RDP via Bridge

checkout → derive Windows username from BRITIVE_USER_EMAIL (SAM-safe, max 20 chars)
         → generate password meeting Windows complexity rules
         → WinRM or SSH: New-LocalUser (description bridge:<TRX>),
           Add-LocalGroupMember "Remote Desktop Users"
         → broker-bridge-api.sh checkout-create
             { protocol: rdp, target_password, rdp_security,
               native_auth: bridge_credentials, bridge_auth_password }
         → return { command, browser_session, bridge_username, ... }

checkin  → broker-bridge-api.sh checkout-delete <TRX>   ← session dies FIRST
         → WinRM or SSH: Remove-LocalGroupMember, Remove-LocalUser

# SAM-safe username from the email local part (a-z0-9, max 20 chars)
USERNAME="$(python3 -c "
import re, sys
name = re.sub(r'[^a-z0-9]', '', sys.argv[1].split('@')[0].lower())
if name[0].isdigit(): name = 'brg' + name
print(name[:20])
" "$USER_EMAIL")"

# Password meeting Windows complexity: upper + lower + digit + special
RAND="$(head -c 12 /dev/urandom | base64 | tr -d "+/='\\\\" | head -c 12)"
PASSWORD="${RAND}Aa1@"

# PowerShell run over WinRM (pywinrm) or SSH (-EncodedCommand):
#   New-LocalUser -Description 'bridge:<TRX>' ... ;
#   Add-LocalGroupMember -Group 'Remote Desktop Users' ...

# The Windows password goes to Bridge as target_password; the user never sees
# it. What the user types is their own Bridge Password.
AUTH_FIELDS="$(jq -n --arg p "$BRIDGE_AUTH_PASSWORD" \
  '{native_auth:"bridge_credentials", bridge_auth_password:$p}')"

jq -n --arg transaction_id "$TRANSACTION_ID" --arg username "$USER_EMAIL" \
      --arg target_username "$USERNAME" --arg target_password "$PASSWORD" \
      --arg rdp_security "$RDP_SECURITY" --argjson auth "$AUTH_FIELDS" \
  '{transaction_id: $transaction_id, protocol: "rdp",
    username: $username, target_username: $target_username,
    target_password: $target_password, rdp_security: $rdp_security,
    record_session: true} + $auth' > "$PAYLOAD_FILE"

"${BROKER_API}" checkout-create --file "$PAYLOAD_FILE" >/dev/null

{
  "BRIDGE_URL": "bridge.example.com",
  "command": "mstsc /v:bridge.example.com:3389",
  "auth_method": "password",
  "bridge_username": "alice@corp%server.internal",
  "bridge_port": "3389",
  "target_username": "alicecorp",
  "browser_session": "https://bridge.example.com/rdp/#transaction_id=<TRX>"
}

# Terminate the Bridge session FIRST so the RDP tunnel closes cleanly
"${BROKER_API}" checkout-delete "${TRANSACTION_ID}"

# Then deprovision over WinRM or SSH (best-effort after the session is revoked):
#   Remove-LocalGroupMember -Group 'Remote Desktop Users' ... ;
#   Remove-LocalUser -Name <username>