MainWindow.axaml.cs

/*
 * By David Barrett, Microsoft Ltd. Use at your own risk.  No warranties are given.
 * 
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 * */

using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Management.Automation.Runspaces;
using System.Security.Cryptography.X509Certificates;
using System.Text.RegularExpressions;
using System.Threading;
using System.Threading.Tasks;
using Avalonia;
using Avalonia.Controls;
using Avalonia.Input.Platform;
using Avalonia.Styling;
using Avalonia.Interactivity;
using Avalonia.Media;
using Avalonia.Media.Imaging;
using Avalonia.Platform;
using Avalonia.Platform.Storage;
using Avalonia.Threading;
using SkiaSharp;
using Svg.Skia;

namespace PowerShell_Automation_Sample
{
    public partial class MainWindow : Window
    {
        PowerShellHelper _psHelper;
        Runspace? _runspace;

        // True while a user-initiated script invocation is executing on a
        // background task. Used to keep Run Script (and Disconnect)
        // disabled until the pipeline completes so the user cannot start
        // a second invocation or tear down the runspace mid-run.
        private bool _isScriptRunning;

        // Regex for the MSAL device-code prompt printed by
        // Connect-ExchangeOnline -Device:
        //   "To sign in, use a web browser to open the page <URL>
        //    and enter the code <CODE> to authenticate."
        // The whole message can arrive as a single Console.WriteLine, so this
        // pulls both pieces out in one match.
        private static readonly Regex s_deviceCodeRegex = new Regex(
            @"(?<url>https?://\S+?)\s+and\s+enter\s+the\s+code\s+(?<code>\S+?)\s+to\s+authenticate",
            RegexOptions.IgnoreCase | RegexOptions.Compiled);

        // Gate so we only act on the first device-code message per connect
        // attempt (MSAL re-emits the same line during polling on some paths).
        // Reset to 0 each time ConnectRunspaceButton_Click is invoked.
        private int _deviceCodeHandled;
        public MainWindow()
        {
            InitializeComponent();
            _psHelper = new PowerShellHelper(
                logOutput: AppendOutput,
                logError: AppendError,
                logVerbose: AppendVerbose,
                logAutomation: AppendAutomation);

            LoadCertificatesFromStore();
            Icon = LoadAppIcon();
            UpdateRunspaceStatus();
            InitializeThemeToggle();

            // Restore previously persisted Configuration / Script Editor
            // values, if the user opted in on a prior run. Done after
            // LoadCertificatesFromStore so the saved thumbprint can be
            // resolved against the live cert list.
            LoadPersistedSettings();
        }

        /// <summary>
        /// Capture the main window's HWND once Avalonia has created the
        /// platform-level window so that <see cref="PowerShellHelper"/> can
        /// use it as the owner for the hidden console it allocates for the
        /// MSAL/WAM broker. Without this anchor the broker sign-in dialog
        /// can appear behind the main application window on reconnect.
        /// </summary>
        protected override void OnOpened(EventArgs e)
        {
            base.OnOpened(e);

            try
            {
                var handle = TryGetPlatformHandle();
                if (handle is not null && handle.Handle != IntPtr.Zero)
                {
                    _psHelper.OwnerWindowHandle = handle.Handle;
                }
            }
            catch
            {
                // Non-fatal; broker parenting just falls back to the hidden
                // console owning itself, which is the previous behavior.
            }

            // Re-evaluate the log action buttons whenever the active tab
            // changes or any log's scroll metrics change (extent/viewport
            // shifts caused by text appends or window resizes).
            LogTabControl.SelectionChanged += (_, _) => UpdateLogActionButtons();
            foreach (var item in LogTabControl.Items.OfType<TabItem>())
            {
                if (item.Content is ScrollViewer sv)
                {
                    sv.ScrollChanged += (_, _) => UpdateLogActionButtons();
                }
            }
            UpdateLogActionButtons();

            // Re-evaluate Run Script enablement when the script content
            // changes (in addition to the runspace state transitions that
            // already drive UpdateRunspaceStatus).
            ScriptEditor.TextChanged += (_, _) => UpdateRunspaceStatus();
        }

        /// <summary>
        /// Ensure any long-running PowerShell pipeline (e.g.
        /// <c>Connect-ExchangeOnline -Device</c> blocked in the MSAL device-code
        /// polling loop) is cancelled and the runspace is disposed when the
        /// window closes. The MSAL identity stack inside the EXO module spins
        /// up its own foreground polling threads that are not always
        /// cooperative with cancellation, so after a best-effort graceful
        /// shutdown we hard-exit the process to guarantee the app actually
        /// closes instead of hanging in the background.
        /// </summary>
        protected override void OnClosed(EventArgs e)
        {
            // Persist current Configuration / Script Editor state before
            // tearing anything down, but only if the user opted in via the
            // "Remember settings" checkbox. Done first so a hang in the
            // PowerShell shutdown path below can't lose the file.
            TrySavePersistedSettings(silent: true);

            try { _psHelper?.CancelRunning(); } catch { /* best effort */ }

            // Dispose on a background thread so a still-running pipeline
            // can't block the UI thread inside Runspace.Dispose().
            Runspace? toDispose = _runspace;
            _runspace = null;
            if (toDispose is not null)
            {
                _ = Task.Run(() =>
                {
                    try { toDispose.Dispose(); } catch { /* best effort */ }
                });
            }

            base.OnClosed(e);

            // The Exchange Online module's MSAL stack can leave foreground
            // polling threads running after sign-in is cancelled, which
            // prevents the process from exiting. Force termination now that
            // the UI is gone.
            Environment.Exit(0);
        }

        private static WindowIcon? LoadAppIcon()
        {
            try
            {
                var uri = new Uri("avares://PowerShell Automation Sample/Assets/logo.svg");
                using var stream = AssetLoader.Open(uri);

                using var svg = new SKSvg();
                svg.Load(stream);
                if (svg.Picture is null)
                {
                    return null;
                }

                const int size = 256;
                var bounds = svg.Picture.CullRect;
                var scale = Math.Min(size / bounds.Width, size / bounds.Height);

                using var bitmap = new SKBitmap(size, size);
                using (var canvas = new SKCanvas(bitmap))
                {
                    canvas.Clear(SKColors.Transparent);
                    canvas.Translate(
                        (size - bounds.Width * scale) / 2f,
                        (size - bounds.Height * scale) / 2f);
                    canvas.Scale(scale);
                    canvas.DrawPicture(svg.Picture);
                }

                using var data = bitmap.Encode(SKEncodedImageFormat.Png, 100);
                using var ms = new MemoryStream();
                data.SaveTo(ms);
                ms.Position = 0;

                return new WindowIcon(new Bitmap(ms));
            }
            catch
            {
                // Logo is non-critical; fail silently so the app still starts.
                return null;
            }
        }

        private void AppendOutput(string message)
        {
            AppendTo(OutputLog, message);
            TryHandleDeviceCodePrompt(message);
        }

        private void AppendError(string message) => AppendTo(ErrorsLog, message);

        private void AppendVerbose(string message) => AppendTo(VerboseLog, message);

        private void AppendAutomation(string message) => AppendTo(AutomationLog, message);

        /// <summary>
        /// Clear the text in the log tab that is currently selected. Leaves
        /// the other log tabs untouched.
        /// </summary>
        private void ClearLogButton_Click(object? sender, RoutedEventArgs e)
        {
            var selectable = GetActiveLogTextBlock();
            if (selectable is not null)
            {
                selectable.Text = string.Empty;
                UpdateLogActionButtons();
            }
        }

        /// <summary>
        /// Scroll the currently shown log tab to the top.
        /// </summary>
        private void ScrollLogTopButton_Click(object? sender, RoutedEventArgs e)
            => GetActiveLogScrollViewer()?.ScrollToHome();

        /// <summary>
        /// Scroll the currently shown log tab to the bottom.
        /// </summary>
        private void ScrollLogBottomButton_Click(object? sender, RoutedEventArgs e)
            => GetActiveLogScrollViewer()?.ScrollToEnd();

        /// <summary>
        /// Resolve the <see cref="ScrollViewer"/> that hosts the currently
        /// selected log tab's content, or null if the structure can't be
        /// resolved (e.g. during teardown).
        /// </summary>
        private ScrollViewer? GetActiveLogScrollViewer()
            => (LogTabControl.SelectedItem as TabItem)?.Content as ScrollViewer;

        /// <summary>
        /// Resolve the <see cref="SelectableTextBlock"/> hosted inside the
        /// currently selected log tab's <see cref="ScrollViewer"/>.
        /// </summary>
        private SelectableTextBlock? GetActiveLogTextBlock()
            => GetActiveLogScrollViewer()?.Content as SelectableTextBlock;

        /// <summary>
        /// Enable the log action buttons only when meaningful: To Top / To
        /// Bottom require the active log's content to actually exceed the
        /// viewport, and Clear requires there to be any text to remove.
        /// </summary>
        private void UpdateLogActionButtons()
        {
            var sv = GetActiveLogScrollViewer();
            var tb = GetActiveLogTextBlock();

            bool canScroll = sv is not null
                && (sv.Extent.Height > sv.Viewport.Height + 0.5
                    || sv.Extent.Width > sv.Viewport.Width + 0.5);

            ScrollLogTopButton.IsEnabled = canScroll;
            ScrollLogBottomButton.IsEnabled = canScroll;
            ClearLogButton.IsEnabled = !string.IsNullOrEmpty(tb?.Text);
        }

        /// <summary>
        /// Scan output captured from <c>Console.Out</c> (where the EXO module's
        /// MSAL device-code callback writes the sign-in prompt) for a URL and
        /// user code. When found on the first occurrence per connect attempt,
        /// copy the code to the clipboard and launch the URL in the default
        /// browser so the user doesn't have to do either by hand.
        /// </summary>
        private void TryHandleDeviceCodePrompt(string message)
        {
            if (string.IsNullOrEmpty(message))
            {
                return;
            }

            Match match = s_deviceCodeRegex.Match(message);
            if (!match.Success)
            {
                return;
            }

            // Only handle once per connect attempt.
            if (Interlocked.Exchange(ref _deviceCodeHandled, 1) != 0)
            {
                return;
            }

            string url = match.Groups["url"].Value.TrimEnd('.', ',');
            string code = match.Groups["code"].Value.TrimEnd('.', ',');

            // Marshal to the UI thread for clipboard access; browser launch is
            // safe from any thread but we batch them together for simplicity.
            Dispatcher.UIThread.Post(async () =>
            {
                try
                {
                    IClipboard? clipboard = this.Clipboard;
                    if (clipboard is not null)
                    {
                        await clipboard.SetTextAsync(code);
                        AppendAutomation($"Device code '{code}' copied to clipboard.{Environment.NewLine}");
                    }
                }
                catch (Exception ex)
                {
                    AppendAutomation($"Failed to copy device code to clipboard: {ex.Message}{Environment.NewLine}");
                }

                try
                {
                    Process.Start(new ProcessStartInfo
                    {
                        FileName = url,
                        UseShellExecute = true,
                    });
                    AppendAutomation($"Opened device sign-in page: {url}{Environment.NewLine}");
                }
                catch (Exception ex)
                {
                    AppendAutomation($"Failed to open device sign-in page '{url}': {ex.Message}{Environment.NewLine}");
                }
            });
        }

        private void AppendTo(TextBlock target, string message)
        {
            if (Dispatcher.UIThread.CheckAccess())
            {
                target.Text += message;
                UpdateLogActionButtons();
            }
            else
            {
                Dispatcher.UIThread.Post(() =>
                {
                    target.Text += message;
                    UpdateLogActionButtons();
                });
            }
        }

        /// <summary>
        /// Build a <see cref="ConnectionSettings"/> instance from the current
        /// state of the Configuration tab. Passed to
        /// <see cref="PowerShellHelper.ConnectToRemotePowerShell"/>.
        /// </summary>
        private ConnectionSettings BuildConnectionSettings()
        {
            var settings = new ConnectionSettings
            {
                UsePowerShellUrl = PowerShellUrlCheckBox.IsChecked == true,
                Url = PowerShellUrlTextBox.Text,
                ConfigurationName = string.IsNullOrWhiteSpace(ConfigurationNameTextBox.Text)
                    ? "Microsoft.Exchange"
                    : ConfigurationNameTextBox.Text,
                LoadExchangeOnline = ExchangeOnlineModuleCheckBox.IsChecked == true,
                ExchangeOnlineUseDeviceAuth = ExchangeOnlineDeviceAuthCheckBox.IsChecked == true
                                              && SpecifiedCredentialsRadio.IsChecked == true,
                LoadSharePointOnline = SharePointOnlineModuleCheckBox.IsChecked == true,
                SPOUrl = SharePointOnlineUrlTextBox.Text,
                LoadMicrosoftTeams = MicrosoftTeamsModuleCheckBox.IsChecked == true,
                LoadEntraID = EntraIdModuleCheckBox.IsChecked == true,
                LoadAzureInformationProtection = AzureInformationProtectionModuleCheckBox.IsChecked == true,
                UseOutOfProcessRunspace = OutOfProcessRunspaceCheckBox.IsChecked == true,
            };

            if (SpecifiedCredentialsRadio.IsChecked == true)
            {
                settings.AuthMode = AuthenticationMode.SpecifiedCredentials;
                settings.Username = UsernameTextBox.Text;
                settings.Password = PasswordTextBox.Text;
            }
            else if (CertificateRadio.IsChecked == true)
            {
                settings.AuthMode = AuthenticationMode.Certificate;

                if (CertFileRadio.IsChecked == true)
                {
                    settings.Certificate = LoadCertificateFromFile(
                        CertFilePathTextBox.Text,
                        CertFilePasswordTextBox.Text);
                }
                else
                {
                    // ComboBox already holds the X509Certificate2 instances
                    // produced by LoadCertificatesFromStore, so just pick
                    // the selected one straight off the control.
                    settings.Certificate = CertStoreComboBox.SelectedItem as X509Certificate2;
                }

                // Required by Connect-ExchangeOnline / Connect-SPOService
                // when using certificate auth.
                settings.AppID = AppIdTextBox.Text;
                settings.Organization = OrganizationTextBox.Text;
            }
            else
            {
                settings.AuthMode = AuthenticationMode.LoggedOnUser;
            }

            return settings;
        }

        private void LoadCertificatesFromStore()
        {
            try
            {
                using var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
                store.Open(OpenFlags.ReadOnly);
                CertStoreComboBox.ItemsSource =
                    store.Certificates.Cast<X509Certificate2>().ToList();
            }
            catch (Exception ex)
            {
                AppendAutomation($"Failed to load certificates from store: {ex.Message}{Environment.NewLine}");
            }
        }

        /// <summary>
        /// Load an <see cref="X509Certificate2"/> from disk. PFX/P12 inputs
        /// are decrypted using <paramref name="password"/>; other formats
        /// (.cer/.crt) are loaded public-key-only. Returns <c>null</c> and
        /// logs to the Automation tab on any failure so the caller can
        /// abort cleanly. Used by <see cref="BuildConnectionSettings"/> to
        /// produce the <see cref="ConnectionSettings.Certificate"/> handed
        /// to <see cref="PowerShellHelper"/>.
        /// </summary>
        private X509Certificate2? LoadCertificateFromFile(string? path, string? password)
        {
            if (string.IsNullOrWhiteSpace(path))
            {
                AppendAutomation($"Certificate file path is required.{Environment.NewLine}");
                return null;
            }

            if (!File.Exists(path))
            {
                AppendAutomation($"Certificate file not found: {path}{Environment.NewLine}");
                return null;
            }

            try
            {
                string extension = Path.GetExtension(path);

                if (string.Equals(extension, ".pfx", StringComparison.OrdinalIgnoreCase) ||
                    string.Equals(extension, ".p12", StringComparison.OrdinalIgnoreCase))
                {
                    return X509CertificateLoader.LoadPkcs12FromFile(path, password);
                }

                return X509CertificateLoader.LoadCertificateFromFile(path);
            }
            catch (Exception ex)
            {
                AppendAutomation($"Failed to load certificate from '{path}': {ex.Message}{Environment.NewLine}");
                return null;
            }
        }

        private void RefreshCertStoreButton_Click(object? sender, RoutedEventArgs e)
            => LoadCertificatesFromStore();

        /// <summary>
        /// Toggle the SharePoint Online checkbox label between the default
        /// short form and the "Sharepoint Online URL: " form (used while
        /// the URL textbox is shown next to it) so the textbox reads as a
        /// labelled input rather than a stray field.
        /// </summary>
        private void SharePointOnlineModuleCheckBox_IsCheckedChanged(object? sender, RoutedEventArgs e)
        {
            SharePointOnlineModuleCheckBox.Content =
                SharePointOnlineModuleCheckBox.IsChecked == true
                    ? "Sharepoint Online URL: "
                    : "Sharepoint Online";
        }

        private async void BrowseCertFileButton_Click(object? sender, RoutedEventArgs e)
        {
            try
            {
                var topLevel = TopLevel.GetTopLevel(this);
                if (topLevel is null)
                {
                    return;
                }

                var files = await topLevel.StorageProvider.OpenFilePickerAsync(
                    new FilePickerOpenOptions
                    {
                        Title = "Select certificate file",
                        AllowMultiple = false,
                        FileTypeFilter = new[]
                        {
                            new FilePickerFileType("Certificate files")
                            {
                                Patterns = new[] { "*.pfx", "*.p12", "*.cer", "*.crt" }
                            },
                            FilePickerFileTypes.All,
                        }
                    });

                var selected = files.FirstOrDefault();
                if (selected is not null)
                {
                    CertFilePathTextBox.Text = selected.Path.LocalPath;
                }
            }
            catch (Exception ex)
            {
                AppendAutomation($"Failed to pick certificate file: {ex.Message}{Environment.NewLine}");
            }
        }

        private async void ConnectRunspaceButton_Click(object? sender, RoutedEventArgs e)
        {
            // Dispose any prior runspace before opening a new one.
            if (_runspace is not null)
            {
                try { _runspace.Dispose(); } catch { /* best effort */ }
                _runspace = null;
            }

            // Reset the device-code gate so a fresh connect attempt is allowed
            // to copy/open the prompt even if a previous attempt already did.
            Interlocked.Exchange(ref _deviceCodeHandled, 0);

            // Reflect "Opening" while the runspace is created and any modules
            // (ExchangeOnlineManagement, etc.) are imported. The connect work
            // is offloaded to a background thread so the UI thread is free to
            // paint this transient status; otherwise the status set here would
            // never be drawn before the synchronous connect returned.
            ConnectRunspaceButton.IsEnabled = false;
            UpdateRunspaceStatus("Opening", Brushes.Goldenrod);

            try
            {
                var settings = BuildConnectionSettings();

                bool wantUrl = settings.UsePowerShellUrl;
                bool wantModules = settings.LoadExchangeOnline
                    || settings.LoadSharePointOnline
                    || settings.LoadMicrosoftTeams
                    || settings.LoadEntraID
                    || settings.LoadAzureInformationProtection;

                if (!wantUrl && !wantModules)
                {
                    AppendAutomation(
                        $"Select PowerShell URL and/or at least one online module before connecting.{Environment.NewLine}");
                    _runspace = null;
                }
                else if (wantUrl && !wantModules)
                {
                    // URL only: open a pure remote WSMan runspace.
                    _runspace = await Task.Run(() => _psHelper.ConnectToRemotePowerShell(settings));
                }
                else
                {
                    // Modules selected (optionally combined with a URL):
                    // open a local in-process runspace that imports the
                    // requested modules, then if a URL was also requested,
                    // import that remote session into the same runspace so
                    // both sets of cmdlets are available together.
                    _runspace = await Task.Run(() => _psHelper.ConnectWithLocalPowerShell(settings));

                    if (_runspace is not null && wantUrl)
                    {
                        await Task.Run(() => _psHelper.ImportRemotePSSession(_runspace, settings));
                    }
                }
            }
            catch (Exception ex)
            {
                AppendAutomation($"Failed to connect runspace: {ex.Message}{Environment.NewLine}");
                _runspace = null;
            }
            finally
            {
                ConnectRunspaceButton.IsEnabled = true;
                UpdateRunspaceStatus();
            }
        }

        private async void RunScriptButton_Click(object? sender, RoutedEventArgs e)
        {
            // Capture the script text on the UI thread, then execute the
            // pipeline on a background thread so the UI stays responsive
            // (PowerShell.Invoke() is synchronous and can run for a long
            // time, especially for cmdlets that block on network I/O).
            // Run Script is disabled for the duration via the transient
            // "Running" status; UpdateRunspaceStatus() at the end restores
            // normal enablement based on the live runspace state.
            var runspace = _runspace;
            var script = ScriptEditor.Text;

            _isScriptRunning = true;
            UpdateRunspaceStatus("Running", Brushes.SteelBlue);

            try
            {
                await Task.Run(() => _psHelper.RunScript(runspace, script));
            }
            catch (Exception ex)
            {
                AppendAutomation($"Failed to run script: {ex.Message}{Environment.NewLine}");
            }
            finally
            {
                _isScriptRunning = false;
                UpdateRunspaceStatus();
            }
        }

        /// <summary>
        /// Disconnect any active Exchange Online session (when the
        /// ExchangeOnlineManagement module has been loaded into the runspace)
        /// and then dispose the runspace itself. Runs the teardown on a
        /// background thread so a slow Disconnect-ExchangeOnline call doesn't
        /// freeze the UI.
        /// </summary>
        private async void DisconnectRunspaceButton_Click(object? sender, RoutedEventArgs e)
        {
            Runspace? toDispose = _runspace;
            if (toDispose is null)
            {
                UpdateRunspaceStatus();
                return;
            }

            _runspace = null;

            DisconnectRunspaceButton.IsEnabled = false;
            RunScriptButton.IsEnabled = false;
            ConnectRunspaceButton.IsEnabled = false;
            UpdateRunspaceStatus("Closing", Brushes.Goldenrod);

            try
            {
                await Task.Run(() => _psHelper.DisconnectRunspace(toDispose));
            }
            catch (Exception ex)
            {
                AppendAutomation($"Failed to disconnect runspace: {ex.Message}{Environment.NewLine}");
            }
            finally
            {
                // UpdateRunspaceStatus() centrally recomputes enablement
                // for Connect/Disconnect/Run Script based on the current
                // runspace state and script editor contents.
                UpdateRunspaceStatus();
            }
        }

        /// <summary>
        /// Refresh the runspace status indicator from <see cref="_runspace"/>.
        /// Pass a custom <paramref name="overrideText"/>/<paramref name="overrideBrush"/>
        /// for transient states (e.g. "Opening").
        /// </summary>
        private void UpdateRunspaceStatus(string? overrideText = null, IBrush? overrideBrush = null)
        {
            if (Dispatcher.UIThread.CheckAccess())
            {
                ApplyRunspaceStatus(overrideText, overrideBrush);
            }
            else
            {
                Dispatcher.UIThread.Post(() => ApplyRunspaceStatus(overrideText, overrideBrush));
            }
        }

        private void ApplyRunspaceStatus(string? overrideText, IBrush? overrideBrush)
        {
            if (overrideText is not null)
            {
                RunspaceStatusText.Text = overrideText;
                RunspaceStatusIndicator.Background = overrideBrush ?? Brushes.Goldenrod;
                // Transient state (Opening/Closing): all runspace actions
                // should be unavailable until the operation settles.
                ConnectRunspaceButton.IsEnabled = false;
                DisconnectRunspaceButton.IsEnabled = false;
                RunScriptButton.IsEnabled = false;
                return;
            }

            var state = _runspace?.RunspaceStateInfo.State ?? RunspaceState.Closed;
            RunspaceStatusText.Text = _runspace is null ? "Disconnected" : state.ToString();
            RunspaceStatusIndicator.Background = state switch
            {
                RunspaceState.Opened => Brushes.Green,
                RunspaceState.Opening or RunspaceState.Connecting => Brushes.Goldenrod,
                RunspaceState.Broken => Brushes.OrangeRed,
                _ => Brushes.Red,
            };

            // Connect is only meaningful when there is no live runspace;
            // Disconnect is only meaningful when there is one. While a
            // script is running we also keep Disconnect disabled so the
            // user cannot tear the runspace down out from under an
            // in-flight pipeline.
            bool isConnected = _runspace is not null
                && state == RunspaceState.Opened;
            ConnectRunspaceButton.IsEnabled = !isConnected && !_isScriptRunning;
            DisconnectRunspaceButton.IsEnabled = isConnected && !_isScriptRunning;

            // Run Script requires a live runspace, non-empty script in
            // the editor, and no other script currently executing.
            RunScriptButton.IsEnabled = isConnected
                && !_isScriptRunning
                && !string.IsNullOrWhiteSpace(ScriptEditor.Text);
        }

        /// <summary>
        /// Handle clicks on the "Remember settings" checkbox in the
        /// Configuration tab. Checking it for the first time immediately
        /// writes the current Configuration / Script Editor values to the
        /// encrypted settings file so the user sees the feature "take
        /// effect" right away; subsequent updates are then written on
        /// window close. Unchecking it deletes the file so opting out
        /// actually removes the previously persisted data.
        /// </summary>
        private void RememberSettingsCheckBox_Click(object? sender, RoutedEventArgs e)
        {
            if (RememberSettingsCheckBox.IsChecked == true)
            {
                TrySavePersistedSettings(silent: false);
            }
            else
            {
                if (!SettingsManager.TryDelete(out string? error))
                {
                    AppendAutomation(
                        $"Failed to delete settings file: {error}{Environment.NewLine}");
                }
                else if (SettingsManager.IsSupported)
                {
                    AppendAutomation(
                        $"Saved settings removed ({SettingsManager.SettingsFilePath}).{Environment.NewLine}");
                }
            }
        }

        /// <summary>
        /// Load persisted settings (if any) and apply them to the
        /// Configuration tab controls. No-op when the user has never
        /// opted in or the file is missing/corrupt.
        /// </summary>
        private void LoadPersistedSettings()
        {
            if (!SettingsManager.FileExists())
            {
                return;
            }

            var loaded = SettingsManager.TryLoad(out string? error);
            if (loaded is null)
            {
                if (!string.IsNullOrEmpty(error))
                {
                    AppendAutomation(
                        $"Failed to load saved settings: {error}{Environment.NewLine}");
                }
                return;
            }

            ApplySettings(loaded);
            AppendAutomation(
                $"Loaded saved settings from {SettingsManager.SettingsFilePath}.{Environment.NewLine}");
        }

        /// <summary>
        /// Write the current Configuration / Script Editor state to the
        /// encrypted settings file when the user has opted in. When
        /// <paramref name="silent"/> is true (i.e. called from
        /// <see cref="OnClosed"/>) errors are swallowed because the UI
        /// is gone; otherwise they are logged to the Automation tab.
        /// </summary>
        private void TrySavePersistedSettings(bool silent)
        {
            if (RememberSettingsCheckBox is null
                || RememberSettingsCheckBox.IsChecked != true)
            {
                return;
            }

            AppSettings snapshot = CaptureSettings();
            if (!SettingsManager.TrySave(snapshot, out string? error))
            {
                if (!silent)
                {
                    AppendAutomation(
                        $"Failed to save settings: {error}{Environment.NewLine}");
                    // Roll the checkbox back so the user isn't misled into
                    // thinking persistence is active when it isn't.
                    RememberSettingsCheckBox.IsChecked = false;
                }
            }
            else if (!silent)
            {
                AppendAutomation(
                    $"Settings saved to {SettingsManager.SettingsFilePath}.{Environment.NewLine}");
            }
        }

        /// <summary>
        /// Project the current UI state into an <see cref="AppSettings"/>
        /// DTO suitable for <see cref="SettingsManager.TrySave"/>.
        /// </summary>
        private AppSettings CaptureSettings()
        {
            string authMode =
                CertificateRadio.IsChecked == true ? "Certificate" :
                LoggedOnUserRadio.IsChecked == true ? "LoggedOnUser" :
                                                     "SpecifiedCredentials";

            string certSource =
                CertFileRadio.IsChecked == true ? "File" : "Store";

            string? thumbprint =
                (CertStoreComboBox.SelectedItem as X509Certificate2)?.Thumbprint;

            return new AppSettings
            {
                RememberSettings = RememberSettingsCheckBox.IsChecked == true,

                UsePowerShellUrl = PowerShellUrlCheckBox.IsChecked == true,
                PowerShellUrl = PowerShellUrlTextBox.Text,
                ConfigurationName = ConfigurationNameTextBox.Text,

                LoadExchangeOnline = ExchangeOnlineModuleCheckBox.IsChecked == true,
                ExchangeOnlineUseDeviceAuth = ExchangeOnlineDeviceAuthCheckBox.IsChecked == true,

                LoadSharePointOnline = SharePointOnlineModuleCheckBox.IsChecked == true,
                SharePointOnlineUrl = SharePointOnlineUrlTextBox.Text,

                LoadMicrosoftTeams = MicrosoftTeamsModuleCheckBox.IsChecked == true,
                LoadEntraID = EntraIdModuleCheckBox.IsChecked == true,
                LoadAzureInformationProtection = AzureInformationProtectionModuleCheckBox.IsChecked == true,

                UseOutOfProcessRunspace = OutOfProcessRunspaceCheckBox.IsChecked == true,

                AuthMode = authMode,
                Username = UsernameTextBox.Text,
                Password = PasswordTextBox.Text,

                CertSource = certSource,
                CertStoreThumbprint = thumbprint,
                CertFilePath = CertFilePathTextBox.Text,
                CertFilePassword = CertFilePasswordTextBox.Text,

                AppId = AppIdTextBox.Text,
                Organization = OrganizationTextBox.Text,

                ScriptText = ScriptEditor.Text,
            };
        }

        /// <summary>
        /// Push values from a loaded <see cref="AppSettings"/> back onto
        /// the Configuration tab controls. Missing values are tolerated
        /// (defaults from the XAML are left alone).
        /// </summary>
        private void ApplySettings(AppSettings s)
        {
            RememberSettingsCheckBox.IsChecked = s.RememberSettings;

            PowerShellUrlCheckBox.IsChecked = s.UsePowerShellUrl;
            PowerShellUrlTextBox.Text = s.PowerShellUrl;
            if (!string.IsNullOrEmpty(s.ConfigurationName))
            {
                ConfigurationNameTextBox.Text = s.ConfigurationName;
            }

            ExchangeOnlineModuleCheckBox.IsChecked = s.LoadExchangeOnline;
            ExchangeOnlineDeviceAuthCheckBox.IsChecked = s.ExchangeOnlineUseDeviceAuth;

            SharePointOnlineModuleCheckBox.IsChecked = s.LoadSharePointOnline;
            SharePointOnlineUrlTextBox.Text = s.SharePointOnlineUrl;

            MicrosoftTeamsModuleCheckBox.IsChecked = s.LoadMicrosoftTeams;
            EntraIdModuleCheckBox.IsChecked = s.LoadEntraID;
            AzureInformationProtectionModuleCheckBox.IsChecked = s.LoadAzureInformationProtection;

            OutOfProcessRunspaceCheckBox.IsChecked = s.UseOutOfProcessRunspace;

            // Radios are in a GroupName so setting one to true clears the
            // others automatically.
            switch (s.AuthMode)
            {
                case "LoggedOnUser":
                    LoggedOnUserRadio.IsChecked = true;
                    break;
                case "Certificate":
                    CertificateRadio.IsChecked = true;
                    break;
                default:
                    SpecifiedCredentialsRadio.IsChecked = true;
                    break;
            }

            UsernameTextBox.Text = s.Username;
            PasswordTextBox.Text = s.Password;

            if (string.Equals(s.CertSource, "File", StringComparison.OrdinalIgnoreCase))
            {
                CertFileRadio.IsChecked = true;
            }
            else
            {
                CertStoreRadio.IsChecked = true;
            }

            if (!string.IsNullOrEmpty(s.CertStoreThumbprint)
                && CertStoreComboBox.ItemsSource is System.Collections.IEnumerable items)
            {
                foreach (var item in items)
                {
                    if (item is X509Certificate2 cert
                        && string.Equals(cert.Thumbprint, s.CertStoreThumbprint, StringComparison.OrdinalIgnoreCase))
                    {
                        CertStoreComboBox.SelectedItem = cert;
                        break;
                    }
                }
            }

            CertFilePathTextBox.Text = s.CertFilePath;
            CertFilePasswordTextBox.Text = s.CertFilePassword;

            AppIdTextBox.Text = s.AppId;
            OrganizationTextBox.Text = s.Organization;

            if (s.ScriptText is not null)
            {
                ScriptEditor.Text = s.ScriptText;
            }
        }

        /// <summary>
        /// Initialize the theme toggle to reflect the currently active
        /// application theme. The window currently starts dark, so default
        /// the toggle to the checked (Dark) state if no explicit variant
        /// has been set yet.
        /// </summary>
        private void InitializeThemeToggle()
        {
            var app = Application.Current;
            if (app is null) return;

            // If the app is following the system default, force it to Dark
            // so the initial UI state matches the existing dark appearance.
            if (app.RequestedThemeVariant is null ||
                app.RequestedThemeVariant == ThemeVariant.Default)
            {
                app.RequestedThemeVariant = ThemeVariant.Dark;
            }

            ThemeToggle.IsChecked = app.RequestedThemeVariant == ThemeVariant.Dark;
        }

        private void ThemeToggle_IsCheckedChanged(object? sender, Avalonia.Interactivity.RoutedEventArgs e)
        {
            var app = Application.Current;
            if (app is null) return;

            app.RequestedThemeVariant = ThemeToggle.IsChecked == true
                ? ThemeVariant.Dark
                : ThemeVariant.Light;
        }
    }
}