###########################################################
#SUPER SCRIPT PARA VALIDAR W.A.S. E Ms Internet Information Server (Msiis)

Boa! Peguei os pontos dos tópicos do fórum que você enviou (checklist de usuário LOCAL e grupos, permissões nas pastas do IIS/PC SOFT, handlers .awp/.awws/.wb, correção do “Virtual Directory”, e a exigência do DISM funcionar) e empacotei num script PowerShell completo, idempotente e com “guard rails”. Ele instala e configura o IIS para o W.A.S., cria usuário local dedicado (opcional), aplica permissões, registra handlers/ISAPI do WDxxAWP.exe, cria app pool com identidade específica, cria aplicação virtual, testa a URL e roda um diagnóstico detalhado — com switches para habilitar passos “arriscados” apenas quando você quiser.

Referências de onde veio cada exigência/prova de campo: checklist/diagnóstico e correção de “Virtual Directory” e handlers (.awp/.awws/.wb) ; necessidade do DISM operacional para o W.A.S. em alguns ambientes ; tópico base “WAS - Webdev Aplicativo Server” (coletânea) com boas práticas gerais de instalação e IIS “tudo verde” .

⸻

Script (salve como Setup-WAS-IIS.ps1 e execute em PowerShell administrador)

#requires -RunAsAdministrator
<#
.SYNOPSIS
Configuração COMPLETA do IIS + W.A.S. (WebDev Application Server) com diagnósticos.
.DESCRIPTION
- Instala recursos do IIS necessários ao WebDev/WAS
- (Opcional) Cria usuário LOCAL dedicado e o coloca nos grupos Administrators e IIS_IUSRS
- Configura Application Pool, ISAPI/Handlers (.awp/.awws/.wb), permissões NTFS
- (Opcional) Faz correções para DISM funcionar quando exigido pelo WAS
- Cria Aplicação Virtual e testa URL
- Executa diagnóstico abrangente com resumo em % de prontidão

Baseado em experiências reais e tópicos do fórum PC SOFT (checklist, erros de Virtual Directory, handlers e DISM).
Autor: Adriano José Boller – PC SOFT Brasil | Versão 3.0
#>

param(
[Parameter(Mandatory=$false)]
[ValidatePattern('^\d{4}$')]
[string]$WebdevVersion = "2025",

[Parameter(Mandatory=$false)]
[string]$ProjectName = "",

[Parameter(Mandatory=$false)]
[string]$SiteName = "Default Web Site",

[Parameter(Mandatory=$false)]
[string]$LocalUser = "WebdevAdmin",

[Parameter(Mandatory=$false)]
[SecureString]$LocalUserPassword,

[Parameter(Mandatory=$false)]
[string]$InstallPathC = "C:\PC SOFT\WINDEV {0}" -f "2025",

[Parameter(Mandatory=$false)]
[string]$InstallPathD = "D:\PC SOFT\WINDEV {0}" -f "2025",

# Opções de execução
[switch]$CreateLocalUser,
[switch]$ConfigureIIS,
[switch]$ConfigureWAS,
[switch]$CreateVirtualApp,
[switch]$RunDiagnostics, # roda diagnóstico ao final
[switch]$FixDism, # tenta corrigir o acesso ao DISM (situações específicas)
[switch]$OpenFirewall, # abre portas 80/443 (e 21/990 se FTP for desejado)
[switch]$CopyDllsToBin, # copia DLLs do engine para a pasta do AWP/BIN (NÃO para System32)
[switch]$Force # força recriação de artefatos
)

# =========================
# Inicialização e utilitários
# =========================
$ErrorActionPreference = "Stop"
$VerbosePreference = "Continue"
$global:StartedAt = Get-Date
$LogDir = "C:\Logs"
if (!(Test-Path $LogDir)) { New-Item -Path $LogDir -ItemType Directory -Force | Out-Null }
$LogPath = Join-Path $LogDir ("WAS_IIS_{0}.log" -f (Get-Date -Format "yyyyMMdd_HHmmss"))

function Write-Log([string]$msg, [ValidateSet("INFO","WARN","ERROR","OK","STEP")]$level="INFO"){
$stamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$line = "[{0}] [{1}] {2}" -f $stamp, $level, $msg
Write-Host $line
Add-Content -Path $LogPath -Value $line
}

function Confirm-Action([string]$question){
$ans = Read-Host "$question (S/N)"
return ($ans -match '^(s|S|y|Y)$')
}

function Must-BeLocalAdmin {
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$pri = New-Object Security.Principal.WindowsPrincipal($id)
if (-not $pri.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
Write-Log "Execute como Administrador." "ERROR"; throw "Necessário administrador local."
}
}

function Ensure-NotADUser {
$u = [Security.Principal.WindowsIdentity]::GetCurrent().Name
# Heurística: DOMAIN\user indica AD diferente do computador local (prática do fórum)
if ($u.Contains('\') -and -not $u.StartsWith($env:COMPUTERNAME+'\')) {
Write-Log "Usuário do AD detectado ($u). Use usuário LOCAL administrativo." "ERROR"
throw "Não execute com usuário do AD."
}
}

function Resolve-WebDevPaths {
param([string]$ver)
$c = $InstallPathC -replace '\{0\}', $ver
$d = $InstallPathD -replace '\{0\}', $ver
$c = $c -replace 'WINDEV', 'WEBDEV' # se máquina tem só WEBDEV instalado com pasta WEBDEV
$d = $d -replace 'WINDEV', 'WEBDEV'
$c2 = $InstallPathC -replace '\{0\}', $ver
# Tenta ambas nomenclaturas (há ambientes com WINDEV contendo Engine do WAS)
$candidates = @(
(Join-Path $c "Programs\Engine\Win64x86\AWP"),
(Join-Path $d "Programs\Engine\Win64x86\AWP"),
(Join-Path $c2 "Programs\Engine\Win64x86\AWP"),
(Join-Path $c "Programs\Engine\Win32\AWP"),
(Join-Path $d "Programs\Engine\Win32\AWP")
) | Get-Unique
foreach($p in $candidates){ if(Test-Path $p){ return $p } }
return $null
}

function Get-AwpExe {
param([string]$ver)
# WD300awp.exe => WebDev 30, WD295awp.exe => 2025 beta, etc. Usaremos heurística:
$awpFolder = Resolve-WebDevPaths -ver $ver
if (!$awpFolder) { return $null }
$files = Get-ChildItem -Path $awpFolder -Filter "WD*awp.exe" -ErrorAction SilentlyContinue | Sort-Object Name -Descending
return $files | Select-Object -First 1
}

# =========================
# Usuário local (opcional)
# =========================
function Ensure-LocalWebdevUser {
param([string]$User, [SecureString]$Pass, [switch]$force)
$exists = Get-LocalUser -Name $User -ErrorAction SilentlyContinue
if ($exists -and $force){
Write-Log "Removendo usuário existente $User" "WARN"
Remove-LocalUser -Name $User -ErrorAction SilentlyContinue
$exists = $null
}
if (!$exists){
if (-not $Pass){ $Pass = Read-Host -AsSecureString -Prompt "Senha para $User (mín. 8 chars)" }
New-LocalUser -Name $User -Password $Pass -FullName "$User - WebDev Admin" -PasswordNeverExpires -UserMayNotChangePassword | Out-Null
Write-Log "Usuário criado: $User" "OK"
} else {
Write-Log "Usuário já existe: $User" "INFO"
}
foreach($grp in @("Administrators","IIS_IUSRS")){
try { Add-LocalGroupMember -Group $grp -Member $User -ErrorAction SilentlyContinue } catch {}
}
Write-Log "Usuário '$User' está nos grupos Administrators e IIS_IUSRS" "OK"
}

# =========================
# IIS: instalação e base
# =========================
function Ensure-IIS {
Write-Log "Instalando recursos IIS..." "STEP"
$features = @(
"IIS-WebServerRole","IIS-WebServer","IIS-CommonHttpFeatures",
"IIS-HttpErrors","IIS-HttpRedirect",
"IIS-ApplicationDevelopment","IIS-NetFxExtensibility45","IIS-ASPNET45",
"IIS-ISAPIExtensions","IIS-ISAPIFilter",
"IIS-HealthAndDiagnostics","IIS-HttpLogging",
"IIS-Security","IIS-RequestFiltering",
"IIS-Performance",
"IIS-WebServerManagementTools","IIS-ManagementConsole",
"IIS-IIS6ManagementCompatibility","IIS-Metabase"
)
foreach($f in $features){
try { Enable-WindowsOptionalFeature -Online -FeatureName $f -All -NoRestart -ErrorAction SilentlyContinue | Out-Null } catch {}
}
# Inicia/garante site padrão
Import-Module WebAdministration -ErrorAction SilentlyContinue
$site = Get-Website -Name $SiteName -ErrorAction SilentlyContinue
if ($site -and $site.State -ne "Started"){ Start-Website -Name $SiteName }
Write-Log "IIS instalado e $SiteName ativo" "OK"
}

function Configure-AppPool {
param([string]$Pool="WebdevAppPool",[string]$User,[SecureString]$Pass)
Import-Module WebAdministration -ErrorAction SilentlyContinue
if (-not (Get-IISAppPool -Name $Pool -ErrorAction SilentlyContinue)){
New-IISAppPool -Name $Pool | Out-Null
}
if ($User -and $Pass){
$plain = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($Pass))
Set-IISAppPool -Name $Pool -ProcessModel @{ identityType="SpecificUser"; userName=$User; password=$plain }
}
# Ajustes recomendados para apps longas
Set-WebConfiguration "/system.applicationHost/applicationPools/add[@name='$Pool']/recycling/periodicRestart" -Value @{time="00:00:00"} -PSPath IIS:\ -ErrorAction SilentlyContinue
Set-WebConfiguration "/system.applicationHost/applicationPools/add[@name='$Pool']" -Value @{startMode="AlwaysRunning"} -PSPath IIS:\ -ErrorAction SilentlyContinue
Write-Log "Application Pool '$Pool' configurado" "OK"
# Atribui pool ao site
if (Get-Website -Name $SiteName -ErrorAction SilentlyContinue){
Set-ItemProperty "IIS:\Sites\$SiteName" -Name applicationPool -Value $Pool
Write-Log "Pool '$Pool' aplicado ao site '$SiteName'" "OK"
}
}

# =========================
# Handlers / ISAPI do W.A.S.
# =========================
function Configure-WebDevHandlers {
param([string]$awpExePath)
if (-not (Test-Path $awpExePath)){ throw "WDxxawp.exe não encontrado ($awpExePath)" }
Import-Module WebAdministration -ErrorAction SilentlyContinue

# Permite ISAPI para o executável do W.A.S.
$isapi = Get-WebConfiguration "system.webServer/security/isapiCgiRestriction/add[@path='$awpExePath']" -ErrorAction SilentlyContinue
if (-not $isapi){
Add-WebConfiguration "system.webServer/security/isapiCgiRestriction" -Value @{ path=$awpExePath; allowed=$true; description=("WebDev AWP " + $WebdevVersion) } -ErrorAction SilentlyContinue
Write-Log "ISAPI permitido: $awpExePath" "OK"
}

# Limpa handlers antigos “WebDev-*”
$handlers = Get-WebConfiguration "system.webServer/handlers/add" -PSPath "IIS:\Sites\$SiteName" -ErrorAction SilentlyContinue | Where-Object { $_.name -like "WebDev-*" -or $_.path -like "*.awp" -or $_.path -like "*.awws" -or $_.path -like "*.wb" }
foreach($h in $handlers){
Remove-WebConfiguration "system.webServer/handlers/add[@name='$($h.name)']" -PSPath "IIS:\Sites\$SiteName" -ErrorAction SilentlyContinue
}

$map = @(
@{ Ext=".awp"; Name="WebDev-AWP" },
@{ Ext=".awws"; Name="WebDev-AWWS" },
@{ Ext=".wb"; Name="WebDev-WB" }
)
foreach($m in $map){
Add-WebConfiguration "system.webServer/handlers" -PSPath "IIS:\Sites\$SiteName" -Value @{
name=$m.Name; path=("*{0}" -f $m.Ext); verb="*"; modules="IsapiModule"; scriptProcessor=$awpExePath; resourceType="File"
} -ErrorAction SilentlyContinue
}

# MIME types (tolerante a duplicatas)
$mimes = @(
@{ext=".awp"; type="application/x-webdev-awp"},
@{ext=".awws"; type="application/x-webdev-awws"},
@{ext=".wb"; type="application/x-webdev-wb"}
)
foreach($mm in $mimes){
try {
Add-WebConfiguration "system.webServer/staticContent" -PSPath "IIS:\Sites\$SiteName" -Value @{ fileExtension=$mm.ext; mimeType=$mm.type } -ErrorAction Stop
} catch { }
}
Write-Log "Handlers/MIME do WebDev configurados para $SiteName" "OK"
}

# =========================
# Permissões NTFS úteis
# =========================
function Grant-Permissions {
param([string]$Path,[string]$User)
if(-not (Test-Path $Path)){ New-Item -ItemType Directory -Path $Path -Force | Out-Null }
$acl = Get-Acl $Path
$rules = @(
New-Object System.Security.AccessControl.FileSystemAccessRule($User, "FullControl","ContainerInherit, ObjectInherit","None","Allow"),
New-Object System.Security.AccessControl.FileSystemAccessRule("IIS_IUSRS", "Modify","ContainerInherit, ObjectInherit","None","Allow"),
New-Object System.Security.AccessControl.FileSystemAccessRule("NETWORK SERVICE", "ReadAndExecute","ContainerInherit, ObjectInherit","None","Allow")
)
foreach($r in $rules){ $acl.SetAccessRule($r) }
Set-Acl -Path $Path -AclObject $acl
Write-Log "Permissões aplicadas em '$Path'" "OK"
}

# =========================
# Aplicação Virtual
# =========================
function Ensure-VirtualApp {
param([string]$Name,[string]$User)
Import-Module WebAdministration -ErrorAction SilentlyContinue
$physical = Join-Path "C:\inetpub\wwwroot" $Name
if (!(Test-Path $physical)){ New-Item -ItemType Directory -Path $physical -Force | Out-Null }
Grant-Permissions -Path $physical -User $User

# Remove app anterior se Force
if ($Force -and (Get-WebApplication -Site $SiteName -Name $Name -ErrorAction SilentlyContinue)){
Remove-WebApplication -Site $SiteName -Name $Name -ErrorAction SilentlyContinue
}
if (-not (Get-WebApplication -Site $SiteName -Name $Name -ErrorAction SilentlyContinue)){
New-WebApplication -Site $SiteName -Name $Name -PhysicalPath $physical -ApplicationPool "WebdevAppPool" | Out-Null
}

# web.config básico
$webCfg = @"


























"@
$webCfg | Out-File -FilePath (Join-Path $physical "web.config") -Encoding UTF8 -Force

# WEB.INI mínimo (útil para diagnósticos do Checklist)
$webIni = @"
[PROJECT]
PROJECTNAME=$Name
PROJECTPATH=$physical
VERSION=$WebdevVersion
TIMEOUT=7200
"@
$webIni | Out-File -FilePath (Join-Path $physical "WEB.INI") -Encoding UTF8 -Force

# Página de teste
$html = @"

✅ $Name online

Servidor: $env:COMPUTERNAME

Diretório: $physical

"@
$html | Out-File -FilePath (Join-Path $physical "test.html") -Encoding UTF8 -Force

Write-Log "Aplicação virtual '$Name' pronta em $physical" "OK"
return $physical
}

# =========================
# Correção p/ DISM (opcional)
# =========================
function Ensure-DismWorks {
# Alguns ambientes de WAS exigem que o DISM rode corretamente (vide fórum)
$dism = "$env:WINDIR\System32\dism.exe"
if (!(Test-Path $dism)){ Write-Log "DISM não encontrado: $dism" "WARN"; return }
try {
& $dism /online /Get-CurrentEdition | Out-Null
if ($LASTEXITCODE -eq 0){ Write-Log "DISM operacional." "OK"; return }
} catch {}
Write-Log "DISM apresentou erro. Aplicando correções leves (ACL no dism.exe)." "WARN"
try{
takeown /f $dism | Out-Null
icacls $dism /grant "Administrators:F" /Q | Out-Null
icacls $dism /grant "IIS_IUSRS:RX" /Q | Out-Null
} catch {
Write-Log "Falha ao ajustar ACL do DISM: $_" "WARN"
}
}

# =========================
# Abrir firewall (opcional)
# =========================
function Ensure-Firewall {
New-NetFirewallRule -DisplayName "IIS HTTP 80" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 80 -ErrorAction SilentlyContinue | Out-Null
New-NetFirewallRule -DisplayName "IIS HTTPS 443" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 -ErrorAction SilentlyContinue | Out-Null
Write-Log "Firewall: portas 80/443 liberadas" "OK"
}

# =========================
# Copiar DLLs para BIN do AWP (seguro)
# =========================
function Copy-EngineDllsToAwpBin {
param([string]$awpFolder)
# Em vez de System32, mantenha as DLLs ao lado do WDxxawp.exe (boa prática de isolamento)
$engineRoot = Split-Path $awpFolder -Parent
$src = $engineRoot
$dst = $awpFolder
$patterns = @("wd*.dll","hf*.dll","*sql*.dll","*oracle*.dll","*mysql*.dll")
$copied = 0
foreach($pat in $patterns){
Get-ChildItem -Path $src -Filter $pat -ErrorAction SilentlyContinue | ForEach-Object {
Copy-Item $_.FullName -Destination (Join-Path $dst $_.Name) -Force -ErrorAction SilentlyContinue
$copied++
}
}
Write-Log ("DLLs copiadas para AWP/BIN: {0}" -f $copied) "OK"
}

# =========================
# Testes e Diagnósticos
# =========================
function Test-Endpoints {
param([string]$AppName)
try {
$r = Invoke-WebRequest -Uri "http://localhost" -UseBasicParsing -TimeoutSec 10
Write-Log "IIS responde (HTTP 80): $($r.StatusCode)" "OK"
} catch {
Write-Log "IIS não respondeu em http://localhost" "ERROR"
}
if ($AppName){
try {
$url = "http://localhost/{0}/test.html" -f $AppName
$r2 = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10
Write-Log "Aplicação '$AppName' responde: $($r2.StatusCode) - $url" "OK"
} catch {
Write-Log "Aplicação '$AppName' NÃO respondeu." "ERROR"
}
}
}

function Invoke-WasIisDiagnostics {
param([string]$AppName,[string]$awpExe)
Import-Module WebAdministration -ErrorAction SilentlyContinue
$checks = [ordered]@{
"Usuário local administrativo" = $true
"Usuário NÃO é AD" = $true
"IIS instalado e ativo" = $false
"Pool WebdevAppPool existe" = $false
"WDxxawp.exe localizado" = $false
"Handlers .awp/.awws/.wb" = $false
"ISAPI liberado p/ AWP" = $false
"Porta 80 acessível" = $false
"Aplicação virtual existe" = $false
"Permissões wwwroot/app OK" = $false
"DISM funcional (opcional)" = $false
}

# AD/local
try { Ensure-NotADUser } catch { $checks["Usuário NÃO é AD"] = $false }
try {
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$pri = New-Object Security.Principal.WindowsPrincipal($id)
$checks["Usuário local administrativo"] = $pri.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
} catch { $checks["Usuário local administrativo"] = $false }

# IIS
$site = Get-Website -Name $SiteName -ErrorAction SilentlyContinue
if ($site -and $site.State -eq "Started"){ $checks["IIS instalado e ativo"] = $true }

# Pool
if (Get-IISAppPool -Name "WebdevAppPool" -ErrorAction SilentlyContinue){ $checks["Pool WebdevAppPool existe"] = $true }

# AWP
if ($awpExe -and (Test-Path $awpExe)){ $checks["WDxxawp.exe localizado"] = $true }

# Handlers (.awp)
$hAwp = Get-WebConfiguration "system.webServer/handlers/add[@path='*.awp']" -PSPath "IIS:\Sites\$SiteName" -ErrorAction SilentlyContinue
$hAwws = Get-WebConfiguration "system.webServer/handlers/add[@path='*.awws']" -PSPath "IIS:\Sites\$SiteName" -ErrorAction SilentlyContinue
$hWb = Get-WebConfiguration "system.webServer/handlers/add[@path='*.wb']" -PSPath "IIS:\Sites\$SiteName" -ErrorAction SilentlyContinue
if ($hAwp -and $hAwws -and $hWb){ $checks["Handlers .awp/.awws/.wb"] = $true }

# ISAPI
$isapi = Get-WebConfiguration "system.webServer/security/isapiCgiRestriction/add[@path='$awpExe']" -ErrorAction SilentlyContinue
if ($isapi){ $checks["ISAPI liberado p/ AWP"] = $true }

# Porta 80
try { $r = Invoke-WebRequest -Uri "http://localhost" -UseBasicParsing -TimeoutSec 5; if($r.StatusCode){ $checks["Porta 80 acessível"] = $true } } catch {}

# App
if ($AppName){
$app = Get-WebApplication -Site $SiteName -Name $AppName -ErrorAction SilentlyContinue
if ($app){ $checks["Aplicação virtual existe"] = $true
if (Test-Path $app.PhysicalPath){ $checks["Permissões wwwroot/app OK"] = $true }
}
}

# DISM
try {
& "$env:WINDIR\System32\dism.exe" /online /Get-CurrentEdition | Out-Null
if ($LASTEXITCODE -eq 0){ $checks["DISM funcional (opcional)"] = $true }
} catch {}

Write-Host ""
Write-Host "📊 DIAGNÓSTICO WAS/IIS"
Write-Host "----------------------"
$ok=0; $tot=$checks.Count
foreach($k in $checks.Keys){
$val = $checks[$k]
if ($val){ Write-Host ("[OK] {0}" -f $k) -ForegroundColor Green; $ok++ }
else { Write-Host ("[NOK] {0}" -f $k) -ForegroundColor Red }
}
$pct = [math]::Round(($ok/$tot)*100,2)
Write-Host ("Resumo: {0}/{1} = {2}%" -f $ok,$tot,$pct) -ForegroundColor Cyan
}

# =========================
# Fluxo principal
# =========================
try{
Must-BeLocalAdmin
Ensure-NotADUser

# Ajusta versões de caminho
$InstallPathC = $InstallPathC -replace '\{0\}', $WebdevVersion
$InstallPathD = $InstallPathD -replace '\{0\}', $WebdevVersion

Write-Log "Início da configuração WAS/IIS (v$WebdevVersion) — Site: $SiteName — Projeto: $ProjectName" "STEP"

if ($CreateLocalUser){
Ensure-LocalWebdevUser -User $LocalUser -Pass $LocalUserPassword -force:$Force
}

if ($ConfigureIIS){
Ensure-IIS
if ($CreateLocalUser){
Configure-AppPool -Pool "WebdevAppPool" -User $LocalUser -Pass $LocalUserPassword
} else {
Configure-AppPool -Pool "WebdevAppPool"
}
}

$awp = $null
if ($ConfigureWAS){
$awpFile = Get-AwpExe -ver $WebdevVersion
if (-not $awpFile){ throw "Não foi possível localizar WDxxawp.exe (verifique instalação do WebDev/WAS)" }
$awp = $awpFile.FullName
Write-Log "AWP detectado: $awp" "OK"
Configure-WebDevHandlers -awpExePath $awp
if ($CopyDllsToBin){ Copy-EngineDllsToAwpBin -awpFolder $awpFile.DirectoryName }
}

if ($OpenFirewall){ Ensure-Firewall }

if ($FixDism){ Ensure-DismWorks }

if ($CreateVirtualApp -and $ProjectName){
$userForPerms = ($CreateLocalUser) ? $LocalUser : "$env:USERNAME"
Ensure-VirtualApp -Name $ProjectName -User $userForPerms | Out-Null
iisreset | Out-Null
Test-Endpoints -AppName $ProjectName
} else {
Test-Endpoints
}

if ($RunDiagnostics){
if (-not $awp){ $awpFile = Get-AwpExe -ver $WebdevVersion; if($awpFile){ $awp=$awpFile.FullName } }
Invoke-WasIisDiagnostics -AppName $ProjectName -awpExe $awp
}

Write-Log ("Concluído em {0}s" -f [int](New-TimeSpan -Start $global:StartedAt -End (Get-Date)).TotalSeconds) "OK"
}
catch{
Write-Log "Falhou: $_" "ERROR"
throw
}

#requires -RunAsAdministrator
<#
.SYNOPSIS
Configuração COMPLETA do IIS + W.A.S. (WebDev Application Server) com diagnósticos e backup.
.DESCRIPTION
- Instala recursos do IIS necessários ao WebDev/WAS
- (Opcional) Cria usuário LOCAL dedicado e o coloca nos grupos Administrators e IIS_IUSRS
- Configura Application Pool, ISAPI/Handlers (.awp/.awws/.wb), permissões NTFS
- (Opcional) Faz correções para DISM funcionar quando exigido pelo WAS
- Cria Aplicação Virtual e testa URL
- Executa diagnóstico abrangente com resumo em % de prontidão
- Realiza backup da configuração do IIS e dos sites.

Baseado em experiências reais e tópicos do fórum PC SOFT (checklist, erros de Virtual Directory, handlers e DISM).
Autor: Adriano José Boller – PC SOFT Brasil | Versão 4.0
#>

# =========================
# Inicialização e utilitários
# =========================
$ErrorActionPreference = "Stop"
$VerbosePreference = "Continue"
$global:StartedAt = Get-Date
$LogDir = "C:\Logs"
if (!(Test-Path $LogDir)) { New-Item -Path $LogDir -ItemType Directory -Force | Out-Null }
$LogPath = Join-Path $LogDir ("WAS_IIS_{0}.log" -f (Get-Date -Format "yyyyMMdd_HHmmss"))

function Write-Log(\[string\]$msg, \[ValidateSet("INFO","WARN","ERROR","OK","STEP")\]$level="INFO"){
$stamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$line = "\[{0}\] \[{1}\] {2}" -f $stamp, $level, $msg
Write-Host $line
Add-Content -Path $LogPath -Value $line
}

function Confirm-Action(\[string\]$question){
$ans = Read-Host "$question (S/N)"
return ($ans -match '^(s|S|y|Y)$')
}

function Must-BeLocalAdmin {
$id = \[Security.Principal.WindowsIdentity\]::GetCurrent()
$pri = New-Object Security.Principal.WindowsPrincipal($id)
if (-not $pri.IsInRole(\[Security.Principal.WindowsBuiltInRole\]::Administrator)) {
Write-Log "Execute como Administrador." "ERROR"; throw "Necessário administrador local."
}
}

function Ensure-NotADUser {
$u = \[Security.Principal.WindowsIdentity\]::GetCurrent().Name
if ($u.Contains('\') -and -not $u.StartsWith($env:COMPUTERNAME+'\')) {
Write-Log "Usuário do AD detectado ($u). Use usuário LOCAL administrativo." "ERROR"
throw "Não execute com usuário do AD."
}
}

function Resolve-WebDevPaths {
param(\[string\]$ver, \[string\]$InstallPathC, \[string\]$InstallPathD)
$c = $InstallPathC -replace '(\{0\})', $ver
$d = $InstallPathD -replace '(\{0\})', $ver
$c = $c -replace 'WINDEV', 'WEBDEV'
$d = $d -replace 'WINDEV', 'WEBDEV'
$c2 = $InstallPathC -replace '(\{0\})', $ver
$candidates = @(
(Join-Path $c "Programs\Engine\Win64x86\AWP"),
(Join-Path $d "Programs\Engine\Win64x86\AWP"),
(Join-Path $c2 "Programs\Engine\Win64x86\AWP"),
(Join-Path $c "Programs\Engine\Win32\AWP"),
(Join-Path $d "Programs\Engine\Win32\AWP")
) | Get-Unique
foreach($p in $candidates){
if(Test-Path $p){ return $p }
}
return $null
}

function Get-AwpExe {
param(\[string\]$ver, \[string\]$InstallPathC, \[string\]$InstallPathD)
$awpFolder = Resolve-WebDevPaths -ver $ver -InstallPathC $InstallPathC -InstallPathD $InstallPathD
if (!$awpFolder) { return $null }
$files = Get-ChildItem -Path $awpFolder -Filter "WD*awp.exe" -ErrorAction SilentlyContinue | Sort-Object Name -Descending
return $files | Select-Object -First 1
}

# =========================
# Funções de Ação
# =========================

function Ensure-LocalWebdevUser {
param(\[string\]$User, \[SecureString\]$Pass, \[switch\]$force)
$exists = Get-LocalUser -Name $User -ErrorAction SilentlyContinue
if ($exists -and $force){
Write-Log "Removendo usuário existente $User" "WARN"
Remove-LocalUser -Name $User -ErrorAction SilentlyContinue
$exists = $null
}
if (!$exists){
if (-not $Pass){
$Pass = Read-Host -AsSecureString -Prompt "Senha para $User (mín. 8 chars)"
}
New-LocalUser -Name $User -Password $Pass -FullName "$User - WebDev Admin" -PasswordNeverExpires -UserMayNotChangePassword | Out-Null
Write-Log "Usuário criado: $User" "OK"
} else {
Write-Log "Usuário já existe: $User" "INFO"
}
foreach($grp in @("Administrators","IIS_IUSRS")){
try {
Add-LocalGroupMember -Group $grp -Member $User -ErrorAction SilentlyContinue
} catch {}
}
Write-Log "Usuário '$User' está nos grupos Administrators e IIS_IUSRS" "OK"
}

function Ensure-IIS {
param(\[string\]$SiteName)
Write-Log "Instalando recursos IIS..." "STEP"
$features = @(
"IIS-WebServerRole","IIS-WebServer","IIS-CommonHttpFeatures",
"IIS-HttpErrors","IIS-HttpRedirect",
"IIS-ApplicationDevelopment","IIS-NetFxExtensibility45","IIS-ASPNET45",
"IIS-ISAPIExtensions","IIS-ISAPIFilter",
"IIS-HealthAndDiagnostics","IIS-HttpLogging",
"IIS-Security","IIS-RequestFiltering",
"IIS-Performance",
"IIS-WebServerManagementTools","IIS-ManagementConsole",
"IIS-IIS6ManagementCompatibility","IIS-Metabase"
)
foreach($f in $features){
try {
Enable-WindowsOptionalFeature -Online -FeatureName $f -All -NoRestart -ErrorAction SilentlyContinue | Out-Null
} catch {}
}
Import-Module WebAdministration -ErrorAction SilentlyContinue
$site = Get-Website -Name $SiteName -ErrorAction SilentlyContinue
if (!$site) {
Write-Log "Criando site padrão '$SiteName'..." "INFO"
New-Website -Name $SiteName -Port 80 -PhysicalPath "C:\inetpub\wwwroot" | Out-Null
$site = Get-Website -Name $SiteName
}
if ($site.State -ne "Started") {
Write-Log "Iniciando site '$SiteName'..." "INFO"
Start-Website -Name $SiteName
}
Write-Log "Recursos IIS instalados e site '$SiteName' garantido." "OK"
}

function Configure-WAS {
param(\[string\]$WebdevVersion, \[string\]$ProjectName, \[string\]$SiteName, \[string\]$LocalUser, \[SecureString\]$LocalUserPassword, \[switch\]$Force, \[switch\]$CopyDllsToBin, \[string\]$InstallPathC, \[string\]$InstallPathD)

Write-Log "Configurando WAS para WebDev $WebdevVersion..." "STEP"

$awpExe = Get-AwpExe -ver $WebdevVersion -InstallPathC $InstallPathC -InstallPathD $InstallPathD
if (!$awpExe) {
Write-Log "WDxxAWP.exe não encontrado para WebDev $WebdevVersion. Verifique InstallPathC/D." "ERROR"
throw "WDxxAWP.exe não encontrado."
}
$awpExePath = $awpExe.FullName
$awpFolder = $awpExe.DirectoryName
Write-Log "WDxxAWP.exe encontrado em: $awpExePath" "INFO"

$appPoolName = "WebDevAppPool_{0}" -f $WebdevVersion
$appPool = Get-WebAppPoolState -Name $appPoolName -ErrorAction SilentlyContinue
if (!$appPool -or $Force) {
if ($appPool) { Remove-WebAppPool -Name $appPoolName }
Write-Log "Criando Application Pool '$appPoolName'..." "INFO"
New-WebAppPool -Name $appPoolName -Force | Out-Null
Set-ItemProperty IIS:\AppPools\$appPoolName -Name managedRuntimeVersion -Value "v4.0"
Set-ItemProperty IIS:\AppPools\$appPoolName -Name enable32BitAppOnWin64 -Value $true
Set-ItemProperty IIS:\AppPools\$appPoolName -Name processModel.identityType -Value "SpecificUser"
Set-ItemProperty IIS:\AppPools\$appPoolName -Name processModel.userName -Value $LocalUser
Set-ItemProperty IIS:\AppPools\$appPoolName -Name processModel.password -Value $LocalUserPassword
Write-Log "Application Pool '$appPoolName' criado e configurado." "OK"
} else {
Write-Log "Application Pool '$appPoolName' já existe." "INFO"
}
if ((Get-WebAppPoolState -Name $appPoolName).Value -ne "Started") {
Write-Log "Iniciando Application Pool '$appPoolName'..." "INFO"
Start-WebAppPool -Name $appPoolName
}

$handlers = @(
@{Name="AWP-ISAPI"; Path="*.awp"; Verb="*"; Modules="IsapiModule"; ScriptProcessor=$awpExePath; ResourceType="Unspecified"; AllowPathInfo=$true},
@{Name="AWWS-ISAPI"; Path="*.awws"; Verb="*"; Modules="IsapiModule"; ScriptProcessor=$awpExePath; ResourceType="Unspecified"; AllowPathInfo=$true},
@{Name="WB-ISAPI"; Path="*.wb"; Verb="*"; Modules="IsapiModule"; ScriptProcessor=$awpExePath; ResourceType="Unspecified"; AllowPathInfo=$true}
)
foreach($h in $handlers){
try {
Add-WebConfigurationProperty -PSPath "IIS:\Sites\$SiteName" -Filter "system.webServer/handlers" -Name "." -Value $h -ErrorAction SilentlyContinue
Write-Log "Handler '$($h.Name)' adicionado/verificado." "OK"
} catch {
Write-Log "Erro ao adicionar handler $($h.Name): $($_.Exception.Message)" "WARN"
}
}

Set-WebConfigurationProperty -PSPath "IIS:\" -Filter "system.webServer/security/isapiCgiRestriction" -Name "." -Value @{path=$awpExePath; allowed=$true; description="WebDev AWP Engine"} -ErrorAction SilentlyContinue
Write-Log "ISAPI-DLL para $awpExePath habilitado." "OK"

$folders = @(
$awpFolder,
"C:\inetpub\wwwroot",
"C:\PC SOFT\Shared"
)
foreach($f in $folders){
if (Test-Path $f) {
$acl = Get-Acl $f
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($LocalUser, "Modify", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl $f $acl
Write-Log "Permissões 'Modify' para '$LocalUser' na pasta '$f'." "OK"
} else {
Write-Log "Pasta '$f' não encontrada, pulando permissões." "WARN"
}
}

if ($CopyDllsToBin) {
Write-Log "Copiando DLLs do engine para $awpFolder..." "INFO"
$engineDlls = Get-ChildItem -Path (Join-Path $awpFolder "..\..") -Filter "*.dll" -Recurse -ErrorAction SilentlyContinue
foreach ($dll in $engineDlls) {
try {
Copy-Item -Path $dll.FullName -Destination $awpFolder -Force -ErrorAction SilentlyContinue
} catch {
Write-Log "Erro ao copiar $($dll.Name): $($_.Exception.Message)" "WARN"
}
}
Write-Log "Cópia de DLLs concluída." "OK"
}

Write-Log "Configuração WAS concluída." "OK"
}

function Create-VirtualApplication {
param(\[string\]$WebdevVersion, \[string\]$ProjectName, \[string\]$SiteName, \[string\]$LocalUser, \[switch\]$Force, \[string\]$InstallPathC, \[string\]$InstallPathD)

if ([string]::IsNullOrEmpty($ProjectName)) {
Write-Log "ProjectName é obrigatório para criar aplicação virtual." "ERROR"
throw "ProjectName é obrigatório."
}

Write-Log "Criando Aplicação Virtual para '$ProjectName'..." "STEP"

$awpExe = Get-AwpExe -ver $WebdevVersion -InstallPathC $InstallPathC -InstallPathD $InstallPathD
if (!$awpExe) {
Write-Log "WDxxAWP.exe não encontrado para WebDev $WebdevVersion." "ERROR"
throw "WDxxAWP.exe não encontrado."
}
$awpFolder = $awpExe.DirectoryName

$appPoolName = "WebDevAppPool_{0}" -f $WebdevVersion
$virtualPath = "/$ProjectName"
$physicalPath = Join-Path $awpFolder "Projects\$ProjectName"

if (!(Test-Path $physicalPath)) {
Write-Log "Caminho físico do projeto '$physicalPath' não encontrado." "ERROR"
throw "Caminho físico do projeto não encontrado."
}

$app = Get-WebApplication -Site $SiteName -Name $ProjectName -ErrorAction SilentlyContinue
if ($app -and $Force) {
Write-Log "Removendo aplicação virtual existente '$ProjectName'." "WARN"
Remove-WebApplication -Site $SiteName -Name $ProjectName
$app = $null
}

if (!$app) {
Write-Log "Criando aplicação virtual '$virtualPath' apontando para '$physicalPath'..." "INFO"
New-WebApplication -Name $ProjectName -Site $SiteName -PhysicalPath $physicalPath -ApplicationPool $appPoolName | Out-Null
Write-Log "Aplicação virtual '$ProjectName' criada." "OK"
} else {
Write-Log "Aplicação virtual '$ProjectName' já existe." "INFO"
}

Write-Log "Aplicação Virtual para '$ProjectName' configurada." "OK"
}

function Run-Diagnostics {
param(\[string\]$WebdevVersion, \[string\]$ProjectName, \[string\]$SiteName, \[string\]$LocalUser, \[string\]$InstallPathC, \[string\]$InstallPathD)

Write-Log "Iniciando diagnóstico..." "STEP"
$results = @{}
$totalChecks = 0
$passedChecks = 0

function Perform-Check(\[string\]$description, \[scriptblock\]$checkScript) {
$totalChecks++
Write-Log "Verificando: $description" "INFO"
try {
$result = Invoke-Command -ScriptBlock $checkScript
if ($result -eq $true) {
Write-Log "PASS: $description" "OK"
$passedChecks++
$results[$description] = "PASS"
} else {
Write-Log "FAIL: $description" "ERROR"
$results[$description] = "FAIL"
}
} catch {
Write-Log "ERRO ao verificar $description: $($_.Exception.Message)" "ERROR"
$results[$description] = "ERROR"
}
}

Perform-Check "IIS está instalado e rodando" {
(Get-Service W3SVC -ErrorAction SilentlyContinue).Status -eq "Running"
}

Perform-Check "Site '$SiteName' está rodando" {
(Get-Website -Name $SiteName -ErrorAction SilentlyContinue).State -eq "Started"
}

$appPoolName = "WebDevAppPool_{0}" -f $WebdevVersion
Perform-Check "Application Pool '$appPoolName' existe e está rodando" {
$pool = Get-WebAppPoolState -Name $appPoolName -ErrorAction SilentlyContinue
$pool -ne $null -and $pool.Value -eq "Started"
}

$awpExe = Get-AwpExe -ver $WebdevVersion -InstallPathC $InstallPathC -InstallPathD $InstallPathD
Perform-Check "WDxxAWP.exe encontrado" {
$awpExe -ne $null
}

$awpExePath = $awpExe.FullName
Perform-Check "Handlers .awp, .awws, .wb registrados" {
$handlersOk = $true
$handlerPaths = @("*.awp", "*.awws", "*.wb")
foreach ($hp in $handlerPaths) {
$h = Get-WebConfigurationProperty -PSPath "IIS:\Sites\$SiteName" -Filter "system.webServer/handlers" -Name "." | Where-Object {$_.Path -eq $hp -and $_.ScriptProcessor -eq $awpExePath}
if (!$h) { $handlersOk = $false; break }
}
$handlersOk
}

Perform-Check "ISAPI-DLL para WDxxAWP.exe habilitado" {
$isapiRestriction = Get-WebConfigurationProperty -PSPath "IIS:\" -Filter "system.webServer/security/isapiCgiRestriction" -Name "." | Where-Object {$_.path -eq $awpExePath -and $_.allowed -eq $true}
$isapiRestriction -ne $null
}

$awpFolder = $awpExe.DirectoryName
Perform-Check "Permissões 'Modify' para '$LocalUser' na pasta '$awpFolder'" {
if (Test-Path $awpFolder) {
$acl = Get-Acl $awpFolder
$ruleExists = $false
foreach ($access in $acl.Access) {
if ($access.IdentityReference.Value -eq $LocalUser -and $access.FileSystemRights -band \[System.Security.AccessControl.FileSystemRights\]::Modify) {
$ruleExists = $true; break
}
}
$ruleExists
} else { $false }
}

if (-not \[string\]::IsNullOrEmpty($ProjectName)) {
Perform-Check "Aplicação Virtual '/$ProjectName' existe e aponta corretamente" {
$app = Get-WebApplication -Site $SiteName -Name $ProjectName -ErrorAction SilentlyContinue
$app -ne $null -and $app.PhysicalPath -eq (Join-Path $awpFolder "Projects\$ProjectName")
}

Perform-Check "URL da aplicação virtual 'http://localhost/$ProjectName/' acessível" {
try {
$url = "http://localhost/$ProjectName/"
$response = Invoke-WebRequest -Uri $url -UseBasicParsing -ErrorAction Stop
$response.StatusCode -eq 200
} catch { $false }
}
}

Write-Log "\n--- Resumo do Diagnóstico ---" "INFO"
foreach ($key in $results.Keys) {
Write-Log "$key: $($results[$key])" "INFO"
}
$readiness = 0
if ($totalChecks -gt 0) {
$readiness = \[Math\]::Round(($passedChecks / $totalChecks) * 100)
}
Write-Log "Prontidão Geral: $passedChecks de $totalChecks verificações passaram ($readiness%)" "OK"
Write-Log "Diagnóstico concluído." "STEP"
}

function Fix-Dism {
Write-Log "Tentando corrigir acesso ao DISM..." "STEP"
try {
Set-Service TrustedInstaller -StartupType Manual -ErrorAction SilentlyContinue
Start-Service TrustedInstaller -ErrorAction SilentlyContinue
Write-Log "Serviço TrustedInstaller garantido." "OK"
} catch {
Write-Log "Erro ao garantir TrustedInstaller: $($_.Exception.Message)" "WARN"
}
Write-Log "Correção de DISM concluída (se aplicável)." "STEP"
}

function Open-FirewallPorts {
Write-Log "Abrindo portas de firewall (80, 443)..." "STEP"
$ports = @(80, 443)
foreach ($p in $ports) {
try {
New-NetFirewallRule -DisplayName "IIS Port $p" -Direction Inbound -LocalPort $p -Protocol TCP -Action Allow -ErrorAction SilentlyContinue | Out-Null
Write-Log "Porta $p aberta no firewall." "OK"
} catch {
Write-Log "Erro ao abrir porta $p: $($_.Exception.Message)" "WARN"
}
}
Write-Log "Configuração de firewall concluída." "STEP"
}

function Backup-IISConfiguration {
param(
\[string\]$BackupPath = "C:\IIS_Backup",
\[string\]$SiteName = "Default Web Site"
)

Write-Log "Iniciando backup da configuração do IIS..." "STEP"

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$currentBackupDir = Join-Path $BackupPath "IIS_Config_$timestamp"

if (!(Test-Path $currentBackupDir)) {
New-Item -Path $currentBackupDir -ItemType Directory -Force | Out-Null
Write-Log "Diretório de backup criado: $currentBackupDir" "OK"
} else {
Write-Log "Diretório de backup já existe: $currentBackupDir" "INFO"
}

try {
$appcmdPath = Join-Path $env:SystemRoot "System32\inetsrv\appcmd.exe"
if (Test-Path $appcmdPath) {
Write-Log "Executando backup da configuração do IIS com appcmd..." "INFO"
& $appcmdPath add backup "IIS_Config_$timestamp" | Out-Null
Write-Log "Backup da configuração do IIS concluído com appcmd. Nome: IIS_Config_$timestamp" "OK"

$appcmdBackupLocation = Join-Path $env:SystemRoot "System32\inetsrv\backup\IIS_Config_$timestamp"
if (Test-Path $appcmdBackupLocation) {
Copy-Item -Path $appcmdBackupLocation -Destination $currentBackupDir -Recurse -Force | Out-Null
Write-Log "Copiado backup do appcmd para $currentBackupDir" "OK"
}
}

Import-Module WebAdministration -ErrorAction SilentlyContinue
$sites = Get-Website -Name $SiteName -ErrorAction SilentlyContinue
if ($sites) {
foreach ($site in $sites) {
Write-Log "Processando site: $($site.Name)" "INFO"
$siteConfigPath = Join-Path $currentBackupDir "Sites\$($site.Name)"
if (!(Test-Path $siteConfigPath)) {
New-Item -Path $siteConfigPath -ItemType Directory -Force | Out-Null
}

$webConfig = Join-Path $site.PhysicalPath "web.config"
if (Test-Path $webConfig) {
Copy-Item -Path $webConfig -Destination $siteConfigPath -Force | Out-Null
Write-Log "Copiado web.config do site $($site.Name) para $siteConfigPath" "OK"
}

$applications = Get-WebApplication -Site $site.Name -ErrorAction SilentlyContinue
foreach ($app in $applications) {
Write-Log "Aplicação virtual: $($app.Path) -> $($app.PhysicalPath)" "INFO"
}
}
}

Write-Log "Backup da configuração do IIS concluído com sucesso em $currentBackupDir" "OK"
} catch {
Write-Log "Erro durante o backup da configuração do IIS: $($_.Exception.Message)" "ERROR"
}
}

# =========================
# Execução Principal
# =========================
function Main {
Must-BeLocalAdmin
Ensure-NotADUser

# Parâmetros
$WebdevVersion = "2025"
$ProjectName = ""
$SiteName = "Default Web Site"
$LocalUser = "WebdevAdmin"
$LocalUserPassword = $null
$InstallPathC = "C:\PC SOFT\WINDEV {0}" -f $WebdevVersion
$InstallPathD = "D:\PC SOFT\WINDEV {0}" -f $WebdevVersion
$Force = $false
$CopyDllsToBin = $false

while ($true) {
Write-Host "\nMenu de Configuração WAS/IIS"
Write-Host "1. Criar Usuário Local Dedicado"
Write-Host "2. Instalar e Configurar IIS"
Write-Host "3. Configurar WAS (WebDev Application Server)"
Write-Host "4. Criar Aplicação Virtual"
Write-Host "5. Executar Diagnóstico Completo"
Write-Host "6. Corrigir Acesso ao DISM"
Write-Host "7. Abrir Portas do Firewall (80, 443)"
Write-Host "8. Fazer Backup do IIS e Sites"
Write-Host "9. Executar Todas as Etapas (Exceto Backup e DISM)"
Write-Host "Q. Sair"

$choice = Read-Host "Escolha uma opção"

switch ($choice) {
"1" { Ensure-LocalWebdevUser -User $LocalUser -Pass $LocalUserPassword -force:$Force }
"2" { Ensure-IIS -SiteName $SiteName }
"3" { Configure-WAS -WebdevVersion $WebdevVersion -ProjectName $ProjectName -SiteName $SiteName -LocalUser $LocalUser -LocalUserPassword $LocalUserPassword -Force:$Force -CopyDllsToBin:$CopyDllsToBin -InstallPathC $InstallPathC -InstallPathD $InstallPathD }
"4" { Create-VirtualApplication -WebdevVersion $WebdevVersion -ProjectName $ProjectName -SiteName $SiteName -LocalUser $LocalUser -Force:$Force -InstallPathC $InstallPathC -InstallPathD $InstallPathD }
"5" { Run-Diagnostics -WebdevVersion $WebdevVersion -ProjectName $ProjectName -SiteName $SiteName -LocalUser $LocalUser -InstallPathC $InstallPathC -InstallPathD $InstallPathD }
"6" { Fix-Dism }
"7" { Open-FirewallPorts }
"8" { Backup-IISConfiguration -SiteName $SiteName }
"9" {
Ensure-LocalWebdevUser -User $LocalUser -Pass $LocalUserPassword -force:$Force
Ensure-IIS -SiteName $SiteName
Configure-WAS -WebdevVersion $WebdevVersion -ProjectName $ProjectName -SiteName $SiteName -LocalUser $LocalUser -LocalUserPassword $LocalUserPassword -Force:$Force -CopyDllsToBin:$CopyDllsToBin -InstallPathC $InstallPathC -InstallPathD $InstallPathD
Create-VirtualApplication -WebdevVersion $WebdevVersion -ProjectName $ProjectName -SiteName $SiteName -LocalUser $LocalUser -Force:$Force -InstallPathC $InstallPathC -InstallPathD $InstallPathD
Run-Diagnostics -WebdevVersion $WebdevVersion -ProjectName $ProjectName -SiteName $SiteName -LocalUser $LocalUser -InstallPathC $InstallPathC -InstallPathD $InstallPathD
Open-FirewallPorts
}
"q" { return }
default { Write-Host "Opção inválida." -ForegroundColor Red }
}
}
}

# Executa a função principal
Main

#requires -RunAsAdministrator
<#
.SYNOPSIS
WAS Orchestrator v5.0
.DESCRIPTION
Orquestrador completo para IIS (Msiis) e Webdev Application Server (W.A.S.).
Inclui instalação, hardening, diagnósticos, DR-Plan, Exporter Prometheus e SafeTest.
.AUTHOR
Adriano José Boller - PC SOFT Brasil
.VERSION
5.0
#>

function Write-Info { Write-Host "[INFO] $args" -ForegroundColor Cyan }
function Write-Success { Write-Host "[ OK ] $args" -ForegroundColor Green }
function Write-Warn { Write-Host "[WARN] $args" -ForegroundColor Yellow }
function Write-ErrorX { Write-Host "[FAIL] $args" -ForegroundColor Red }

# ==============================
# IIS Service Ops
# ==============================
function Start-IIS { try { Start-Service W3SVC; Write-Success "IIS iniciado." } catch { Write-ErrorX $_ } }
function Stop-IIS { try { Stop-Service W3SVC -Force; Write-Success "IIS parado." } catch { Write-ErrorX $_ } }

# ==============================
# WAS Service Ops
# ==============================
function Start-WAS { try { Get-Service | Where-Object { $_.Name -like "WD*AWP" } | Start-Service; Write-Success "WAS iniciado." } catch { Write-ErrorX $_ } }
function Stop-WAS { try { Get-Service | Where-Object { $_.Name -like "WD*AWP" } | Stop-Service -Force; Write-Success "WAS parado." } catch { Write-ErrorX $_ } }

# ==============================
# Safe Test Mode
# ==============================
function Invoke-SafeTest {
Write-Warn "Ativando SAFE TEST..."
$ports = @(4900,4901,4902,4910,4920)
foreach ($p in $ports) {
netsh advfirewall firewall add rule name="WAS SafeTest $p" dir=in action=allow protocol=TCP localport=$p
netsh advfirewall firewall add rule name="WAS SafeTest $p" dir=out action=allow protocol=TCP localport=$p
}
netsh advfirewall set allprofiles state off
Pause
Write-Info "Revertendo SafeTest..."
netsh advfirewall set allprofiles state on
foreach ($p in $ports) { netsh advfirewall firewall delete rule name="WAS SafeTest $p" }
Write-Success "SafeTest revertido."
}

# ==============================
# Hardening Max
# ==============================
function Invoke-HardeningMax {
Import-Module WebAdministration
$pool = "WebdevAppPool"
if (-not (Get-WebAppPoolState -Name $pool -ErrorAction SilentlyContinue)) {
New-WebAppPool -Name $pool
}
Set-ItemProperty "IIS:\AppPools\$pool" -Name managedRuntimeVersion -Value ""
Set-ItemProperty "IIS:\AppPools\$pool" -Name processModel.idleTimeout -Value ([TimeSpan]::Zero)
Set-ItemProperty "IIS:\AppPools\$pool" -Name recycling.periodicRestart.time -Value ([TimeSpan]::Zero)
Set-ItemProperty "IIS:\AppPools\$pool" -Name startMode -Value "AlwaysRunning"
Set-ItemProperty "IIS:\AppPools\$pool" -Name autoStart -Value $true
Write-Success "Hardening aplicado no pool $pool."
}

# ==============================
# Diagnósticos
# ==============================
function Invoke-WASDiagnostics {
Write-Info "Executando diagnósticos..."
$iis = Get-Service W3SVC -ErrorAction SilentlyContinue
if ($iis.Status -eq 'Running') { Write-Success "IIS ativo" } else { Write-ErrorX "IIS parado" }
$was = Get-Service | Where-Object { $_.Name -like "WD*AWP" }
foreach ($svc in $was) {
if ($svc.Status -eq 'Running') { Write-Success "WAS $($svc.Name) ativo" }
else { Write-ErrorX "WAS $($svc.Name) parado" }
}
Get-Website | ForEach-Object { Write-Info "Site: $($_.Name) - Estado: $($_.State)" }
}

# ==============================
# Integração com outros módulos
# ==============================
function Run-DRPlan {
& "$PSScriptRoot\DR-Plan.ps1"
}
function Run-ValidateInstall {
& "$PSScriptRoot\Validate-Install.ps1"
}
function Check-Exporter {
Get-Service | Where-Object { $_.Name -eq "WASExporter" } | ForEach-Object {
Write-Info "Exporter: $($_.Status)"
}
}

# ==============================
# Menu Principal
# ==============================
function Show-MainMenu {
Clear-Host
Write-Host "===============================" -ForegroundColor Magenta
Write-Host " WAS Orchestrator v5.0" -ForegroundColor Magenta
Write-Host "===============================" -ForegroundColor Magenta
Write-Host "1. Iniciar IIS"
Write-Host "2. Parar IIS"
Write-Host "3. Iniciar WAS"
Write-Host "4. Parar WAS"
Write-Host "5. Safe Test Mode"
Write-Host "6. Hardening Max"
Write-Host "7. Rodar Diagnósticos"
Write-Host "8. Executar DR-Plan"
Write-Host "9. Validar Integridade"
Write-Host "10. Status do Exporter"
Write-Host "0. Sair"
Write-Host "==============================="
$choice = Read-Host "Escolha uma opção"
switch ($choice) {
"1" { Start-IIS }
"2" { Stop-IIS }
"3" { Start-WAS }
"4" { Stop-WAS }
"5" { Invoke-SafeTest }
"6" { Invoke-HardeningMax }
"7" { Invoke-WASDiagnostics }
"8" { Run-DRPlan }
"9" { Run-ValidateInstall }
"10" { Check-Exporter }
"0" { exit }
default { Write-Warn "Opção inválida" }
}
Pause
Show-MainMenu
}

Show-MainMenu

#requires -RunAsAdministrator
<#
.SYNOPSIS
Metrics Exporter v5.0
.DESCRIPTION
Exporta métricas DO IIS/WAS/TLS No formato Prometheus.
Endpoint: http://localhost:4900/metrics
#>

Add-Type -AssemblyName System.Net.HttpListener

$listener = new-object System.Net.HttpListener
$prefix = "http://+:4900/metrics/"
$listener.Prefixes.Add($prefix)
$listener.Start()
Write-Host "[INFO] Exporter iniciado em $prefix" -ForegroundColor Cyan

FUNCTION Get-Metrics {
$metrics = @()

# IIS
try {
$iis = Get-Service W3SVC -ErrorAction STOP
$metrics += "was_iis_status " + $(IF ($iis.Status -eq 'Running') {1}ELSE{0})
} catch { $metrics += "was_iis_status 0" }

# WAS
try {
$was = Get-Service | WHERE-object { $_.Name -like "WD*AWP" }
foreach ($svc IN $was) {
$metrics += "was_service_status{name=`"$($svc.Name)`"} " + $(IF ($svc.Status -eq 'Running'){1}ELSE{0})
}
} catch { $metrics += "was_service_status{name=`"unknown`"} 0" }

# Sites
try {
Import-Module WebAdministration
$sites = Get-Website
$metrics += "was_sites_total " + $sites.Count
foreach ($s IN $sites) {
$val = IF ($s.State -eq "Started") {1}ELSE{0}
$metrics += "was_site_status{name=`"$($s.Name)`"} $val"
}
} catch { $metrics += "was_sites_total 0" }

# TLS Checks (Schannel)
$tls10 = (Get-ItemProperty -Path "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\Server" -ErrorAction SilentlyContinue)."Enabled"
$tls11 = (Get-ItemProperty -Path "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1\\Server" -ErrorAction SilentlyContinue)."Enabled"
$tls12 = (Get-ItemProperty -Path "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2\\Server" -ErrorAction SilentlyContinue)."Enabled"
$tls13 = (Get-ItemProperty -Path "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.3\\Server" -ErrorAction SilentlyContinue)."Enabled"

$metrics += "was_tls10_enabled " + $(IF ($tls10 -eq 1){1}ELSE{0})
$metrics += "was_tls11_enabled " + $(IF ($tls11 -eq 1){1}ELSE{0})
$metrics += "was_tls12_enabled " + $(IF ($tls12 -eq 1){1}ELSE{0})
$metrics += "was_tls13_enabled " + $(IF ($tls13 -eq 1){1}ELSE{0})

# HTTPS Bindings
try {
$httpsBindings = Get-WebBinding | WHERE-object {$_.protocol -eq "https"}
$metrics += "was_https_bindings_total " + $httpsBindings.Count
} catch { $metrics += "was_https_bindings_total 0" }

RETURN ($metrics -join "`n")
}

# LOOP HTTP
WHILE ($listener.IsListening) {
$context = $listener.GetContext()
$response = $context.Response
$buffer = [System.Text.Encoding]::UTF8.GetBytes((Get-Metrics))
$response.ContentLength64 = $buffer.Length
$response.ContentType = "text/plain"
$response.OutputStream.Write($buffer, 0, $buffer.Length)
$response.Close()
}

was_iis_status 1
was_service_status{name="WDAWP180"} 1
was_sites_total 3
was_site_status{name="Portal"} 1
was_tls12_enabled 1
was_tls13_enabled 1
was_https_bindings_total 2

#requires -RunAsAdministrator
<#
.SYNOPSIS
Metrics Exporter Service v5.0
.DESCRIPTION
Instala/gerencia o Metrics-Exporter.ps1 como serviço Windows.
.PARAMETER Action
Install | Uninstall | Start | STOP | Restart | Status
#>

param(
[Parameter(Mandatory=$true)]
[ValidateSet("Install","Uninstall","Start","Stop","Restart","Status")]
[string]$Action
)

$ServiceName = "WASExporter"
$DisplayName = "WAS Metrics Exporter Service"
$ExporterScript = Join-Path $PSScriptRoot "Metrics-Exporter.ps1"
$NssmPath = "C:\nssm\nssm.exe" # precisa DO NSSM (Non-Sucking Service Manager)

FUNCTION Install-Service {
IF (-not (Test-Path $NssmPath)) {
Write-Host "[FAIL] NSSM não encontrado em $NssmPath" -ForegroundColor Red
RETURN
}
& $NssmPath install $ServiceName "powershell.exe" "-ExecutionPolicy Bypass -File `"$ExporterScript`""
& $NssmPath set $ServiceName DisplayName "$DisplayName"
& $NssmPath set $ServiceName Start SERVICE_AUTO_START
Start-Service $ServiceName
Write-Host "[OK] Serviço $DisplayName instalado e iniciado." -ForegroundColor Green
}

FUNCTION Uninstall-Service {
IF (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue) {
STOP-Service $ServiceName -Force
& $NssmPath remove $ServiceName Confirm
Write-Host "[OK] Serviço $DisplayName removido." -ForegroundColor Green
} ELSE {
Write-Host "[WARN] Serviço não encontrado." -ForegroundColor Yellow
}
}

SWITCH ($Action) {
"Install" { Install-Service }
"Uninstall"{ Uninstall-Service }
"Start" { Start-Service $ServiceName; Write-Host "[OK] Serviço iniciado." -ForegroundColor Green }
"Stop" { STOP-Service $ServiceName -Force; Write-Host "[OK] Serviço parado." -ForegroundColor Green }
"Restart" { Restart-Service $ServiceName; Write-Host "[OK] Serviço reiniciado." -ForegroundColor Green }
"Status" { Get-Service $ServiceName }
}

.\Metrics-Exporter-Service.ps1 -Action Install

.\Metrics-Exporter-Service.ps1 -Action Status

.\Metrics-Exporter-Service.ps1 -Action STOP

.\Metrics-Exporter-Service.ps1 -Action Uninstall

#requires -RunAsAdministrator
<#
.SYNOPSIS
Metrics Exporter Wrapper v5.0
.DESCRIPTION
Watchdog para o Metrics-Exporter.ps1: garante 1 instância, abre firewall,
reinicia em caso de falha e grava logs.
.PARAMETER ExporterPath
Caminho DO Metrics-Exporter.ps1 (padrão: ao lado deste script).
.PARAMETER Port
Porta HTTP DO exporter (padrão 4900).
.PARAMETER LogPath
Caminho DO Log DO wrapper (padrão: C:\WAS\Logs\metrics-exporter-wrapper.log).
.PARAMETER RestartDelaySec
Tempo de espera antes de reiniciar após queda (padrão: 3s).
#>

param(
[string]$ExporterPath = (Join-Path $PSScriptRoot "Metrics-Exporter.ps1"),
[int]$Port = 4900,
[string]$LogPath = "C:\WAS\Logs\metrics-exporter-wrapper.log",
[int]$RestartDelaySec = 3
)

# --- util ---
FUNCTION Write-Log($msg,[string]$level="INFO"){
$ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$line = "[{0}] [{1}] {2}" -f $ts,$level,$msg
Write-Host $line
$dir = Split-Path $LogPath -Parent
IF (-not (Test-Path $dir)) { new-Item -ItemType Directory -Path $dir -Force | Out-Null }
Add-Content -Path $LogPath -Value $line
}

# --- 1) verificação de instância única (mutex) ---
$mutexName = "Global\WAS_MetricsExporter_Wrapper"
$created = $false
try {
$mutex = new-object System.Threading.Mutex($true, $mutexName, [ref]$created)
IF (-not $created) {
Write-Log "Já existe uma instância do wrapper em execução (mutex=$mutexName)." "WARN"
exit 0
}
} catch {
Write-Log "Falha criando mutex único: $($_.Exception.Message)" "FAIL"
exit 1
}

# --- 2) sanity checks ---
IF (-not (Test-Path $ExporterPath)) {
Write-Log "Metrics-Exporter não encontrado em: $ExporterPath" "FAIL"
exit 1
}

# --- 3) firewall rule para a porta ---
try {
$ruleName = "WAS Metrics Exporter (TCP $Port)"
$existing = netsh advfirewall firewall show rule name="$ruleName" | Out-string
IF ($existing -notmatch "Rule Name") {
Write-Log "Criando regra de firewall para porta $Port (in/out)."
netsh advfirewall firewall Add rule name="$ruleName" dir=IN action=allow protocol=TCP localport=$Port | Out-Null
netsh advfirewall firewall Add rule name="$ruleName" dir=out action=allow protocol=TCP localport=$Port | Out-Null
} ELSE {
Write-Log "Regra de firewall já existe: $ruleName"
}
} catch {
Write-Log "Falha ao configurar firewall: $($_.Exception.Message)" "WARN"
}

# --- 4) loop de execução/monitoramento ---
Write-Log "Iniciando watchdog. Exporter: $ExporterPath | Porta: $Port | Log: $LogPath"
WHILE ($true) {
try {
$psi = new-object System.Diagnostics.ProcessStartInfo
$psi.FileName = "powershell.exe"
$psi.Arguments = "-NoProfile -ExecutionPolicy Bypass -File `"$ExporterPath`""
$psi.RedirectStandardOutput = $true
$psi.RedirectStandardError = $true
$psi.UseShellExecute = $false
$psi.CreateNoWindow = $true

$proc = new-object System.Diagnostics.Process
$proc.StartInfo = $psi
[void]$proc.Start()
Write-Log "Exporter iniciado. PID=$($proc.Id)"

# leitura não bloqueante dos streams
$proc.BeginOutputReadLine()
$proc.BeginErrorReadLine()

# aguarda saída
$proc.WaitForExit()
$code = $proc.ExitCode
Write-Log "Exporter encerrou. ExitCode=$code" "WARN"
} catch {
Write-Log "Erro ao executar exporter: $($_.Exception.Message)" "FAIL"
}

Write-Log "Aguardando $RestartDelaySec s para reinício..."
Start-Sleep -Seconds $RestartDelaySec
}

C:\WAS\Bundle\Scripts\Metrics-Exporter-Wrapper.ps1 -ExporterPath "C:\WAS\Bundle\Scripts\Metrics-Exporter.ps1" -Port 4900

C:\WAS\Bundle\Scripts\Metrics-Exporter-Wrapper.ps1 -ExporterPath "C:\WAS\Bundle\Scripts\Metrics-Exporter.ps1" -Port 4901

#requires -RunAsAdministrator
<#
.SYNOPSIS
DR-Plan v5.0 – Executor de plano de contingência (YAML)
.DESCRIPTION
Aplica um plano de DR a partir de Profiles\DR-Plan.yaml (ou arquivo informado).
- Mantém site crítico ativo
- Opcionalmente para outros pools/sites
- Pode priorizar a porta 443 para o site crítico (removendo https dos demais)
- Sobe sites em ordem declarada
- Publica banner de contingência no portal
- Snapshot e rollback
.PARAMETER PlanFile
Caminho do YAML (padrão: C:\WAS\Bundle\Profiles\DR-Plan.yaml)
.PARAMETER Rollback
Reverte para o snapshot mais recente (em C:\WAS\Reports\DR-Snapshots\)
.PARAMETER PortalPath
Caminho do portal para publicar banner (padrão: C:\inetpub\WAS-AuditPortal)
.PARAMETER LogPath
Caminho do log (padrão: C:\WAS\Logs\dr-plan.log)
#>

param(
[string]$PlanFile = "C:\WAS\Bundle\Profiles\DR-Plan.yaml",
[switch]$Rollback,
[string]$PortalPath = "C:\inetpub\WAS-AuditPortal",
[string]$LogPath = "C:\WAS\Logs\dr-plan.log"
)

$ErrorActionPreference = "Stop"

function Write-Log($msg,[string]$level="INFO"){
$ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$line = "[{0}] [{1}] {2}" -f $ts,$level,$msg
Write-Host $line
$dir = Split-Path $LogPath -Parent
if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
Add-Content -Path $LogPath -Value $line
}

function Ensure-ModuleWebAdmin {
if (-not (Get-Module -ListAvailable -Name WebAdministration)) {
throw "Módulo WebAdministration não disponível. Instale o IIS Management Scripts and Tools."
}
Import-Module WebAdministration -ErrorAction Stop
}

function Parse-YamlBasic([string]$path){
# Parser mínimo para as chaves suportadas no plano
# Suporta:
# criticalSite: Nome
# stopOthers: true|false
# prioritize443: true|false
# order: (lista com '- item')
# banner: "texto"
$result = @{
criticalSite = ""
stopOthers = $false
prioritize443 = $false
order = @()
banner = ""
}
$lines = Get-Content $path
$inOrder = $false
foreach($ln in $lines){
$t = $ln.Trim()
if ($t -match "^\s*#") { continue }
if ($t -match "^\s*$") { continue }

if ($t -match "^\s*order\s*:\s*$"){ $inOrder = $true; continue }
if ($inOrder -and $t -match "^\s*-\s*(.+)$"){ $result.order += ($t -replace "^\s*-\s*","").Trim(); continue }
if ($t -match "^\s*[A-Za-z]+:") { $inOrder = $false }

if ($t -match "^\s*criticalSite\s*:\s*(.+)$"){ $result.criticalSite = $matches[1].Trim('"'); continue }
if ($t -match "^\s*stopOthers\s*:\s*(.+)$"){ $result.stopOthers = [bool]::Parse($matches[1]); continue }
if ($t -match "^\s*prioritize443\s*:\s*(.+)$"){ $result.prioritize443 = [bool]::Parse($matches[1]); continue }
if ($t -match "^\s*banner\s*:\s*\"(.+)\"$"){ $result.banner = $matches[1]; continue }
}
return $result
}

function Load-Plan([string]$file){
if (-not (Test-Path $file)) { throw "Plano não encontrado: $file" }
try {
if (Get-Command ConvertFrom-Yaml -ErrorAction SilentlyContinue) {
$obj = Get-Content $file -Raw | ConvertFrom-Yaml
# normaliza para hashtable
$plan = @{
criticalSite = "$($obj.criticalSite)"
stopOthers = [bool]$obj.stopOthers
prioritize443 = [bool]$obj.prioritize443
order = @()
banner = "$($obj.banner)"
}
if ($obj.order) { $plan.order = @($obj.order | ForEach-Object { "$_" }) }
return $plan
} else {
Write-Log "ConvertFrom-Yaml não disponível; usando parser básico." "WARN"
return (Parse-YamlBasic $file)
}
} catch {
throw "Falha ao carregar plano: $($_.Exception.Message)"
}
}

function Snapshot-State {
Ensure-ModuleWebAdmin
$snap = @{
timestamp = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
sites = @()
appPools = @()
httpsBinds = @()
}
$sites = Get-Website
foreach($s in $sites){
$snap.sites += @{
name = $s.Name
state = $s.State
}
}
$pools = Get-WebAppPoolState
foreach($p in $pools){
$snap.appPools += @{
name = $p.ItemName
state = $p.Value
}
}
foreach($s in $sites){
$b = Get-WebBinding -Name $s.Name -Protocol https -ErrorAction SilentlyContinue
if ($b) {
foreach($bi in @($b)){
$snap.httpsBinds += @{
site = $s.Name
bindingInformation = $bi.bindingInformation
}
}
}
}
$outDir = "C:\WAS\Reports\DR-Snapshots"
if (-not (Test-Path $outDir)) { New-Item -ItemType Directory -Path $outDir -Force | Out-Null }
$file = Join-Path $outDir ("snapshot-{0}.json" -f (Get-Date -Format "yyyyMMdd-HHmmss"))
$snap | ConvertTo-Json -Depth 5 | Out-File -FilePath $file -Encoding UTF8
Write-Log "Snapshot salvo: $file"
return $file
}

function Find-LastSnapshot {
$dir = "C:\WAS\Reports\DR-Snapshots"
if (-not (Test-Path $dir)) { return $null }
$files = Get-ChildItem $dir -Filter "snapshot-*.json" | Sort-Object LastWriteTime -Descending
if ($files.Count -gt 0) { return $files[0].FullName } else { return $null }
}

function Apply-Rollback([string]$snapshotFile){
Ensure-ModuleWebAdmin
if (-not (Test-Path $snapshotFile)) { throw "Snapshot não encontrado: $snapshotFile" }
$snap = Get-Content $snapshotFile -Raw | ConvertFrom-Json

# 1) Restaurar bindings https conforme snapshot (remove extras)
$currentSites = Get-Website
foreach($s in $currentSites){
# remove todos https atuais
Get-WebBinding -Name $s.Name -Protocol https -ErrorAction SilentlyContinue | ForEach-Object {
Remove-WebBinding -Name $s.Name -BindingInformation $_.bindingInformation -Protocol https -ErrorAction SilentlyContinue
}
}
# recria os do snapshot
foreach($hb in $snap.httpsBinds){
try {
New-WebBinding -Name $hb.site -Protocol https -BindingInformation $hb.bindingInformation -ErrorAction SilentlyContinue
} catch {
Write-Log "Falha ao restaurar binding $($hb.site) :: $($hb.bindingInformation) -> $($_.Exception.Message)" "WARN"
}
}

# 2) Restaurar estados de sites
foreach($s in $snap.sites){
try {
if ($s.state -eq "Started") { Start-Website -Name $s.name -ErrorAction SilentlyContinue }
else { Stop-Website -Name $s.name -ErrorAction SilentlyContinue }
} catch { Write-Log "Falha ao restaurar site $($s.name): $($_.Exception.Message)" "WARN" }
}

# 3) Restaurar estados de pools
foreach($p in $snap.appPools){
try {
if ($p.state -eq "Started") { Start-WebAppPool -Name $p.name -ErrorAction SilentlyContinue }
else { Stop-WebAppPool -Name $p.name -ErrorAction SilentlyContinue }
} catch { Write-Log "Falha ao restaurar pool $($p.name): $($_.Exception.Message)" "WARN" }
}

Write-Log "Rollback concluído a partir de: $snapshotFile" "OK"
}

function Publish-Banner([string]$portal,[string]$message){
if (-not $message -or $message.Trim().Length -eq 0) { return }
try {
if (-not (Test-Path $portal)) { New-Item -ItemType Directory -Path $portal -Force | Out-Null }
$bannerPath = Join-Path $portal "dr-banner.html"
$html = @"

"@
$html | Out-File -FilePath $bannerPath -Encoding UTF8
Write-Log "Banner publicado em: $bannerPath"
} catch {
Write-Log "Falha ao publicar banner: $($_.Exception.Message)" "WARN"
}
}

function Apply-Plan([hashtable]$plan){
Ensure-ModuleWebAdmin

if (-not $plan.criticalSite -or $plan.criticalSite.Trim().Length -eq 0) {
throw "criticalSite não definido no plano."
}

$snapshotFile = Snapshot-State

# 1) Start site crítico + seu pool
$critical = $plan.criticalSite
Write-Log "Iniciando site crítico: $critical"
$site = Get-Website -Name $critical -ErrorAction SilentlyContinue
if (-not $site) { throw "Site crítico não encontrado no IIS: $critical" }

$poolName = (Get-ItemProperty "IIS:\Sites\$critical").applicationPool
if ($poolName) {
try { Start-WebAppPool -Name $poolName -ErrorAction SilentlyContinue } catch {}
}
try { Start-Website -Name $critical -ErrorAction SilentlyContinue } catch {}

# 2) Stop outros pools/sites (opcional)
if ($plan.stopOthers) {
Write-Log "Parando pools/sites não críticos."
# pools
Get-WebAppPoolState | Where-Object { $_.ItemName -ne $poolName } | ForEach-Object {
try { Stop-WebAppPool -Name $_.ItemName -ErrorAction SilentlyContinue } catch {}
}
# sites
Get-Website | Where-Object { $_.Name -ne $critical } | ForEach-Object {
try { Stop-Website -Name $_.Name -ErrorAction SilentlyContinue } catch {}
}
}

# 3) Priorizar 443 para site crítico (opcional)
if ($plan.prioritize443) {
Write-Log "Priorizando 443 para $critical (removendo https dos demais)."
$allSites = Get-Website
foreach ($s in $allSites) {
if ($s.Name -ne $critical) {
Get-WebBinding -Name $s.Name -Protocol https -ErrorAction SilentlyContinue | ForEach-Object {
try { Remove-WebBinding -Name $s.Name -BindingInformation $_.bindingInformation -Protocol https -ErrorAction SilentlyContinue } catch {}
}
}
}
}

# 4) Start ordem adicional
if ($plan.order -and $plan.order.Count -gt 0) {
foreach($name in $plan.order){
if ($name -eq $critical) { continue }
try {
Start-Website -Name $name -ErrorAction SilentlyContinue
Write-Log "Site iniciado (order): $name"
} catch {
Write-Log "Falha ao iniciar site da ordem: $name -> $($_.Exception.Message)" "WARN"
}
}
}

# 5) Publicar banner
Publish-Banner -portal $PortalPath -message $plan.banner

Write-Log "Plano de DR aplicado com sucesso. Snapshot: $snapshotFile" "OK"
return $snapshotFile
}

# =======================
# Main
# =======================
try {
if ($Rollback) {
$last = Find-LastSnapshot
if (-not $last) {
Write-Log "Nenhum snapshot encontrado para rollback." "WARN"
exit 1
}
Apply-Rollback -snapshotFile $last
Write-Log "Rollback finalizado."
exit 0
}

$plan = Load-Plan -file $PlanFile
Write-Log "Plano carregado. criticalSite=$($plan.criticalSite); stopOthers=$($plan.stopOthers); prioritize443=$($plan.prioritize443); order=$(@($plan.order) -join ', ')"
$snap = Apply-Plan -plan $plan
Write-Log "DR-Plan concluído. Snapshot: $snap"
exit 0
}
catch {
Write-Log "ERRO: $($_.Exception.Message)" "FAIL"
exit 2
}