tools
    - AzureLocalConfig.psm1 module for configuration loading
    - Administrator privileges may be required for some operations
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
$downloadDir = $config.GetValue('ztp.download_directory')
$extractedDir = $config.GetValue('ztp.extracted_directory')

# Confirm operation if not forced
if (!$Force) {
    Write-Host "About to unblock Azure Local ZTP files:" -ForegroundColor Yellow
    Write-Host "  Download Directory: $downloadDir" -ForegroundColor Gray
    Write-Host "  Extracted Directory: $extractedDir" -ForegroundColor Gray
    Write-Host ""

    $confirmation = Read-Host "Continue? (y/N)"
    if ($confirmation -ne 'y' -and $confirmation -ne 'Y') {
        Write-Host "Unblock operation cancelled." -ForegroundColor Yellow
        exit 0
    }
}

Write-Host "Unblocking files in download directory..." -ForegroundColor Cyan
$downloadFiles = Get-ChildItem -Path $downloadDir -Recurse -Include "*.zip","*.exe","*.ps1","*.cmd" -ErrorAction SilentlyContinue
if ($downloadFiles) {
    $downloadFiles | Unblock-File
    Write-Host "✓ Unblocked $($downloadFiles.Count) files in download directory" -ForegroundColor Green
} else {
    Write-Host "No blocked files found in download directory" -ForegroundColor Gray
}

Write-Host "Unblocking files in extracted directory..." -ForegroundColor Cyan
$extractedFiles = Get-ChildItem -Path $extractedDir -Recurse -Include "*.exe","*.ps1","*.cmd","*.iso" -ErrorAction SilentlyContinue
if ($extractedFiles) {
    $extractedFiles | Unblock-File
    Write-Host "✓ Unblocked $($extractedFiles.Count) files in extracted directory" -ForegroundColor Green
} else {
    Write-Host "No blocked files found in extracted directory" -ForegroundColor Gray
}

Write-Host "✓ All ZTP files have been unblocked" -ForegroundColor Green

.\scripts\common\utilities\tools\Extract-ZTPTools.ps1

.\scripts\common\utilities\tools\Create-ZTPShare.ps1

<#
.SYNOPSIS
    Creates network share for Azure Local ISO files.

.DESCRIPTION
    Creates a network share accessible to cluster nodes for hosting the Azure Local
    maintenance environment ISO file. The share directory will be created for ISO placement.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Create-ZTPShare.ps1

    Creates the ZTP share with default settings

.EXAMPLE
    .\Create-ZTPShare.ps1 -Force

    Creates the share without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Administrator privileges
    - AzureLocalConfig.psm1 module for configuration loading
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
$shareLocation = $config.GetValue('ztp.share_location')
$shareName = $config.GetValue('ztp.share_name')

# Confirm operation if not forced
if (!$Force) {
    Write-Host "About to create Azure Local ZTP network share:" -ForegroundColor Yellow
    Write-Host "  Share Location: $shareLocation" -ForegroundColor Gray
    Write-Host "  Share Name: $shareName" -ForegroundColor Gray
    Write-Host ""

    $confirmation = Read-Host "Continue? (y/N)"
    if ($confirmation -ne 'y' -and $confirmation -ne 'Y') {
        Write-Host "Share creation cancelled." -ForegroundColor Yellow
        exit 0
    }
}

Write-Host "Creating share directory..." -ForegroundColor Cyan
New-Item -ItemType Directory -Path $shareLocation -Force

Write-Host "Creating SMB share..." -ForegroundColor Cyan
# Remove existing share if it exists
$existingShare = Get-SmbShare -Name $shareName -ErrorAction SilentlyContinue
if ($existingShare) {
    Remove-SmbShare -Name $shareName -Force
}

New-SmbShare -Name $shareName -Path $shareLocation -FullAccess "Everyone"

Write-Host "✓ Network share created successfully" -ForegroundColor Green
Write-Host "  Share Path: \\$env:COMPUTERNAME\$shareName" -ForegroundColor Green

.\scripts\common\utilities\tools\Create-ShareAccessUser.ps1

<#
.SYNOPSIS
    Creates local user for iDRAC virtual media share access.

.DESCRIPTION
    Creates a local Windows user account with appropriate permissions for iDRAC virtual media
    to access the Azure Local ZTP network share. Configures both SMB share and NTFS permissions
    for read-only access to the share location.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Create-ShareAccessUser.ps1

    Creates the share access user with default settings from environment.yaml

.EXAMPLE
    .\Create-ShareAccessUser.ps1 -Force

    Creates the user without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Administrator privileges
    - AzureLocalConfig.psm1 module for configuration loading
    - Network share already created (Create-ZTPShare.ps1)

    Configuration Variables (from environment.yaml):
    - ztp.share_username: Username for the share access account
    - ztp.share_password: Password for the share access account
    - ztp.share_location: Local path to the ZTP share directory
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0
#Requires -RunAsAdministrator

# Find repository root by looking for config directory
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$configModulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
if (!(Test-Path $configModulePath)) {
    throw "Config module not found at $configModulePath"
}
Import-Module $configModulePath -Force
$config = Get-AzureLocalConfig

# Get configuration values
$username = $config.GetValue('ztp.share_username')
$password = $config.GetValue('ztp.share_password')
$sharePath = $config.GetValue('ztp.share_location')
$shareName = $config.GetValue('ztp.share_name')

# Validate share exists
if (!(Test-Path $sharePath)) {
    throw "Share location not found: $sharePath. Please run Create-ZTPShare.ps1 first."
}

$existingShare = Get-SmbShare -Name $shareName -ErrorAction SilentlyContinue
if (!$existingShare) {
    throw "SMB share '$shareName' not found. Please run Create-ZTPShare.ps1 first."
}

# Confirm operation
if (-not $Force) {
    Write-Host "About to create share access user:" -ForegroundColor Yellow
    Write-Host "  Username: $env:COMPUTERNAME\$username" -ForegroundColor Gray
    Write-Host "  Share Path: $sharePath" -ForegroundColor Gray
    Write-Host "  Share Name: $shareName" -ForegroundColor Gray
    Write-Host "  Permissions: Read-Only" -ForegroundColor Gray
    Write-Host ""
    $confirm = Read-Host "Continue? (y/N)"
    if ($confirm -ne 'y' -and $confirm -ne 'Y') {
        Write-Host "Operation cancelled." -ForegroundColor Yellow
        exit 0
    }
}

Write-Host "`nCreating share access user..." -ForegroundColor Cyan

# Step 1: Create local user
Write-Host "  Creating local user '$username'..." -ForegroundColor Gray
$securePass = ConvertTo-SecureString $password -AsPlainText -Force

if (Get-LocalUser -Name $username -ErrorAction SilentlyContinue) {
    Set-LocalUser -Name $username -Password $securePass
    Write-Host "  ⚠ User '$username' already exists - password reset" -ForegroundColor Yellow
} else {
    try {
        New-LocalUser -Name $username -Password $securePass `
            -Description "iDRAC virtual media share access" `
            -PasswordNeverExpires -UserMayNotChangePassword -AccountNeverExpires `
            -ErrorAction Stop | Out-Null
        Write-Host "  ✓ User '$username' created" -ForegroundColor Green
    } catch {
        throw "Failed to create user: $($_.Exception.Message)"
    }
}

# Ensure user is enabled
Enable-LocalUser -Name $username -ErrorAction SilentlyContinue
Write-Host "  ✓ User enabled" -ForegroundColor Green

# Step 2: Grant SMB share read access
Write-Host "  Granting SMB read access..." -ForegroundColor Gray
try {
    # Remove any existing access
    $existingAccess = Get-SmbShareAccess -Name $shareName -AccountName "$env:COMPUTERNAME\$username" -ErrorAction SilentlyContinue
    if ($existingAccess) {
        Revoke-SmbShareAccess -Name $shareName -AccountName "$env:COMPUTERNAME\$username" -Force -ErrorAction SilentlyContinue
    }

    # Grant read access
    Grant-SmbShareAccess -Name $shareName -AccountName "$env:COMPUTERNAME\$username" -AccessRight Read -Force | Out-Null
    Write-Host "  ✓ SMB read access granted" -ForegroundColor Green
} catch {
    Write-Host "  ⚠ SMB access configuration warning: $($_.Exception.Message)" -ForegroundColor Yellow
}

# Step 3: Grant NTFS read access
Write-Host "  Granting NTFS read access..." -ForegroundColor Gray
try {
    $acl = Get-Acl $sharePath

    # Remove any existing rules for this user
    $existingRules = $acl.Access | Where-Object { $_.IdentityReference -eq "$env:COMPUTERNAME\$username" }
    foreach ($rule in $existingRules) {
        $acl.RemoveAccessRule($rule) | Out-Null
    }

    # Add new read rule
    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
        "$env:COMPUTERNAME\$username",
        "ReadAndExecute",
        "ContainerInherit,ObjectInherit",
        "None",
        "Allow"
    )
    $acl.AddAccessRule($rule)
    Set-Acl $sharePath $acl
    Write-Host "  ✓ NTFS read access granted" -ForegroundColor Green
} catch {
    throw "Failed to set NTFS permissions: $($_.Exception.Message)"
}

Write-Host "`n✓ Share access user configured successfully" -ForegroundColor Green
Write-Host "  Username: $env:COMPUTERNAME\$username" -ForegroundColor Cyan
Write-Host "  Share: \\$env:COMPUTERNAME\$shareName" -ForegroundColor Cyan
Write-Host "  Permissions: Read-Only (SMB + NTFS)" -ForegroundColor Cyan
Write-Host "`nUse this credential for iDRAC virtual media operations." -ForegroundColor Gray

.\scripts\common\utilities\tools\Copy-ZTPISO.ps1

<#
.SYNOPSIS
    Copies Azure Local ISO to network share location.

.DESCRIPTION
    Copies the extracted Azure Local maintenance environment ISO file to the
    configured network share location for access by cluster nodes.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Copy-ZTPISO.ps1

    Copies the ISO to the share location

.EXAMPLE
    .\Copy-ZTPISO.ps1 -Force

    Copies without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Extracted Azure Local maintenance environment
    - Network share already created
    - AzureLocalConfig.psm1 module for configuration loading
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
$shareLocation = $config.GetValue('ztp.share_location')
$extractedDir = $config.GetValue('ztp.extracted_directory')

# Confirm operation if not forced
if (!$Force) {
    Write-Host "About to copy Azure Local ISO to share location:" -ForegroundColor Yellow
    Write-Host "  Source: $extractedDir" -ForegroundColor Gray
    Write-Host "  Destination: $shareLocation" -ForegroundColor Gray
    Write-Host ""

    $confirmation = Read-Host "Continue? (y/N)"
    if ($confirmation -ne 'y' -and $confirmation -ne 'Y') {
        Write-Host "ISO copy cancelled." -ForegroundColor Yellow
        exit 0
    }
}

# Validate source directory exists
if (!(Test-Path $extractedDir)) {
    throw "Extracted directory not found: $extractedDir"
}

# Validate share location exists
if (!(Test-Path $shareLocation)) {
    throw "Share location not found: $shareLocation"
}

# Find ISO file
$isoFile = Get-ChildItem -Path $extractedDir -Filter "*.iso" -Recurse | Select-Object -First 1
if (!$isoFile) {
    throw "No ISO file found in extracted directory: $extractedDir"
}

Write-Host "Copying ISO file to share location..." -ForegroundColor Cyan
Write-Host "  Source: $($isoFile.FullName)" -ForegroundColor Gray
Write-Host "  Destination: $shareLocation" -ForegroundColor Gray

Copy-Item $isoFile.FullName $shareLocation -Force

Write-Host "✓ ISO file copied successfully" -ForegroundColor Green
Write-Host "  File: $(Split-Path $isoFile.FullName -Leaf)" -ForegroundColor Green
Write-Host "  Location: $shareLocation" -ForegroundColor Green

.\scripts\common\utilities\tools\Test-ZTPShare.ps1

<#
.SYNOPSIS
    Verifies access to Azure Local ZTP network share.

.DESCRIPTION
    Tests network connectivity and file access to the Azure Local ISO share
    to ensure cluster nodes can access the maintenance environment.

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    .\Test-ZTPShare.ps1

    Tests access to the ZTP share

.EXAMPLE
    .\Test-ZTPShare.ps1 -Force

    Tests without confirmation

.NOTES
    Requires:
    - PowerShell 7.0+
    - Network access to share location
    - AzureLocalConfig.psm1 module for configuration loading
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
$shareLocation = $config.GetValue('ztp.share_location')
$shareName = $config.GetValue('ztp.share_name')

Write-Host "Testing Azure Local ZTP share access..." -ForegroundColor Cyan

# Test local access
Write-Host "Testing local file access..." -ForegroundColor Gray
$localTest = Test-Path (Join-Path $shareLocation "*.iso")
if ($localTest) {
    Write-Host "✓ Local ISO file access: OK" -ForegroundColor Green
} else {
    Write-Host "✗ Local ISO file access: FAILED" -ForegroundColor Red
}

# Test network share access
Write-Host "Testing network share access..." -ForegroundColor Gray
$sharePath = "\\$env:COMPUTERNAME\$shareName"
$networkTest = Test-Path $sharePath
if ($networkTest) {
    Write-Host "✓ Network share access: OK ($sharePath)" -ForegroundColor Green
} else {
    Write-Host "✗ Network share access: FAILED ($sharePath)" -ForegroundColor Red
}

# Test SMB connectivity
Write-Host "Testing SMB connectivity..." -ForegroundColor Gray
$smbTest = Test-NetConnection -ComputerName $env:COMPUTERNAME -Port 445 -InformationLevel Quiet
if ($smbTest) {
    Write-Host "✓ SMB connectivity: OK (Port 445 open)" -ForegroundColor Green
} else {
    Write-Host "✗ SMB connectivity: FAILED (Port 445 blocked)" -ForegroundColor Red
}

# List share contents
Write-Host "Checking share contents..." -ForegroundColor Gray
try {
    $shareContents = Get-ChildItem -Path $sharePath -ErrorAction Stop
    $isoFiles = $shareContents | Where-Object { $_.Extension -eq '.iso' }
    if ($isoFiles) {
        Write-Host "✓ Share contents: OK ($($isoFiles.Count) ISO file(s) found)" -ForegroundColor Green
        $isoFiles | ForEach-Object {
            Write-Host "  - $($_.Name) ($([math]::Round($_.Length / 1GB, 2)) GB)" -ForegroundColor Gray
        }
    } else {
        Write-Host "✗ Share contents: No ISO files found" -ForegroundColor Red
    }
} catch {
    Write-Host "✗ Share contents check: FAILED - $($_.Exception.Message)" -ForegroundColor Red
}

Write-Host "Share verification completed." -ForegroundColor Cyan

# Option 1: Use Key Vault credentials, all servers from config
.\scripts\common\utilities\tools\Discover-Servers.ps1 -Full

# Option 2: Provide credentials interactively
$Credential = Get-Credential
.\scripts\common\utilities\tools\Discover-Servers.ps1 -Credential $Credential -Full

# Option 3: Target specific servers
.\scripts\common\utilities\tools\Discover-Servers.ps1 -ServerIPs "192.168.1.100","192.168.1.101" -Full

# Option 4: Basic discovery (no detailed hardware inventory)
.\scripts\common\utilities\tools\Discover-Servers.ps1

<#
.SYNOPSIS
    Discovers Azure Local servers via Redfish API for ZTP deployment with comprehensive hardware inventory.

.DESCRIPTION
    Uses Redfish API to discover Dell PowerEdge servers with iDRAC, collecting
    detailed hardware information including system details, chassis, power, thermal,
    CPUs, memory, storage, network adapters, BIOS configuration, iDRAC settings,
    and firmware inventory for comprehensive ZTP preparation.

.PARAMETER Credential
    PSCredential object for BMC/iDRAC authentication

.PARAMETER ServerIPs
    One or more iDRAC IP addresses to target. If not specified, all servers from environment.yaml are used.

.PARAMETER Full
    Include detailed hardware inventory in discovery results (enabled by default for comprehensive discovery)

.EXAMPLE
    .\Discover-Servers.ps1 -Full

    Discovers all servers from config using Key Vault credentials with full hardware inventory.

.EXAMPLE
    $Credential = Get-Credential
    .\Discover-Servers.ps1 -Credential $Credential -Full

    Discovers all servers defined in config with full hardware inventory details.

.EXAMPLE
    .\Discover-Servers.ps1 -ServerIPs "192.168.1.100","192.168.1.101" -Full

    Discovers specific servers with full hardware inventory.

.NOTES
    Requires:
    - PowerShell 7.0+
    - Network access to BMC/iDRAC interfaces
    - Valid BMC credentials with system read permissions
    - AzureLocalConfig.psm1 module for configuration loading
    - Az.KeyVault module (if using Key Vault for credentials)
    - Key Vault name and secret name in environment.yaml (keyvault.platform_name, ztp.idrac_secret_name)
#>

param(
    [Parameter(Mandatory=$false)]
    [PSCredential]$Credential,

    [Parameter(Mandatory=$false)]
    [string[]]$ServerIPs,

    [Parameter(Mandatory=$false)]
    [switch]$Full
)

#Requires -Version 7.0

# Find repository root and config file
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) {
    throw "Could not find repository root (config directory not found)"
}

# Import configuration module
$modulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
Import-Module $modulePath -Force

# Load configuration
$config = Get-AzureLocalConfig
if ($ServerIPs) {
    $serverIPs = $ServerIPs
} else {
    $serverIPs = $config.GetIdracIPs()
}

# Retrieve credentials from Key Vault if not provided
if (!$Credential) {
    $keyVaultName = $config.GetValue('keyvault.platform_name')
    $secretName = $config.GetValue('ztp.idrac_secret_name')
    if (!$keyVaultName -or !$secretName) {
        throw "Key Vault name and secret name must be configured in environment.yaml under keyvault.platform_name and ztp.idrac_secret_name"
    }
    Write-Host "Retrieving credentials from Azure Key Vault '$keyVaultName'..." -ForegroundColor Cyan
    $secret = Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $secretName
    if (!$secret) {
        throw "Failed to retrieve secret '$secretName' from Key Vault '$keyVaultName'"
    }
    $credString = $secret.SecretValue | ConvertFrom-SecureString -AsPlainText
    if ($credString -notmatch ':') {
        throw "Secret value must be in format 'username:password'"
    }
    $username, $password = $credString -split ':', 2
    $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
    $Credential = New-Object PSCredential ($username, $securePassword)
    Write-Host "✓ Credentials retrieved successfully" -ForegroundColor Green
}

Write-Host "Starting server discovery for $($serverIPs.Count) servers..." -ForegroundColor Green
Write-Host "Server IPs: $($serverIPs -join ', ')" -ForegroundColor Cyan

$results = @()

foreach ($ip in $serverIPs) {
    try {
        Write-Host "Discovering server at $ip..." -ForegroundColor Yellow

        $baseUrl = "https://$ip"

        # Test connectivity and get basic system information
        $systemUri = "$baseUrl/redfish/v1/Systems"
        $systemResponse = Invoke-RestMethod -Uri $systemUri -Credential $Credential -Method GET -SkipCertificateCheck -TimeoutSec 30

        # Get the first system (usually the only one)
        $system = $systemResponse.Members[0]
        $systemDetailsUri = "$baseUrl$system.'@odata.id'"
        $systemDetails = Invoke-RestMethod -Uri $systemDetailsUri -Credential $Credential -Method GET -SkipCertificateCheck

        $serverInfo = [PSCustomObject]@{
            IPAddress = $ip
            Model = $systemDetails.Model
            SerialNumber = $systemDetails.SerialNumber
            Manufacturer = $systemDetails.Manufacturer
            Status = "Discovered"
            Timestamp = Get-Date
            PowerState = $systemDetails.PowerState
            BiosVersion = $systemDetails.BiosVersion
            HostName = $systemDetails.HostName
        }

        # Include hardware inventory if requested
        if ($Full) {
            try {
                # Get processor information
                $processorUri = "$baseUrl/redfish/v1/Systems/System.Embedded.1/Processors"
                $processorResponse = Invoke-RestMethod -Uri $processorUri -Credential $Credential -Method GET -SkipCertificateCheck
                $serverInfo | Add-Member -MemberType NoteProperty -Name "ProcessorCount" -Value $processorResponse.Members.Count

                # Get memory information
                $memoryUri = "$baseUrl/redfish/v1/Systems/System.Embedded.1/Memory"
                $memoryResponse = Invoke-RestMethod -Uri $memoryUri -Credential $Credential -Method GET -SkipCertificateCheck
                $totalMemoryGB = ($memoryResponse.Members | Measure-Object -Property SizeMiB -Sum).Sum / 1024
                $serverInfo | Add-Member -MemberType NoteProperty -Name "TotalMemoryGB" -Value $totalMemoryGB

                # Get storage information
                $storageUri = "$baseUrl/redfish/v1/Systems/System.Embedded.1/Storage"
                $storageResponse = Invoke-RestMethod -Uri $storageUri -Credential $Credential -Method GET -SkipCertificateCheck
                $driveCount = ($storageResponse.Members | ForEach-Object {
                    $storageDetailsUri = "$baseUrl$($_. '@odata.id')"
                    $storageDetails = Invoke-RestMethod -Uri $storageDetailsUri -Credential $Credential -Method GET -SkipCertificateCheck
                    $storageDetails.Drives.Count
                } | Measure-Object -Sum).Sum
                $serverInfo | Add-Member -MemberType NoteProperty -Name "DriveCount" -Value $driveCount

            } catch {
                Write-Warning "Could not retrieve hardware inventory for $ip`: $($_.Exception.Message)"
            }
        }

        $results += $serverInfo
        Write-Host "Successfully discovered server at $ip ($($systemDetails.Model))" -ForegroundColor Green

    } catch {
        Write-Warning "Failed to discover server at $ip`: $($_.Exception.Message)"
        $results += [PSCustomObject]@{
            IPAddress = $ip
            Status = "Failed"
            Error = $_.Exception.Message
            Timestamp = Get-Date
        }
    }
}

# Export results
$outputDir = Join-Path $repoRoot "config\dell\discovery"
New-Item -ItemType Directory -Path $outputDir -Force | Out-Null

# Create individual JSON files for each server
foreach ($result in $results) {
    $serverName = $result.ServerIP -replace '\.', '-'
    $individualJsonPath = Join-Path $outputDir "$serverName.json"
    $result | ConvertTo-Json | Out-File $individualJsonPath
}

# Create combined CSV and JSON files
$csvPath = Join-Path $outputDir "server-discovery-results.csv"
$jsonPath = Join-Path $outputDir "server-discovery-results.json"

$results | Export-Csv -Path $csvPath -NoTypeInformation
$results | ConvertTo-Json | Out-File $jsonPath

Write-Host "Discovery complete. Results saved to:" -ForegroundColor Green
Write-Host "  Individual JSON files: config/dell/discovery/<server-ip>.json" -ForegroundColor Cyan
Write-Host "  Combined CSV: $csvPath" -ForegroundColor Cyan
Write-Host "  Combined JSON: $jsonPath" -ForegroundColor Cyan
Write-Host "Discovered servers: $(($results | Where-Object { $_.Status -eq 'Discovered' }).Count)" -ForegroundColor Cyan
Write-Host "Failed discoveries: $(($results | Where-Object { $_.Status -eq 'Failed' }).Count)" -ForegroundColor Yellow

.\scripts\common\utilities\tools\Validate-DiscoveryResults.ps1

<#
.SYNOPSIS
    Validates server discovery results.

.DESCRIPTION
    Reviews and validates the output from server discovery operations
    to ensure all servers are properly inventoried.

.EXAMPLE
    .\Validate-DiscoveryResults.ps1

    Validates discovery results from CSV and JSON files

.NOTES
    Requires:
    - PowerShell 7.0+
    - Discovery results files (CSV and JSON)
#>

Write-Host "Validating server discovery results..." -ForegroundColor Cyan

# Check for results files
$csvFile = ".\server-discovery-results.csv"
$jsonFile = ".\server-discovery-results.json"

$filesExist = $true
if (!(Test-Path $csvFile)) {
    Write-Warning "CSV results file not found: $csvFile"
    $filesExist = $false
}

if (!(Test-Path $jsonFile)) {
    Write-Warning "JSON results file not found: $jsonFile"
    $filesExist = $false
}

if (!$filesExist) {
    Write-Host "No discovery results files found. Run discovery first." -ForegroundColor Yellow
    exit 1
}

# Import and display results
Write-Host "Importing discovery results..." -ForegroundColor Gray
$results = Import-Csv $csvFile

Write-Host "`nDiscovery Results Summary:" -ForegroundColor Yellow
$results | Format-Table -AutoSize

# Analyze results
$discovered = $results | Where-Object { $_.Status -eq "Discovered" }
$failed = $results | Where-Object { $_.Status -eq "Failed" }

Write-Host "`nAnalysis:" -ForegroundColor Cyan
Write-Host "  Total servers: $($results.Count)" -ForegroundColor White
Write-Host "  Successfully discovered: $($discovered.Count)" -ForegroundColor Green
Write-Host "  Failed discoveries: $($failed.Count)" -ForegroundColor Red

if ($failed.Count -gt 0) {
    Write-Host "`nFailed servers:" -ForegroundColor Red
    $failed | ForEach-Object {
        Write-Host "  - $($_.IPAddress): $($_.Error)" -ForegroundColor Red
    }
}

if ($discovered.Count -gt 0) {
    Write-Host "`nDiscovered servers:" -ForegroundColor Green
    $discovered | ForEach-Object {
        $model = if ($_.Model) { " ($($_.Model))" } else { "" }
        Write-Host "  - $($_.IPAddress)$model" -ForegroundColor Green
    }

    # Check for hardware details
    $withHardware = $discovered | Where-Object { $_.ProcessorCount -or $_.TotalMemoryGB -or $_.DriveCount }
    if ($withHardware) {
        Write-Host "`nServers with hardware inventory:" -ForegroundColor Cyan
        $withHardware | ForEach-Object {
            Write-Host "  - $($_.IPAddress): $($_.ProcessorCount) CPUs, $($_.TotalMemoryGB) GB RAM, $($_.DriveCount) drives" -ForegroundColor Gray
        }
    }
}

Write-Host "`nValidation completed." -ForegroundColor Cyan

# Option 1: Using interactive credentials
$credential = Get-Credential
.\scripts\common\utilities\tools\Mount-AzureLocalISO.ps1 -Credential $credential

# Option 2: Using Azure Key Vault (automatic from config)
.\scripts\common\utilities\tools\Mount-AzureLocalISO.ps1

<#
.SYNOPSIS
    Mounts Azure Local ISO as virtual media on Dell servers via iDRAC Redfish API.

.DESCRIPTION
    Uses Redfish API to mount an ISO as virtual CD on Dell PowerEdge servers via iDRAC,
    then sets one-time boot to CD. Uses CIFS share credentials from environment.yaml config.

    The qualified username (SERVER\user) is built at runtime by extracting the server name
    from ztp.share_network_path, so the config stays portable across environments.

.PARAMETER ServerIPs
    Array of iDRAC IP addresses. Defaults to config values.

.PARAMETER Credential
    PSCredential for iDRAC authentication.

.PARAMETER IsoUrl
    Override: HTTP/HTTPS URL to ISO. Bypasses CIFS and share credentials entirely.

.PARAMETER DelayBetweenServers
    Delay in seconds between servers (default: 10)

.PARAMETER Force
    Skip confirmation prompts

.EXAMPLE
    $cred = Get-Credential
    .\Mount-AzureLocalISO.ps1 -Credential $cred -Force

.EXAMPLE
    .\Mount-AzureLocalISO.ps1 -Credential $cred -IsoUrl "http://{fileserver_ip}:{fileserver_port}/provision-os.iso" -Force

.NOTES
    Requires: PowerShell 7.0+, AzureLocalConfig.psm1

    Config keys used (under ztp:):
      share_location      - local path to ISO directory (e.g. C:\share\ztp)
      share_network_path  - UNC path to share (e.g. \\util-eus-01\share\ztp)
      share_username      - local account name (e.g. svc_idrac_share)
      share_password      - account password
#>
param(
    [Parameter(Mandatory=$false)]
    [string[]]$ServerIPs,

    [Parameter(Mandatory=$false)]
    [PSCredential]$Credential,

    [Parameter(Mandatory=$false)]
    [string]$IsoUrl,

    [Parameter(Mandatory=$false)]
    [int]$DelayBetweenServers = 10,

    [Parameter(Mandatory=$false)]
    [switch]$Force
)

#Requires -Version 7.0

# Validate parameters
if ($ServerIPs) {
    foreach ($ip in $ServerIPs) {
        if ($ip -notmatch '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$') {
            throw "Invalid IP address provided: $ip"
        }
    }
}

if ($Credential -and $Credential.GetType().Name -ne 'PSCredential') {
    throw "Credential parameter must be a PSCredential object"
}

# ── Load Config ──────────────────────────────────────────────────────────────
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) { throw "Could not find repository root (config directory not found)" }

$configModulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
if (!(Test-Path $configModulePath)) { throw "Config module not found at $configModulePath" }
Import-Module $configModulePath -Force
$config = Get-AzureLocalConfig

# ── Resolve Server IPs ──────────────────────────────────────────────────────
if (-not $ServerIPs) { $ServerIPs = $config.GetIdracIPs() }
if (-not $ServerIPs -or $ServerIPs.Count -eq 0) { throw "No server IPs provided and none found in config" }
Write-Host "Using ServerIPs: $($ServerIPs -join ', ')" -ForegroundColor Cyan

# ── Build InsertMedia Payload ────────────────────────────────────────────────
if ($IsoUrl -and $IsoUrl -match '^https?://') {
    # HTTP override - no share credentials needed
    Write-Host "Using HTTP: $IsoUrl" -ForegroundColor Cyan
    $insertBodyTemplate = @{
        Image          = $IsoUrl
        Inserted       = $true
        WriteProtected = $true
    }
} else {
    # CIFS from config
    $shareLocation   = $config.GetValue('ztp.share_location')
    $shareNetworkPath = $config.GetValue('ztp.share_network_path')
    $shareUsername   = $config.GetValue('ztp.share_username')
    $sharePassword   = $config.GetValue('ztp.share_password')

    # Auto-detect ISO
    $isoFile = Get-ChildItem -Path $shareLocation -Filter "*.iso" -ErrorAction SilentlyContinue | Select-Object -First 1
    if (-not $isoFile) { throw "No ISO file found in: $shareLocation" }
    Write-Host "Auto-detected ISO: $($isoFile.Name)" -ForegroundColor Green

    # Build CIFS path with forward slashes
    $cifsPath = "$shareNetworkPath\$($isoFile.Name)".Replace('\', '/')
    Write-Host "CIFS path: $cifsPath" -ForegroundColor Cyan

    # Build qualified username: extract server name from \\server\share\path
    # share_network_path = \\util-eus-01\share\ztp  →  server = util-eus-01
    $shareServer = ($shareNetworkPath -replace '^\\\\', '') -split '\\' | Select-Object -First 1
    $qualifiedUsername = "$shareServer\$shareUsername"
    Write-Host "Share account: $qualifiedUsername" -ForegroundColor Gray

    $insertBodyTemplate = @{
        Image    = $cifsPath
        UserName = $qualifiedUsername
        Password = $sharePassword
    }
}

# ── Resolve iDRAC Credentials ───────────────────────────────────────────────
if (!$Credential) {
    $keyVaultName = $config.GetValue('keyvault.platform_name', $null)
    $secretName = $config.GetValue('ztp.idrac_secret_name', $null)
    if ($keyVaultName -and $secretName) {
        Write-Host "Retrieving iDRAC credentials from Key Vault '$keyVaultName'..." -ForegroundColor Cyan
        $secret = Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $secretName
        if (!$secret) { throw "Failed to retrieve secret '$secretName' from Key Vault '$keyVaultName'" }
        $credString = $secret.SecretValue | ConvertFrom-SecureString -AsPlainText
        if ($credString -notmatch ':') { throw "Invalid Key Vault secret format. Expected: 'username:password'" }
        $username, $password = $credString -split ':', 2
        $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
        $Credential = New-Object PSCredential ($username, $securePassword)
        Write-Host "✓ iDRAC credentials retrieved" -ForegroundColor Green
    } else {
        $Credential = Get-Credential -Message "Enter iDRAC credentials"
    }
}

# ── Confirm ──────────────────────────────────────────────────────────────────
if (-not $Force) {
    $serverList = $ServerIPs -join ", "
    $confirm = Read-Host "Mount '$($insertBodyTemplate.Image)' on servers: $serverList. Continue? (y/N)"
    if ($confirm -ne 'y' -and $confirm -ne 'Y') { Write-Host "Cancelled." ; exit 0 }
}

# ── Mount ISO on Each Server ─────────────────────────────────────────────────
$results = @()
foreach ($ip in $ServerIPs) {
    Write-Host "`n── Server $ip ──" -ForegroundColor Cyan
    $baseUrl = "https://$ip"

    try {
        # 1. Test connectivity
        Write-Host "  Connecting..." -ForegroundColor Gray
        $redfishRoot = Invoke-RestMethod -Uri "$baseUrl/redfish/v1" `
            -Credential $Credential -SkipCertificateCheck -TimeoutSec 30 -ErrorAction Stop
        Write-Host "  ✓ Connected - Redfish $($redfishRoot.RedfishVersion)" -ForegroundColor Green

        # 2. Eject existing media
        Write-Host "  Ejecting existing media..." -ForegroundColor Gray
        try {
            Invoke-RestMethod -Uri "$baseUrl/redfish/v1/Managers/iDRAC.Embedded.1/VirtualMedia/CD/Actions/VirtualMedia.EjectMedia" `
                -Method Post -Credential $Credential -SkipCertificateCheck `
                -ContentType 'application/json' -Body '{}' -TimeoutSec 30 -ErrorAction Stop
            Write-Host "  ✓ Ejected" -ForegroundColor Green
        } catch {
            Write-Host "  - No media to eject" -ForegroundColor Gray
        }

        Start-Sleep -Seconds 2

        # 3. Insert ISO
        $insertJson = $insertBodyTemplate | ConvertTo-Json
        Write-Host "  Mounting: $($insertBodyTemplate.Image)" -ForegroundColor Gray

        Invoke-RestMethod -Uri "$baseUrl/redfish/v1/Managers/iDRAC.Embedded.1/VirtualMedia/CD/Actions/VirtualMedia.InsertMedia" `
            -Method Post -Credential $Credential -SkipCertificateCheck `
            -ContentType 'application/json' -Body $insertJson -TimeoutSec 60 -ErrorAction Stop
        Write-Host "  ✓ ISO mounted" -ForegroundColor Green

        # 4. Verify
        $vmStatus = Invoke-RestMethod -Uri "$baseUrl/redfish/v1/Managers/iDRAC.Embedded.1/VirtualMedia/CD" `
            -Credential $Credential -SkipCertificateCheck -TimeoutSec 30 -ErrorAction Stop
        if ($vmStatus.Inserted -eq $true) {
            Write-Host "  ✓ Verified: $($vmStatus.Image)" -ForegroundColor Green
        } else {
            Write-Host "  ⚠ Inserted=false - check iDRAC GUI" -ForegroundColor Yellow
        }

        # 5. Set one-time boot to CD
        $bootBody = @{ Boot = @{ BootSourceOverrideEnabled = "Once"; BootSourceOverrideTarget = "Cd" } } | ConvertTo-Json -Depth 5
        Invoke-RestMethod -Uri "$baseUrl/redfish/v1/Systems/System.Embedded.1" `
            -Method Patch -Credential $Credential -SkipCertificateCheck `
            -ContentType 'application/json' -Body $bootBody -TimeoutSec 30 -ErrorAction Stop
        Write-Host "  ✓ Boot set to CD (one-time)" -ForegroundColor Green

        $results += @{ server = $ip; success = $true; message = "OK" }
    }
    catch {
        Write-Host "  ✗ FAILED: $($_.Exception.Message)" -ForegroundColor Red
        if ($_.ErrorDetails -and $_.ErrorDetails.Message) {
            Write-Host "  Response: $($_.ErrorDetails.Message)" -ForegroundColor Red
        }
        $results += @{ server = $ip; success = $false; message = $_.Exception.Message }
    }

    if ($ip -ne $ServerIPs[-1]) { Start-Sleep -Seconds $DelayBetweenServers }
}

# ── Summary ──────────────────────────────────────────────────────────────────
$ok = ($results | Where-Object { $_.success }).Count
$fail = ($results | Where-Object { -not $_.success }).Count
Write-Host "`n========================================" -ForegroundColor Yellow
Write-Host "  Total: $($results.Count)  |  OK: $ok  |  Failed: $fail" -ForegroundColor $(if ($fail -gt 0) { "Red" } else { "Green" })
if ($fail -gt 0) {
    $results | Where-Object { -not $_.success } | ForEach-Object {
        Write-Host "  ✗ $($_.server): $($_.message)" -ForegroundColor Red
    }
}
Write-Host "========================================" -ForegroundColor Yellow

$credential = Get-Credential
.\scripts\common\utilities\tools\Verify-ISOMount.ps1 -Credential $credential

<#
.SYNOPSIS
    Verifies ISO mount status on servers.

.DESCRIPTION
    Checks that the Azure Local maintenance environment ISO is properly
    mounted as virtual media on target servers via Redfish API.

.PARAMETER ServerIPs
    Array of BMC/iDRAC IP addresses for target servers. Defaults to config values.

.PARAMETER Credential
    PSCredential object for BMC/iDRAC authentication

.EXAMPLE
    $credential = Get-Credential
    .\Verify-ISOMount.ps1 -ServerIPs "192.168.200.11","192.168.200.12" -Credential $credential

    Verifies ISO mount status on specified servers

.EXAMPLE
    .\Verify-ISOMount.ps1 -Credential $credential

    Verifies ISO mount status on all servers from config

.NOTES
    Requires:
    - PowerShell 7.0+
    - Network access to BMC/iDRAC interfaces
    - Valid BMC credentials with virtual media permissions
    - AzureLocalConfig.psm1 module for configuration loading
#>

param(
    [Parameter(Mandatory=$false)]
    [string[]]$ServerIPs,

    [Parameter(Mandatory=$false)]
    [PSCredential]$Credential
)

#Requires -Version 7.0

# ── Load Config ──────────────────────────────────────────────────────────────
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = $scriptDir
while ($repoRoot -and !(Test-Path (Join-Path $repoRoot "config"))) {
    $repoRoot = Split-Path -Parent $repoRoot
}
if (!$repoRoot) { throw "Could not find repository root (config directory not found)" }

$configModulePath = Join-Path $repoRoot "scripts\common\AzureLocalConfig.psm1"
if (!(Test-Path $configModulePath)) { throw "Config module not found at $configModulePath" }
Import-Module $configModulePath -Force
$config = Get-AzureLocalConfig

# ── Resolve Server IPs ──────────────────────────────────────────────────────
if (-not $ServerIPs) { $ServerIPs = $config.GetIdracIPs() }
if (-not $ServerIPs -or $ServerIPs.Count -eq 0) { throw "No server IPs provided and none found in config" }

# ── Resolve iDRAC Credentials ───────────────────────────────────────────────
if (!$Credential) {
    $keyVaultName = $config.GetValue('keyvault.platform_name', $null)
    $secretName = $config.GetValue('ztp.idrac_secret_name', $null)
    if ($keyVaultName -and $secretName) {
        Write-Host "Retrieving iDRAC credentials from Key Vault '$keyVaultName'..." -ForegroundColor Cyan
        $secret = Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $secretName
        if (!$secret) { throw "Failed to retrieve secret '$secretName' from Key Vault '$keyVaultName'" }
        $credString = $secret.SecretValue | ConvertFrom-SecureString -AsPlainText
        if ($credString -notmatch ':') { throw "Invalid Key Vault secret format. Expected: 'username:password'" }
        $username, $password = $credString -split ':', 2
        $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
        $Credential = New-Object PSCredential ($username, $securePassword)
        Write-Host "✓ iDRAC credentials retrieved" -ForegroundColor Green
    } else {
        $Credential = Get-Credential -Message "Enter iDRAC credentials"
    }
}

Write-Host "Verifying ISO mount status on $($ServerIPs.Count) servers..." -ForegroundColor Cyan

$results = @()

foreach ($ip in $ServerIPs) {
    $result = [PSCustomObject]@{
        IPAddress = $ip
        Status = "Checking"
        ISOMounted = $false
        Message = ""
        Timestamp = Get-Date
    }

    try {
        Write-Host "Checking server $ip..." -ForegroundColor Gray

        $baseUrl = "https://$ip"

        # Check virtual media status
        $vmUri = "$baseUrl/redfish/v1/Managers/iDRAC.Embedded.1/VirtualMedia/CD"
        $vmResponse = Invoke-RestMethod -Uri $vmUri -Credential $Credential -Method GET -SkipCertificateCheck

        if ($vmResponse.Inserted -eq $true) {
            $result.Status = "Success"
            $result.ISOMounted = $true
            $result.Message = "ISO successfully mounted: $($vmResponse.Image)"
            Write-Host "✓ ISO mounted on server $ip" -ForegroundColor Green
        } else {
            $result.Status = "Not Mounted"
            $result.Message = "ISO not mounted"
            Write-Warning "ISO not mounted on server $ip"
        }

    } catch {
        $result.Status = "Error"
        $result.Message = $_.Exception.Message
        Write-Error "Could not verify ISO mount on server $ip`: $($_.Exception.Message)"
    }

    $results += $result
}

# Display results
Write-Host "`nISO Mount Verification Results:" -ForegroundColor Yellow
$results | Format-Table -AutoSize

# Summary
$mounted = $results | Where-Object { $_.ISOMounted -eq $true }
$notMounted = $results | Where-Object { $_.ISOMounted -eq $false -and $_.Status -ne "Error" }
$errors = $results | Where-Object { $_.Status -eq "Error" }

Write-Host "`nSummary:" -ForegroundColor Cyan
Write-Host "  Successfully mounted: $($mounted.Count)" -ForegroundColor Green
Write-Host "  Not mounted: $($notMounted.Count)" -ForegroundColor Yellow
Write-Host "  Errors: $($errors.Count)" -ForegroundColor Red

if ($notMounted.Count -gt 0) {
    Write-Host "`nServers without ISO mounted:" -ForegroundColor Yellow
    $notMounted | ForEach-Object {
        Write-Host "  - $($_.IPAddress)" -ForegroundColor Yellow
    }
}

if ($errors.Count -gt 0) {
    Write-Host "`nServers with verification errors:" -ForegroundColor Red
    $errors | ForEach-Object {
        Write-Host "  - $($_.IPAddress): $($_.Message)" -ForegroundColor Red
    }
}