using CertificateManager;
using CertificateManager.Models;
using Microsoft.Extensions.DependencyInjection;

var serviceProvider = new ServiceCollection()
    .AddCertificateManager()
    .BuildServiceProvider();

string password = "1234";
var cc = serviceProvider.GetService<CreateCertificatesClientServerAuth>();
var iec = serviceProvider.GetService<ImportExportCertificate>();
if (cc == null) throw new ArgumentNullException(nameof(cc));
if (iec == null) throw new ArgumentNullException(nameof(iec));

var dpsCa = cc.NewRootCertificate(
    new DistinguishedName { CommonName = "dpsCa", Country = "CH" },
    new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) },
    3, "dpsCa");
dpsCa.FriendlyName = "developement root certificate";

var dpsIntermediate1 = cc.NewIntermediateChainedCertificate(
    new DistinguishedName { CommonName = "dpsIntermediate1", Country = "CH" },
    new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) },
    2, "dpsIntermediate1", dpsCa);
dpsIntermediate1.FriendlyName = "dpsIntermediate1 certificate";

var dpsIntermediate2 = cc.NewIntermediateChainedCertificate(
    new DistinguishedName { CommonName = "dpsIntermediate2", Country = "CH" },
    new ValidityPeriod { ValidFrom = DateTime.UtcNow, ValidTo = DateTime.UtcNow.AddYears(10) },
    2, "dpsIntermediate2", dpsCa);
dpsIntermediate2.FriendlyName = "dpsIntermediate2 certificate";

// EXPORTS PFX

var rootCertInPfxBtyes = iec.ExportRootPfx(password, dpsCa);
File.WriteAllBytes("dpsCa.pfx", rootCertInPfxBtyes);

var dpsIntermediate1Btyes = iec.ExportChainedCertificatePfx(password, dpsIntermediate1, dpsCa);
File.WriteAllBytes("dpsIntermediate1.pfx", dpsIntermediate1Btyes);

var dpsIntermediate2Btyes = iec.ExportChainedCertificatePfx(password, dpsIntermediate2, dpsCa);
File.WriteAllBytes("dpsIntermediate2.pfx", dpsIntermediate2Btyes);

Console.WriteLine("Certificates exported to pfx and cer files");

// EXPORTS PEM

var dpsCaPEM = iec.PemExportPublicKeyCertificate(dpsCa);
File.WriteAllText("dpsCa.pem", dpsCaPEM);

var dpsIntermediate1PEM = iec.PemExportPublicKeyCertificate(dpsIntermediate1);
File.WriteAllText("dpsIntermediate1.pem", dpsIntermediate1PEM);

var dpsIntermediate2PEM = iec.PemExportPublicKeyCertificate(dpsIntermediate2);
File.WriteAllText("dpsIntermediate2.pem", dpsIntermediate2PEM);

private static async Task CreateEnrollmentGroup(
	string enrollmentGroup, X509Certificate2 groupCertificate)
{
	if (_sp == null) throw new ArgumentNullException(nameof(_sp));

	var cc = _sp.GetService<CreateCertificatesClientServerAuth>();
	var dpsEnrollmentGroup = _sp.GetService<DpsEnrollmentGroup>();
	var iec = _sp.GetService<ImportExportCertificate>();

	if (cc == null) throw new ArgumentNullException(nameof(cc));
	if (dpsEnrollmentGroup == null) 
		throw new ArgumentNullException(nameof(dpsEnrollmentGroup));
	if (iec == null) throw new ArgumentNullException(nameof(iec));

	await dpsEnrollmentGroup.CreateDpsEnrollmentGroupAsync(
		enrollmentGroup, new X509Certificate2(groupCertificate));
}

private static async Task<X509Certificate2> CreateGroupEnrollmentDeviceAsync(
	string commonNameDeviceId, 
	X509Certificate2 dpsGroupCertificate, 
	string password)
{
	if (_sp == null) throw new ArgumentNullException(nameof(_sp));

	var cc = _sp.GetService<CreateCertificatesClientServerAuth>();
	var dpsRegisterDevice = _sp.GetService<DpsRegisterDevice>();
	var iec = _sp.GetService<ImportExportCertificate>();

	if (cc == null) throw new ArgumentNullException(nameof(cc));
	if (dpsRegisterDevice == null) 
		throw new ArgumentNullException(nameof(dpsRegisterDevice));
	if (iec == null) throw new ArgumentNullException(nameof(iec));

	commonNameDeviceId = commonNameDeviceId.ToLower();

	var device = cc.NewDeviceChainedCertificate(
	  new DistinguishedName { CommonName = $"{commonNameDeviceId}" },
	  new ValidityPeriod { ValidFrom = DateTime.UtcNow, 
		ValidTo = DateTime.UtcNow.AddYears(10) },
	  $"{commonNameDeviceId}", dpsGroupCertificate);
	device.FriendlyName = $"IoT device {commonNameDeviceId}";
	
	var deviceInPfxBytes = iec.ExportChainedCertificatePfx(
		password, device, dpsGroupCertificate);
	var deviceCert = new X509Certificate2(deviceInPfxBytes, password);

	await dpsRegisterDevice.RegisterDeviceAsync(deviceCert, dpsGroupCertificate);

	// Save File to use in IoC device
	File.WriteAllBytes($"{commonNameDeviceId}.pfx", deviceInPfxBytes);
	var devicePEM = iec.PemExportPublicKeyCertificate(device);
	File.WriteAllText($"{commonNameDeviceId}.pem", devicePEM);

	return device;
}

using Microsoft.Azure.Devices.Provisioning.Client;
using Microsoft.Azure.Devices.Provisioning.Client.Transport;
using Microsoft.Azure.Devices.Shared;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Logging;
using System.Security.Cryptography.X509Certificates;

namespace DpsManagement;

public class DpsRegisterDevice
{
    private IConfiguration Configuration { get; set; }
    private readonly ILogger<DpsRegisterDevice> _logger;

    public DpsRegisterDevice(IConfiguration config, ILoggerFactory loggerFactory)
    {
        Configuration = config;
        _logger = loggerFactory.CreateLogger<DpsRegisterDevice>();
    }

    /// <summary>
    /// transport exception if the Common Name "CN=" value within the device x.509 certificate does not match the Group Enrollment name within DPS.
    /// https://github.com/Azure/azure-iot-sdk-c/blob/main/tools/CACertificates/CACertificateOverview.md
    /// </summary>
    public async Task<DeviceRegistrationResult> RegisterDeviceAsync(
        X509Certificate2 deviceCertificate,
        X509Certificate2 enrollmentCertificate)
    {
        var scopeId = Configuration["ScopeId"];

        using (var security = new SecurityProviderX509Certificate(deviceCertificate, new X509Certificate2Collection(enrollmentCertificate)))

        // To optimize for size, reference only the protocols used by your application.
        using (var transport = new ProvisioningTransportHandlerAmqp(TransportFallbackType.TcpOnly))
        //using (var transport = new ProvisioningTransportHandlerHttp())
        //using (var transport = new ProvisioningTransportHandlerMqtt(TransportFallbackType.TcpOnly))
        // using (var transport = new ProvisioningTransportHandlerMqtt(TransportFallbackType.WebSocketOnly))
        {
            var client = ProvisioningDeviceClient.Create("global.azure-devices-provisioning.net", scopeId, security, transport);

            var result = await client.RegisterAsync();
            _logger.LogInformation("DPS client created: {result}", result);
            return result;
        }
    }
}

public async Task DisableDeviceAsync(string deviceId)
{
	var device = await _registryManager.GetDeviceAsync(deviceId);
	device.Status = DeviceStatus.Disabled;
	device = await _registryManager.UpdateDeviceAsync(device);
	_logger.LogInformation("iot hub device disabled  {device}", device);
}

public async Task DisableEnrollmentGroupAsync(string enrollmentGroupId)
{
	var groupEnrollment = await 
		_provisioningServiceClient.GetEnrollmentGroupAsync(enrollmentGroupId);

	if (groupEnrollment != null && groupEnrollment.ProvisioningStatus != null 
		&& groupEnrollment.ProvisioningStatus.Value != ProvisioningStatus.Disabled)
	{
		groupEnrollment.ProvisioningStatus = ProvisioningStatus.Disabled;
		var update = await _provisioningServiceClient
			.CreateOrUpdateEnrollmentGroupAsync(groupEnrollment);
		_logger.LogInformation("DisableEnrollmentGroupAsync update.ProvisioningStatus: ",
			update.ProvisioningStatus);
	}
}