#requires -Version 7.2

Configuration WorkshopWindowsBaseline {
    param(
        [ValidateSet('Present', 'Absent')]
        [string]$IisEnsure = 'Absent'
    )

    Import-DscResource -ModuleName PSDscResources -ModuleVersion '2.12.0.0'
    Import-DscResource -ModuleName WorkshopMachineConfiguration -ModuleVersion '1.0.0'

    Node localhost {
        Registry WorkshopRegistryRoot {
            Key       = 'HKLM:\SOFTWARE\AzureWorkshopz\MachineConfiguration'
            ValueName = ''
            Ensure    = 'Present'
        }

        Registry WorkshopEnvironment {
            Key       = 'HKLM:\SOFTWARE\AzureWorkshopz\MachineConfiguration'
            ValueName = 'Environment'
            ValueData = 'Workshop'
            ValueType = 'String'
            Ensure    = 'Present'
            Force     = $true
            DependsOn = '[Registry]WorkshopRegistryRoot'
        }

        Registry WorkshopBaselineVersion {
            Key       = 'HKLM:\SOFTWARE\AzureWorkshopz\MachineConfiguration'
            ValueName = 'BaselineVersion'
            ValueData = '1.1.0'
            ValueType = 'String'
            Ensure    = 'Present'
            Force     = $true
            DependsOn = '[Registry]WorkshopRegistryRoot'
        }

        Registry DomainFirewallEnabled {
            Key       = 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile'
            ValueName = 'EnableFirewall'
            ValueData = 1
            ValueType = 'Dword'
            Ensure    = 'Present'
            Force     = $true
        }

        Registry PrivateFirewallEnabled {
            Key       = 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile'
            ValueName = 'EnableFirewall'
            ValueData = 1
            ValueType = 'Dword'
            Ensure    = 'Present'
            Force     = $true
        }

        Registry PublicFirewallEnabled {
            Key       = 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile'
            ValueName = 'EnableFirewall'
            ValueData = 1
            ValueType = 'Dword'
            Ensure    = 'Present'
            Force     = $true
        }

        # Machine Configuration's PowerShell 7 worker has a documented feature-
        # resource compatibility issue. These custom resources bridge to the inbox
        # Windows PowerShell feature cmdlets and expose Machine Configuration reasons.
        WorkshopWindowsOptionalFeature Smb1Protocol {
            Name   = 'SMB1Protocol'
            Ensure = 'Absent'
        }

        Service WindowsEventLog {
            Name        = 'EventLog'
            State       = 'Running'
            StartupType = 'Automatic'
        }

        Script WorkshopMarker {
            GetScript = {
                $path = 'C:\AzureWorkshopz\MachineConfiguration\desired-state.txt'
                @{ Result = if (Test-Path -LiteralPath $path) { Get-Content -Raw -LiteralPath $path } else { '' } }
            }
            TestScript = {
                $path = 'C:\AzureWorkshopz\MachineConfiguration\desired-state.txt'
                $expected = "Azure Workshopz Machine Configuration`r`nBaselineVersion=1.1.0`r`nDesiredState=Compliant`r`n"
                (Test-Path -LiteralPath $path) -and ((Get-Content -Raw -LiteralPath $path) -eq $expected)
            }
            SetScript = {
                $directory = 'C:\AzureWorkshopz\MachineConfiguration'
                $path = Join-Path $directory 'desired-state.txt'
                $expected = "Azure Workshopz Machine Configuration`r`nBaselineVersion=1.1.0`r`nDesiredState=Compliant`r`n"
                New-Item -ItemType Directory -Path $directory -Force | Out-Null
                Set-Content -LiteralPath $path -Value $expected -Encoding ascii -NoNewline
            }
        }

        WorkshopWindowsFeature IisWebServer {
            Name   = 'Web-Server'
            Ensure = $IisEnsure
        }

    }
}
