{
  "properties": {
    "roleName": "Druva-Subscription-Provisioning-Role",
    "description": "Custom role containing baseline permissions required to provision Druva infrastructure components.",
    "assignableScopes": [
      "/subscriptions/00000000-0000-0000-0000-000000000000"
    ],
    "permissions": [
      {
        "actions": [           "Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/read",          "Microsoft.ManagedIdentity/userAssignedIdentities/write",
"Microsoft.ManagedIdentity/userAssignedIdentities/read",
          "Microsoft.Authorization/roleDefinitions/write",
          "Microsoft.Authorization/roleDefinitions/read",
          "Microsoft.Authorization/roleAssignments/write",
          "Microsoft.Authorization/roleAssignments/read",
          "Microsoft.KeyVault/vaults/read",
          "Microsoft.KeyVault/vaults/write"
        ],
        "notActions": [],
        "dataActions": [],
        "notDataActions": []
      }
    ]
  }
}

{

  "backupApp": {

    "tenantID": "00000000-0000-0000-0000-000000000000",

    "appID": "00000000-0000-0000-0000-000000000000",

    "servicePrincipalID": "00000000-0000-0000-0000-000000000000",

    "secretKeyID": "00000000-0000-0000-0000-000000000000",

    "secretExpiryTS": 1767225600

  },

  "druva": {

    "organizationID": 100001,

    "adminGroupID": 5001,

    "clientID": "your-druva-api-client-id"

  },

  "subscriptions": [

    {

      "subscriptionID": "00000000-0000-0000-0000-000000000000",

      "subscriptionName": "Production-Azure-Subscription",

      "resourceGroupName": "druva-rg-16567",

      "managedIdentityName": "druva-mi-16567",

      "primaryKVName": "druva-pkv-a1b2-16567",

      "secondaryKVName": "druva-skv-c3d4-16567",

      "azureDruvaKeyVaultPermissionsRole": {

        "azureRoleName": "druva-role-kv-16567",

        "azureRoleAssignName": "00000000-0000-0000-0000-000000000000"

      },

      "azureVMRole": {

        "azureRoleName": "druva-role-vm-16567",

        "azureRoleAssignName": "00000000-0000-0000-0000-000000000000"

      }

    }

  ]

}

<#
.SYNOPSIS
    Azure Manual Onboarding Script (PowerShell Edition)

.DESCRIPTION
    End-to-end automation for registering an Azure tenant and its subscriptions with 
    Druva's cloud connection service ("manual onboarding").
    
    Reads a druva_resources.json manifest, validates runtime and configuration, 
    discovers required Azure resources via Az PowerShell modules, obtains Druva OAuth tokens, 
    and registers connection and subscription manifests.

.PARAMETER ResourcesJson
    Path to the resources manifest JSON file. Defaults to 'druva_resources.json' in current dir.

.PARAMETER CredentialFile
    Optional path to a JSON file containing DRUVA_BKP_APP_SECRET and DRUVA_CLIENT_SECRET.

.PARAMETER AzureRetryCount
    Number of retries for Azure discovery calls. Defaults to 0 (no retries).

.PARAMETER DruvaRetryCount
    Number of retries for Druva REST API calls. Defaults to 0 (no retries).

.PARAMETER VerboseLogging
    Enables detailed DEBUG-level output and logging.

.EXAMPLE
    .\Start-AzureManualOnboarding.ps1
#>

[CmdletBinding()]
param (
    [Parameter(Mandatory = $false, Position = 0)]
    [Alias("ResourceJson")]
    [string]$ResourcesJson = "druva_resources.json",

    [Parameter(Mandatory = $false)]
    [string]$CredentialFile,

    [Parameter(Mandatory = $false)]
    [int]$AzureRetryCount = 0,

    [Parameter(Mandatory = $false)]
    [int]$DruvaRetryCount = 0,

    [Parameter(Mandatory = $false)]
    [switch]$VerboseLogging
)

# --- GLOBAL WARNING SUPPRESSION ---
$global:WarningPreference = 'SilentlyContinue'
$env:AZURE_CLIENTS_SHOW_BREAKING_CHANGE_WARNINGS = "false"

# --- CONFIGURATION & CONSTANTS ---
$DRUVA_BASE_URL        = "https://apis-us0.druva.com"
$DRUVA_OAUTH_TOKEN_URL = "https://apis-us0.druva.com/token"
$LOG_FILE              = "druva_onboarding.log"

$ENV_BKP_APP_SECRET = "DRUVA_BKP_APP_SECRET"
$ENV_CLIENT_SECRET  = "DRUVA_CLIENT_SECRET"

$MANDATORY_WORKLOAD_ROLE_KEY = "azureDruvaKeyVaultPermissionsRole"
$WORKLOAD_SPECIFIC_ROLE_KEYS = @("azureVMRole", "azureSQLRole", "azureBlobRole", "azureFSRole")
$WORKLOAD_ROLE_SPECS = @(
    @{ Key = "azureVMRole"; Label = "VM" },
    @{ Key = "azureSQLRole"; Label = "SQL" },
    @{ Key = "azureBlobRole"; Label = "Blob" },
    @{ Key = "azureFSRole"; Label = "FS" },
    @{ Key = "azureDruvaKeyVaultPermissionsRole"; Label = "Druva Key Vault Permissions" }
)

# --- LOGGING HELPER ---
function Write-Log {
    param (
        [string]$Message,
        [ValidateSet("INFO", "WARNING", "ERROR", "DEBUG", "RAW")]
        [string]$Level = "INFO"
    )
    
    if ($Level -eq "RAW") {
        Add-Content -Path $LOG_FILE -Value $Message -ErrorAction SilentlyContinue
        return
    }

    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logLine = "[$timestamp] [$Level] $Message"
    
    Add-Content -Path $LOG_FILE -Value $logLine -ErrorAction SilentlyContinue

    switch ($Level) {
        "INFO"    { Write-Host $Message -ForegroundColor Green }
        "WARNING" { Write-Host $Message -ForegroundColor Yellow }
        "ERROR"   { Write-Host $Message -ForegroundColor Red }
        "DEBUG"   { if ($VerboseLogging) { Write-Host "[DEBUG] $Message" -ForegroundColor DarkGray } }
    }
}

# --- RETRY WRAPPER ---
function Invoke-WithRetry {
    param (
        [scriptblock]$ScriptBlock,
        [int]$MaxRetries = 0,
        [int]$InitialDelaySec = 5,
        [string]$OperationName = "Operation"
    )

    $attempt = 0
    while ($true) {
        try {
            return &$ScriptBlock
        }
        catch {
            $statusCode = 0
            
            if ($_.Exception.Response) {
                if ($_.Exception.Response.StatusCode -is [int]) {
                    $statusCode = $_.Exception.Response.StatusCode
                } elseif ($_.Exception.Response.StatusCode.value__) {
                    $statusCode = $_.Exception.Response.StatusCode.value__
                }
            }

            if ($statusCode -eq 429) {
                Write-Log "$OperationName encountered HTTP 429 throttling. Halting retries." "ERROR"
                throw $_
            }

            if ($attempt -ge $MaxRetries) {
                if ($MaxRetries -gt 0) {
                    Write-Log "$OperationName failed after $attempt retries. Exiting." "ERROR"
                }
                throw $_
            }

            $attempt++
            $delay = $InitialDelaySec * [math]::Pow(2, $attempt - 1)
            Write-Log "  [Retry] $OperationName failed ($($_.Exception.Message)). Retrying in ${delay}s (Attempt $attempt/$MaxRetries)..." "WARNING"
            Start-Sleep -Seconds $delay
        }
    }
}

# --- PRE-FLIGHT VALIDATION ---
function Test-RuntimeEnvironment {
    param ([string]$ConfigPath)

    if (-not (Test-Path -Path $ConfigPath -PathType Leaf)) {
        throw "Config file not found: '$ConfigPath'. Ensure 'druva_resources.json' exists in current folder or specify -ResourcesJson."
    }

    $requiredModules = @('Az.Accounts', 'Az.Resources', 'Az.KeyVault', 'Az.ManagedServiceIdentity')
    foreach ($module in $requiredModules) {
        if (-not (Get-Module -ListAvailable -Name $module)) {
            throw "Missing required PowerShell module: $module. Please run: Install-Module -Name Az -Scope CurrentUser"
        }
    }
}

# --- SECRET PROMPTING ---
function Read-MaskedSecret {
    param ([string]$Prompt)
    $secure = Read-Host -Prompt $Prompt -AsSecureString
    $bstr   = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
    try {
        return [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr)
    }
    finally {
        [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
    }
}

function Get-OnboardingCredentials {
    param ([string]$CredFile)

    $bkpSecret = ""
    $clientSecret = ""

    if ($CredFile -and (Test-Path -Path $CredFile)) {
        $json = Get-Content -Path $CredFile -Raw | ConvertFrom-Json
        $bkpSecret = $json.DRUVA_BKP_APP_SECRET
        $clientSecret = $json.DRUVA_CLIENT_SECRET
        Write-Log "Loaded onboarding credentials from file: $CredFile"
        return @{ BkpSecret = $bkpSecret; ClientSecret = $clientSecret }
    }

    $envBkp = [Environment]::GetEnvironmentVariable($ENV_BKP_APP_SECRET)
    if ([string]::IsNullOrWhiteSpace($envBkp)) { $envBkp = $env:DRUVA_BKP_APP_SECRET }

    $envCli = [Environment]::GetEnvironmentVariable($ENV_CLIENT_SECRET)
    if ([string]::IsNullOrWhiteSpace($envCli)) { $envCli = $env:DRUVA_CLIENT_SECRET }

    if (-not [string]::IsNullOrWhiteSpace($envBkp)) {
        $bkpSecret = $envBkp
        Write-Log "Loaded Azure Backup App secret from environment variable '$ENV_BKP_APP_SECRET'." "INFO"
    }

    if (-not [string]::IsNullOrWhiteSpace($envCli)) {
        $clientSecret = $envCli
        Write-Log "Loaded Druva Client secret from environment variable '$ENV_CLIENT_SECRET'." "INFO"
    }

    if ([string]::IsNullOrWhiteSpace($bkpSecret) -or [string]::IsNullOrWhiteSpace($clientSecret)) {
        Write-Host "`n=================================================="
        Write-Host "          SECURITY CREDENTIAL PROMPTS"
        Write-Host "=================================================="
        
        if ([string]::IsNullOrWhiteSpace($bkpSecret)) {
            $bkpSecret = Read-MaskedSecret -Prompt "1. Enter Azure Backup App Secret"
        }
        if ([string]::IsNullOrWhiteSpace($clientSecret)) {
            $clientSecret = Read-MaskedSecret -Prompt "2. Enter Druva API Client Secret"
        }
        Write-Host "==================================================`n"
    }

    if ([string]::IsNullOrWhiteSpace($bkpSecret) -or [string]::IsNullOrWhiteSpace($clientSecret)) {
        throw "Both Backup App Secret and Druva Client Secret are required."
    }

    return @{ BkpSecret = $bkpSecret; ClientSecret = $clientSecret }
}

# --- CONFIG VALIDATION ---
function Assert-ValidConfig {
    param ($Config)

    if (-not $Config.backupApp -or -not $Config.druva -or -not $Config.subscriptions) {
        throw "resources.json missing required root keys (backupApp, druva, subscriptions)."
    }

    $bApp = $Config.backupApp
    if ($bApp.secretExpiryTS -le [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()) {
        throw "backupApp.secretExpiryTS is expired or in the past."
    }

    foreach ($sub in $Config.subscriptions) {
        if ($sub.primaryKVName.Trim().ToLower() -eq $sub.secondaryKVName.Trim().ToLower()) {
            throw "primaryKVName and secondaryKVName must be different for subscription '$($sub.subscriptionID)'."
        }

        if (-not $sub.$MANDATORY_WORKLOAD_ROLE_KEY) {
            throw "Subscription '$($sub.subscriptionID)' missing mandatory role block: $MANDATORY_WORKLOAD_ROLE_KEY"
        }

        $hasWorkload = $false
        foreach ($wkKey in $WORKLOAD_SPECIFIC_ROLE_KEYS) {
            if ($sub.$wkKey -and $sub.$wkKey.azureRoleName) { $hasWorkload = $true; break }
        }
        if (-not $hasWorkload) {
            throw "Subscription '$($sub.subscriptionID)' must specify at least one workload role ($($WORKLOAD_SPECIFIC_ROLE_KEYS -join ', '))."
        }
    }
    Write-Log "Configuration schema validation successful."
}

# --- AZURE DISCOVERY ---
function Discover-AzureResources {
    param (
        $Config,
        [string]$BkpAppSecret
    )

    Write-Log "Verifying Azure Backup App credentials..."
    $tenantId = [string]$Config.backupApp.tenantID
    $appId = [string]$Config.backupApp.appID
    $spId = [string]$Config.backupApp.servicePrincipalID

    $secSecret = ConvertTo-SecureString $BkpAppSecret -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential($appId, $secSecret)

    try { Set-AzConfig -DisplayBreakingChangeWarning $false -Scope Process -ErrorAction SilentlyContinue | Out-Null } catch {}

    Invoke-WithRetry -OperationName "Azure Authentication" -MaxRetries $AzureRetryCount -ScriptBlock {
        Connect-AzAccount -ServicePrincipal -Credential $credential -Tenant $tenantId -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null
    }
    Write-Log "Azure authentication successful using Backup App credentials."

    foreach ($sub in $Config.subscriptions) {
        $subId = [string]$sub.subscriptionID
        $rgName = [string]$sub.resourceGroupName
        Write-Log "--- Validating Subscription: $subId ---"

        Select-AzSubscription -SubscriptionId $subId -WarningAction SilentlyContinue | Out-Null

        # 1. Resource Group
        $rg = Invoke-WithRetry -OperationName "Get Resource Group" -MaxRetries $AzureRetryCount -ScriptBlock {
            Get-AzResourceGroup -Name $rgName -WarningAction SilentlyContinue -ErrorAction Stop
        }
        Write-Log "  Found Resource Group in $($rg.Location)"

        # 2. Key Vaults
        $pKv = Invoke-WithRetry -OperationName "Get Primary Key Vault" -MaxRetries $AzureRetryCount -ScriptBlock {
            Get-AzKeyVault -VaultName $sub.primaryKVName -ResourceGroupName $rgName -WarningAction SilentlyContinue -ErrorAction Stop
        }
        $sub | Add-Member -NotePropertyName "primaryKVURI" -NotePropertyValue ([string]$pKv.VaultUri) -Force
        $sub | Add-Member -NotePropertyName "primaryKVLocation" -NotePropertyValue ([string]$pKv.Location) -Force

        $sKv = Invoke-WithRetry -OperationName "Get Secondary Key Vault" -MaxRetries $AzureRetryCount -ScriptBlock {
            Get-AzKeyVault -VaultName $sub.secondaryKVName -ResourceGroupName $rgName -WarningAction SilentlyContinue -ErrorAction Stop
        }
        $sub | Add-Member -NotePropertyName "secondaryKVURI" -NotePropertyValue ([string]$sKv.VaultUri) -Force
        $sub | Add-Member -NotePropertyName "secondaryKVLocation" -NotePropertyValue ([string]$sKv.Location) -Force

        # 3. Managed Identity
        $mi = Invoke-WithRetry -OperationName "Get Managed Identity" -MaxRetries $AzureRetryCount -ScriptBlock {
            Get-AzUserAssignedIdentity -ResourceGroupName $rgName -Name $sub.managedIdentityName -WarningAction SilentlyContinue -ErrorAction Stop
        }
        $sub | Add-Member -NotePropertyName "managedIdentityID" -NotePropertyValue ([string]$mi.Id) -Force
        $sub | Add-Member -NotePropertyName "managedIdentityPrincipalID" -NotePropertyValue ([string]$mi.PrincipalId) -Force
        $sub | Add-Member -NotePropertyName "managedIdentityLocation" -NotePropertyValue ([string]$mi.Location) -Force

        # 4. Workload Roles Resolution
        foreach ($spec in $WORKLOAD_ROLE_SPECS) {
            $rKey = $spec.Key
            $rLabel = $spec.Label
            $roleObj = $sub.$rKey

            if ($null -eq $roleObj -or [string]::IsNullOrWhiteSpace($roleObj.azureRoleName)) { continue }

            $queryScope = if ($rKey -eq $MANDATORY_WORKLOAD_ROLE_KEY) { 
                "/subscriptions/$subId/resourceGroups/$rgName" 
            } else { 
                "/subscriptions/$subId" 
            }

            # Discover Role Definition
            $roleDef = Invoke-WithRetry -OperationName "Get Role Definition ($rLabel)" -MaxRetries $AzureRetryCount -ScriptBlock {
                Get-AzRoleDefinition -Name $roleObj.azureRoleName -Scope $queryScope -WarningAction SilentlyContinue -ErrorAction Stop
            }

            $rawRoleGuid = $roleDef.Id.Split('/')[-1]
            # Standard ARM Role Definition ID path (subscription-scoped for all roles)
            $fullRoleArmId = "/subscriptions/$subId/providers/Microsoft.Authorization/roleDefinitions/$rawRoleGuid"

            $roleObj | Add-Member -NotePropertyName "azureRoleDefinitionID" -NotePropertyValue ([string]$fullRoleArmId) -Force

            # Resolve Role Assignment if missing
            if ([string]::IsNullOrWhiteSpace($roleObj.azureRoleAssignName)) {
                $roleAssign = Invoke-WithRetry -OperationName "Find Role Assignment ($rLabel)" -MaxRetries $AzureRetryCount -ScriptBlock {
                    Get-AzRoleAssignment -ObjectId $spId -RoleDefinitionName $roleObj.azureRoleName -Scope $queryScope -WarningAction SilentlyContinue -ErrorAction Stop
                }
                if ($null -eq $roleAssign) {
                    throw "No $rLabel role assignment found for Backup App Principal '$spId' at scope '$queryScope'."
                }
                $roleObj | Add-Member -NotePropertyName "azureRoleAssignName" -NotePropertyValue ([string]$roleAssign.RoleAssignmentId.Split('/')[-1]) -Force
            }
        }
    }
}

# --- DRUVA API INTEGRATION ---
function Get-DruvaOAuthToken {
    param ($Config, [string]$DruvaClientSecret)

    Write-Log "Fetching OAuth access token for adminAccessToken..."
    $clientId = $Config.druva.clientID
    $pair = "${clientId}:${DruvaClientSecret}"
    $bytes = [System.Text.Encoding]::ASCII.GetBytes($pair)
    $base64 = [Convert]::ToBase64String($bytes)

    $headers = @{
        "Authorization" = "Basic $base64"
        "Content-Type"  = "application/x-www-form-urlencoded"
        "Accept"        = "application/json"
    }
    $body = "grant_type=client_credentials&scope=read"

    Write-Log "DRUVA API REQUEST [POST $DRUVA_OAUTH_TOKEN_URL] Body: $body" "INFO"

    $response = Invoke-WithRetry -OperationName "Druva OAuth Token" -MaxRetries $DruvaRetryCount -ScriptBlock {
        Invoke-RestMethod -Uri $DRUVA_OAUTH_TOKEN_URL -Method Post -Headers $headers -Body $body -ErrorAction Stop
    }

    $resJson = $response | ConvertTo-Json -Compress
    Write-Log "DRUVA API RESPONSE [POST $DRUVA_OAUTH_TOKEN_URL]: $resJson" "INFO"

    if (-not $response.access_token) {
        throw "OAuth response missing 'access_token'."
    }
    return $response.access_token
}

function Register-DruvaConnection {
    param ($Config, [string]$AdminAccessToken, [string]$BkpAppSecret)

    Write-Log "POSTing manual connection manifest to Druva..."
    $url = "$DRUVA_BASE_URL/unity/connectionsvc/v1/azure/manual/connections"
    
    $headers = @{
        "Authorization" = "Bearer $AdminAccessToken"
        "Content-Type"  = "application/json"
        "Accept"        = "application/json"
        "authEntities"  = "pType=org;pID=$($Config.druva.organizationID);sType=group;sID=$($Config.druva.adminGroupID)"
    }

    $bodyObj = @{
        microsoftTenantID           = [string]$Config.backupApp.tenantID
        backupAppID                 = [string]$Config.backupApp.appID
        backupAppSecret             = "[MASKED_SECRET]"
        backupAppSecretKeyID        = [string]$Config.backupApp.secretKeyID
        backupAppSecretExpiryTS     = [int64]$Config.backupApp.secretExpiryTS
        backupAppServicePrincipalID = [string]$Config.backupApp.servicePrincipalID
    }
    $bodyLogJson = $bodyObj | ConvertTo-Json -Compress
    Write-Log "DRUVA API REQUEST [POST $url] Payload: $bodyLogJson" "INFO"

    $bodyObj.backupAppSecret = [string]$BkpAppSecret
    $bodyJson = $bodyObj | ConvertTo-Json -Compress

    $response = Invoke-WithRetry -OperationName "Register Druva Connection" -MaxRetries $DruvaRetryCount -ScriptBlock {
        Invoke-RestMethod -Uri $url -Method Post -Headers $headers -Body $bodyJson -ErrorAction Stop
    }

    $resJson = $response | ConvertTo-Json -Compress
    Write-Log "DRUVA API RESPONSE [POST $url]: $resJson" "INFO"

    if (-not $response.connectionID) {
        throw "Connection registration response did not contain a valid 'connectionID'."
    }
    Write-Log "Druva Connection Created! ID: $($response.connectionID)"
    return $response.connectionID
}

function Register-DruvaSubscriptions {
    param ($Config, [string]$AdminAccessToken, [int]$ConnectionID)

    $tenantId = [string]$Config.backupApp.tenantID
    $url = "$DRUVA_BASE_URL/unity/connectionsvc/v1/azure/manual/$tenantId/subscriptions"
    
    $headers = @{
        "Authorization" = "Bearer $AdminAccessToken"
        "Content-Type"  = "application/json"
        "Accept"        = "application/json"
        "authEntities"  = "pType=org;pID=$($Config.druva.organizationID);sType=group;sID=$($Config.druva.adminGroupID)"
    }

    foreach ($sub in $Config.subscriptions) {
        Write-Log "Registering Subscription $($sub.subscriptionID) with Druva..."

        $subId     = [string]$sub.subscriptionID
        $pLocation = if ($sub.primaryKVLocation) { [string]$sub.primaryKVLocation } else { "" }
        $sLocation = if ($sub.secondaryKVLocation) { [string]$sub.secondaryKVLocation } else { "" }
        $miID      = if ($sub.managedIdentityID) { [string]$sub.managedIdentityID } else { "" }
        $miPrinID  = if ($sub.managedIdentityPrincipalID) { [string]$sub.managedIdentityPrincipalID } else { "" }
        $miLoc     = if ($sub.managedIdentityLocation) { [string]$sub.managedIdentityLocation } else { "" }

        $payloadDict = [ordered]@{
            connectionID                    = [int]$ConnectionID
            adminGroupID                    = [int]$Config.druva.adminGroupID
            adminAccessToken                = [string]$AdminAccessToken
            microsoftSubscriptionID         = [string]$sub.subscriptionID
            microsoftSubscriptionName       = [string]$sub.subscriptionName
            azureResourceGroupName          = [string]$sub.resourceGroupName
            azureManagedIdentityName        = [string]$sub.managedIdentityName
            azureManagedIdentityID          = [string]$miID
            azureManagedIdentityPrincipalID = [string]$miPrinID
            azureManagedIdentityLocation   = [string]$miLoc
            azurePrimaryKeyVaultURI         = [string]$sub.primaryKVName
            azurePrimaryKeyVaultLocation    = [string]$pLocation
            azureSecondaryKeyVaultURI       = [string]$sub.secondaryKVName
            azureSecondaryKeyVaultLocation  = [string]$sLocation
        }

        foreach ($spec in $WORKLOAD_ROLE_SPECS) {
            $rKey = $spec.Key
            $rLabel = $spec.Label
            
            $roleObj = $sub.PSObject.Properties[$rKey]?.Value

            if ($null -ne $roleObj -and -not [string]::IsNullOrWhiteSpace($roleObj.azureRoleName)) {
                # 1. Extract raw GUID suffix
                $rawVal = if ($roleObj.PSObject.Properties['azureRoleDefinitionID']?.Value) { 
                    [string]$roleObj.azureRoleDefinitionID 
                } else { 
                    [string]$roleObj.azureRoleName 
                }
                $roleGuid = $rawVal.Split('/')[-1]

                # 2. Standard ARM role definition path format expected by Azure & Druva
                $roleDefId = "/subscriptions/$subId/providers/Microsoft.Authorization/roleDefinitions/$roleGuid"

                $assignName = [string]$roleObj.azureRoleAssignName

                if ([string]::IsNullOrWhiteSpace($assignName)) {
                    throw "Workload role '$rLabel' assignment ID (azureRoleAssignName) is missing for subscription '$subId'."
                }

                $payloadDict[$rKey] = [ordered]@{
                    azureRoleName       = $roleDefId
                    azureRoleAssignName = $assignName
                }
            }
        }

        $jsonBody = $payloadDict | ConvertTo-Json -Depth 10 -Compress
        
        Write-Log "DRUVA API REQUEST [POST $url] Payload: $jsonBody" "INFO"

        $response = Invoke-WithRetry -OperationName "Register Subscription $($sub.subscriptionID)" -MaxRetries $DruvaRetryCount -ScriptBlock {
            try {
                Invoke-RestMethod -Uri $url -Method Post -Headers $headers -Body $jsonBody -ErrorAction Stop
            }
            catch {
                if ($_.ErrorDetails -and $_.ErrorDetails.Message) {
                    Write-Log "DRUVA API REJECTION RESPONSE [POST $url]: $($_.ErrorDetails.Message)" "ERROR"
                } elseif ($_.Exception.Message) {
                    Write-Log "DRUVA API EXCEPTION [POST $url]: $($_.Exception.Message)" "ERROR"
                }
                throw $_
            }
        }

        $resJson = $response | ConvertTo-Json -Compress
        Write-Log "DRUVA API RESPONSE [POST $url]: $resJson" "INFO"
        Write-Log "  SUCCESS: Subscription $($sub.subscriptionID) is now onboarded and authorized."
    }
}

# --- MAIN RUNTIME ---
function Main {
    Write-Log "`r`n`r`n====================================================================================================" "RAW"
    Write-Log "================================ NEW SCRIPT EXECUTION STARTED ====================================" "RAW"
    Write-Log "====================================================================================================`r`n" "RAW"

    try {
        Write-Log "=== STARTING AZURE MANUAL ONBOARDING VALIDATION ==="
        
        Test-RuntimeEnvironment -ConfigPath $ResourcesJson
        
        $configData = Get-Content -Path $ResourcesJson -Raw | ConvertFrom-Json
        Assert-ValidConfig -Config $configData
        
        $creds = Get-OnboardingCredentials -CredFile $CredentialFile
        
        # Phase A: Discovery
        Discover-AzureResources -Config $configData -BkpAppSecret $creds.BkpSecret
        
        # Phase B: Druva API Onboarding
        $adminToken = Get-DruvaOAuthToken -Config $configData -DruvaClientSecret $creds.ClientSecret
        $connId = Register-DruvaConnection -Config $configData -AdminAccessToken $adminToken -BkpAppSecret $creds.BkpSecret
        Register-DruvaSubscriptions -Config $configData -AdminAccessToken $adminToken -ConnectionID $connId

        Write-Host "`n=================================================="
        Write-Log "=== ALL OPERATIONS COMPLETED SUCCESSFULLY ===" "INFO"
        Write-Host "==================================================`n"

        Write-Log "`r`n================================ EXECUTION COMPLETED SUCCESSFULLY ================================`r`n`r`n" "RAW"
    }
    catch {
        Write-Log "!!! CRITICAL FAILURE !!!" "ERROR"
        Write-Log "Details: $($_.Exception.Message)" "ERROR"
        Write-Log "Please check $LOG_FILE for full debug information." "INFO"
        
        Write-Log "`r`n================================ EXECUTION FAILED WITH ERRORS ====================================`r`n`r`n" "RAW"
        exit 1
    }
}

# Entrypoint execution
Main