$ErrorActionPreference = 'Stop'

Write-Host ""
Write-Host "Step 1/3  Checking MicrosoftTeams module..." -ForegroundColor Cyan
if (-not (Get-Module -ListAvailable -Name MicrosoftTeams)) {
    Write-Host "          Installing (first run only, ~30 s)..." -ForegroundColor Yellow
    if (-not (Get-PackageProvider -Name NuGet -ErrorAction SilentlyContinue)) {
        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser | Out-Null
    }
    Install-Module -Name MicrosoftTeams -Force -AllowClobber -Scope CurrentUser -Repository PSGallery
    Write-Host "          Installed." -ForegroundColor Green
} else {
    Write-Host "          Already installed." -ForegroundColor Green
}
try {
    Import-Module MicrosoftTeams -Force -ErrorAction Stop
} catch {
    Write-Host "ERROR: Could not load MicrosoftTeams module: $_" -ForegroundColor Red
    Write-Host "       Try: Install-Module MicrosoftTeams -Force -Scope CurrentUser" -ForegroundColor Yellow
    exit 1
}

Write-Host ""
Write-Host "Step 2/3  Connecting to Microsoft Teams..." -ForegroundColor Cyan
Write-Host "          A browser window will open. Sign in as a Teams Administrator."
$session = Connect-MicrosoftTeams
if (-not $session) {
    Write-Host "ERROR: Sign-in failed or was cancelled." -ForegroundColor Red
    exit 1
}
Write-Host "          Signed in as: $($session.Account)" -ForegroundColor Green
Write-Host "          Tenant:       $($session.TenantId)" -ForegroundColor Green

Write-Host ""
Write-Host "Step 3/3  Configuring Application Access Policy..." -ForegroundColor Cyan
$policyName = "OneClarityTranscriptAccess"
$appId      = "9231ae82-4486-426e-b80b-081ce800bd60"

if ([string]::IsNullOrWhiteSpace($appId)) {
    Write-Host "ERROR: App Client ID is empty. Contact OneClarity support." -ForegroundColor Red
    exit 1
}

try {
    $existing = Get-CsApplicationAccessPolicy -Identity $policyName -ErrorAction Stop
} catch {
    $existing = $null
}

$justCreated = $false
if ($null -eq $existing) {
    try {
        New-CsApplicationAccessPolicy `
            -Identity    $policyName `
            -AppIds      @($appId) `
            -Description "Grants OneClarity read access to Teams meeting transcripts"
        Write-Host "          Policy created." -ForegroundColor Green
        $justCreated = $true
    } catch {
        Write-Host "ERROR: Could not create policy: $_" -ForegroundColor Red
        Write-Host "       Ensure the signed-in account has the Teams Administrator role." -ForegroundColor Yellow
        exit 1
    }
} else {
    Write-Host "          Policy already exists, skipping." -ForegroundColor Yellow
}

if ($justCreated) {
    Write-Host "          Waiting 15 s for policy replication..." -ForegroundColor Yellow
    Start-Sleep -Seconds 15
}

try {
    Grant-CsApplicationAccessPolicy -PolicyName $policyName -Global
    Write-Host "          Policy applied to all users." -ForegroundColor Green
} catch {
    Write-Host "ERROR: Grant-CsApplicationAccessPolicy failed: $_" -ForegroundColor Red
    Write-Host "       If the error says 'policy not found', wait 2 minutes and re-run." -ForegroundColor Yellow
    exit 1
}

Write-Host ""
Write-Host "==========================================" -ForegroundColor Green
Write-Host " Setup complete!" -ForegroundColor Green
Write-Host " Application Access Policy is configured." -ForegroundColor Green
Write-Host "==========================================" -ForegroundColor Green
Write-Host ""