# Idempotent VM setup after install: test users, sshd access, console defaults.
# Users come from C:\Windows\Temp\cst-users.txt ("name<TAB>password", UTF-8), deleted afterwards.
$ErrorActionPreference = 'Stop'

$list = 'C:\Windows\Temp\cst-users.txt'
if (Test-Path $list) {
    foreach ($line in Get-Content -Path $list -Encoding UTF8) {
        $name, $pw = $line -split "`t", 2
        if (-not $name) { continue }
        $sec = ConvertTo-SecureString $pw -AsPlainText -Force
        if (Get-LocalUser -Name $name -ErrorAction SilentlyContinue) {
            Set-LocalUser -Name $name -Password $sec
        } else {
            New-LocalUser -Name $name -Password $sec -PasswordNeverExpires -AccountNeverExpires | Out-Null
        }
        foreach ($g in 'Users', 'OpenSSH Users') {
            Add-LocalGroupMember -Group $g -Member $name -ErrorAction SilentlyContinue
        }
        "user ok: $name"
    }
    Remove-Item -Force $list
}

# the built-in rule only covers the Private profile; QEMU user networking is Public
Set-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -Profile Any -Enabled True
Set-SConfig -AutoLaunch $false
New-Item -ItemType Directory -Force C:\cst-test | Out-Null
"provision ok"