Browser-Based RDP via Bridge

checkout → derive Windows username from BRITIVE_USER_EMAIL (SAM-safe, max 20 chars)
         → generate password meeting Windows complexity rules
         → WinRM or SSH: New-LocalUser (description bridge:<TRX>),
           Add-LocalGroupMember "Remote Desktop Users"
         → bridge.sh checkout-create (payload includes the password)
         → return { token, url: <BRIDGE_URL>/rdp/#token=...&transaction_id=... }

checkin  → bridge.sh checkout-delete <TRX>   ← tunnel closes FIRST
         → WinRM or SSH: Remove-LocalGroupMember, Remove-LocalUser

# SAM-safe username from the email local part (a-z0-9, max 20 chars)
USERNAME="$(python3 -c "
import re, sys
name = re.sub(r'[^a-z0-9]', '', sys.argv[1].split('@')[0].lower())
if name[0].isdigit(): name = 'brg' + name
print(name[:20])
" "$USER_EMAIL")"

# Password meeting Windows complexity: upper + lower + digit + special
RAND="$(head -c 12 /dev/urandom | base64 | tr -d "+/='\\\\" | head -c 12)"
PASSWORD="${RAND}Aa1@"

# PowerShell run over WinRM (pywinrm) or SSH (-EncodedCommand):
#   New-LocalUser -Description 'bridge:<TRX>' ... ;
#   Add-LocalGroupMember -Group 'Remote Desktop Users' ...

# Register the proxied RDP session — the password goes to Bridge, not the user
TOKEN="$(head -c 32 /dev/urandom | base64 | tr -d '/+=' | head -c 43)"
EXPIRES_AT="$(($(date +%s) + EXPIRATION))"

cat > "$PAYLOAD_FILE" <<EOF
{
  "transaction_id":  "${TRANSACTION_ID}",
  "protocol":        "rdp",
  "username":        "${USER_EMAIL}",
  "target_host":     "${TARGET_HOST}",
  "target_port":     ${TARGET_PORT},
  "target_username": "${USERNAME}",
  "target_password": ${PASSWORD_JSON},
  "expires_at":      ${EXPIRES_AT},
  "token":           "${TOKEN}"
}
EOF

"${BROKER_API}" checkout-create --file "$PAYLOAD_FILE" >/dev/null

printf '{"token": "%s", "url": "%s/rdp/#token=%s&transaction_id=%s"}\n' \
  "${TOKEN}" "${BRIDGE_URL}" "${TOKEN}" "${TRANSACTION_ID}"

# Terminate the Bridge session FIRST so the RDP tunnel closes
"${BROKER_API}" checkout-delete "${TRANSACTION_ID}"

# Then deprovision over WinRM or SSH (best-effort after session revoked):
#   Remove-LocalGroupMember -Group 'Remote Desktop Users' ... ;
#   Remove-LocalUser -Name <username>