#Requires -Version 5.1
#Requires -RunAsAdministrator
<#
.SYNOPSIS
  SMTPGraphRelay Installer / Repair / Update

.DESCRIPTION
  Einheitliches Verwaltungswerkzeug für SMTPGraphRelay.

  Modi:
    1 - Neuinstallation
    2 - Installation reparieren
    3 - Relay aktualisieren
    4 - Entra / Exchange RBAC prüfen
    5 - Zertifikat erneuern
    6 - Health Check ausführen
    7 - Deinstallieren

  WICHTIG:
  Dieses Skript muss mit Windows PowerShell 5.1 ausgeführt werden.
#>

[CmdletBinding()]
param(
    [string]$InstallPath = "$env:ProgramFiles\SMTPGraphRelay"
)

$ErrorActionPreference = "Stop"
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8

$TaskName = "SMTPGraphRelay"
$AppDefaultName = "SMTPGraphRelay"
$RelayFileName = "SMTPGraphRelay.ps1"
$HealthFileName = "Test-SMTPGraphRelay.ps1"
$RenewFileName = "Renew-SMTPGraphRelayCertificate.ps1"
$ConfigFileName = "config.json"

# Zentrales Gitea-Repository / Updatequelle
$RepoBaseUrl = "https://me-gitea.maieredv.cloud/MAIEREDV/SMTPGraphRelay"
$RemoteVersionUrl = "$RepoBaseUrl/raw/branch/main/version.json"
$RemoteArchiveUrl = "$RepoBaseUrl/archive/main.zip"
$RemoteRelayUrl = "$RepoBaseUrl/raw/branch/main/SMTPGraphRelay.ps1"

# Dateien, die ein Update verändern darf.
# config.json, Queue, Logs und sonstige lokale Daten sind absichtlich NICHT enthalten.
$ManagedReleaseFiles = @(
    "SMTPGraphRelay.ps1",
    "Test-SMTPGraphRelay.ps1",
    "Renew-SMTPGraphRelayCertificate.ps1",
    "Setup-SMTPGraphRelay.ps1",
    "version.json",
    "README.md"
)

function Write-Title {
    param([string]$Text)
    Write-Host ""
    Write-Host "==========================================================" -ForegroundColor Cyan
    Write-Host " $Text" -ForegroundColor Cyan
    Write-Host "==========================================================" -ForegroundColor Cyan
    Write-Host ""
}

function Write-Ok { param([string]$Text) Write-Host "[OK]   $Text" -ForegroundColor Green }
function Write-Warn { param([string]$Text) Write-Host "[WARN] $Text" -ForegroundColor Yellow }
function Write-Fail { param([string]$Text) Write-Host "[FAIL] $Text" -ForegroundColor Red }
function Write-Info { param([string]$Text) Write-Host "[INFO] $Text" -ForegroundColor Cyan }

function Read-Default {
    param([string]$Prompt, [string]$Default)
    $value = Read-Host "$Prompt [Standard: $Default]"
    if ([string]::IsNullOrWhiteSpace($value)) { return $Default }
    return $value
}

function Confirm-Yes {
    param([string]$Prompt)
    $answer = Read-Host "$Prompt [j/N]"
    return ($answer -match '^(?i)j|ja|y|yes$')
}

function Assert-WindowsPowerShell51 {
    if ($PSVersionTable.PSEdition -ne "Desktop" -or $PSVersionTable.PSVersion.Major -ne 5) {
        Write-Title "FALSCHE POWERSHELL-VERSION"
        Write-Fail "Dieses Tool muss mit Windows PowerShell 5.1 ausgeführt werden."
        Write-Host ""
        Write-Host "Aktuell erkannt:"
        Write-Host "  Edition: $($PSVersionTable.PSEdition)"
        Write-Host "  Version: $($PSVersionTable.PSVersion)"
        Write-Host ""
        Write-Host "Bitte starten:"
        Write-Host "  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ForegroundColor Yellow
        exit 1
    }

    Write-Ok "Windows PowerShell $($PSVersionTable.PSVersion) erkannt."
}

function Ensure-PackageProvider {
    try {
        if (-not (Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue)) {
            Write-Info "NuGet Package Provider wird installiert..."
            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
        }
    } catch {
        Write-Warn "NuGet Provider konnte nicht automatisch vorbereitet werden: $($_.Exception.Message)"
    }
}

function Ensure-Modules {
    param(
        [switch]$IncludeExchange
    )

    Ensure-PackageProvider

    $modules = @(
        "Microsoft.Graph.Authentication",
        "Microsoft.Graph.Applications"
    )

    if ($IncludeExchange) {
        $modules += "ExchangeOnlineManagement"
    }

    foreach ($module in $modules) {
        $existing = Get-Module -ListAvailable -Name $module |
            Sort-Object Version -Descending |
            Select-Object -First 1

        if (-not $existing) {
            Write-Info "$module fehlt. Installation für AllUsers..."
            Install-Module $module -Scope AllUsers -Repository PSGallery -Force -AllowClobber
            $existing = Get-Module -ListAvailable -Name $module |
                Sort-Object Version -Descending |
                Select-Object -First 1
        }

        if (-not $existing) {
            throw "Modul '$module' konnte nicht installiert/gefunden werden."
        }

        # Schutz gegen den bereits beobachteten PowerShell-7-Pfad.
        if ($existing.ModuleBase -notmatch '\\WindowsPowerShell\\Modules\\') {
            Write-Warn "$module wurde gefunden, aber nicht im Windows-PowerShell-Modulpfad: $($existing.ModuleBase)"
            Write-Info "Installiere das Modul nochmals explizit aus Windows PowerShell 5.1..."
            Install-Module $module -Scope AllUsers -Repository PSGallery -Force -AllowClobber
        }

        Write-Ok "$module verfügbar."
    }
}


function New-RepoStagingArea {
    Enable-Tls12

    $root = Join-Path $env:TEMP ("SMTPGraphRelay-repo-{0}" -f [guid]::NewGuid().ToString("N"))
    $archive = Join-Path $root "main.zip"
    $extract = Join-Path $root "extract"

    New-Item -ItemType Directory -Path $extract -Force | Out-Null

    Write-Info "Lade aktuellen Stand aus Gitea..."
    Write-Info "Quelle: $RemoteArchiveUrl"

    Invoke-WebRequest `
        -Uri $RemoteArchiveUrl `
        -OutFile $archive `
        -UseBasicParsing `
        -TimeoutSec 120 `
        -ErrorAction Stop

    if (-not (Test-Path -LiteralPath $archive)) {
        throw "Gitea-Archiv wurde nicht heruntergeladen."
    }

    Expand-Archive `
        -LiteralPath $archive `
        -DestinationPath $extract `
        -Force

    $releaseRoot = Find-ExtractedReleaseRoot -ExtractPath $extract

    # Pflichtdateien prüfen.
    foreach ($required in @("SMTPGraphRelay.ps1", "version.json")) {
        if (-not (Test-Path -LiteralPath (Join-Path $releaseRoot $required))) {
            throw "Repository-Archiv ist unvollständig: '$required' fehlt."
        }
    }

    $versionInfo = Get-Content `
        -LiteralPath (Join-Path $releaseRoot "version.json") `
        -Raw `
        -Encoding UTF8 | ConvertFrom-Json

    if (-not $versionInfo.Version) {
        throw "version.json aus dem Repository enthält keine Version."
    }

    Write-Ok "Repository-Version $($versionInfo.Version) geladen."

    return [pscustomobject]@{
        TempRoot = $root
        ReleaseRoot = $releaseRoot
        VersionInfo = $versionInfo
    }
}

function Remove-RepoStagingArea {
    param($Staging)

    if ($Staging -and $Staging.TempRoot) {
        Remove-Item -LiteralPath $Staging.TempRoot -Recurse -Force -ErrorAction SilentlyContinue
    }
}

function Install-RepoProgramFiles {
    param(
        [Parameter(Mandatory)][string]$ReleaseRoot,
        [Parameter(Mandatory)][string]$TargetPath
    )

    New-Item -ItemType Directory -Path $TargetPath -Force | Out-Null

    foreach ($name in $ManagedReleaseFiles) {
        $source = Join-Path $ReleaseRoot $name

        if (Test-Path -LiteralPath $source) {
            Copy-Item `
                -LiteralPath $source `
                -Destination (Join-Path $TargetPath $name) `
                -Force

            Write-Ok "Installiert: $name"
        }
    }
}

function Get-SourceFile {
    param([Parameter(Mandatory)][string]$Name)

    $candidate = Join-Path $PSScriptRoot $Name

    if (Test-Path -LiteralPath $candidate) {
        return $candidate
    }

    return $null
}

function Get-PackageVersion {
    $versionFile = Join-Path $PSScriptRoot "version.json"

    if (-not (Test-Path -LiteralPath $versionFile)) {
        return $null
    }

    try {
        return Get-Content -LiteralPath $versionFile -Raw -Encoding UTF8 | ConvertFrom-Json
    }
    catch {
        Write-Warn "version.json konnte nicht gelesen werden: $($_.Exception.Message)"
        return $null
    }
}

function Get-InstalledVersion {
    param([Parameter(Mandatory)][string]$TargetPath)

    $versionFile = Join-Path $TargetPath "version.json"

    if (-not (Test-Path -LiteralPath $versionFile)) {
        return $null
    }

    try {
        return Get-Content -LiteralPath $versionFile -Raw -Encoding UTF8 | ConvertFrom-Json
    }
    catch {
        return $null
    }
}

function Copy-ProgramFiles {
    param(
        [Parameter(Mandatory)][string]$TargetPath,
        [switch]$RequireRelay
    )

    New-Item -ItemType Directory -Path $TargetPath -Force | Out-Null

    $files = @($RelayFileName, $HealthFileName, $RenewFileName, "version.json")

    foreach ($name in $files) {
        $source = Get-SourceFile -Name $name

        if (-not $source) {
            if ($name -eq $RelayFileName -and $RequireRelay) {
                throw "Quelldatei '$name' wurde neben dem Installer nicht gefunden."
            }

            Write-Warn "Optionale Quelldatei nicht gefunden: $name"
            continue
        }

        $destination = Join-Path $TargetPath $name

        # Nicht auf sich selbst kopieren.
        if ([IO.Path]::GetFullPath($source) -ne [IO.Path]::GetFullPath($destination)) {
            Copy-Item -LiteralPath $source -Destination $destination -Force
        }

        Write-Ok "$name bereitgestellt."
    }

    # Installer selbst ebenfalls in den Installationsordner legen.
    try {
        $selfDest = Join-Path $TargetPath "Setup-SMTPGraphRelay.ps1"
        if ([IO.Path]::GetFullPath($PSCommandPath) -ne [IO.Path]::GetFullPath($selfDest)) {
            Copy-Item -LiteralPath $PSCommandPath -Destination $selfDest -Force
        }
    } catch {}
}

function Ensure-Directories {
    param([Parameter(Mandatory)][string]$TargetPath)

    foreach ($dir in @(
        $TargetPath,
        (Join-Path $TargetPath "queue"),
        (Join-Path $TargetPath "queue\incoming"),
        (Join-Path $TargetPath "queue\pending"),
        (Join-Path $TargetPath "queue\processing"),
        (Join-Path $TargetPath "failed"),
        (Join-Path $TargetPath "logs")
    )) {
        New-Item -ItemType Directory -Path $dir -Force | Out-Null
    }

    Write-Ok "Programm-/Queue-/Log-Verzeichnisse vorhanden."
}

function Get-RelayConfig {
    param([Parameter(Mandatory)][string]$TargetPath)

    $path = Join-Path $TargetPath $ConfigFileName
    if (-not (Test-Path -LiteralPath $path)) {
        return $null
    }

    try {
        return Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
    }
    catch {
        throw "config.json konnte nicht gelesen werden: $($_.Exception.Message)"
    }
}

function Write-RelayConfig {
    param(
        [Parameter(Mandatory)]$Config,
        [Parameter(Mandatory)][string]$TargetPath
    )

    $configPath = Join-Path $TargetPath $ConfigFileName
    $tmp = "$configPath.tmp"

    $Config | ConvertTo-Json -Depth 20 | Set-Content -LiteralPath $tmp -Encoding UTF8
    Move-Item -LiteralPath $tmp -Destination $configPath -Force

    Write-Ok "config.json geschrieben."
}

function Ensure-FirewallRule {
    param([Parameter(Mandatory)][int]$Port)

    $prefix = "SMTPGraphRelay TCP "
    Get-NetFirewallRule -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -like "$prefix*" -and $_.DisplayName -ne "$prefix$Port" } |
        Remove-NetFirewallRule -ErrorAction SilentlyContinue

    $ruleName = "$prefix$Port"
    $existing = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue

    if (-not $existing) {
        New-NetFirewallRule `
            -DisplayName $ruleName `
            -Direction Inbound `
            -Action Allow `
            -Protocol TCP `
            -LocalPort $Port `
            -Profile Any | Out-Null

        Write-Ok "Firewallregel '$ruleName' erstellt."
    }
    else {
        Write-Ok "Firewallregel '$ruleName' vorhanden."
    }
}

function Ensure-ScheduledTask {
    param([Parameter(Mandatory)][string]$TargetPath)

    $scriptPath = Join-Path $TargetPath $RelayFileName
    if (-not (Test-Path -LiteralPath $scriptPath)) {
        throw "Relay-Skript fehlt: $scriptPath"
    }

    $psExe = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"

    $configPath = Join-Path $TargetPath $ConfigFileName

    $action = New-ScheduledTaskAction `
        -Execute $psExe `
        -Argument "-NoLogo -NoProfile -ExecutionPolicy Bypass -File `"$scriptPath`" -ConfigPath `"$configPath`"" `
        -WorkingDirectory $TargetPath

    $trigger = New-ScheduledTaskTrigger -AtStartup
    $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
    $settings = New-ScheduledTaskSettingsSet `
        -AllowStartIfOnBatteries `
        -DontStopIfGoingOnBatteries `
        -StartWhenAvailable `
        -RestartCount 5 `
        -RestartInterval (New-TimeSpan -Minutes 1) `
        -ExecutionTimeLimit ([TimeSpan]::Zero)

    Register-ScheduledTask `
        -TaskName $TaskName `
        -Action $action `
        -Trigger $trigger `
        -Principal $principal `
        -Settings $settings `
        -Description "Lokaler SMTP Store-and-Forward Relay zu Microsoft 365 via Microsoft Graph" `
        -Force | Out-Null

    Write-Ok "Scheduled Task '$TaskName' eingerichtet."
}

function Stop-RelayTask {
    $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue

    if (-not $task -or $task.State -ne "Running") {
        return
    }

    $graceSeconds = 30

    try {
        $config = Get-RelayConfig -TargetPath $InstallPath
        if ($config -and $config.Smtp.PSObject.Properties.Name -contains "GracefulShutdownSeconds") {
            $configured = [int]$config.Smtp.GracefulShutdownSeconds
            if ($configured -ge 5 -and $configured -le 300) {
                $graceSeconds = $configured
            }
        }
    }
    catch {}

    $signalPath = Join-Path $InstallPath "shutdown.request"

    try {
        [IO.File]::WriteAllText(
            $signalPath,
            ([DateTime]::UtcNow.ToString("o")),
            (New-Object Text.UTF8Encoding($false))
        )

        Write-Info "Graceful Shutdown angefordert. Warte auf Relay (max. $graceSeconds Sekunden)..."

        $deadline = (Get-Date).AddSeconds($graceSeconds + 5)

        while ((Get-Date) -lt $deadline) {
            Start-Sleep -Milliseconds 250
            $current = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue

            if (-not $current -or $current.State -ne "Running") {
                Write-Ok "Relay sauber beendet."
                return
            }
        }

        Write-Warn "Graceful-Shutdown-Timeout erreicht. Task wird hart beendet."
        Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
        Start-Sleep -Milliseconds 750
    }
    finally {
        Remove-Item -LiteralPath $signalPath -Force -ErrorAction SilentlyContinue
    }
}

function Start-RelayTask {
    $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
    if ($task) {
        Remove-Item -LiteralPath (Join-Path $InstallPath "shutdown.request") -Force -ErrorAction SilentlyContinue
        Start-ScheduledTask -TaskName $TaskName
        Start-Sleep -Seconds 2
        Write-Ok "Scheduled Task gestartet."
    }
}

function Convert-CertToKeyCredential {
    param([Parameter(Mandatory)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate)

    return @{
        Type = "AsymmetricX509Cert"
        Usage = "Verify"
        Key = $Certificate.GetRawCertData()
        DisplayName = "SMTPGraphRelay Certificate"
        StartDateTime = $Certificate.NotBefore.ToUniversalTime()
        EndDateTime = $Certificate.NotAfter.ToUniversalTime()
    }
}

function New-RelayCertificate {
    $subject = "CN=SMTPGraphRelay-$env:COMPUTERNAME"

    return New-SelfSignedCertificate `
        -Subject $subject `
        -CertStoreLocation "Cert:\LocalMachine\My" `
        -KeyAlgorithm RSA `
        -KeyLength 2048 `
        -HashAlgorithm SHA256 `
        -KeyExportPolicy NonExportable `
        -KeySpec Signature `
        -NotAfter (Get-Date).AddYears(2)
}

function Connect-RelayGraphAdmin {
    param([string]$TenantId)

    Import-Module Microsoft.Graph.Authentication -Force -ErrorAction Stop
    Import-Module Microsoft.Graph.Applications -Force -ErrorAction Stop

    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null

    if ([string]::IsNullOrWhiteSpace($TenantId)) {
        Connect-MgGraph -Scopes "Application.ReadWrite.All" -NoWelcome
    }
    else {
        Connect-MgGraph -TenantId $TenantId -Scopes "Application.ReadWrite.All" -NoWelcome
    }
}

function Ensure-ExchangeRbac {
    param(
        [Parameter(Mandatory)][string]$TenantId,
        [Parameter(Mandatory)][string]$ClientId,
        [Parameter(Mandatory)][string]$ServicePrincipalObjectId,
        [Parameter(Mandatory)][string]$AppName,
        [Parameter(Mandatory)][string]$SenderMailbox
    )

    Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop

    Write-Info "Exchange Online Anmeldung erforderlich (Admin)."
    Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

    try {
        $recipient = Get-EXORecipient -Identity $SenderMailbox -ErrorAction Stop
        Write-Ok "Exchange-Empfänger gefunden: $($recipient.DisplayName)"

        $exoSp = $null
        try {
            $exoSp = Get-ServicePrincipal -Identity $ServicePrincipalObjectId -ErrorAction Stop
        }
        catch {
            Write-Info "Exchange Service Principal wird registriert..."
            $exoSp = New-ServicePrincipal `
                -AppId $ClientId `
                -ObjectId $ServicePrincipalObjectId `
                -DisplayName $AppName
        }

        if (-not $exoSp) {
            throw "Exchange Service Principal konnte nicht ermittelt/erstellt werden."
        }

        $shortId = $ClientId.Substring(0,8)
        $scopeName = "SMTPGraphRelay-$shortId-Sender"
        $assignmentName = "SMTPGraphRelay-$shortId-MailSend"
        $escaped = $SenderMailbox.Replace("'", "''")
        $filter = "PrimarySmtpAddress -eq '$escaped'"

        $scope = Get-ManagementScope -Identity $scopeName -ErrorAction SilentlyContinue
        if ($scope) {
            Set-ManagementScope -Identity $scopeName -RecipientRestrictionFilter $filter
        }
        else {
            New-ManagementScope -Name $scopeName -RecipientRestrictionFilter $filter | Out-Null
        }
        Write-Ok "Exchange Resource Scope: $scopeName -> $SenderMailbox"

        $assignment = Get-ManagementRoleAssignment -Identity $assignmentName -ErrorAction SilentlyContinue
        if ($assignment) {
            Set-ManagementRoleAssignment -Identity $assignmentName -CustomResourceScope $scopeName
        }
        else {
            New-ManagementRoleAssignment `
                -Name $assignmentName `
                -Role "Application Mail.Send" `
                -App $ServicePrincipalObjectId `
                -CustomResourceScope $scopeName | Out-Null
        }

        Write-Ok "Exchange RBAC 'Application Mail.Send' eingerichtet."

        $auth = Test-ServicePrincipalAuthorization `
            -Identity $ServicePrincipalObjectId `
            -Resource $SenderMailbox

        $mailSend = $auth | Where-Object { $_.RoleName -eq "Application Mail.Send" } | Select-Object -First 1

        if (-not $mailSend -or -not $mailSend.InScope) {
            throw "RBAC-Test für '$SenderMailbox' ist nicht InScope."
        }

        Write-Ok "RBAC-Test: $SenderMailbox ist InScope."
    }
    finally {
        Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
    }
}

function Test-NoGlobalMailSend {
    param(
        [Parameter(Mandatory)][string]$ServicePrincipalObjectId
    )

    # Microsoft Graph Service Principal
    $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles"

    if (-not $graphSp) {
        Write-Warn "Microsoft Graph Service Principal konnte nicht geprüft werden."
        return
    }

    $mailSendRole = $graphSp.AppRoles | Where-Object {
        $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application"
    } | Select-Object -First 1

    if (-not $mailSendRole) {
        Write-Warn "Graph AppRole Mail.Send konnte nicht aufgelöst werden."
        return
    }

    $assignments = Get-MgServicePrincipalAppRoleAssignment `
        -ServicePrincipalId $ServicePrincipalObjectId `
        -All `
        -ErrorAction SilentlyContinue

    $global = $assignments | Where-Object {
        $_.ResourceId -eq $graphSp.Id -and $_.AppRoleId -eq $mailSendRole.Id
    }

    if ($global) {
        Write-Fail "Die App besitzt zusätzlich globale Microsoft Graph Mail.Send Application Permission."
        Write-Warn "Diese globale Berechtigung würde Exchange Application RBAC additiv umgehen."
    }
    else {
        Write-Ok "Keine globale Graph Mail.Send Application Permission vorhanden."
    }
}


function Enable-Tls12 {
    try {
        [Net.ServicePointManager]::SecurityProtocol = `
            [Net.ServicePointManager]::SecurityProtocol -bor `
            [Net.SecurityProtocolType]::Tls12
    } catch {}
}

function Get-RemoteVersion {
    Enable-Tls12

    $tempFile = Join-Path $env:TEMP ("SMTPGraphRelay-version-{0}.json" -f [guid]::NewGuid().ToString("N"))

    try {
        Invoke-WebRequest `
            -Uri $RemoteVersionUrl `
            -OutFile $tempFile `
            -UseBasicParsing `
            -TimeoutSec 20 `
            -ErrorAction Stop

        $remote = Get-Content -LiteralPath $tempFile -Raw -Encoding UTF8 | ConvertFrom-Json

        if (-not $remote.Version) {
            throw "Remote version.json enthält keine Version."
        }

        return $remote
    }
    finally {
        Remove-Item -LiteralPath $tempFile -Force -ErrorAction SilentlyContinue
    }
}

function Compare-RelayVersions {
    param(
        [Parameter(Mandatory)][string]$Installed,
        [Parameter(Mandatory)][string]$Remote
    )

    try {
        $installedVersion = [version]$Installed
        $remoteVersion = [version]$Remote

        if ($remoteVersion -gt $installedVersion) { return 1 }
        if ($remoteVersion -lt $installedVersion) { return -1 }
        return 0
    }
    catch {
        throw "Versionsvergleich fehlgeschlagen: installiert='$Installed', remote='$Remote'."
    }
}

function Find-ExtractedReleaseRoot {
    param(
        [Parameter(Mandatory)][string]$ExtractPath
    )

    # Gitea kann beim Archiv einen zusätzlichen Root-Ordner erzeugen.
    # Daher suchen wir nach der Kombination aus Relay + version.json statt
    # einen konkreten Archivordnernamen vorauszusetzen.
    $relayFiles = Get-ChildItem `
        -LiteralPath $ExtractPath `
        -Recurse `
        -File `
        -Filter $RelayFileName `
        -ErrorAction SilentlyContinue

    foreach ($relay in $relayFiles) {
        $candidate = $relay.Directory.FullName
        if (Test-Path -LiteralPath (Join-Path $candidate "version.json")) {
            return $candidate
        }
    }

    throw "Im heruntergeladenen Archiv wurde kein gültiges SMTPGraphRelay-Release gefunden."
}

function Backup-ManagedFiles {
    param(
        [Parameter(Mandatory)][string]$TargetPath
    )

    $backupRoot = Join-Path $TargetPath "backup"
    $backupPath = Join-Path $backupRoot (Get-Date -Format "yyyyMMdd-HHmmss")

    New-Item -ItemType Directory -Path $backupPath -Force | Out-Null

    foreach ($name in $ManagedReleaseFiles) {
        $source = Join-Path $TargetPath $name

        if (Test-Path -LiteralPath $source) {
            Copy-Item -LiteralPath $source -Destination (Join-Path $backupPath $name) -Force
        }
    }

    return $backupPath
}

function Restore-ManagedFiles {
    param(
        [Parameter(Mandatory)][string]$BackupPath,
        [Parameter(Mandatory)][string]$TargetPath
    )

    foreach ($name in $ManagedReleaseFiles) {
        $backupFile = Join-Path $BackupPath $name
        $targetFile = Join-Path $TargetPath $name

        if (Test-Path -LiteralPath $backupFile) {
            Copy-Item -LiteralPath $backupFile -Destination $targetFile -Force
        }
    }
}

function Install-ExtractedRelease {
    param(
        [Parameter(Mandatory)][string]$ReleaseRoot,
        [Parameter(Mandatory)][string]$TargetPath
    )

    $required = @(
        "SMTPGraphRelay.ps1",
        "version.json"
    )

    foreach ($name in $required) {
        if (-not (Test-Path -LiteralPath (Join-Path $ReleaseRoot $name))) {
            throw "Updatepaket ist unvollständig: '$name' fehlt."
        }
    }

    foreach ($name in $ManagedReleaseFiles) {
        $source = Join-Path $ReleaseRoot $name

        if (Test-Path -LiteralPath $source) {
            Copy-Item -LiteralPath $source -Destination (Join-Path $TargetPath $name) -Force
            Write-Ok "Aktualisiert: $name"
        }
    }
}

function Invoke-PostUpdateHealthCheck {
    param(
        [Parameter(Mandatory)][string]$TargetPath
    )

    $health = Join-Path $TargetPath $HealthFileName

    if (-not (Test-Path -LiteralPath $health)) {
        Write-Warn "Health Check ist nicht installiert; automatische Nachprüfung entfällt."
        return 0
    }

    Write-Info "Starte Health Check nach dem Update..."
    & $health -ConfigPath (Join-Path $TargetPath $ConfigFileName)
    return $LASTEXITCODE
}

function Install-New {
    Write-Title "SMTPGraphRelay - Neuinstallation aus Gitea"

    if (Test-Path -LiteralPath (Join-Path $InstallPath $ConfigFileName)) {
        Write-Warn "Es existiert bereits eine config.json unter:"
        Write-Host "  $InstallPath"
        Write-Warn "Neuinstallation würde eine neue App/Zertifikat erzeugen."

        if (-not (Confirm-Yes "Trotzdem fortfahren?")) {
            return
        }
    }

    $staging = $null

    try {
        $staging = New-RepoStagingArea

        Ensure-Modules -IncludeExchange
        Ensure-Directories -TargetPath $InstallPath

        # Nur Programmdateien aus Git übernehmen.
        Install-RepoProgramFiles `
            -ReleaseRoot $staging.ReleaseRoot `
            -TargetPath $InstallPath

        Write-Ok "Programmdateien aus Gitea installiert."

        $appName = Read-Default "Name der Entra App" $AppDefaultName

        $senderMailbox = Read-Host "M365-Absenderpostfach (z.B. info@firma.de)"
        while ([string]::IsNullOrWhiteSpace($senderMailbox) -or $senderMailbox -notmatch '^[^@\s]+@[^@\s]+\.[^@\s]+$') {
            $senderMailbox = Read-Host "Bitte eine gültige Mailadresse eingeben"
        }

        $listenAddress = Read-Default "Lokale Listen-IP" "0.0.0.0"
        $port = [int](Read-Default "SMTP-Port" "2525")
        $allowedText = Read-Default "Erlaubte Netze, mit Komma getrennt" "127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
        $allowedNetworks = @($allowedText -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ })

        Write-Info "Erzeuge Relay-Zertifikat..."
        $cert = New-RelayCertificate
        Write-Ok "Zertifikat erstellt: $($cert.Thumbprint)"

        Write-Info "Microsoft Graph Anmeldung erforderlich (Entra-Admin)."
        Connect-RelayGraphAdmin

        try {
            $tenantId = (Get-MgContext).TenantId
            Write-Ok "Tenant: $tenantId"

            $appParams = @{
                DisplayName = $appName
                SignInAudience = "AzureADMyOrg"
                KeyCredentials = @(
                    (Convert-CertToKeyCredential -Certificate $cert)
                )
            }

            $app = New-MgApplication -BodyParameter $appParams
            Write-Ok "App Registration erstellt: $($app.AppId)"

            $sp = $null
            for ($i = 0; $i -lt 10 -and -not $sp; $i++) {
                try {
                    $sp = New-MgServicePrincipal -AppId $app.AppId
                }
                catch {
                    Start-Sleep -Seconds 2
                }
            }

            if (-not $sp) {
                throw "Entra Service Principal konnte nicht erstellt werden."
            }

            Write-Ok "Entra Service Principal erstellt: $($sp.Id)"
            Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id

            Ensure-ExchangeRbac `
                -TenantId $tenantId `
                -ClientId $app.AppId `
                -ServicePrincipalObjectId $sp.Id `
                -AppName $appName `
                -SenderMailbox $senderMailbox

            $config = [ordered]@{
                Smtp = [ordered]@{
                    ListenAddress = $listenAddress
                    Port = $port
                    Hostname = $env:COMPUTERNAME
                    AllowedNetworks = $allowedNetworks
                    MaxMessageSizeMB = 25
                    ClientTimeoutSeconds = 120
                    MaxConcurrentClients = 20
                    MaxRecipients = 50
                    MaxMessagesPerConnection = 25
                    RequireAuth = $false
                    AuthMaxFailures = 5
                    AllowUnauthenticatedNetworks = @()
                    AuthUsers = @()
                    GracefulShutdownSeconds = 30
                }
                Graph = [ordered]@{
                    TenantId = $tenantId
                    ClientId = $app.AppId
                    CertificateThumbprint = $cert.Thumbprint
                    SenderMailbox = $senderMailbox
                    ForceSender = $true
                    CertificateWarningDays = 60
                    CertificateCriticalDays = 14
                    CertificateCheckHours = 12
                }
                Queue = [ordered]@{
                    PollSeconds = 10
                    MaxRetries = 8
                    RetryMinutes = @(1,5,15,30,60,120,240,480)
                    MaxPendingMessages = 5000
                    MinFreeDiskSpaceMB = 1024
                }
                Paths = [ordered]@{
                    Queue = "queue"
                    Failed = "failed"
                    Logs = "logs"
                }
                Logging = [ordered]@{
                    MaxFileSizeMB = 10
                    RetentionDays = 30
                    CleanupHours = 12
                }
                Update = [ordered]@{
                    Repository = $RepoBaseUrl
                    Branch = "main"
                }
            }

            Write-RelayConfig -Config $config -TargetPath $InstallPath
            Ensure-FirewallRule -Port $port
            Ensure-ScheduledTask -TargetPath $InstallPath

            Write-Info "Teste App-only Anmeldung mit Relay-Zertifikat..."
            Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null

            Connect-MgGraph `
                -TenantId $tenantId `
                -ClientId $app.AppId `
                -Certificate $cert `
                -NoWelcome | Out-Null

            $ctx = Get-MgContext
            if (-not $ctx -or $ctx.AuthType -ne "AppOnly") {
                throw "App-only Anmeldung konnte nicht bestätigt werden."
            }

            Write-Ok "App-only Anmeldung funktioniert."
            Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null

            Start-RelayTask

            $health = Join-Path $InstallPath $HealthFileName
            if (Test-Path -LiteralPath $health) {
                Write-Info "Starte abschließenden Health Check..."
                & $health -ConfigPath (Join-Path $InstallPath $ConfigFileName)
                $healthExit = $LASTEXITCODE

                if ($healthExit -ge 2) {
                    Write-Warn "Installation abgeschlossen, Health Check meldet Fehler. Bitte Ausgabe prüfen."
                }
            }

            Write-Title "Neuinstallation abgeschlossen"
            Write-Host "Version:           $($staging.VersionInfo.Version)"
            Write-Host "Installationspfad: $InstallPath"
            Write-Host "Client ID:         $($app.AppId)"
            Write-Host "Tenant ID:         $tenantId"
            Write-Host "Sender:            $senderMailbox"
            Write-Host "SMTP:              $listenAddress`:$port"
        }
        finally {
            Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
        }
    }
    finally {
        Remove-RepoStagingArea -Staging $staging
    }
}

function Repair-Installation {
    Write-Title "SMTPGraphRelay - Repair aus Gitea"

    $config = Get-RelayConfig -TargetPath $InstallPath
    if (-not $config) {
        Write-Fail "Keine config.json gefunden. Repair ist nur für bestehende Installationen gedacht."
        Write-Info "Bitte Neuinstallation verwenden."
        return
    }

    $staging = $null
    $backupPath = $null

    try {
        $staging = New-RepoStagingArea

        Ensure-Modules
        Ensure-Directories -TargetPath $InstallPath

        $certPath = "Cert:\LocalMachine\My\$($config.Graph.CertificateThumbprint)"
        $cert = Get-Item -LiteralPath $certPath -ErrorAction SilentlyContinue

        if (-not $cert) {
            Write-Fail "Konfiguriertes Zertifikat fehlt: $($config.Graph.CertificateThumbprint)"
            Write-Warn "Repair erzeugt absichtlich kein neues Credential. Nutze Zertifikat erneuern."
        }
        elseif (-not $cert.HasPrivateKey) {
            Write-Fail "Konfiguriertes Zertifikat besitzt keinen privaten Schlüssel."
        }
        else {
            Write-Ok "Zertifikat vorhanden und besitzt Private Key."
        }

        Write-Info "Sichere aktuelle Programmdateien..."
        $backupPath = Backup-ManagedFiles -TargetPath $InstallPath
        Write-Ok "Backup: $backupPath"

        Stop-RelayTask

        Install-RepoProgramFiles `
            -ReleaseRoot $staging.ReleaseRoot `
            -TargetPath $InstallPath

        Ensure-FirewallRule -Port ([int]$config.Smtp.Port)
        Ensure-ScheduledTask -TargetPath $InstallPath
        Start-RelayTask

        $healthExit = Invoke-PostUpdateHealthCheck -TargetPath $InstallPath

        if ($healthExit -ge 2) {
            throw "Health Check nach Repair meldet FEHLER (ExitCode $healthExit)."
        }

        if ($healthExit -eq 1) {
            Write-Warn "Repair abgeschlossen, Health Check enthält Warnungen."
        }
        else {
            Write-Ok "Repair Health Check erfolgreich."
        }

        Write-Title "Repair abgeschlossen"
        Write-Host "Installierte Repo-Version: $($staging.VersionInfo.Version)"
    }
    catch {
        Write-Fail "Repair fehlgeschlagen: $($_.Exception.Message)"

        if ($backupPath -and (Test-Path -LiteralPath $backupPath)) {
            Write-Warn "Stelle vorherige Programmdateien wieder her..."

            try {
                Stop-RelayTask
                Restore-ManagedFiles -BackupPath $backupPath -TargetPath $InstallPath
                Ensure-ScheduledTask -TargetPath $InstallPath
                Start-RelayTask
                Write-Ok "Rollback nach Repair abgeschlossen."
            }
            catch {
                Write-Fail "Repair-Rollback fehlgeschlagen: $($_.Exception.Message)"
            }
        }
    }
    finally {
        Remove-RepoStagingArea -Staging $staging
    }
}

function Update-Relay {
    Write-Title "SMTPGraphRelay - Online Update"

    $config = Get-RelayConfig -TargetPath $InstallPath
    if (-not $config) {
        Write-Fail "Keine bestehende config.json gefunden."
        Write-Info "Für eine neue Installation bitte 'Neuinstallation' wählen."
        return
    }

    $installedVersionInfo = Get-InstalledVersion -TargetPath $InstallPath
    $installedVersion = $null

    if ($installedVersionInfo -and $installedVersionInfo.Version) {
        $installedVersion = [string]$installedVersionInfo.Version
        Write-Info "Installierte Version: $installedVersion"
    }
    else {
        Write-Warn "Keine installierte version.json gefunden."
        $installedVersion = Read-Host "Installierte Version manuell eingeben (z.B. 1.5.0)"
        if ([string]::IsNullOrWhiteSpace($installedVersion)) {
            Write-Fail "Ohne lokale Versionsinformation kann kein sicheres Online-Update durchgeführt werden."
            return
        }
    }

    Write-Info "Prüfe Gitea auf neue Version..."
    Write-Info "Repository: $RepoBaseUrl"

    try {
        $remoteInfo = Get-RemoteVersion
    }
    catch {
        Write-Fail "Remote-Version konnte nicht geladen werden: $($_.Exception.Message)"
        return
    }

    $remoteVersion = [string]$remoteInfo.Version
    Write-Ok "Remote-Version: $remoteVersion"

    try {
        $comparison = Compare-RelayVersions -Installed $installedVersion -Remote $remoteVersion
    }
    catch {
        Write-Fail $_.Exception.Message
        return
    }

    if ($comparison -eq 0) {
        Write-Ok "SMTPGraphRelay ist bereits aktuell ($installedVersion)."
        return
    }

    if ($comparison -lt 0) {
        Write-Warn "Die installierte Version ($installedVersion) ist neuer als main ($remoteVersion)."
        if (-not (Confirm-Yes "Downgrade auf $remoteVersion durchführen?")) {
            return
        }
    }
    else {
        Write-Host ""
        Write-Host "Update verfügbar:" -ForegroundColor Green
        Write-Host "  Installiert: $installedVersion"
        Write-Host "  Neu:         $remoteVersion" -ForegroundColor Yellow
        Write-Host ""

        if (-not (Confirm-Yes "Update auf $remoteVersion installieren?")) {
            return
        }
    }

    Enable-Tls12

    $updateRoot = Join-Path $env:TEMP ("SMTPGraphRelay-update-{0}" -f [guid]::NewGuid().ToString("N"))
    $archivePath = Join-Path $updateRoot "main.zip"
    $extractPath = Join-Path $updateRoot "extract"

    New-Item -ItemType Directory -Path $updateRoot -Force | Out-Null
    New-Item -ItemType Directory -Path $extractPath -Force | Out-Null

    $backupPath = $null
    $taskWasRunning = $false

    try {
        Write-Info "Lade Repository-Archiv..."
        Invoke-WebRequest `
            -Uri $RemoteArchiveUrl `
            -OutFile $archivePath `
            -UseBasicParsing `
            -TimeoutSec 120 `
            -ErrorAction Stop

        if (-not (Test-Path -LiteralPath $archivePath)) {
            throw "Download des Updatearchivs fehlgeschlagen."
        }

        Write-Ok "Archiv heruntergeladen."

        Expand-Archive `
            -LiteralPath $archivePath `
            -DestinationPath $extractPath `
            -Force

        $releaseRoot = Find-ExtractedReleaseRoot -ExtractPath $extractPath
        Write-Ok "Release im Archiv gefunden: $releaseRoot"

        $downloadedVersionInfo = Get-Content `
            -LiteralPath (Join-Path $releaseRoot "version.json") `
            -Raw `
            -Encoding UTF8 | ConvertFrom-Json

        if (-not $downloadedVersionInfo.Version) {
            throw "version.json im Archiv enthält keine Version."
        }

        if ([string]$downloadedVersionInfo.Version -ne $remoteVersion) {
            throw "Versionskonflikt: version.json-URL meldet $remoteVersion, Archiv enthält $($downloadedVersionInfo.Version)."
        }

        $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
        if ($task -and $task.State -eq "Running") {
            $taskWasRunning = $true
        }

        Write-Info "Erstelle Backup der verwalteten Programmdateien..."
        $backupPath = Backup-ManagedFiles -TargetPath $InstallPath
        Write-Ok "Backup: $backupPath"

        Stop-RelayTask

        Write-Info "Installiere Release $remoteVersion..."
        Install-ExtractedRelease `
            -ReleaseRoot $releaseRoot `
            -TargetPath $InstallPath

        Ensure-Directories -TargetPath $InstallPath
        Ensure-FirewallRule -Port ([int]$config.Smtp.Port)
        Ensure-ScheduledTask -TargetPath $InstallPath

        Start-RelayTask

        $healthExit = Invoke-PostUpdateHealthCheck -TargetPath $InstallPath

        if ($healthExit -ge 2) {
            throw "Health Check nach Update meldet FEHLER (ExitCode $healthExit)."
        }

        if ($healthExit -eq 1) {
            Write-Warn "Update erfolgreich, Health Check enthält Warnungen."
        }
        else {
            Write-Ok "Health Check nach Update erfolgreich."
        }

        Write-Title "Online Update abgeschlossen"
        Write-Host "Vorher: $installedVersion"
        Write-Host "Jetzt:  $remoteVersion" -ForegroundColor Green
        Write-Host "Backup: $backupPath"
    }
    catch {
        Write-Host ""
        Write-Fail "Update fehlgeschlagen: $($_.Exception.Message)"

        if ($backupPath -and (Test-Path -LiteralPath $backupPath)) {
            Write-Warn "Automatischer Rollback wird durchgeführt..."

            try {
                Stop-RelayTask
                Restore-ManagedFiles `
                    -BackupPath $backupPath `
                    -TargetPath $InstallPath

                Ensure-ScheduledTask -TargetPath $InstallPath
                Start-RelayTask

                Write-Ok "Rollback abgeschlossen."
            }
            catch {
                Write-Fail "Rollback fehlgeschlagen: $($_.Exception.Message)"
                Write-Warn "Backup liegt unter: $backupPath"
            }
        }
    }
    finally {
        Remove-Item -LiteralPath $updateRoot -Recurse -Force -ErrorAction SilentlyContinue
    }
}

function Verify-CloudRbac {
    Write-Title "SMTPGraphRelay - Entra / Exchange RBAC prüfen"

    $config = Get-RelayConfig -TargetPath $InstallPath
    if (-not $config) {
        Write-Fail "config.json nicht gefunden."
        return
    }

    Ensure-Modules -IncludeExchange

    Write-Info "Microsoft Graph Anmeldung erforderlich (Entra-Admin)."
    Connect-RelayGraphAdmin -TenantId $config.Graph.TenantId

    try {
        $app = Get-MgApplication -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName,keyCredentials" |
            Select-Object -First 1

        if (-not $app) {
            Write-Fail "App Registration mit ClientId $($config.Graph.ClientId) nicht gefunden."
            return
        }

        Write-Ok "App Registration gefunden: $($app.DisplayName)"

        $sp = Get-MgServicePrincipal -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName" |
            Select-Object -First 1

        if (-not $sp) {
            Write-Fail "Entra Service Principal nicht gefunden."
            return
        }

        Write-Ok "Entra Service Principal gefunden: $($sp.Id)"
        Test-NoGlobalMailSend -ServicePrincipalObjectId $sp.Id

        Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop
        Write-Info "Exchange Online Anmeldung erforderlich (Admin)."
        Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

        try {
            $auth = Test-ServicePrincipalAuthorization `
                -Identity $sp.Id `
                -Resource $config.Graph.SenderMailbox

            $role = $auth | Where-Object { $_.RoleName -eq "Application Mail.Send" } | Select-Object -First 1

            if ($role -and $role.InScope) {
                Write-Ok "Exchange Application Mail.Send: SenderMailbox ist InScope."
                if ($role.AllowedResourceScope) {
                    Write-Info "AllowedResourceScope: $($role.AllowedResourceScope)"
                }
            }
            else {
                Write-Fail "Exchange Application Mail.Send fehlt oder SenderMailbox ist nicht InScope."
            }
        }
        finally {
            Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
        }
    }
    finally {
        Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
    }
}

function Invoke-CertificateRenewal {
    Write-Title "SMTPGraphRelay - Zertifikat erneuern"

    $renew = Join-Path $InstallPath $RenewFileName
    if (-not (Test-Path -LiteralPath $renew)) {
        Write-Fail "$RenewFileName ist nicht installiert."
        return
    }

    & $renew -ConfigPath (Join-Path $InstallPath $ConfigFileName)
}

function Invoke-HealthCheck {
    Write-Title "SMTPGraphRelay - Health Check"

    $health = Join-Path $InstallPath $HealthFileName
    if (-not (Test-Path -LiteralPath $health)) {
        Write-Fail "$HealthFileName ist nicht installiert."
        return
    }

    & $health -ConfigPath (Join-Path $InstallPath $ConfigFileName)
}


function ConvertTo-PlainText {
    param([Parameter(Mandatory)][Security.SecureString]$SecureString)

    $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString)

    try {
        return [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)
    }
    finally {
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)
    }
}

function Invoke-Pbkdf2Sha256 {
    param(
        [Parameter(Mandatory)][string]$Password,
        [Parameter(Mandatory)][byte[]]$Salt,
        [Parameter(Mandatory)][int]$Iterations,
        [int]$Length = 32
    )

    if ($Iterations -lt 1) {
        throw "Iterations must be greater than zero."
    }

    # Auf unterstützten .NET-Framework-Versionen verwenden wir die native,
    # schnelle PBKDF2-SHA256-Implementierung.
    try {
        $derive = New-Object System.Security.Cryptography.Rfc2898DeriveBytes(
            $Password,
            $Salt,
            $Iterations,
            [System.Security.Cryptography.HashAlgorithmName]::SHA256
        )

        try {
            return $derive.GetBytes($Length)
        }
        finally {
            $derive.Dispose()
        }
    }
    catch {
        # Kompatibilitäts-Fallback für ältere .NET-Framework-Stände.
        $hmac = New-Object System.Security.Cryptography.HMACSHA256
        $hmac.Key = [Text.Encoding]::UTF8.GetBytes($Password)

        try {
            $hashLength = 32
            $blocks = [Math]::Ceiling($Length / [double]$hashLength)
            $output = New-Object byte[] ($blocks * $hashLength)
            $offset = 0

            for ($block = 1; $block -le $blocks; $block++) {
                $blockBytes = [BitConverter]::GetBytes([int]$block)
                if ([BitConverter]::IsLittleEndian) {
                    [Array]::Reverse($blockBytes)
                }

                $input = New-Object byte[] ($Salt.Length + 4)
                [Array]::Copy($Salt, 0, $input, 0, $Salt.Length)
                [Array]::Copy($blockBytes, 0, $input, $Salt.Length, 4)

                $u = $hmac.ComputeHash($input)
                $t = New-Object byte[] $u.Length
                [Array]::Copy($u, $t, $u.Length)

                for ($i = 2; $i -le $Iterations; $i++) {
                    $u = $hmac.ComputeHash($u)
                    for ($j = 0; $j -lt $t.Length; $j++) {
                        $t[$j] = $t[$j] -bxor $u[$j]
                    }
                }

                [Array]::Copy($t, 0, $output, $offset, $t.Length)
                $offset += $t.Length
            }

            $result = New-Object byte[] $Length
            [Array]::Copy($output, 0, $result, 0, $Length)
            return $result
        }
        finally {
            $hmac.Dispose()
        }
    }
}

function New-SmtpPasswordRecord {
    param([Parameter(Mandatory)][Security.SecureString]$Password)

    $plain = ConvertTo-PlainText -SecureString $Password

    try {
        $salt = New-Object byte[] 16
        $rng = [Security.Cryptography.RandomNumberGenerator]::Create()

        try {
            $rng.GetBytes($salt)
        }
        finally {
            $rng.Dispose()
        }

        $iterations = 150000
        $hash = Invoke-Pbkdf2Sha256 `
            -Password $plain `
            -Salt $salt `
            -Iterations $iterations `
            -Length 32

        return [pscustomobject]@{
            Salt = [Convert]::ToBase64String($salt)
            PasswordHash = [Convert]::ToBase64String($hash)
            Iterations = $iterations
        }
    }
    finally {
        $plain = $null
    }
}

function Ensure-SmtpAuthConfig {
    param([Parameter(Mandatory)]$Config)

    if (-not ($Config.Smtp.PSObject.Properties.Name -contains "RequireAuth")) {
        $Config.Smtp | Add-Member -NotePropertyName RequireAuth -NotePropertyValue $false
    }

    if (-not ($Config.Smtp.PSObject.Properties.Name -contains "AuthMaxFailures")) {
        $Config.Smtp | Add-Member -NotePropertyName AuthMaxFailures -NotePropertyValue 5
    }

    if (-not ($Config.Smtp.PSObject.Properties.Name -contains "AllowUnauthenticatedNetworks")) {
        $Config.Smtp | Add-Member -NotePropertyName AllowUnauthenticatedNetworks -NotePropertyValue @()
    }

    if (-not ($Config.Smtp.PSObject.Properties.Name -contains "AuthUsers")) {
        $Config.Smtp | Add-Member -NotePropertyName AuthUsers -NotePropertyValue @()
    }

    return $Config
}

function Save-SmtpAuthConfigAndRestart {
    param([Parameter(Mandatory)]$Config)

    Write-RelayConfig -Config $Config -TargetPath $InstallPath
    Ensure-ScheduledTask -TargetPath $InstallPath

    Stop-RelayTask
    Start-RelayTask
}


function Get-FailedQueuePath {
    param([Parameter(Mandatory)]$Config)

    $path = [string]$Config.Paths.Failed

    if ([IO.Path]::IsPathRooted($path)) {
        return $path
    }

    return (Join-Path $InstallPath $path)
}

function Get-PendingQueuePath {
    param([Parameter(Mandatory)]$Config)

    $path = [string]$Config.Paths.Queue

    if (-not [IO.Path]::IsPathRooted($path)) {
        $path = Join-Path $InstallPath $path
    }

    return (Join-Path $path "pending")
}

function Get-FailedQueueEntries {
    param([Parameter(Mandatory)]$Config)

    $failedPath = Get-FailedQueuePath -Config $Config

    if (-not (Test-Path -LiteralPath $failedPath)) {
        return @()
    }

    $entries = @()

    foreach ($file in Get-ChildItem -LiteralPath $failedPath -Filter "*.eml" -File -ErrorAction SilentlyContinue | Sort-Object LastWriteTime) {
        $metaPath = "$($file.FullName).json"
        $meta = $null

        if (Test-Path -LiteralPath $metaPath) {
            try {
                $meta = Get-Content -LiteralPath $metaPath -Raw -Encoding UTF8 | ConvertFrom-Json
            }
            catch {}
        }

        $queueId = [IO.Path]::GetFileNameWithoutExtension($file.Name)
        if ($meta -and $meta.PSObject.Properties.Name -contains "QueueId" -and $meta.QueueId) {
            $queueId = [string]$meta.QueueId
        }

        $entries += [pscustomobject]@{
            QueueId = $queueId
            FileName = $file.Name
            Path = $file.FullName
            MetaPath = $metaPath
            SizeKB = [Math]::Round($file.Length / 1KB, 1)
            FailedSince = $file.LastWriteTime
            RetryCount = if ($meta -and $meta.RetryCount -ne $null) { [int]$meta.RetryCount } else { $null }
            From = if ($meta) { [string]$meta.EnvelopeFrom } else { "" }
            Recipients = if ($meta) { (@($meta.EnvelopeRecipients) -join ", ") } else { "" }
            LastStatusCode = if ($meta) { [string]$meta.LastStatusCode } else { "" }
            LastError = if ($meta) { [string]$meta.LastError } else { "" }
            AuthenticatedUser = if ($meta -and $meta.PSObject.Properties.Name -contains "AuthenticatedUser") { [string]$meta.AuthenticatedUser } else { "" }
            Meta = $meta
        }
    }

    return @($entries)
}

function Retry-FailedQueueEntry {
    param(
        [Parameter(Mandatory)]$Config,
        [Parameter(Mandatory)]$Entry
    )

    $pendingPath = Get-PendingQueuePath -Config $Config
    New-Item -ItemType Directory -Path $pendingPath -Force | Out-Null

    $targetEml = Join-Path $pendingPath $Entry.FileName
    $targetMeta = "$targetEml.json"

    if (Test-Path -LiteralPath $targetEml) {
        throw "Pending enthält bereits '$($Entry.FileName)'."
    }

    if ($Entry.Meta) {
        $meta = $Entry.Meta

        if ($meta.PSObject.Properties.Name -contains "RetryCount") {
            $meta.RetryCount = 0
        } else {
            $meta | Add-Member -NotePropertyName RetryCount -NotePropertyValue 0
        }

        $now = [DateTime]::UtcNow.ToString("o")

        if ($meta.PSObject.Properties.Name -contains "NextAttemptUtc") {
            $meta.NextAttemptUtc = $now
        } else {
            $meta | Add-Member -NotePropertyName NextAttemptUtc -NotePropertyValue $now
        }

        if ($meta.PSObject.Properties.Name -contains "RequeuedUtc") {
            $meta.RequeuedUtc = $now
        } else {
            $meta | Add-Member -NotePropertyName RequeuedUtc -NotePropertyValue $now
        }

        $meta | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $Entry.MetaPath -Encoding UTF8
    }

    if (Test-Path -LiteralPath $Entry.MetaPath) {
        Move-Item -LiteralPath $Entry.MetaPath -Destination $targetMeta -Force
    }

    Move-Item -LiteralPath $Entry.Path -Destination $targetEml -Force
}

function Remove-FailedQueueEntry {
    param([Parameter(Mandatory)]$Entry)

    Remove-Item -LiteralPath $Entry.Path -Force -ErrorAction Stop
    Remove-Item -LiteralPath $Entry.MetaPath -Force -ErrorAction SilentlyContinue
}

function Manage-FailedQueue {
    $config = Get-RelayConfig -TargetPath $InstallPath

    if (-not $config) {
        Write-Fail "config.json nicht gefunden."
        return
    }

    while ($true) {
        Clear-Host
        Write-Title "SMTPGraphRelay - Failed Queue"

        $entries = @(Get-FailedQueueEntries -Config $config)

        Write-Host "Failed-Mails: $($entries.Count)"
        Write-Host ""

        Write-Host " [1] Failed Queue anzeigen"
        Write-Host " [2] Details einer Mail anzeigen"
        Write-Host " [3] Eine Mail erneut zustellen"
        Write-Host " [4] Alle Mails erneut zustellen"
        Write-Host " [5] Eine Mail endgültig löschen"
        Write-Host " [6] Alle Failed-Mails endgültig löschen"
        Write-Host " [0] Zurück"
        Write-Host ""

        $choice = Read-Host "Auswahl"

        switch ($choice) {
            "1" {
                if ($entries.Count -eq 0) {
                    Write-Ok "Failed Queue ist leer."
                }
                else {
                    $entries |
                        Select-Object QueueId,FailedSince,RetryCount,From,Recipients,LastStatusCode,SizeKB |
                        Format-Table -AutoSize
                }

                Read-Host "Enter"
            }

            "2" {
                $id = Read-Host "Queue-ID"

                $entry = $entries |
                    Where-Object { $_.QueueId -eq $id -or $_.FileName -eq $id -or $_.FileName -eq "$id.eml" } |
                    Select-Object -First 1

                if (-not $entry) {
                    Write-Fail "Queue-ID '$id' nicht gefunden."
                }
                else {
                    Write-Host ""
                    Write-Host "Queue-ID:      $($entry.QueueId)"
                    Write-Host "Datei:         $($entry.FileName)"
                    Write-Host "Fehlgeschlagen:$($entry.FailedSince)"
                    Write-Host "RetryCount:    $($entry.RetryCount)"
                    Write-Host "Von:           $($entry.From)"
                    Write-Host "An:            $($entry.Recipients)"
                    Write-Host "Auth-User:     $($entry.AuthenticatedUser)"
                    Write-Host "Status:        $($entry.LastStatusCode)"
                    Write-Host "Größe:         $($entry.SizeKB) KB"
                    Write-Host ""
                    Write-Host "Letzter Fehler:" -ForegroundColor Yellow
                    Write-Host $entry.LastError
                }

                Read-Host "Enter"
            }

            "3" {
                $id = Read-Host "Queue-ID"

                $entry = $entries |
                    Where-Object { $_.QueueId -eq $id -or $_.FileName -eq $id -or $_.FileName -eq "$id.eml" } |
                    Select-Object -First 1

                if (-not $entry) {
                    Write-Fail "Queue-ID '$id' nicht gefunden."
                }
                else {
                    Retry-FailedQueueEntry -Config $config -Entry $entry
                    Write-Ok "[$($entry.QueueId)] zurück nach pending verschoben."
                }

                Read-Host "Enter"
            }

            "4" {
                if ($entries.Count -eq 0) {
                    Write-Ok "Failed Queue ist leer."
                }
                elseif (Confirm-Yes "Alle $($entries.Count) Failed-Mails erneut zustellen?") {
                    $ok = 0
                    $failed = 0

                    foreach ($entry in $entries) {
                        try {
                            Retry-FailedQueueEntry -Config $config -Entry $entry
                            $ok++
                        }
                        catch {
                            $failed++
                            Write-Warn "[$($entry.QueueId)] konnte nicht requeued werden: $($_.Exception.Message)"
                        }
                    }

                    Write-Ok "$ok Mail(s) zurück nach pending verschoben."
                    if ($failed -gt 0) {
                        Write-Warn "$failed Mail(s) konnten nicht verschoben werden."
                    }
                }

                Read-Host "Enter"
            }

            "5" {
                $id = Read-Host "Queue-ID"

                $entry = $entries |
                    Where-Object { $_.QueueId -eq $id -or $_.FileName -eq $id -or $_.FileName -eq "$id.eml" } |
                    Select-Object -First 1

                if (-not $entry) {
                    Write-Fail "Queue-ID '$id' nicht gefunden."
                }
                elseif (Confirm-Yes "[$($entry.QueueId)] endgültig aus Failed löschen?") {
                    Remove-FailedQueueEntry -Entry $entry
                    Write-Ok "[$($entry.QueueId)] gelöscht."
                }

                Read-Host "Enter"
            }

            "6" {
                if ($entries.Count -eq 0) {
                    Write-Ok "Failed Queue ist leer."
                }
                elseif (Confirm-Yes "WIRKLICH alle $($entries.Count) Failed-Mails endgültig löschen?") {
                    if (Confirm-Yes "Endgültiges Löschen nochmals bestätigen?") {
                        $ok = 0

                        foreach ($entry in $entries) {
                            try {
                                Remove-FailedQueueEntry -Entry $entry
                                $ok++
                            }
                            catch {
                                Write-Warn "[$($entry.QueueId)] konnte nicht gelöscht werden."
                            }
                        }

                        Write-Ok "$ok Failed-Mail(s) endgültig gelöscht."
                    }
                }

                Read-Host "Enter"
            }

            "0" {
                return
            }

            default {
                Write-Warn "Ungültige Auswahl."
                Start-Sleep -Seconds 1
            }
        }

        $config = Get-RelayConfig -TargetPath $InstallPath
    }
}

function Manage-SmtpAuth {
    $config = Get-RelayConfig -TargetPath $InstallPath

    if (-not $config) {
        Write-Fail "config.json nicht gefunden."
        return
    }

    $config = Ensure-SmtpAuthConfig -Config $config

    while ($true) {
        Clear-Host
        Write-Title "SMTPGraphRelay - SMTP-AUTH"

        $users = @($config.Smtp.AuthUsers)
        $authState = if ([bool]$config.Smtp.RequireAuth) { "ERFORDERLICH" } else { "optional / nicht erforderlich" }

        Write-Host "Status:                   $authState"
        Write-Host "Benutzer:                 $($users.Count)"
        Write-Host "Max. Fehlversuche:        $($config.Smtp.AuthMaxFailures)"
        Write-Host "Ohne Auth erlaubte Netze: $(@($config.Smtp.AllowUnauthenticatedNetworks) -join ', ')"
        Write-Host ""
        Write-Host " [1] SMTP-AUTH erforderlich EIN/AUS"
        Write-Host " [2] Benutzer hinzufügen"
        Write-Host " [3] Benutzer anzeigen"
        Write-Host " [4] Passwort ändern"
        Write-Host " [5] Benutzer löschen"
        Write-Host " [6] Netze ohne Auth verwalten"
        Write-Host " [7] Max. Fehlversuche ändern"
        Write-Host " [0] Zurück"
        Write-Host ""

        $choice = Read-Host "Auswahl"

        switch ($choice) {
            "1" {
                $config.Smtp.RequireAuth = -not [bool]$config.Smtp.RequireAuth

                if ($config.Smtp.RequireAuth -and @($config.Smtp.AuthUsers).Count -eq 0) {
                    Write-Warn "AUTH wurde aktiviert, aber es existiert noch kein SMTP-Benutzer."
                }

                Save-SmtpAuthConfigAndRestart -Config $config
                Write-Ok "SMTP-AUTH Status geändert."
                Read-Host "Enter"
            }

            "2" {
                $username = Read-Host "Benutzername"

                if ([string]::IsNullOrWhiteSpace($username) -or $username -notmatch '^[A-Za-z0-9._@-]{1,128}$') {
                    Write-Fail "Ungültiger Benutzername."
                    Read-Host "Enter"
                    continue
                }

                $existing = @($config.Smtp.AuthUsers) |
                    Where-Object { ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) } |
                    Select-Object -First 1

                if ($existing) {
                    Write-Fail "Benutzer '$username' existiert bereits."
                    Read-Host "Enter"
                    continue
                }

                $p1 = Read-Host "Passwort" -AsSecureString
                $p2 = Read-Host "Passwort wiederholen" -AsSecureString

                $plain1 = ConvertTo-PlainText -SecureString $p1
                $plain2 = ConvertTo-PlainText -SecureString $p2

                try {
                    if ($plain1.Length -lt 8) {
                        Write-Fail "Passwort muss mindestens 8 Zeichen lang sein."
                        Read-Host "Enter"
                        continue
                    }

                    if ($plain1 -cne $plain2) {
                        Write-Fail "Passwörter stimmen nicht überein."
                        Read-Host "Enter"
                        continue
                    }
                }
                finally {
                    $plain1 = $null
                    $plain2 = $null
                }

                $record = New-SmtpPasswordRecord -Password $p1

                $newUser = [pscustomobject]@{
                    Username = $username
                    Salt = $record.Salt
                    PasswordHash = $record.PasswordHash
                    Iterations = $record.Iterations
                }

                $config.Smtp.AuthUsers = @($config.Smtp.AuthUsers) + @($newUser)

                Save-SmtpAuthConfigAndRestart -Config $config
                Write-Ok "SMTP-Benutzer '$username' angelegt."
                Read-Host "Enter"
            }

            "3" {
                Write-Host ""

                if (@($config.Smtp.AuthUsers).Count -eq 0) {
                    Write-Warn "Keine SMTP-Benutzer vorhanden."
                }
                else {
                    @($config.Smtp.AuthUsers) |
                        Select-Object Username,Iterations |
                        Format-Table -AutoSize
                }

                Read-Host "Enter"
            }

            "4" {
                $username = Read-Host "Benutzername"

                $user = @($config.Smtp.AuthUsers) |
                    Where-Object { ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) } |
                    Select-Object -First 1

                if (-not $user) {
                    Write-Fail "Benutzer '$username' nicht gefunden."
                    Read-Host "Enter"
                    continue
                }

                $p1 = Read-Host "Neues Passwort" -AsSecureString
                $p2 = Read-Host "Passwort wiederholen" -AsSecureString

                $plain1 = ConvertTo-PlainText -SecureString $p1
                $plain2 = ConvertTo-PlainText -SecureString $p2

                try {
                    if ($plain1.Length -lt 8) {
                        Write-Fail "Passwort muss mindestens 8 Zeichen lang sein."
                        Read-Host "Enter"
                        continue
                    }

                    if ($plain1 -cne $plain2) {
                        Write-Fail "Passwörter stimmen nicht überein."
                        Read-Host "Enter"
                        continue
                    }
                }
                finally {
                    $plain1 = $null
                    $plain2 = $null
                }

                $record = New-SmtpPasswordRecord -Password $p1
                $user.Salt = $record.Salt
                $user.PasswordHash = $record.PasswordHash
                $user.Iterations = $record.Iterations

                Save-SmtpAuthConfigAndRestart -Config $config
                Write-Ok "Passwort für '$username' geändert."
                Read-Host "Enter"
            }

            "5" {
                $username = Read-Host "Benutzername"

                $found = @($config.Smtp.AuthUsers) |
                    Where-Object { ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) }

                if (-not $found) {
                    Write-Fail "Benutzer '$username' nicht gefunden."
                    Read-Host "Enter"
                    continue
                }

                if (Confirm-Yes "Benutzer '$username' wirklich löschen?") {
                    $config.Smtp.AuthUsers = @(
                        $config.Smtp.AuthUsers |
                        Where-Object { -not ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) }
                    )

                    Save-SmtpAuthConfigAndRestart -Config $config
                    Write-Ok "Benutzer '$username' gelöscht."
                }

                Read-Host "Enter"
            }

            "6" {
                $current = @($config.Smtp.AllowUnauthenticatedNetworks) -join ","
                $input = Read-Default "Netze/IPs ohne AUTH, Komma getrennt; '-' für keine" $(if ($current) { $current } else { "-" })

                if ($input -eq "-") {
                    $config.Smtp.AllowUnauthenticatedNetworks = @()
                }
                else {
                    $config.Smtp.AllowUnauthenticatedNetworks = @(
                        $input -split "," |
                        ForEach-Object { $_.Trim() } |
                        Where-Object { $_ }
                    )
                }

                Save-SmtpAuthConfigAndRestart -Config $config
                Write-Ok "Ausnahmen für SMTP-AUTH gespeichert."
                Read-Host "Enter"
            }

            "7" {
                $value = Read-Host "Maximale Fehlversuche pro Verbindung [aktuell: $($config.Smtp.AuthMaxFailures)]"

                if ($value -match '^\d+$' -and [int]$value -ge 1 -and [int]$value -le 100) {
                    $config.Smtp.AuthMaxFailures = [int]$value
                    Save-SmtpAuthConfigAndRestart -Config $config
                    Write-Ok "Maximale Fehlversuche geändert."
                }
                else {
                    Write-Fail "Bitte einen Wert zwischen 1 und 100 eingeben."
                }

                Read-Host "Enter"
            }

            "0" {
                return
            }

            default {
                Write-Warn "Ungültige Auswahl."
                Start-Sleep -Seconds 1
            }
        }

        # Config nach jeder Änderung neu laden, damit Serialisierung/Arrays exakt
        # dem installierten Zustand entsprechen.
        $config = Get-RelayConfig -TargetPath $InstallPath
        $config = Ensure-SmtpAuthConfig -Config $config
    }
}

function Uninstall-Relay {
    Write-Title "SMTPGraphRelay - Deinstallation"

    $config = Get-RelayConfig -TargetPath $InstallPath

    Write-Warn "Lokale Deinstallation entfernt Task, Firewallregel und auf Wunsch das lokale Zertifikat."
    if (-not (Confirm-Yes "Lokale SMTPGraphRelay-Installation wirklich entfernen?")) {
        return
    }

    Stop-RelayTask
    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
    Write-Ok "Scheduled Task entfernt."

    Get-NetFirewallRule -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -like "SMTPGraphRelay TCP *" } |
        Remove-NetFirewallRule -ErrorAction SilentlyContinue
    Write-Ok "SMTPGraphRelay Firewallregeln entfernt."

    if ($config -and $config.Graph.CertificateThumbprint) {
        if (Confirm-Yes "Lokales Relay-Zertifikat $($config.Graph.CertificateThumbprint) entfernen?") {
            Remove-Item -LiteralPath "Cert:\LocalMachine\My\$($config.Graph.CertificateThumbprint)" -Force -ErrorAction SilentlyContinue
            Write-Ok "Lokales Zertifikat entfernt."
        }
    }

    if ($config -and (Confirm-Yes "Auch Entra-App und Exchange-RBAC-Objekte entfernen?")) {
        Ensure-Modules -IncludeExchange

        Write-Warn "Cloud-Cleanup ist destruktiv und betrifft die konfigurierte ClientId:"
        Write-Host "  $($config.Graph.ClientId)" -ForegroundColor Yellow

        if (Confirm-Yes "Cloud-Cleanup endgültig bestätigen?") {
            Connect-RelayGraphAdmin -TenantId $config.Graph.TenantId

            try {
                $app = Get-MgApplication -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName" | Select-Object -First 1
                $sp = Get-MgServicePrincipal -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName" | Select-Object -First 1

                if ($sp) {
                    Import-Module ExchangeOnlineManagement -Force -ErrorAction Stop
                    Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

                    try {
                        $shortId = $config.Graph.ClientId.Substring(0,8)
                        $scopeName = "SMTPGraphRelay-$shortId-Sender"
                        $assignmentName = "SMTPGraphRelay-$shortId-MailSend"

                        Remove-ManagementRoleAssignment -Identity $assignmentName -Confirm:$false -ErrorAction SilentlyContinue
                        Remove-ManagementScope -Identity $scopeName -Confirm:$false -ErrorAction SilentlyContinue

                        # Exchange Service Principal Referenz löschen, wenn Cmdlet verfügbar.
                        if (Get-Command Remove-ServicePrincipal -ErrorAction SilentlyContinue) {
                            Remove-ServicePrincipal -Identity $sp.Id -Confirm:$false -ErrorAction SilentlyContinue
                        }

                        Write-Ok "Exchange-RBAC-Objekte bereinigt."
                    }
                    finally {
                        Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
                    }

                    Remove-MgServicePrincipal -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue
                    Write-Ok "Entra Service Principal entfernt."
                }

                if ($app) {
                    Remove-MgApplication -ApplicationId $app.Id -ErrorAction SilentlyContinue
                    Write-Ok "Entra App Registration entfernt."
                }
            }
            finally {
                Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
            }
        }
    }

    # Programmdateien. Wenn der Installer selbst aus dem Zielordner läuft, kann er
    # sich nicht zuverlässig selbst löschen. Dann bleiben Setup + Ordner bis nach Ende stehen.
    $currentInstaller = [IO.Path]::GetFullPath($PSCommandPath)
    $targetFull = [IO.Path]::GetFullPath($InstallPath)

    foreach ($item in Get-ChildItem -LiteralPath $InstallPath -Force -ErrorAction SilentlyContinue) {
        try {
            if ($item.FullName -eq $currentInstaller) {
                continue
            }

            Remove-Item -LiteralPath $item.FullName -Recurse -Force -ErrorAction Stop
        }
        catch {
            Write-Warn "Konnte nicht entfernen: $($item.FullName)"
        }
    }

    Write-Ok "Lokale Programmdateien entfernt."
    if ($currentInstaller.StartsWith($targetFull, [StringComparison]::OrdinalIgnoreCase)) {
        Write-Warn "Der aktuell laufende Installer bleibt übrig. Nach dem Beenden kann '$InstallPath' manuell gelöscht werden."
    }

    Write-Title "Deinstallation abgeschlossen"
}

function Show-Status {
    Write-Title "SMTPGraphRelay - Status"

    $configPath = Join-Path $InstallPath $ConfigFileName
    Write-Host "Installationspfad: $InstallPath"

    if (Test-Path -LiteralPath $configPath) {
        Write-Ok "config.json vorhanden."
        try {
            $config = Get-RelayConfig -TargetPath $InstallPath
            Write-Host "  Sender: $($config.Graph.SenderMailbox)"
            Write-Host "  SMTP:   $($config.Smtp.ListenAddress):$($config.Smtp.Port)"
            Write-Host "  Client: $($config.Graph.ClientId)"

            if ($config.Smtp.PSObject.Properties.Name -contains "RequireAuth") {
                $authText = if ([bool]$config.Smtp.RequireAuth) { "erforderlich" } else { "optional / aus" }
                $authUsers = if ($config.Smtp.PSObject.Properties.Name -contains "AuthUsers") { @($config.Smtp.AuthUsers).Count } else { 0 }
                Write-Host "  AUTH:   $authText ($authUsers Benutzer)"
            }

            try {
                $failedCount = @(Get-FailedQueueEntries -Config $config).Count
                Write-Host "  Failed: $failedCount Mail(s)"
            } catch {}
        } catch {}
    }
    else {
        Write-Warn "Keine config.json vorhanden."
    }

    $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
    if ($task) {
        Write-Host "Task State: $($task.State)"
    }
    else {
        Write-Warn "Scheduled Task nicht vorhanden."
    }
}

function Show-Menu {
    Clear-Host
    Write-Title "SMTPGraphRelay - Bootstrap / Repair / Online Update"
    Write-Host "Installationspfad: $InstallPath" -ForegroundColor DarkGray

    $installedVersion = Get-InstalledVersion -TargetPath $InstallPath

    if ($installedVersion -and $installedVersion.Version) {
        Write-Host "Installiert: $($installedVersion.Version)" -ForegroundColor DarkGray
    }

    Write-Host "Updatequelle: Gitea / main" -ForegroundColor DarkGray
    Write-Host ""
    Write-Host " [1] Neuinstallation aus Gitea"
    Write-Host " [2] Installation aus Gitea reparieren"
    Write-Host " [3] Nach Online-Updates suchen"
    Write-Host " [4] Entra / Exchange RBAC prüfen"
    Write-Host " [5] Zertifikat erneuern"
    Write-Host " [6] Health Check ausführen"
    Write-Host " [7] Deinstallieren"
    Write-Host " [8] Status anzeigen"
    Write-Host " [9] SMTP-AUTH verwalten"
    Write-Host " [10] Failed Queue verwalten"
    Write-Host " [0] Beenden"
    Write-Host ""
}

Assert-WindowsPowerShell51

while ($true) {
    Show-Menu
    $choice = Read-Host "Auswahl"

    try {
        switch ($choice) {
            "1" { Install-New }
            "2" { Repair-Installation }
            "3" { Update-Relay }
            "4" { Verify-CloudRbac }
            "5" { Invoke-CertificateRenewal }
            "6" { Invoke-HealthCheck }
            "7" { Uninstall-Relay }
            "8" { Show-Status }
            "9" { Manage-SmtpAuth }
            "10" { Manage-FailedQueue }
            "0" { break }
            default { Write-Warn "Ungültige Auswahl." }
        }
    }
    catch {
        Write-Host ""
        Write-Fail $_.Exception.Message
        if ($_.ScriptStackTrace) {
            Write-Host $_.ScriptStackTrace -ForegroundColor DarkYellow
        }
    }

    if ($choice -ne "0") {
        Write-Host ""
        Read-Host "Enter drücken, um zum Menü zurückzukehren"
    }

    if ($choice -eq "0") {
        break
    }
}