# Module ApiClient - Communication REST API Eclypse (API v2)

$script:CurlAvailable = $false

function Initialize-ApiClient {
    [CmdletBinding()]
    param()

    # Forcer TLS 1.2 + 1.1 + 1.0
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls

    # Desactiver la verification SSL (certificats auto-signes)
    if (-not ([System.Management.Automation.PSTypeName]'TrustAllCertsPolicy').Type) {
        Add-Type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
    public bool CheckValidationResult(
        ServicePoint srvPoint, X509Certificate certificate,
        WebRequest request, int certificateProblem) {
        return true;
    }
}
"@
    }
    [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

    # Verifier si curl.exe est disponible (fallback SSL)
    $script:CurlAvailable = [bool](Get-Command curl.exe -ErrorAction SilentlyContinue)
    if ($script:CurlAvailable) {
        Write-Log -Message "ApiClient initialise (TLS multi, SSL bypass, curl.exe fallback)" -Level INFO
    }
    else {
        Write-Log -Message "ApiClient initialise (TLS multi, SSL bypass)" -Level INFO
    }
}

function Get-AuthHeader {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [AllowEmptyString()]
        [string]$Password
    )

    $pair = "${Username}:${Password}"
    $bytes = [System.Text.Encoding]::ASCII.GetBytes($pair)
    $base64 = [System.Convert]::ToBase64String($bytes)

    return @{
        "Authorization" = "Basic $base64"
        "Accept"        = "application/json"
        "User-Agent"    = "DaliACLI/1.0 (PowerShell; Win32NT)"
    }
}

function Test-SslError {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [System.Exception]$Exception
    )

    $msg = $Exception.Message
    return ($msg -match "SSL" -or $msg -match "TLS" -or $msg -match "confiance" -or $msg -match "trust" -or $msg -match "certificate")
}

function Invoke-CurlGet {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Url,

        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [AllowEmptyString()]
        [string]$Password
    )

    Write-Log -Message "GET $Url (curl -k fallback)" -Level WARN

    $output = & curl.exe -s -k -u "${Username}:${Password}" -H "Accept: application/json" $Url 2>&1
    if ($LASTEXITCODE -ne 0) {
        throw "curl GET erreur (exit code $LASTEXITCODE): $output"
    }

    Write-Log -Message "GET OK (curl)" -Level SUCCESS
    return ($output | Out-String)
}

function Invoke-CurlPost {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Url,

        [Parameter(Mandatory)]
        [string]$JsonBody,

        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [AllowEmptyString()]
        [string]$Password
    )

    Write-Log -Message "POST $Url (curl -k fallback)" -Level WARN

    $tempFile = [System.IO.Path]::GetTempFileName()
    try {
        [System.IO.File]::WriteAllText($tempFile, $JsonBody, [System.Text.Encoding]::UTF8)
        $output = & curl.exe -s -k -u "${Username}:${Password}" -H "Content-Type: application/json; charset=utf-8" -d "@$tempFile" $Url 2>&1
        if ($LASTEXITCODE -ne 0) {
            throw "curl POST erreur (exit code $LASTEXITCODE): $output"
        }
        Write-Log -Message "POST OK (curl)" -Level SUCCESS
    }
    finally {
        Remove-Item $tempFile -Force -ErrorAction SilentlyContinue
    }
}

function Invoke-ApiGet {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Url,

        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [AllowEmptyString()]
        [string]$Password
    )

    $headers = Get-AuthHeader -Username $Username -Password $Password

    Write-Log -Message "GET $Url" -Level INFO

    try {
        $response = Invoke-WebRequest -Uri $Url -Method GET -Headers $headers -UseBasicParsing -TimeoutSec 30

        if ($response.Content -is [byte[]]) {
            return [System.Text.Encoding]::UTF8.GetString($response.Content).TrimStart([char]0xFEFF)
        }
        return $response.Content
    }
    catch {
        if ((Test-SslError -Exception $_.Exception) -and $script:CurlAvailable) {
            return Invoke-CurlGet -Url $Url -Username $Username -Password $Password
        }
        throw
    }
}

function Invoke-ApiPost {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$Url,

        [Parameter(Mandatory)]
        [string]$JsonBody,

        [Parameter(Mandatory)]
        [string]$Username,

        [Parameter(Mandatory)]
        [AllowEmptyString()]
        [string]$Password
    )

    $headers = Get-AuthHeader -Username $Username -Password $Password

    Write-Log -Message "POST $Url" -Level INFO

    try {
        $bodyBytes = [System.Text.Encoding]::UTF8.GetBytes($JsonBody)
        $response = Invoke-WebRequest -Uri $Url -Method POST -Headers $headers -Body $bodyBytes -ContentType "application/json; charset=utf-8" -UseBasicParsing -TimeoutSec 30
        $statusCode = $response.StatusCode
        Write-Log -Message "POST reponse : $statusCode" -Level SUCCESS
        return $statusCode
    }
    catch {
        if ((Test-SslError -Exception $_.Exception) -and $script:CurlAvailable) {
            Invoke-CurlPost -Url $Url -JsonBody $JsonBody -Username $Username -Password $Password
            return
        }
        Write-Log -Message "POST erreur : $($_.Exception.Message)" -Level ERROR
        throw
    }
}

Export-ModuleMember -Function Initialize-ApiClient, Invoke-ApiGet, Invoke-ApiPost