#Requires -Version 7.2
<#
.SYNOPSIS
    Names who may use the Entra Policy Suite web app: SuperAdmin, Admin or Reader. Used once to name the first SuperAdmin.
.DESCRIPTION
    The web app's access list (eps.WebAccess) is managed in the app itself by a SuperAdmin. When there is none - every
    SuperAdmin has left - this script names one: it starts the install's database setup job with that person (you need
    the right to start a job in the install's resource group, no database right); the job names a SuperAdmin only when
    there is none. An install made before 2.0.59 (no setup job) is changed directly, by a SQL administrator of the database.
    Anyone who signs in and is not named is a Reader. The change is written to the audit trail.
    You sign in in a browser (no module). -WhatIf: what it would write, nothing changed.
.EXAMPLE
    ./Set-EpsWebAccess.ps1 -TenantId <tenant> -SubscriptionId <sub> -UserPrincipalName admin@contoso.com -Role SuperAdmin -Reason 'first SuperAdmin after the install'
.LINK
    https://invardia.com/docs/eps/scripts/Set-EpsWebAccess
#>
# PUBLISHED as a self-contained launcher of Set-EpsWebAccess.ps1 (EntraPolicySuite 2.0.107, Publish-EpsHandover): it runs release 2.0.107 unless -EpsVersion picks another.
[CmdletBinding(SupportsShouldProcess)]
param(
    [Parameter(Mandatory)][guid]$TenantId,
    [Parameter(Mandatory)][guid]$SubscriptionId,
    [Parameter(Mandatory)][string]$UserPrincipalName,
    [ValidateSet('SuperAdmin', 'Admin', 'Reader')][string]$Role = 'SuperAdmin',
    [Parameter(Mandatory)][string]$Reason,
    [string]$ResourceGroup = '',
    [ValidatePattern('^$|^2\.\d+\.\d+$')][string]$EpsVersion = '2.0.107'
)
$ErrorActionPreference = 'Stop'
# A self-contained launcher of Set-EpsWebAccess.ps1 (invardia.com/support/eps/): it downloads the EntraPolicySuite release this script
# was handed over for (2.0.107 - the version of your install's ring; -EpsVersion picks another, -EpsVersion '' the
# latest), checks it against the release's published SHA-256 digest and runs the release's own Set-EpsWebAccess.ps1 with the
# parameters you gave. Nothing is installed on this machine; the download goes to a temporary folder.
$what = [bool]$WhatIfPreference; $WhatIfPreference = $false
$repo = 'KnudsenMorten/EntraPolicySuite'; $h = @{ 'User-Agent' = 'EntraPolicySuite-support' }
$rel = Invoke-RestMethod -Uri $(if ($EpsVersion) { "https://api.github.com/repos/$repo/releases/tags/v$EpsVersion" } else { "https://api.github.com/repos/$repo/releases?per_page=30" }) -Headers $h
$rel = @($rel | Where-Object { $_.tag_name -match '^v2\.' -and -not $_.draft -and -not $_.prerelease } | Sort-Object { [version]($_.tag_name.TrimStart('v') -replace '[^0-9.].*$', '') } -Descending)[0]
if (-not $rel) { Write-Host 'No EntraPolicySuite v2 release found.' -ForegroundColor Red; exit 3 }
$asset = @($rel.assets | Where-Object { $_.name -match '^EntraPolicySuite-v2[0-9A-Za-z.+-]*\.zip$' })[0]
if (-not $asset) { Write-Host "Release $($rel.tag_name) has no EntraPolicySuite-v2*.zip." -ForegroundColor Red; exit 3 }
$dir = Join-Path ([IO.Path]::GetTempPath()) "eps-$($rel.tag_name)-$([guid]::NewGuid().ToString('N').Substring(0, 6))"
New-Item -ItemType Directory -Path $dir | Out-Null
$zip = Join-Path $dir $asset.name
Invoke-WebRequest -Uri $asset.browser_download_url -OutFile $zip -Headers $h
$got = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant()
$published = if ("$($asset.digest)" -match '^(?i)sha256:([0-9a-f]{64})$') { $Matches[1].ToLowerInvariant() } else { '' }
if (-not $published -or $got -ne $published) { [IO.Directory]::Delete($dir, $true); Write-Host "The download does not match the release's SHA-256 - deleted, nothing run." -ForegroundColor Red; exit 3 }
Write-Host "Release $($rel.tag_name), SHA-256 $got (matches the release)"
Expand-Archive -LiteralPath $zip -DestinationPath $dir -Force
$script = Get-ChildItem -LiteralPath $dir -Recurse -Filter 'Set-EpsWebAccess.ps1' -File | Select-Object -First 1
if (-not $script) { Write-Host 'The release has no Set-EpsWebAccess.ps1.' -ForegroundColor Red; exit 3 }
$pass = @{}
foreach ($k in @($PSBoundParameters.Keys)) { if ($k -notin 'EpsVersion', 'WhatIf', 'Confirm') { $pass[$k] = $PSBoundParameters[$k] } }
if ($what) { $pass.WhatIf = $true }
& $script.FullName @pass
exit $LASTEXITCODE