# Script d'audit - Sarah v2024
Connect-PnPOnline -Url "https://assumax.sharepoint.com" -Interactive
Get-PnPSite -Includes HasUniqueRoleAssignments

# Recherche des modifications de permissions
Search-UnifiedAuditLog -StartDate 01/01/2021 -EndDate 01/08/2025 `
    -Operations PermissionLevelAdded,PermissionLevelModified `
    -RecordType SharePoint | Format-Table CreationDate,UserIds,Operations

# Analyse des accès anormaux
Search-UnifiedAuditLog -StartDate 01/01/2024 -EndDate 01/08/2025 `
    -Operations FileAccessed,FileDownloaded `
    -FreeText "Dossiers-Clients" | 
    Group-Object UserId | Sort-Object Count -Descending | Select-Object -First 20

# Détection des accès suspects par employé
$SuspiciousUsers = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate `
    -Operations FileAccessed | Where-Object {
        # Accès en dehors des heures de bureau
        $AccessTime = [DateTime]$_.CreationDate
        ($AccessTime.Hour -lt 7 -or $AccessTime.Hour -gt 19) -and 
        # Volume anormalement élevé
        $_.UserId -match "@assumax\.fr$"
    } | Group-Object UserId | Where-Object Count -gt 1000

Write-Host "ALERT: $($SuspiciousUsers.Count) employés avec accès suspects détectés" -ForegroundColor Red

# Audit des permissions avec le nouveau module PnP (auth par certificat)
Connect-PnPOnline -Url "https://assumax.sharepoint.com" -ClientId $ClientId -CertificatePath $CertPath

# Identifier tous les sites avec "Everyone except external users"
$Sites = Get-PnPTenantSite
$ProblematicSites = @()

foreach($Site in $Sites) {
    $SitePerms = Get-PnPSiteGroup -Site $Site.Url
    if($SitePerms -match "Everyone except external users") {
        $ProblematicSites += [PSCustomObject]@{
            SiteUrl = $Site.Url
            Title = $Site.Title  
            StorageUsed = $Site.StorageUsageCurrent
            LastModified = $Site.LastContentModifiedDate
        }
    }
}

Write-Host "DÉCOUVERTE: $($ProblematicSites.Count) sites avec permissions Everyone identifiés" -ForegroundColor Yellow

# Script d'urgence - Suppression des permissions Everyone
# Exécuté par l'équipe IT sous supervision de Sarah

$Sites = Get-PnPTenantSite | Where-Object Template -ne "SRCHCEN#0"

foreach($Site in $Sites) {
    try {
        Write-Host "Processing $($Site.Url)..." -ForegroundColor Yellow
        Connect-PnPOnline -Url $Site.Url -Interactive
        
        # Supprimer "Everyone except external users" 
        Remove-PnPGroup -Identity "Everyone except external users" -Force -ErrorAction SilentlyContinue
        
        # Vérifier et nettoyer les permissions héritées
        $Web = Get-PnPWeb -Includes RoleAssignments
        foreach($RoleAssignment in $Web.RoleAssignments) {
            if($RoleAssignment.Member.LoginName -match "everyone") {
                Remove-PnPUserFromGroup -LoginName $RoleAssignment.Member.LoginName -Identity "Members"
                Write-Host "REMOVED: Everyone permission from $($Site.Url)" -ForegroundColor Red
            }
        }
    }
    catch {
        Write-Host "ERROR on $($Site.Url): $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Script de reconstruction des permissions - Phase 2
# Architecture par principe du moindre privilège

# 1. Créer des groupes métiers spécifiques
New-PnPGroup -Title "Gestionnaires-Sante" -Description "Accès dossiers santé uniquement"
New-PnPGroup -Title "Experts-Sinistres" -Description "Accès expertises et photos"
New-PnPGroup -Title "Commerciaux-Contrats" -Description "Accès contrats entreprises"

# 2. Appliquer les permissions granulaires
Set-PnPList -Identity "Dossiers-Clients-Sante" -BreakRoleInheritance $true
Grant-PnPSiteDesignRights -Identity "Gestionnaires-Sante" -Rights Read,Write -List "Dossiers-Clients-Sante"

# 3. Audit automatisé quotidien
$AuditScript = @"
# Script d'audit quotidien - Post-crise
`$EveryoneGroups = Get-PnPSiteGroup | Where-Object Title -match "Everyone"
if(`$EveryoneGroups) {
    Send-MailMessage -To "sarah.dubois@assumax.fr" -Subject "ALERTE: Everyone group détecté" -Body "Groupe Everyone détecté: `$(`$EveryoneGroups.Title)"
}
"@

# Programmer l'exécution quotidienne via tâche planifiée

# Script de détection des permissions Everyone - Production 2025
function Get-EveryonePermissionsReport {
    param(
        [Parameter(Mandatory=$true)]
        [string]$TenantUrl,
        [string]$OutputPath = "C:\Audit\EveryoneReport.csv"
    )
    
    # Connexion avec authentification certificat (post-sept 2024)
    Connect-PnPOnline -Url $TenantUrl -ClientId $ClientId -CertificatePath $CertPath
    
    $Results = @()
    $Sites = Get-PnPTenantSite | Where-Object Template -ne "SRCHCEN#0"
    
    foreach($Site in $Sites) {
        Write-Progress "Audit en cours..." -Status $Site.Url -PercentComplete (($Results.Count / $Sites.Count) * 100)
        
        try {
            Connect-PnPOnline -Url $Site.Url -ClientId $ClientId -CertificatePath $CertPath
            
            # Vérifier permissions site
            $SiteGroups = Get-PnPSiteGroup
            $EveryoneGroups = $SiteGroups | Where-Object Title -match "Everyone"
            
            if($EveryoneGroups) {
                # Calculer le risque
                $Lists = Get-PnPList
                $TotalItems = ($Lists | Measure-Object ItemCount -Sum).Sum
                
                $Result = [PSCustomObject]@{
                    SiteUrl = $Site.Url
                    SiteTitle = $Site.Title
                    EveryoneGroups = ($EveryoneGroups.Title -join ";")
                    TotalItems = $TotalItems
                    StorageUsedGB = [Math]::Round($Site.StorageUsageCurrent/1024, 2)
                    LastModified = $Site.LastContentModifiedDate
                    RiskLevel = if($TotalItems -gt 10000) {"HIGH"} elseif($TotalItems -gt 1000) {"MEDIUM"} else {"LOW"}
                }
                $Results += $Result
                
                Write-Host "ALERTE: Permissions Everyone détectées sur $($Site.Url)" -ForegroundColor Red
            }
        }
        catch {
            Write-Warning "Erreur sur $($Site.Url): $($_.Exception.Message)"
        }
    }
    
    # Export et statistiques
    $Results | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
    
    Write-Host "`n=== RAPPORT D'AUDIT PERMISSIONS EVERYONE ===" -ForegroundColor Yellow
    Write-Host "Sites avec permissions Everyone: $($Results.Count)" -ForegroundColor Red
    Write-Host "Risque HIGH: $(($Results | Where-Object RiskLevel -eq 'HIGH').Count)" -ForegroundColor Red
    Write-Host "Éléments exposés total: $(($Results | Measure-Object TotalItems -Sum).Sum)" -ForegroundColor Red
    
    return $Results
}

# Utilisation
$AuditResults = Get-EveryonePermissionsReport -TenantUrl "https://assumax.sharepoint.com"

# Script de détection d'accès suspects - Inspiré cas Marc Dubois
function Get-SuspiciousAccessReport {
    param(
        [Parameter(Mandatory=$true)]
        [int]$DaysBack = 30,
        [int]$SuspiciousThreshold = 100
    )
    
    $StartDate = (Get-Date).AddDays(-$DaysBack)
    $EndDate = Get-Date
    
    # Recherche des accès aux fichiers SharePoint
    $AccessLogs = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate `
        -Operations FileAccessed,FileDownloaded,FileViewed `
        -RecordType SharePointFileOperation -ResultSize 5000
    
    # Analyse des patterns suspects
    $SuspiciousPatterns = $AccessLogs | ForEach-Object {
        $LogData = $_.AuditData | ConvertFrom-Json
        $AccessTime = [DateTime]$_.CreationDate
        
        [PSCustomObject]@{
            User = $LogData.UserId
            FileName = $LogData.SourceFileName
            SiteUrl = $LogData.SiteUrl
            AccessTime = $AccessTime
            IsAfterHours = ($AccessTime.Hour -lt 7 -or $AccessTime.Hour -gt 19)
            IsWeekend = ($AccessTime.DayOfWeek -eq "Saturday" -or $AccessTime.DayOfWeek -eq "Sunday")
            UserAgent = $LogData.UserAgent
            ClientIP = $LogData.ClientIP
        }
    }
    
    # Grouper par utilisateur et identifier les suspects
    $UserAnalysis = $SuspiciousPatterns | Group-Object User | ForEach-Object {
        $UserAccess = $_.Group
        $AfterHoursCount = ($UserAccess | Where-Object IsAfterHours).Count
        $WeekendCount = ($UserAccess | Where-Object IsWeekend).Count
        $UniqueFiles = ($UserAccess | Select-Object FileName -Unique).Count
        
        [PSCustomObject]@{
            User = $_.Name
            TotalAccess = $_.Count
            AfterHoursAccess = $AfterHoursCount
            WeekendAccess = $WeekendCount  
            UniqueFilesAccessed = $UniqueFiles
            SuspiciousScore = ($AfterHoursCount * 2) + ($WeekendCount * 3) + ($UniqueFiles * 0.1)
            IsSuspicious = (($AfterHoursCount -gt 50) -or ($WeekendCount -gt 20) -or ($UniqueFiles -gt $SuspiciousThreshold))
        }
    } | Sort-Object SuspiciousScore -Descending
    
    # Rapport des utilisateurs suspects
    $SuspiciousUsers = $UserAnalysis | Where-Object IsSuspicious
    
    Write-Host "`n=== RAPPORT ACCÈS SUSPECTS ===" -ForegroundColor Yellow
    Write-Host "Utilisateurs suspects identifiés: $($SuspiciousUsers.Count)" -ForegroundColor Red
    
    foreach($User in $SuspiciousUsers | Select-Object -First 10) {
        Write-Host "`n[SUSPECT] $($User.User)" -ForegroundColor Red
        Write-Host "  - Accès total: $($User.TotalAccess)"
        Write-Host "  - Après horaires: $($User.AfterHoursAccess)" -ForegroundColor Yellow
        Write-Host "  - Weekend: $($User.WeekendAccess)" -ForegroundColor Yellow  
        Write-Host "  - Fichiers uniques: $($User.UniqueFilesAccessed)"
        Write-Host "  - Score suspicion: $([Math]::Round($User.SuspiciousScore, 2))"
    }
    
    return $SuspiciousUsers
}

# Utilisation - Détection style "Marc Dubois"
$SuspiciousUsers = Get-SuspiciousAccessReport -DaysBack 90 -SuspiciousThreshold 200

# Script de correction d'urgence - Mode "Plan de crise AssuMax"
function Remove-EveryonePermissionsEmergency {
    param(
        [Parameter(Mandatory=$true)]
        [string]$TenantUrl,
        [switch]$WhatIf = $true
    )
    
    if(-not $WhatIf) {
        $Confirmation = Read-Host "ATTENTION: Suppression permissions Everyone sur TOUS les sites. Confirmer avec 'URGENT' (en majuscules)"
        if($Confirmation -ne "URGENT") {
            Write-Host "Opération annulée." -ForegroundColor Yellow
            return
        }
    }
    
    Connect-PnPOnline -Url $TenantUrl -ClientId $ClientId -CertificatePath $CertPath
    
    $Sites = Get-PnPTenantSite | Where-Object Template -ne "SRCHCEN#0"
    $Results = @()
    
    foreach($Site in $Sites) {
        Write-Progress "Correction permissions..." -Status $Site.Url -PercentComplete (($Results.Count / $Sites.Count) * 100)
        
        try {
            Connect-PnPOnline -Url $Site.Url -ClientId $ClientId -CertificatePath $CertPath
            
            # Identifier les groupes Everyone
            $EveryoneGroups = Get-PnPSiteGroup | Where-Object Title -match "Everyone"
            
            if($EveryoneGroups) {
                foreach($Group in $EveryoneGroups) {
                    if($WhatIf) {
                        Write-Host "[SIMULATION] Supprimerais groupe '$($Group.Title)' de $($Site.Url)" -ForegroundColor Yellow
                    } else {
                        # Suppression réelle
                        Remove-PnPGroup -Identity $Group.Title -Force
                        Write-Host "[CORRIGÉ] Groupe '$($Group.Title)' supprimé de $($Site.Url)" -ForegroundColor Green
                    }
                    
                    $Results += [PSCustomObject]@{
                        SiteUrl = $Site.Url
                        GroupRemoved = $Group.Title
                        Action = if($WhatIf) {"SIMULATION"} else {"SUPPRIMÉ"}
                        Timestamp = Get-Date
                    }
                }
            }
        }
        catch {
            Write-Warning "Erreur sur $($Site.Url): $($_.Exception.Message)"
        }
    }
    
    # Rapport final
    Write-Host "`n=== RAPPORT CORRECTION PERMISSIONS ===" -ForegroundColor Green
    Write-Host "Sites traités: $($Sites.Count)"
    Write-Host "Groupes Everyone supprimés: $($Results.Count)"
    
    if($WhatIf) {
        Write-Host "`nMode simulation activé. Aucune modification réelle." -ForegroundColor Yellow
        Write-Host "Relancez avec -WhatIf:`$false pour exécuter les corrections." -ForegroundColor Yellow
    }
    
    return $Results
}

# Test en mode simulation d'abord
$SimulationResults = Remove-EveryonePermissionsEmergency -TenantUrl "https://assumax.sharepoint.com" -WhatIf $true

# Exécution réelle en cas d'urgence (avec confirmation)
# $CorrectionResults = Remove-EveryonePermissionsEmergency -TenantUrl "https://assumax.sharepoint.com" -WhatIf $false