CLI User Replicator

@echo off
set IMPORTDIR=%SAFEQ_HOME%\utilities\Import tool\
cd %IMPORTDIR%
call "%IMPORTDIR%import_tool.bat" user replicate --username csv --password csvimport --tenant tenant_1 --host https://localhost

<#
.DESCRIPTION
	Script executes CLI user replicator

	The script enhances security by storing password on HDD in encrypted way.
	The encryption is tied to Windows user, utilizing Windows Data Protection API - DPAPI.
	The account running the script must have WRITE permissions for the script file to be able to encrypt the password.

	Script should be executed on regular basis via Task Scheduler
		Action: powershell.exe
		Arguments: -ExecutionPolicy Bypass -File "<pathtofile>\import.ps1"
		Run whether user is logged on or not, with highest privileges if needed.

	You may need to unblock ps1 file before executing it:
		Run PowerShell as Administrator
		Run: Unblock-File -Path <pathtofile>\import.ps1
#>

#-----------------------------------------------------------[Parameters]-----------------------------------------------------------

$logDirectory = "$env:SAFEQ_HOME\..\Customization\import\log"
$importDir = "$env:SAFEQ_HOME\utilities\Import tool"
$username = 'admin'
$tenant = 'tenant_1'
$srvhost = 'https://localhost'

# $sqpassword initially set as plain text, upon first execution it will be auto-replaced with encrypted value
# $sqpassword plain text must be enclosed in single quotations '', not in ""
$password = 'mysecretpassword'

#-----------------------------------------------------------[Execution]------------------------------------------------------------

$today = Get-Date -Format "yyyy-MM-dd"
$logFile = Join-Path $logDirectory "import_$today.log"

# Ensure log folder exists
if (!(Test-Path $logDirectory)) {
	New-Item -ItemType Directory -Path $logDirectory | Out-Null
}

# --- Rotate old logs (keep 7 most recent) ---
$allLogs = Get-ChildItem -Path $logDirectory -Filter "import_*.log" | Sort-Object LastWriteTime -Descending
$logsToDelete = $allLogs | Select-Object -Skip 7
foreach ($log in $logsToDelete) {
Remove-Item $log.FullName -Force
}

Add-Content $logFile "`n$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") SCRIPT START $($MyInvocation.MyCommand.Name)"

# VALIDATE PASSWORD CHARACTERS (other characters may not be passed properly via import_tool.bat)
$allowedPattern = '^[a-zA-Z0-9!@#$*()_+\=\-\\{}\[\]]*$'
if ($password -notmatch $allowedPattern) {
	# Find all invalid characters
	$invalidChars = ($password.ToCharArray() | Where-Object { $_ -notmatch '[a-zA-Z0-9!@#$*()_+\=\-\\{}\[\]]' }) -join ', '

	$errmsg = "Password contains invalid character(s): $invalidChars. Allowed: a-z, A-Z, 0-9, and !@#$*()_+=-\{[]}"
	Write-Error $errmsg
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") $errmsg"
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") SCRIPT TERMINATED"
	exit 1
}

# PASSWORD ENCRYPTION VIA DPAPI
$requiresEncryption = $false
$securePassword = $null
$decryptAttempted = $false

try {
	$securePassword = $password | ConvertTo-SecureString -ErrorAction Stop
} catch {
	$decryptAttempted = $true
	if ($password.Length -gt 50) {
		$errmsg = "Password decryption failed, and value appears encrypted (length > 50). It was likely encrypted using a different Windows account or on another machine. Cannot continue."
		Write-Error $errmsg
		Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") $errmsg"
		Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") SCRIPT TERMINATED"
		exit 1
} else {
	$requiresEncryption = $true
	}
}

if ($requiresEncryption) {
	Write-Host "Plaintext password detected. Encrypting..."
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") Plaintext password detected. Encrypting..."

	# Encrypt the password
	$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
	$encryptedString = $securePassword | ConvertFrom-SecureString
	$replacementLine = '$password = "' + $encryptedString + '"'

	# Replace this line in the script itself
	$scriptPath = $MyInvocation.MyCommand.Path
	try {
		(Get-Content $scriptPath) -replace '^\s*\$password\s*=.*', $replacementLine | Set-Content $scriptPath

		Write-Host "Password encrypted and script updated."
		Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") Password encrypted and script updated."
	} catch {
		$errmsg = "Error while replacing password with encrypted value. Check that account running the script has WRITE permissions to the script file. Script will continue but password will remain unencrypted."
		Write-Host $errmsg
		Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") $errmsg"
	}
}

# PASSWORD DECRYPTION FOR USE IN MEMORY
try {
	$plainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto(
		[System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($securePassword)
	)
} catch {
	Write-Error "Failed to decrypt the password. Exiting."
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") Failed to decrypt the password. Exiting."
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") SCRIPT TERMINATED"
	exit 1
}

# RUN THE IMPORT TOOL
$cmdhiddenpass = "$importDir\import_tool.bat user replicate --username $username --password <hidden> --tenant $tenant --host $srvhost"
Write-Host "Executing: $cmdhiddenpass"
Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") Executing: $cmdhiddenpass"
$cmd = "`"$importDir\import_tool.bat`" user replicate --username $username --password $plainPassword --tenant $tenant --host $srvhost"

try {
	Add-Content "$env:SAFEQ_HOME\utilities\Import tool\ysoft-shell.log" "`n"
	Write-Host "For debug info see: $env:SAFEQ_HOME\utilities\Import tool\ysoft-shell.log"
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") For debug info see: $env:SAFEQ_HOME\utilities\Import tool\ysoft-shell.log"
} catch {
	$errmsg = "Error while testing WRITE access to $env:SAFEQ_HOME\utilities\Import tool\ysoft-shell.log . Check that account running the script has WRITE permissions to it. Script will continue but debug information will not be available."
	Write-Host $errmsg
	Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") $errmsg"
}

Start-Process "cmd.exe" -ArgumentList "/c $cmd" -WorkingDirectory $importDir -NoNewWindow -Wait
Add-Content $logFile "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") SCRIPT END"