#  Script to be run as a scheduled task to move systems from one Webroot group to another
#  When run at a scheduled time, it can be used to do time based policy management
#  For example, at 9am, move systems into a restrictive group.  Then at 5pm, move systems into an open group

#------------------------------------------------------------------------------------------------------------------
#  Required Variables
#------------------------------------------------------------------------------------------------------------------

# API Credentials
$GsmKeycode = 'XXXX-XXXX-XXXX-XXXX-XXXX'
$WebrootUser = 'GSM Admin email address'
$WebrootPassword = 'GSM Admin password'
$APIClientID = 'API Client ID'
$APISecret = 'API Client Secret'

#  Site Name (Sites tab - Name)
$SelectedSite = 'Site Name'

# Webroot group to move from
$Webroot_Group1 = 'Group 2'

# Destination group 
$Webroot_Group2 = 'Group 1'

# Maximum number of systems in site - limits the query
$Max_Systems = 2000

# End of variable definitions
# Do not edit below this line
#------------------------------------------------------------------------------------------------------------------


function GetAuthToken {
#https://unityapi.webrootcloudav.com/Docs/APIDoc/PasswordAuthentication
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True)]
        [string]$client_id,
        [Parameter(Mandatory=$True)]
        [string]$client_secret,
        [string]$username,
        [string]$password,
        [string]$scope   
    )

    $url = 'https://unityapi.webrootcloudav.com/auth/token'
    $Body = @{username=$username;
              password=$password;
              grant_type='password';
              scope=$scope}

    $Auth = "$($client_id):$client_secret"
    $Bytes = [System.Text.Encoding]::ASCII.GetBytes($Auth)
    $Auth =[Convert]::ToBase64String($Bytes)

    try{
        Write-Verbose "Getting auth token."
        $Obj = Invoke-RestMethod -Method Post -Uri $url -Body $Body -ContentType "application/x-www-form-urlencoded" -Headers @{Authorization = "Basic $Auth"}
        $Obj | Add-Member -NotePropertyName 'client_id' -NotePropertyValue $client_id
        $Obj | Add-Member -NotePropertyName 'client_secret' -NotePropertyValue $client_secret
        $Obj | Add-Member -NotePropertyName 'expires' -NotePropertyValue (Get-Date).AddSeconds(295)
        $Obj | Add-Member -NotePropertyName 'Renewable' -NotePropertyValue (Get-Date).AddDays(14).AddSeconds(-5)
        $global:AuthToken = $Obj | Select * -ExcludeProperty 'expires_in'
        Write-Verbose 'Auth Token saved to $AuthToken'
    }
    catch{
        Write-Error "ERROR : Reference Status Codes: https://unityapi.webrootcloudav.com/Docs/APIDoc/Guide#guide-statusCodes `r`n $_"
    }
}

function Get-ConsoleGSMSiteList {
#https://unityapi.webrootcloudav.com/Docs/APIDoc/Api/GET-api-usage-site-keyCode_billingDate_continuation
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True)]
        $GSMKey
    )

    $url = "https://unityapi.webrootcloudav.com/service/api/console/gsm/$($GSMKey)/sites"
    
    try{
        Invoke-RestMethod -Method Get -Uri $url -ContentType "application/json" -Headers @{"Authorization" = "Bearer $($AuthToken.access_token)"}
    }
    catch{
        Write-Error "Error: $($Error[0])"
    }
    
}


function Get-ConsoleGSMSiteGroupList {
#https://unityapi.webrootcloudav.com/Docs/APIDoc/Api/GET-api-console-gsm-gsmKey-sites-siteId-groups
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True)]
        $GSMKey,
        [Parameter(Mandatory=$True)]
        $SiteID
    )

    $url = "https://unityapi.webrootcloudav.com/service/api/console/gsm/$($GSMKey)/sites/$($SiteID)/groups"
    
    try{
        $obj = Invoke-RestMethod -Method Get -Uri $url -ContentType "application/json" -Headers @{"Authorization" = "Bearer $($AuthToken.access_token)"}
        $obj.Groups
    }
    catch{
        Write-Error "Error: $($Error[0])"
    }
    
}

function Set-ConsoleGSMEndpointGroup {
#https://unityapi.webrootcloudav.com/Docs/APIDoc/Api/PUT-api-console-gsm-gsmKey-sites-siteId-endpoints
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True)]
        [string]$GSMKey,
        [Parameter(Mandatory=$True)]
        [string]$SiteID,
        [string]$EndpointsList,
        [string]$SourceGroupId,
        [Parameter(Mandatory=$True)]
        [string]$TargetGroupId,
        [ValidateSet("Unchanged","All","Update")] 
        [string]$Inheritance = "Unchanged"
    )

    $url = "https://unityapi.webrootcloudav.com/service/api/console/gsm/$($GSMKey)/sites/$($SiteID)/endpoints"

    # Forces inheritance to 1 (all) rather than accepting a value

    $Body = @{EndpointsList=$EndpointsList;
              SourceGroupId=$SourceGroupId;
              TargetGroupId=$TargetGroupId;
              Inheritance="1";}
    $Body = $Body | ConvertTo-Json

    try{
        Invoke-RestMethod -Method Put -Uri $url -ContentType "application/json" -Body $Body -Headers @{"Authorization" = "Bearer $($AuthToken.access_token)"}
    }
    catch{
        Write-Error "Error: $($Error[0])"
    }
    
}

function Get-ConsoleGSMGroupEndpointList {
#https://unityapi.webrootcloudav.com/Docs/APIDoc/Api/GET-api-console-gsm-gsmKey-sites-siteId-groups-groupId-endpoints_order_orderDirection_pageSize_pageNr
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True)]
        [string]$GSMKey,
        [Parameter(Mandatory=$True)]
        [string]$SiteId,
        [string]$groupId,
        [string]$order,
        [string]$orderDirection,
        [int]$pageSize,
        [int]$pageNr,
        [switch]$All        
    )

    $url = "https://unityapi.webrootcloudav.com/service/api/console/gsm/$($GSMKey)/sites/$($SiteId)/groups/$($groupId)/endpoints?order=$($order)&orderDirection=$($orderDirection)&pageSize=$($pageSize)&pageNr=$($pageNr)"
    
    try{
        $Obj = Invoke-RestMethod -Method Get -Uri $url -ContentType "application/json" -Headers @{"Authorization" = "Bearer $($AuthToken.access_token)"}
        $Obj.Endpoints
    }
    catch{
        Write-Error "Error: $($Error[0])"
    }
    
}



#------------------------------------------------------------------------------------------------------------------
# End of functions
#------------------------------------------------------------------------------------------------------------------

# Initialize $SystemsToMove
[string] $SystemsToMove = ''

# Authenticate 
GetAuthToken -client_id $APIClientID -client_secret $APISecret -username $WebrootUser -password $WebrootPassword -scope '*'

# Step through all site information and capture relevant SiteID
$WorkingSite = Get-ConsoleGSMSiteList -GSMKey $GsmKeycode

foreach ($SiteElement in $WorkingSite.sites)
{

    If($SiteElement.siteName -eq $SelectedSite)
	{
		$SiteInfo = $SiteElement.siteID
	}
}

# Get a list of groups for the site
$GroupList = Get-ConsoleGSMSiteGroupList -GSMKey $GsmKeycode -SiteID $SiteInfo


# Step through each group

foreach ($GroupElement in $GroupList)
{
    # If the site name matches the destination Webroot group
    if($GroupElement.GroupName -eq $Webroot_Group2)
    {
        # Identify the ID of the destination group
        $WebrootGroup2ID = $GroupElement.GroupID
    }

    # If the site name matches the origination Webroot group
    if($GroupElement.GroupName -eq $Webroot_Group1)
    {
        # Get the endpoints from the group

        $EndpointsFromGroup = Get-ConsoleGSMGroupEndpointList -GSMKey $GsmKeycode -SiteID $SiteInfo -groupId $GroupElement.GroupID

        foreach ($EndpointElement in $EndpointsFromGroup)
        {
            # Add a ", " if there is already values
            if( $SystemsToMove) 
            { 
                $SystemsToMove += ', '
            }
                    
            # Add the Endpoint ID to SystemsToMove
            $SystemsToMove += $EndpointElement.EndpointId
         }
    }
}

# If the group has systems
if($SystemsToMove)
{
   # Move the systems into the corresponding group
    Set-ConsoleGSMEndpointGroup -GSMKey $GsmKeycode -SiteID $SiteInfo -EndpointsList $SystemsToMove -TargetGroupId $WebrootGroup2ID -Inheritance "All"
}