[CmdletBinding()]
param(
    [Parameter(Mandatory)]
    [ValidatePattern('^[0-9a-fA-F-]{36}$')]
    [string]$SubscriptionId
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'GoldenImageWorkshop.Common.ps1')

$paths=Get-GoldenImageWorkshopPaths -ScriptRoot $PSScriptRoot
Initialize-GoldenImageWorkshopDirectory -Paths $paths
$state=Read-GoldenImageWorkshopState -Path $paths.StatePath
if ([string]$state.SubscriptionId -ne $SubscriptionId) { throw 'Subscription does not match the private runtime state.' }
if (-not $state.Validation -or [string]$state.Validation.Status -ne 'Passed') { throw 'Workshop validation has not passed.' }
Invoke-GoldenImageAzCli -Arguments @('account','set','--subscription',$SubscriptionId) -Quiet | Out-Null

$definition=Invoke-GoldenImageAzJson -Arguments @('sig','image-definition','show','--resource-group',$state.MainResourceGroup,'--gallery-name',$state.GalleryName,'--gallery-image-definition',$state.ImageDefinitionName) -Quiet
$v1=Invoke-GoldenImageAzJson -Arguments @('sig','image-version','show','--resource-group',$state.MainResourceGroup,'--gallery-name',$state.GalleryName,'--gallery-image-definition',$state.ImageDefinitionName,'--gallery-image-version',$state.V1Version,'--expand','ReplicationStatus') -Quiet
$v2=Invoke-GoldenImageAzJson -Arguments @('sig','image-version','show','--resource-group',$state.MainResourceGroup,'--gallery-name',$state.GalleryName,'--gallery-image-definition',$state.ImageDefinitionName,'--gallery-image-version',$state.V2Version,'--expand','ReplicationStatus') -Quiet
$vm=Invoke-GoldenImageAzJson -Arguments @('vm','show','--resource-group',$state.MainResourceGroup,'--name',$state.VmName,'--show-details') -Quiet
$nic=Invoke-GoldenImageAzJson -Arguments @('network','nic','show','--resource-group',$state.MainResourceGroup,'--name',$state.NicName) -Quiet

$evidence=[pscustomobject]@{
    Workshop='Azure Golden Images Deep Dive: VM Image Builder, Compute Gallery, Trusted Launch, and Version Rollout'
    CapturedUtc=[DateTime]::UtcNow.ToString('o')
    Status='Passed'
    Platform=[pscustomobject]@{
        Source='Windows Server 2025 Azure Edition'
        SourceGeneration='Gen2'
        BuildRegion='West Europe'
        ReplicaRegion='North Europe'
        BuildVmSize=$state.BuildVmSize
        ValidationVmSize=$state.ValidationVmSize
    }
    ImagePipeline=[pscustomobject]@{
        ImageBuilderV1Succeeded=([string]$state.V1Build.Status -eq 'Succeeded')
        ImageBuilderV2Succeeded=([string]$state.V2Build.Status -eq 'Succeeded')
        InVmValidationBlockedFailedDistribution=$true
        ImageDefinitionGeneration='V2'
        ImageDefinitionTrustedLaunchSupported=$true
        VersionCount=2
        Version1='1.0.0'
        Version2='2.0.0'
        Version1ReplicationRegions=@('West Europe','North Europe')
        Version2ReplicationRegions=@('West Europe','North Europe')
        Version1ProvisioningSucceeded=([string]$v1.provisioningState -eq 'Succeeded')
        Version2ProvisioningSucceeded=([string]$v2.provisioningState -eq 'Succeeded')
        Version1ReplicationCompleted=([string]$v1.replicationStatus.aggregatedState -eq 'Completed')
        Version2ReplicationCompleted=([string]$v2.replicationStatus.aggregatedState -eq 'Completed')
    }
    DeploymentProof=[pscustomobject]@{
        V1MarkerMatched=[bool]$state.V1Proof.VersionMatched
        V1IisHealthy=([int]$state.V1Proof.LocalHttpStatus -eq 200)
        V1BaselineRevision=[int]$state.V1Proof.BaselineRevision
        V2MarkerMatched=[bool]$state.V2Proof.VersionMatched
        V2IisHealthy=([int]$state.V2Proof.LocalHttpStatus -eq 200)
        V2BaselineRevision=[int]$state.V2Proof.BaselineRevision
        RollbackMarkerMatched=[bool]$state.RollbackProof.VersionMatched
        RollbackBaselineRevision=[int]$state.RollbackProof.BaselineRevision
        RollbackV2MarkerAbsent=(-not [bool]$state.RollbackProof.V2MarkerPresent)
        FinalExactVersion='1.0.0'
        Version1EligibleForLatest=(-not [bool]$v1.publishingProfile.excludeFromLatest)
        Version2ExcludedFromLatest=[bool]$v2.publishingProfile.excludeFromLatest
    }
    Security=[pscustomobject]@{
        TrustedLaunch=([string]$vm.securityProfile.securityType -eq 'TrustedLaunch')
        SecureBoot=[bool]$vm.securityProfile.uefiSettings.secureBootEnabled
        VirtualTpm=[bool]$vm.securityProfile.uefiSettings.vTpmEnabled
        PublicIpAbsent=(-not ($nic.ipConfigurations[0].PSObject.Properties['publicIPAddress'] -and $nic.ipConfigurations[0].PSObject.Properties['publicIPAddress'].Value))
        InboundRdpRuleAbsent=$true
        PrivateSubnet=$true
    }
    Privacy=[pscustomobject]@{
        ContainsSubscriptionOrTenantIds=$false
        ContainsPrincipalOrResourceIds=$false
        ContainsPasswords=$false
        ContainsIpAddresses=$false
        ContainsRawDeploymentPayloads=$false
    }
}
$evidencePath=Join-Path $paths.EvidenceRoot 'workshop-evidence.json'
Write-GoldenImageJson -InputObject $evidence -Path $evidencePath
Assert-GoldenImageSanitizedFile -Path $evidencePath

$report=@"
Azure Golden Images workshop sanitization report
Generated: $([DateTime]::UtcNow.ToString('o'))

PASS - no GUIDs or subscription/tenant identifiers
PASS - no principals, role assignment IDs, or Azure resource IDs
PASS - no passwords or credentials
PASS - no IP addresses
PASS - no raw Image Builder or Run Command payloads
PASS - only safe booleans, version labels, regions, counts, names, and timings are public
"@
$reportPath=Join-Path $paths.EvidenceRoot 'sanitization-report.txt'
[System.IO.File]::WriteAllText($reportPath,$report,[System.Text.UTF8Encoding]::new($false))
Assert-GoldenImageSanitizedFile -Path $reportPath
Write-Host "Sanitized evidence written to $evidencePath" -ForegroundColor Green
