param(
    [Parameter(Mandatory=$true)][string]$Email,
    [Parameter(Mandatory=$true)][string]$Name,
    [Parameter(Mandatory=$true)][string]$Operator,
    [Parameter(Mandatory=$true)][string]$Reason
)
$ErrorActionPreference = 'Stop'
$project = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
if ($project -ne 'C:\laragon\www\sgf-tempo') { throw 'Unexpected project path.' }
Set-Location -LiteralPath $project
$OutputEncoding = New-Object Text.UTF8Encoding $false
[Console]::OutputEncoding = $OutputEncoding
$sgfPhp = 'C:\laragon\tools\sgf-tempo\php-8.4.27\php.exe'
$arguments = @('artisan','identity:provision',"--email=$Email","--name=$Name","--operator=$Operator","--reason=$Reason")
& $sgfPhp @arguments
if ($LASTEXITCODE -ne 0) { throw 'Preview refused. No account created.' }
$answer = Read-Host 'Confirma criar apenas esta conta, sem permissoes automaticas? [sim/nao]'
if ($answer -notin @('sim','s','yes','y')) { Write-Host 'Operacao cancelada. Nada criado.'; exit 1 }
Write-Host 'Defina a palavra-passe apenas neste terminal. Minimo 12 caracteres; maximo 72 bytes UTF-8.'
while ($true) {
    $first = Read-Host 'Nova palavra-passe' -AsSecureString
    $repeat = Read-Host 'Repita a palavra-passe' -AsSecureString
    $firstPtr = [IntPtr]::Zero; $repeatPtr = [IntPtr]::Zero
    $plainFirst = $null; $plainRepeat = $null; $payload = $null
    try {
        $firstPtr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($first)
        $repeatPtr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($repeat)
        $plainFirst = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($firstPtr)
        $plainRepeat = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($repeatPtr)
        if ($plainFirst.Length -lt 12) { Write-Host 'Use pelo menos 12 caracteres. Tente novamente.' -ForegroundColor Yellow; continue }
        if ([Text.Encoding]::UTF8.GetByteCount($plainFirst) -gt 72) { Write-Host 'Excede 72 bytes. Tente novamente.' -ForegroundColor Yellow; continue }
        if ($plainFirst -cne $plainRepeat) { Write-Host 'As entradas nao coincidem. Tente novamente.' -ForegroundColor Yellow; continue }
        $payload = @{confirmed=$true;email=$Email.Trim().ToLowerInvariant();password=$plainFirst;confirmation=$plainRepeat} | ConvertTo-Json -Compress
        $payload | & $sgfPhp @arguments --apply --protected-stdin
        if ($LASTEXITCODE -ne 0) { throw 'Account creation refused. Copy only the error message, never the password.' }
        Write-Host 'Conta criada sem acessos automaticos. Um gestor autorizado pode agora conceder os direitos na aplicacao.' -ForegroundColor Green
        break
    } finally {
        if ($firstPtr -ne [IntPtr]::Zero) { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($firstPtr) }
        if ($repeatPtr -ne [IntPtr]::Zero) { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($repeatPtr) }
        $plainFirst=$null; $plainRepeat=$null; $payload=$null
        $first.Dispose(); $repeat.Dispose()
    }
}