Suspend Users By Last Successful Authentication

function Suspend-InactiveUsers{
    ... # function contents
}
Connect-JCOnline -JumpCloudApiKey:("jsdaf892370asdfkljfdaslkjjsdaf892370asdf")
Get-JcLoginEvent -CsvPath:("~/suspension/authnticationTimestamps.csv") -StartDate((Get-Date).AddDays(-30))
Suspend-InactiveUsers -CsvPath:("~/suspension/authnticationTimestamps.csv") -DaysSinceLogin:(30) -ExcludeAttribute:('serviceAccount')

$users = Get-JCsdkUser
foreach ($user in $users) {
    $output = Set-JcSdkUser -id $user.Id -State "ACTIVATED"
}

function Get-JcLoginEvent {
    [CmdletBinding()]
    param (
        [Parameter(HelpMessage = "Set to true to print the number of users who would have been suspend, this will not suspend users")]
        [switch]
        $ReadOnly,
        [Parameter(Mandatory = $true, HelpMessage = "Path to the CSV file. If no such CSV file exists, it will be created. If the CSV file does exist, it will be updated.")]
        [string]
        $CsvPath,
        [Parameter(Mandatory = $true, HelpMessage = "The DateTime value to begin filtering between. ex. (Get-Date.AddDays(-30)) ")]
        [datetime]
        $StartDate,
        [Parameter(Mandatory = $false, HelpMessage = "The DateTime value to end filtering between. Default: Get-Date (current date). ex. (Get-Date.AddDays(-30)) ")]
        [datetime]
        $EndDate
    )
    begin {

        # Write date of last execution to a file
        # $CsvDirectory = Split-Path $CsvPath
        if ( [System.String]::IsNullOrEmpty($EndDate) ) {
            $EndDate = Get-Date
        }
        # New-Item -Path $CsvDirectory -Name "jc-login-suspend-last-run.txt" -Value $EndDate -Force

        # Check if CSV exists. If it does not, create an empty one.
        If (Test-Path -Path $CsvPath -PathType Leaf) {
            Write-Debug "File found at location: $($CsvPath)."
        } Else {
            Write-Debug "No file found at location: $($CsvPath). Creating file."
            [System.Collections.ArrayList]$CsvData = @()
        }

        $users = Get-JCUser -returnProperties username

        # $DaysPerSpan = .5
        # $Span = New-TimeSpan -Start $StartDate -End $EndDate

        # $Spans = @()
        # for ($i = 0; $i -lt $Span.Days; $i += ($DaysPerSpan)) {
        #     $LoopStart = ($StartDate).AddDays($i)
        #     $LoopEnd = ($StartDate).AddDays($i + $DaysPerSpan)
        #     If ($LoopEnd -gt $EndDate) {
        #         $LoopEnd = $EndDate
        #     }
        #     $Spans += New-Object psobject -Property @{StartDate = $LoopStart; EndDate = $LoopEnd }
        # }
        # Write-Debug "$($Spans.Count) day interval(s) will be queried"
    }
    process {
        # Gather Directory Insights Data
        $EventTypes = (
            "radius_auth_attempt",
            "sso_auth",
            "login_attempt",
            "user_login_attempt"
        )
        $FilterFields = @(
            "success",
            "initiated_by",
            "event_type",
            "timestamp"
            "sso_token_success"
        )
        Write-Debug "Collecting Directory Insights data for the following event types: $($EventTypes). This may take a moment."
        #$DirectoryInsightsData = Get-JcSdkEvent -Service all -StartTime $StartDate -SearchTermOr @{ "event_type" = $EventTypes }

        $resultsArrayList = [System.Collections.Concurrent.ConcurrentBag[object]]::new()
        $stopwatch = [system.diagnostics.stopwatch]::StartNew()
        ### Systems START
        $systemsJob = $users | Foreach-Object -ThrottleLimit 5 -Parallel {
            $resultsArrayList = $using:resultsArrayList
            $response = Get-JcSdkEvent -Service systems -StartTime $using:StartDate -EndTime $using:EndDate -SearchTermAnd @{"event_type" = $using:EventTypes; "username" = $_.username } -Fields $using:FilterFields -ErrorAction Ignore
            # Write-Host "Searching $($_.username) | start: ($($using:StartDate)) end: ($($using:EndDate))"
            if ($response) {
                # normalize the date time formats
                $response | ForEach-Object { $_.timestamp = Get-Date "$($_.timestamp)" }
                $sortedResponse = $response | Sort-Object -property timestamp -Descending
                foreach ($res in $sortedResponse) {
                    If ($res.success -eq "True") {
                        $resultsArrayList.Add($res)
                        break
                    }
                }
            }
        } -AsJob
        ### SYSTEMS END
        ### SSO START
        # $resultsArrayList = [System.Collections.Concurrent.ConcurrentBag[object]]::new()
        $ssoJob = $users | Foreach-Object -ThrottleLimit 5 -Parallel {
            $resultsArrayList = $using:resultsArrayList
            $response = Get-JcSdkEvent -Service sso -StartTime $using:StartDate -EndTime $using:EndDate -SearchTermAnd @{"event_type" = $using:EventTypes; "initiated_by.username" = $_.username } -Fields $using:FilterFields -ErrorAction Ignore
            # Write-Host "Searching $($_.username) | start: ($($using:StartDate)) end: ($($using:EndDate))"
            if ($response) {
                # normalize the date time formats
                $response | ForEach-Object { $_.timestamp = Get-Date "$($_.timestamp)" }
                $sortedResponse = $response | Sort-Object -property timestamp -Descending
                foreach ($res in $sortedResponse) {
                    If ($res.sso_token_success -eq 'True') {
                        $resultsArrayList.Add($res)
                        break
                    }
                }
            }
        } -AsJob
        ### SSO END
        ### Directory
        # $resultsArrayList = [System.Collections.Concurrent.ConcurrentBag[object]]::new()
        $directoryJob = $users | Foreach-Object -ThrottleLimit 5 -Parallel {
            $resultsArrayList = $using:resultsArrayList
            $response = Get-JcSdkEvent -Service directory -StartTime $using:StartDate -EndTime $using:EndDate -SearchTermAnd @{"event_type" = $using:EventTypes; "initiated_by.username" = $_.username } -Fields $using:FilterFields -ErrorAction Ignore
            # Write-Host "Searching $($_.username) | start: ($($using:StartDate)) end: ($($using:EndDate))"
            if ($response) {
                # normalize the date time formats
                $response | ForEach-Object { $_.timestamp = Get-Date "$($_.timestamp)" }
                $sortedResponse = $response | Sort-Object -property timestamp -Descending
                foreach ($res in $sortedResponse) {
                    If ($res.success -eq "True") {
                        $resultsArrayList.Add($res)
                        break
                    }
                }
            }
        } -AsJob
        ### DIRECTORY END
        ### RADIUS
        # $resultsArrayList = [System.Collections.Concurrent.ConcurrentBag[object]]::new()
        $RadiusJob = $users | Foreach-Object -ThrottleLimit 5 -Parallel {
            $resultsArrayList = $using:resultsArrayList
            $response = Get-JcSdkEvent -Service radius -StartTime $using:StartDate -EndTime $using:EndDate -SearchTermAnd @{"event_type" = $using:EventTypes; "initiated_by.username" = $_.username } -Fields $using:FilterFields -ErrorAction Ignore
            # Write-Host "Searching $($_.username) | start: ($($using:StartDate)) end: ($($using:EndDate))"
            if ($response) {
                # normalize the date time formats
                $response | ForEach-Object { $_.timestamp = Get-Date "$($_.timestamp)" }
                $sortedResponse = $response | Sort-Object -property timestamp -Descending
                foreach ($res in $sortedResponse) {
                    If ($res.success -eq "True") {
                        $resultsArrayList.Add($res)
                        break
                    }
                }
            }
        } -AsJob
        ### RADIUS END
        $systemsJob | Receive-Job -Wait
        $ssoJob | Receive-Job -Wait
        $directoryJob | Receive-Job -Wait
        $RadiusJob | Receive-Job -Wait
        $stopwatch.Stop()
        $totalSecs = [math]::Round($stopwatch.Elapsed.TotalSeconds, 0)
        Write-host "Events Data query took $totalSecs seconds to run"

        foreach ($user in $users) {
            $latestEventByUser = $resultsArrayList | Where-Object { $_.initiated_by.username -eq $user.Username } | Sort-Object -property timestamp -Descending | Select-Object -First 1
            if ($latestEventByUser) {
                # if new user to the csv
                $CsvData.Add(
                    [PSCustomObject]@{
                        id        = $user._id;
                        username  = $latestEventByUser.initiated_by.username;
                        timestamp = $latestEventByUser.timestamp
                    }
                ) | Out-Null
            } else {
                $CsvData.Add(
                    [PSCustomObject]@{
                        id        = $user._id;
                        username  = $user.Username;
                        timestamp = "NA"
                    }
                ) | Out-Null
            }
        }

    }
    end {
        if ( $ReadOnly ) {
            $CsvData
        } else {
            $CsvData | ConvertTo-CSV | Out-File -FilePath $CsvPath -Force
        }
    }
}

function Suspend-InactiveUsers
{
    [CmdletBinding()]
    param (
        [Parameter(HelpMessage = "Set to true to print the number of users who would have been suspend, this will not suspend users")]
        [switch]
        $ReadOnly = $false,
        [Parameter(Mandatory = $true, HelpMessage = "Path to the CSV file. If no such CSV file exists, it will be created. If the CSV file does exist, it will be updated.")]
        [string]
        $CsvPath,
        [Parameter(HelpMessage = "Custom Attribute to Filter against, if the value of this custom attribute is true, this user will be excluded from suspension")]
        [string]
        $ExcludeAttribute,
        [Parameter(Mandatory = $true, HelpMessage = "The integer value to filter between the current date ex. (30) ")]
        [int]
        $DaysSinceLogin
    )
    begin
    {
        $SuspendedList = [System.Collections.ArrayList]@()
        $CsvDirectory = Split-Path $CsvPath
        $LastRunTimePath = $CsvDirectory + "/jc-login-suspend-last-run.txt"
        If ( Test-Path -Path $LastRunTimePath -PathType Leaf )
        {
            $LastRunTime = ( Get-Date ( Get-Content $LastRunTimePath ) )
            $SuspendDate = $LastRunTime.AddDays(-$DaysSinceLogin)
            Write-Debug "Searching for user's who's last known login time occured before: $SuspendDate"
        }
        else
        {
            Write-Error "ERROR: Unable to locate file at location: $($LastRunTimePath)."
        }

        # Check if CSV exists. If it does not, error out.
        If (Test-Path -Path $CsvPath -PathType Leaf)
        {
            Write-Debug "File found at location: $($CsvPath)."
            [System.Collections.ArrayList]$CsvData = Import-Csv -Path $CsvPath
        }
        Else
        {
            Write-Error "ERROR: Unable to locate CSV at location: $($CsvPath)."
        }

        $UserList = Get-JcSdkUser
        if ($ExcludeAttribute)
        {
            $exclusionUsers = @()
            foreach ($user in $UserList)
            {
                if ($user.Attributes | Where-Object { $_.Name -eq $ExcludeAttribute -and $_.Value -eq 'true' })
                {
                    # if user has custom attribute name w/ true value add it to the exclusion list.
                    $exclusionUsers += $user
                }
            }
            Write-Debug "Users found: $($UserList.count)"
            Write-Debug "Exclusion Users found: $($exclusionUsers.count)"
            $difference = $UserList | where-object { $_.username -notcontains $exclusionUsers.username }
            Write-Debug "Users w/o $ExcludeAttribute attribute found: $($difference.count)"
            # just set the users object to difference...
            $UserList = $difference
        }
    }
    process
    {
        ForEach ( $User in $CsvData )
        {
            # If the user has been deleted since the last run, remove them from the CSV
            If ( ($User.id -notin $UserList.id) -And ($User.id -notin $exclusionUsers.id ) )
            {
                Write-Debug "$($User.username) has been deleted. Removing from list."
                If (-not $ReadOnly)
                {
                    $CsvData.RemoveAt($CsvData.id.IndexOf($User.id))
                }
            }
            else
            {
                If ( ([datetime]$User.timestamp).ticks -lt $SuspendDate.ticks )
                {
                    Write-Debug "Suspending user: $($User.username). Last login: $($User.timestamp)."
                    $SuspendedUser = Get-JcSdkUser -Id $User.Id
                    $SuspendedList.Add([PSCustomObject]@{
                        Username      = $SuspendedUser.Username;
                        Firstname     = $SuspendedUser.Firstname;
                        Lastname      = $SuspendedUser.Lastname;
                        Email         = $SuspendedUser.Email;
                        LastLoginDate = $User.timestamp;
                        Id            = $SuspendedUser.Id;
                        Manager       = ( $SuspendedUser.Attributes | ? { $_.Name -eq "Manager" } ).Value;
                    }) | Out-Null
                    If ( -not $ReadOnly )
                    {
                        Set-JcSdkUser -Id $User.id -State "SUSPENDED" | Out-Null
                        $CsvData.RemoveAt($CsvData.id.IndexOf($User.id))
                    }
                }
            }
        }
        # For each user not found in the csv, they don't have a recorded last login
        ForEach ($User in $UserList)
        {
            if ($User.id -notin $CsvData.id)
            {
                # Check if user is still inactive - don't disable if they are not
                if ( $User.Activated )
                {
                    # suspend
                    Write-Debug "Suspending user: $($User.username). Last login: N/A."
                    $SuspendedList.Add([PSCustomObject]@{
                        Username      = $User.Username;
                        Firstname     = $User.Firstname;
                        Lastname      = $User.Lastname;
                        Email         = $User.Email;
                        LastLoginDate = "N/A";
                        Id            = $User.Id;
                        Manager       = ( $User.Attributes | ? { $_.Name -eq "Manager" } ).Value;
                    }) | Out-Null
                    If ( -not $ReadOnly )
                    {
                        Set-JcSdkUser -Id $User.id -State "SUSPENDED" | Out-Null
                    }
                }
            }
        }
    }
    end
    {
        if ( -not $ReadOnly )
        {
            $CsvData | Export-Csv $CsvPath
        }
        $SuspendedList
    }
}