# Ensure Microsoft.Graph module is installed
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph)) {
    Write-Host "✅ Installing Microsoft.Graph module..."
    Install-Module -Name Microsoft.Graph -Force -AllowClobber
}

# Ensure ExchangeOnlineManagement module is installed
if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
    Write-Host "✅ Installing ExchangeOnlineManagement Module..."
    Install-Module -Name ExchangeOnlineManagement -Force -AllowClobber
}

# Import necessary modules
Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Applications
Import-Module ExchangeOnlineManagement

# Connect to Microsoft Graph with required permissions
Connect-MgGraph -Scopes "Application.ReadWrite.All", "Directory.ReadWrite.All", "AppRoleAssignment.ReadWrite.All" -NoWelcome

# Application details
$Name = "GraphAPI"
$Scope = "Application.ReadWrite.All", "DeviceManagementApps.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All", "Group.ReadWrite.All", "Policy.ReadWrite.ApplicationConfiguration", "User.ReadWrite.All", "Policy.ReadWrite.AuthenticationMethod"

# -------------------------------
# Check for existing apps with the same name
# -------------------------------
Write-Host "🔍 Checking for existing applications named '$Name'..."
$existingApps = Get-MgApplication -All | Where-Object { $_.DisplayName -eq $Name }

if ($existingApps) {
    Write-Host "⚠️ Found $($existingApps.Count) existing application(s) with this name. Removing them..."
    foreach ($existingApp in $existingApps) {
        try {
            # Remove associated Service Principal first
            $sp = Get-MgServicePrincipal -Filter "AppId eq '$($existingApp.AppId)'" -ErrorAction SilentlyContinue
            if ($sp) {
                Remove-MgServicePrincipal -ServicePrincipalId $sp.Id -Confirm:$false
                Write-Host "   ➜ Removed Service Principal: $($sp.Id)"
            }

            # Remove the application
            Remove-MgApplication -ApplicationId $existingApp.Id -Confirm:$false
            Write-Host "   ➜ Removed Application: $($existingApp.Id)"
        } catch {
            Write-Warning "   ❌ Failed to remove application $($existingApp.Id): $_"
        }
    }

    # Optional pause to ensure deletion propagates
    Write-Host "⏳ Waiting for application deletion..."
    Start-Sleep -Seconds 10
} else {
    Write-Host "✅ No existing applications found with name '$Name'."
}


# Fetch Microsoft Graph Service Principal
$graphSp = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
$graphRoles = $graphSp.AppRoles

# Debugging: Confirm AppRoles permissions
# Write-Host "`n🔍 Retrieved AppRoles from Microsoft Graph:"
# $graphRoles | Format-Table DisplayName, Id, Value -AutoSize

# Build required resource access list
$resourceAccess = @()
foreach ($perm in $Scope) {
    $permId = ($graphRoles | Where-Object { $_.Value -eq $perm }).Id
    if ($permId) {
        $resourceAccess += @{
            "id"   = $permId
            "Type" = "Role"  # Use "Scope" if using delegated permissions
        }
    } else {
        Write-Host "⚠️ Skipping $perm - Role ID not found in Microsoft Graph."
    }
}

# Debugging: Confirm matched permissions
# Write-Host "`n✅ Final Mapped Permissions:"
# $resourceAccess | Format-Table -AutoSize

# Define app creation body
$body = @{
    DisplayName            = $Name
    SignInAudience         = "AzureADMyOrg"
    RequiredResourceAccess = @(
        @{
            ResourceAppId  = "00000003-0000-0000-c000-000000000000"  # Microsoft Graph
            ResourceAccess = $resourceAccess
        }
    )
}

# Convert body to JSON
$payload = $body | ConvertTo-Json -Depth 4

# Create the application
Write-Host "Creating Azure AD application..."
$app = New-MgApplication -BodyParameter $payload

if (-not $app) {
    Write-Host "❌ Failed to create application. Exiting."
    exit
}

Write-Host "✅ Application Created: $($app.Id)"

# Wait for the application to propagate
Write-Host "⏳ Waiting for application propagation..."
Start-Sleep -Seconds 10

# Create Service Principal
$servicePrincipal = New-MgServicePrincipal -AppId $app.AppId

if (-not $servicePrincipal) {
    Write-Host "❌ Failed to create Service Principal. Exiting."
    exit
}

Write-Host "✅ Service Principal created: $($servicePrincipal.Id)"

# Wait for service principal to propagate
Start-Sleep -Seconds 10
Write-Host "⏳ Waiting for application permissions to propagate..."

# Grant Admin Consent
foreach ($access in $resourceAccess) {
    # Write-Host "`n🔹 About to grant admin consent for:"
    # Write-Host "   ➜ AppRoleId: $($access.id)"
    # Write-Host "   ➜ ServicePrincipalId: $($servicePrincipal.Id)"
    # Write-Host "   ➜ PrincipalId: $($servicePrincipal.Id)"
    # Write-Host "   ➜ ResourceId: $($graphSp.Id)"

    try {
       $null = New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $servicePrincipal.Id -PrincipalId $servicePrincipal.Id -ResourceId $graphSp.Id -AppRoleId $access.id

        Write-Host "✅ Successfully granted admin consent for AppRoleId: $($access.id)"
    } catch {
        Write-Host "❌ Failed to grant admin consent for AppRoleId: $($access.id) - $_"
    }
}

Write-Host "`n🎉 Admin consent process completed!"

# -------------------------------
# CREATE CLIENT SECRET
# -------------------------------

Write-Host "`n🔐 Creating Client Secret..."
$secretStartDate = Get-Date
$secretEndDate = $secretStartDate.AddYears(1)  # Secret valid for 1 year

$clientSecret = Add-MgApplicationPassword -ApplicationId $app.Id -PasswordCredential @{
    DisplayName = "GraphAPI-ClientSecret"
    StartDateTime = $secretStartDate
    EndDateTime = $secretEndDate
}

if (-not $clientSecret) {
    Write-Host "❌ Failed to create client secret. Exiting."
    exit
}

Write-Host "✅ Client Secret Created!"

# -------------------------------
# PRINT CREDENTIALS (STORE SECURELY!)
# -------------------------------

$tenantId = (Get-MgOrganization).Id

Write-Host "`n🚀 **Application Credentials**"
Write-Host "----------------------------------"
Write-Host "🌐 Tenant ID:       $tenantId"
Write-Host "🔑 Client ID:       $($app.AppId)"
Write-Host "🕵️‍♂️ Client Secret:  $($clientSecret.SecretText)"
Write-Host "----------------------------------"


$null = Disconnect-Graph -ErrorAction SilentlyContinue 
$null = Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue