[CmdletBinding()]
param(
    [string]$ConfigurationPath = "$env:ProgramData\SGU\Enrollment\enrollment.json"
)

$ErrorActionPreference = 'Stop'
$configuration = Get-Content -LiteralPath $ConfigurationPath -Raw | ConvertFrom-Json
$enrollmentRoot = Split-Path $ConfigurationPath -Parent
$testScript = Join-Path $enrollmentRoot 'Test-SguClientEnrollment.ps1'
$installScript = Join-Path $enrollmentRoot 'Install-CredentialProvider.ps1'
$remoteAccessScript = Join-Path $enrollmentRoot 'Enable-LabRemoteAccess.ps1'
$monitoringScript = Join-Path $enrollmentRoot 'Enable-SguClientMonitoring.ps1'

$before = & $testScript
if (-not $before.IsValid) {
    $installParams = @{
        PublishPath = [string]$configuration.PublishPath
        BrokerEndpoint = [string]$configuration.BrokerEndpoint
        ClientCertificateThumbprint = [string]$configuration.ClientCertificateThumbprint
        ServerCertificateThumbprint = [string]$configuration.ServerCertificateThumbprint
        DomainNetbios = [string]$configuration.DomainNetbios
        TimeoutSeconds = [int]$configuration.TimeoutSeconds
    }
    if ($configuration.DotNetRuntimeInstallerPath) {
        $installParams.InstallDotNetRuntime = $true
        $installParams.DotNetRuntimeInstallerPath = [string]$configuration.DotNetRuntimeInstallerPath
    }
    & $installScript @installParams | Out-Null
}

$computer = Get-CimInstance Win32_ComputerSystem
if ($computer.PartOfDomain) {
    & $remoteAccessScript `
        -RemoteDesktopPrincipal ([string]$configuration.RemoteDesktopPrincipal) `
        -EnableAdministrativeFirewallGroups | Out-Null
    & $monitoringScript | Out-Null
}

$verificationParams = @{}
if ($computer.PartOfDomain) {
    $verificationParams.RequireDomainJoined = $true
    $verificationParams.RequireRemoteAccess = $true
    $verificationParams.RemoteDesktopPrincipal = [string]$configuration.RemoteDesktopPrincipal
}
$after = & $testScript @verificationParams
$after
if (-not $after.IsValid) {
    throw "SGU enrollment repair did not reach a valid state: $($after.Issues -join ' ')"
}