<#
.SYNOPSIS
Creates a local LIAM NTFS demo fixture with folders and ACL groups from a production log.

.DESCRIPTION
This script recreates the BRE.01.LEW/Projekte folder and ACL-group fixture from
the diagnostic log in the local imagoverum.com demo environment:

- local folder: C:\file_shares\share2
- optional SMB share: \\<local-server>\file_shares\share2
- group strategy: Ntfs_AGDLP
- group tags: FS for global groups, UG for domain-local groups
- access tags: _O, _W, _R, _T

By default the script creates the exact folders visible in the log and creates
the logged ACL groups in the configured OU, then grants them Read permissions
on the matching local folders. Expected LIAM groups can be created separately
with -CreateExpectedLiamGroups.

Run with -WhatIf first. The ActiveDirectory module is only required when
AD group creation and ACL assignment are enabled.
#>

[CmdletBinding(SupportsShouldProcess = $true)]
param(
    [string]$ShareRootPath = 'C:\file_shares',

    [string]$RootFolderName = 'share2',

    [string]$SmbShareName = 'file_shares',

    [string]$GroupOuDN = 'OU=AGP,OU=LIAM,OU=Global,DC=imagoverum,DC=com',

    [string[]]$AdditionalFolderRelativePaths = @(),

    [string]$GroupNameSanitizeReplacement = '_',

    [switch]$PreserveAdGroupNameCase,

    [switch]$CreateExpectedLiamGroups,

    [switch]$SkipLogAclFixture,

    [switch]$SkipAdGroups,

    [switch]$SkipNtfsAcl,

    [switch]$SkipSmbShare
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

if ([System.Environment]::OSVersion.Platform -ne [System.PlatformID]::Win32NT) {
    throw 'Dieses Script kann nur unter Windows ausgefuehrt werden.'
}

$rootPath = Join-Path -Path $ShareRootPath -ChildPath $RootFolderName
$readRights = [System.Security.AccessControl.FileSystemRights]0x200A9
$writeRights = [System.Security.AccessControl.FileSystemRights]0x301BF
$ownerRights = [System.Security.AccessControl.FileSystemRights]0x1F01FF

$logFolderRelativePaths = @(
    'Arbeitsgruppen',
    'Quartalsplanungen',
    'Projekte',
    'Projekte\__Templ',
    'Projekte\_BAMS_AD Projekte',
    'Projekte\__Admin Only',
    'Projekte\_LSMS_AD Projekte',
    'Projekte\_SW Projekte',
    'Projekte\_AD Projekte',
    'Projekte\_Templ_BMID',
    'Projekte\_HW Projekte',
    'Projekte\_IVD_Projekte',
    'ProjekteAbgeschlossen',
    'RESTORE',
    'Design Control Harmonization',
    'PMO'
)

$logAclFixtures = @(
    @{
        RelativePath = ''
        Groups = @(
            'UG_BRE.BDAL.DE.Users',
            'DALDE-gArchimedesLEW_ALL_RO',
            'DALDE-gArchimedesLEW_Admins',
            'DALDE-gArchimedesLEW_Projekte_Browse',
            'UG_BRE.01',
            'FS_BRE.01.Archimedes_LEW-RW',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte'
        Groups = @(
            'UG_BRE.BDAL.DE.Users',
            'DALDE-gArchimedesLEW_AccessGroup_PAW',
            'DALDE-gArchimedesLEW_AccessGroup_SVC',
            'DALDE-gArchimedesLEW_AccessGroup_TER',
            'DALDE-gArchimedesLEW_ALL_RO',
            'DALDE-gArchimedesLEW_Admins',
            'DALDE-gArchimedesLEW_AccessGroup_PRM',
            'DALDE-gArchimedesLEW_AccessGroup_QS',
            'DALDE-gArchimedesLEW_AccessGroup_WB',
            'DALDE-gArchimedesLEW_RO_Leipzig',
            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
            'DALDE-gArchimedesLEW_AccessGroup_EEL',
            'DALDE-gArchimedesLEW_AccessGroup_TPS',
            'DALDE-gArchimedesLEW_RW',
            'DALDE-gArchimedesLEW_AccessGroup_KST',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
            'DALDE-_Autocad',
            'DALDE-gArchimedesLEW_AccessGroup_APP',
            'DALDE-gArchimedesLEW_Projekte_RO',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
            'DALDE-gArchimedesLEW_AccessGroup_EPT',
            'DALDE-gArchimedesLEW_Projekte_Browse',
            'UG_BRE.01',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\__Templ'
        Groups = @(
            'UG_BRE.BDAL.DE.Users',
            'DALDE-gArchimedesLEW_Projekte_Browse',
            'UG_BRE.01',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_APP',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_GL',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_EEl',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_EpT',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_ESw',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_G&L',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_KSt',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_PRM',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_QS',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_Svc',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_TeR',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_TPS',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_RA_LSMS',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_Proc',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_BD',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_Mark',
            'FG_BRE.01.ArchimedesLEW_AccessGroup_Fin',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_BAMS_AD Projekte'
        Groups = @(
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\__Admin Only'
        Groups = @(
            'DALDE-gArchimedesLEW_Admins',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_LSMS_AD Projekte'
        Groups = @(
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_SW Projekte'
        Groups = @(
            'DALDE-gArchimedesLEW_AccessGroup_PAW',
            'DALDE-gArchimedesLEW_AccessGroup_SVC',
            'DALDE-gArchimedesLEW_SWProjekte_RW',
            'DALDE-gArchimedesLEW_AccessGroup_TER',
            'DALDE-gArchimedesLEW_ManagerSW_RW',
            'DALDE-gArchimedesLEW_Admins',
            'DALDE-gArchimedesLEW_AccessGroup_PRM',
            'DALDE-gArchimedesLEW_AccessGroup_QS',
            'DALDE-gArchimedesLEW_AccessGroup_WB',
            'DALDE-gArchimedesLEW_SWProjekte_RO',
            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
            'DALDE-gArchimedesLEW_AccessGroup_EEL',
            'DALDE-gArchimedesLEW_AccessGroup_TPS',
            'DALDE-gArchimedesLEW_AccessGroup_KST',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
            'DALDE-gArchimedesLEW_AccessGroup_APP',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
            'DALDE-gArchimedesLEW_AccessGroup_EPT',
            'DALDE-gArchimedesLEW_Projekte_Browse',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_AD Projekte'
        Groups = @(
            'UG_BRE.BDAL.DE.Users',
            'DALDE-gArchimedesLEW_AccessGroup_PAW',
            'DALDE-gArchimedesLEW_AccessGroup_SVC',
            'DALDE-gArchimedesLEW_AccessGroup_TER',
            'DALDE-gArchimedesLEW_ALL_RO',
            'DALDE-gArchimedesLEW_AccessGroup_PRM',
            'DALDE-gArchimedesLEW_AccessGroup_QS',
            'DALDE-gArchimedesLEW_AccessGroup_WB',
            'DALDE-gArchimedesLEW_RO_Leipzig',
            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
            'DALDE-gArchimedesLEW_AccessGroup_EEL',
            'DALDE-gArchimedesLEW_AccessGroup_TPS',
            'DALDE-gArchimedesLEW_RW',
            'DALDE-gArchimedesLEW_AccessGroup_KST',
            'DALDE-gArchimedesLEW_RO',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_Only',
            'DALDE-_Autocad',
            'DALDE-gArchimedesLEW_AccessGroup_APP',
            'DALDE-gArchimedesLEW_Projekte_RO',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
            'DALDE-gArchimedesLEW_AccessGroup_EPT',
            'DALDE-gArchimedesLEW_Projekte_Browse',
            'UG_BRE.01',
            'FS_BRE.01.Archimedes_LEW_Projekte_AD Projekte RW',
            'FS_BRE.01.Archimedes_LEW_Projekte_AD Projekte RO',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_Templ_BMID'
        Groups = @(
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_HW Projekte'
        Groups = @(
            'DALDE-gArchimedesLEW_AccessGroup_PAW',
            'DALDE-gArchimedesLEW_AccessGroup_SVC',
            'DALDE-gArchimedesLEW_AccessGroup_FSt',
            'DALDE-gArchimedesLEW_ManagerHW_RW',
            'DALDE-gArchimedesLEW_AccessGroup_GL',
            'DALDE-gArchimedesLEW_AccessGroup_TER',
            'DALDE-gArchimedesLEW_AccessGroup_EBIO',
            'DALDE-gArchimedesLEW_AccessGroup_PRM',
            'DALDE-gArchimedesLEW_HWProjekt_RO',
            'DALDE-gArchimedesLEW_AccessGroup_QS',
            'DALDE-gArchimedesLEW_AccessGroup_WB',
            'DALDE-gArchimedesLEW_AccessGroup_BOM_RO',
            'DALDE-gArchimedesLEW_HWProjekt_RFAP1_RO',
            'DALDE-gArchimedesLEW_AccessGroup_EEL',
            'DALDE-gArchimedesLEW_AccessGroup_TPS',
            'DALDE-gArchimedesLEW_AccessGroup_KST',
            'DALDE-gArchimedesLEW_AccessGroup_APP',
            'DALDE-gArchimedesLEW_AccessGroup_ESW_SW_HW',
            'DALDE-gArchimedesLEW_AccessGroup_EPT',
            'DALDE-gArchimedesLEW_Projekte_Browse',
            'UG_BRE.01.ArchimedesLEW_Projekte_HW Projekte RW',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    },
    @{
        RelativePath = 'Projekte\_IVD_Projekte'
        Groups = @(
            'DALDE-gArchimedesLEW_IVD_Projekte_RW',
            'FS_BRE.01.ArchimedesLEW_Projekte_IVD Projekte RW',
            'FS_BRE.01.ArchimedesLEW_Projekte_IVD Projekte RO',
            'AG_ETT.01.File Server Administrators_Restricted'
        )
    }
)

function ConvertTo-LiamSafeNameSegment {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Value,

        [Parameter(Mandatory = $true)]
        [string]$Replacement,

        [Parameter(Mandatory = $true)]
        [bool]$PreserveCase
    )

    $safeReplacement = if ($null -eq $Replacement) { '_' } else { $Replacement.Trim() }
    if ($safeReplacement -in @('<empty>', 'empty', 'none', 'remove')) {
        $safeReplacement = ''
    }
    if ([string]::IsNullOrWhiteSpace($safeReplacement) -and $Replacement -notin @('<empty>', 'empty', 'none', 'remove')) {
        $safeReplacement = '_'
    }

    $safeValue = [regex]::Replace($Value, '[\x00-\x1F\x7F/\\\[\]:;\|=,\+\*\?<>]', $safeReplacement)
    if ($PreserveCase) {
        return $safeValue
    }

    return $safeValue.ToUpperInvariant()
}

function Get-LiamFolderToken {
    param(
        [Parameter(Mandatory = $true)]
        [string]$FolderPath
    )

    $itemName = Split-Path -Path $FolderPath -Leaf
    if ([string]::IsNullOrWhiteSpace($itemName)) {
        $itemName = $RootFolderName
    }

    ConvertTo-LiamSafeNameSegment `
        -Value $itemName `
        -Replacement $GroupNameSanitizeReplacement `
        -PreserveCase $PreserveAdGroupNameCase.IsPresent
}

function Get-LiamGroupSet {
    param(
        [Parameter(Mandatory = $true)]
        [string]$FolderPath
    )

    $name = Get-LiamFolderToken -FolderPath $FolderPath

    [pscustomobject]@{
        FolderPath     = $FolderPath
        Name           = $name
        GlobalOwner    = "FS_${name}_O"
        GlobalWrite    = "FS_${name}_W"
        GlobalRead     = "FS_${name}_R"
        GlobalTraverse = "FS_${name}_T"
        LocalOwner     = "UG_${name}_O"
        LocalWrite     = "UG_${name}_W"
        LocalRead      = "UG_${name}_R"
    }
}

function Ensure-Folder {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Path
    )

    if (Test-Path -LiteralPath $Path) {
        return
    }

    if ($PSCmdlet.ShouldProcess($Path, 'Create directory')) {
        New-Item -ItemType Directory -Path $Path -Force | Out-Null
    }
}

function Ensure-SmbShare {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Name,

        [Parameter(Mandatory = $true)]
        [string]$Path
    )

    $existingShare = Get-SmbShare -Name $Name -ErrorAction SilentlyContinue
    if ($existingShare) {
        if ($existingShare.Path -ne $Path) {
            Write-Warning "SMB share '$Name' already points to '$($existingShare.Path)', not '$Path'."
        }
        return
    }

    if ($PSCmdlet.ShouldProcess($Name, "Create SMB share for '$Path'")) {
        New-SmbShare -Name $Name -Path $Path -ChangeAccess 'Authenticated Users' | Out-Null
    }
}

function ConvertTo-LdapFilterEscapedValue {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Value
    )

    $escapedValue = $Value.Replace('\', '\5c')
    $escapedValue = $escapedValue.Replace('*', '\2a')
    $escapedValue = $escapedValue.Replace('(', '\28')
    $escapedValue = $escapedValue.Replace(')', '\29')
    $escapedValue = $escapedValue.Replace([string][char]0, '\00')

    return $escapedValue
}

function Get-AdGroupBySamAccountName {
    param(
        [Parameter(Mandatory = $true)]
        [string]$SamAccountName,

        [string[]]$Properties = @()
    )

    $escapedSamAccountName = ConvertTo-LdapFilterEscapedValue -Value $SamAccountName
    $parameters = @{
        LDAPFilter  = "(sAMAccountName=$escapedSamAccountName)"
        ErrorAction = 'Stop'
    }

    if ($Properties.Count -gt 0) {
        $parameters['Properties'] = $Properties
    }

    try {
        return Get-ADGroup @parameters | Select-Object -First 1
    }
    catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
        return $null
    }
}

function Ensure-AdGroup {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Name,

        [Parameter(Mandatory = $true)]
        [ValidateSet('Global', 'DomainLocal')]
        [string]$Scope,

        [Parameter(Mandatory = $true)]
        [string]$Description
    )

    $existingGroup = Get-AdGroupBySamAccountName -SamAccountName $Name
    if ($existingGroup) {
        return $existingGroup
    }

    if ($PSCmdlet.ShouldProcess($Name, "Create AD group in '$GroupOuDN'")) {
        New-ADGroup `
            -Name $Name `
            -SamAccountName $Name `
            -GroupCategory Security `
            -GroupScope $Scope `
            -Path $GroupOuDN `
            -Description $Description | Out-Null
    }

    return Get-AdGroupBySamAccountName -SamAccountName $Name
}

function Ensure-AdGroupMembership {
    param(
        [Parameter(Mandatory = $true)]
        [string]$ParentGroup,

        [Parameter(Mandatory = $true)]
        [string]$MemberGroup
    )

    $parent = Get-AdGroupBySamAccountName -SamAccountName $ParentGroup -Properties @('member')
    $member = Get-AdGroupBySamAccountName -SamAccountName $MemberGroup
    if (-not $parent -or -not $member) {
        if ($WhatIfPreference) {
            if ($PSCmdlet.ShouldProcess($ParentGroup, "Add member group '$MemberGroup'")) {
            }
            return
        }

        throw "Cannot add '$MemberGroup' to '$ParentGroup' because at least one group does not exist."
    }

    if ($parent.member -contains $member.DistinguishedName) {
        return
    }

    if ($PSCmdlet.ShouldProcess($ParentGroup, "Add member group '$MemberGroup'")) {
        Add-ADGroupMember -Identity $parent -Members $member
    }
}

function Ensure-LiamGroups {
    param(
        [Parameter(Mandatory = $true)]
        [pscustomobject]$GroupSet
    )

    $groups = @(
        @{ Name = $GroupSet.GlobalOwner; Scope = 'Global';      Description = "$($GroupSet.Name) - _O" }
        @{ Name = $GroupSet.GlobalWrite; Scope = 'Global';      Description = "$($GroupSet.Name) - _W" }
        @{ Name = $GroupSet.GlobalRead;  Scope = 'Global';      Description = "$($GroupSet.Name) - _R" }
        @{ Name = $GroupSet.LocalOwner;  Scope = 'DomainLocal'; Description = "$($GroupSet.Name) - _O" }
        @{ Name = $GroupSet.LocalWrite;  Scope = 'DomainLocal'; Description = "$($GroupSet.Name) - _W" }
        @{ Name = $GroupSet.LocalRead;   Scope = 'DomainLocal'; Description = "$($GroupSet.Name) - _R" }
        @{ Name = $GroupSet.GlobalTraverse; Scope = 'Global';   Description = "$($GroupSet.Name) - _T" }
    )

    foreach ($group in $groups) {
        Ensure-AdGroup -Name $group.Name -Scope $group.Scope -Description $group.Description | Out-Null
    }

    Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalOwner -MemberGroup $GroupSet.GlobalOwner
    Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalWrite -MemberGroup $GroupSet.GlobalWrite
    Ensure-AdGroupMembership -ParentGroup $GroupSet.LocalRead -MemberGroup $GroupSet.GlobalRead
}

function Ensure-LogAclFixtureGroups {
    param(
        [Parameter(Mandatory = $true)]
        [object[]]$Fixtures
    )

    $groupNames = $Fixtures |
        ForEach-Object { $_['Groups'] } |
        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
        Sort-Object -Unique

    foreach ($groupName in $groupNames) {
        $groupScope = if ($groupName -like 'UG_*') { 'DomainLocal' } else { 'Global' }
        Ensure-AdGroup `
            -Name $groupName `
            -Scope $groupScope `
            -Description 'Source ACL group from BRE.01.LEW diagnostic log' | Out-Null
    }
}

function Add-FolderAccessRule {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Path,

        [Parameter(Mandatory = $true)]
        [string]$Account,

        [Parameter(Mandatory = $true)]
        [System.Security.AccessControl.FileSystemRights]$Rights
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        if ($WhatIfPreference) {
            if ($PSCmdlet.ShouldProcess($Path, "Add NTFS ACL '$Rights' for '$Account'")) {
            }
            return
        }

        throw "Path not found: $Path"
    }

    $acl = Get-Acl -LiteralPath $Path
    $identity = [System.Security.Principal.NTAccount]::new($Account)
    try {
        $sid = $identity.Translate([System.Security.Principal.SecurityIdentifier])
    }
    catch [System.Security.Principal.IdentityNotMappedException] {
        if ($WhatIfPreference) {
            if ($PSCmdlet.ShouldProcess($Path, "Add NTFS ACL '$Rights' for '$Account'")) {
            }
            return
        }

        throw
    }

    foreach ($rule in $acl.Access) {
        if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) {
            continue
        }
        if ($rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) {
            continue
        }
        if (($rule.FileSystemRights -band $Rights) -eq $Rights) {
            return
        }
    }

    $accessRule = [System.Security.AccessControl.FileSystemAccessRule]::new(
        $sid,
        $Rights,
        [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
        [System.Security.AccessControl.PropagationFlags]::None,
        [System.Security.AccessControl.AccessControlType]::Allow
    )

    $acl.AddAccessRule($accessRule)

    if ($PSCmdlet.ShouldProcess($Path, "Add NTFS ACL '$Rights' for '$Account'")) {
        Set-Acl -LiteralPath $Path -AclObject $acl
    }
}

function Ensure-LiamNtfsAcl {
    param(
        [Parameter(Mandatory = $true)]
        [pscustomobject]$GroupSet,

        [Parameter(Mandatory = $true)]
        [string]$DomainNetBiosName
    )

    Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalOwner)" -Rights $ownerRights
    Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalWrite)" -Rights $writeRights
    Add-FolderAccessRule -Path $GroupSet.FolderPath -Account "$DomainNetBiosName\$($GroupSet.LocalRead)" -Rights $readRights
}

function Ensure-LogAclFixtureAcls {
    param(
        [Parameter(Mandatory = $true)]
        [object[]]$Fixtures,

        [Parameter(Mandatory = $true)]
        [string]$DomainNetBiosName
    )

    foreach ($fixture in $Fixtures) {
        $relativePath = $fixture['RelativePath']
        $folderPath = if ([string]::IsNullOrWhiteSpace($relativePath)) {
            $rootPath
        }
        else {
            Join-Path -Path $rootPath -ChildPath $relativePath
        }

        foreach ($groupName in ($fixture['Groups'] | Sort-Object -Unique)) {
            Add-FolderAccessRule `
                -Path $folderPath `
                -Account "$DomainNetBiosName\$groupName" `
                -Rights $readRights
        }
    }
}

$relativeFolders = @($logFolderRelativePaths + $AdditionalFolderRelativePaths) |
    Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
    ForEach-Object { $_.Trim().TrimStart('\', '/') } |
    Sort-Object -Unique

Ensure-Folder -Path $ShareRootPath
Ensure-Folder -Path $rootPath

foreach ($relativeFolder in $relativeFolders) {
    Ensure-Folder -Path (Join-Path -Path $rootPath -ChildPath $relativeFolder)
}

if (-not $SkipSmbShare) {
    Ensure-SmbShare -Name $SmbShareName -Path $ShareRootPath
}

$foldersToManage = @($rootPath)
foreach ($relativeFolder in $relativeFolders) {
    $foldersToManage += (Join-Path -Path $rootPath -ChildPath $relativeFolder)
}

$domainNetBiosName = $null
if (-not $SkipAdGroups -or -not $SkipNtfsAcl) {
    Import-Module ActiveDirectory -ErrorAction Stop
    $domainNetBiosName = (Get-ADDomain).NetBIOSName
}

if (-not $SkipAdGroups -and -not $SkipLogAclFixture) {
    Ensure-LogAclFixtureGroups -Fixtures $logAclFixtures
}

$summary = foreach ($folder in $foldersToManage) {
    $groupSet = Get-LiamGroupSet -FolderPath $folder

    if (-not $SkipAdGroups -and $CreateExpectedLiamGroups) {
        Ensure-LiamGroups -GroupSet $groupSet
    }

    if (-not $SkipNtfsAcl -and $CreateExpectedLiamGroups) {
        Ensure-LiamNtfsAcl -GroupSet $groupSet -DomainNetBiosName $domainNetBiosName
    }

    $relativePath = if ($folder -eq $rootPath) {
        ''
    }
    else {
        $folder.Substring($rootPath.Length).TrimStart('\')
    }
    $fixture = $logAclFixtures | Where-Object { $_['RelativePath'] -eq $relativePath } | Select-Object -First 1

    [pscustomobject]@{
        Folder             = $folder
        LogAclGroupCount   = if ($fixture) { $fixture['Groups'].Count } else { 0 }
        LocalOwnerAcl      = $groupSet.LocalOwner
        LocalWriteAcl      = $groupSet.LocalWrite
        LocalReadAcl       = $groupSet.LocalRead
        GlobalOwner        = $groupSet.GlobalOwner
        GlobalWrite        = $groupSet.GlobalWrite
        GlobalRead         = $groupSet.GlobalRead
        GlobalTraverse     = $groupSet.GlobalTraverse
    }
}

if (-not $SkipNtfsAcl -and -not $SkipLogAclFixture) {
    Ensure-LogAclFixtureAcls -Fixtures $logAclFixtures -DomainNetBiosName $domainNetBiosName
}

$summary

Write-Host ''
Write-Host 'LIAM provider RootPath for this machine:'
Write-Host ("\\{0}\{1}\{2}" -f $env:COMPUTERNAME, $SmbShareName, $RootFolderName)