param(
    [Parameter(Mandatory)]
    [string]$SecretValue,
    [string]$OutputPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
)

$ErrorActionPreference = "Stop"

Add-Type -AssemblyName System.Security

$outputFullPath = [System.IO.Path]::GetFullPath($OutputPath)
$outputDirectory = Split-Path -Parent $outputFullPath
if (-not [string]::IsNullOrWhiteSpace($outputDirectory)) {
    New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
}

$secretBytes = [System.Text.Encoding]::UTF8.GetBytes($SecretValue)
$protectedBytes = [System.Security.Cryptography.ProtectedData]::Protect(
    $secretBytes,
    $null,
    [System.Security.Cryptography.DataProtectionScope]::LocalMachine
)

[System.IO.File]::WriteAllBytes($outputFullPath, $protectedBytes)
Write-Host "Protected secret written to $outputFullPath"