#Requires -Version 5.1
[CmdletBinding(SupportsShouldProcess)]
param(
    [Parameter(Mandatory)][string]$SubscriptionId,
    [Parameter(Mandatory)][string]$ResourceGroupName,
    [Parameter(Mandatory)][string]$VpnGatewayName,
    [string]$OutputPath = (Join-Path $PSScriptRoot '..\artifacts\azure-p2s\sgu-azure-vpn-client.zip')
)

$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'
if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
    throw 'Azure CLI is required.'
}
& az account set --subscription $SubscriptionId --only-show-errors
if ($LASTEXITCODE -ne 0) {
    throw "Could not select Azure subscription $SubscriptionId."
}

if ($PSCmdlet.ShouldProcess($OutputPath, 'Generate and download the Azure P2S client package')) {
    $downloadUriText = & az network vnet-gateway vpn-client generate `
        --resource-group $ResourceGroupName `
        --name $VpnGatewayName `
        --processor-architecture Amd64 `
        --authentication-method EAPTLS `
        --only-show-errors `
        --output tsv
    $downloadUriText = ($downloadUriText -join '').Trim()
    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($downloadUriText)) {
        throw 'Azure did not generate a P2S client package URL.'
    }
    $downloadUri = $null
    if (-not [uri]::TryCreate($downloadUriText, [UriKind]::Absolute, [ref]$downloadUri) -or
        $downloadUri.Scheme -ne 'https') {
        throw 'Azure returned an invalid VPN client package URL.'
    }
    $resolvedOutputPath = [IO.Path]::GetFullPath($OutputPath)
    New-Item -ItemType Directory -Path (Split-Path $resolvedOutputPath -Parent) -Force | Out-Null
    Invoke-WebRequest -Uri $downloadUri -OutFile $resolvedOutputPath -UseBasicParsing
    if ((Get-Item -LiteralPath $resolvedOutputPath).Length -lt 1024) {
        throw 'The downloaded VPN client package is unexpectedly small.'
    }
    [pscustomobject]@{
        PackagePath = $resolvedOutputPath
        Sha256 = (Get-FileHash -LiteralPath $resolvedOutputPath -Algorithm SHA256).Hash
        VpnGatewayName = $VpnGatewayName
    }
}