<#
.SYNOPSIS
    Windows-Pendant zum Newt-Installer (Bash).
    Unterstützt: --install, --update, --reinstall, --uninstall
#>

# 1. TLS 1.2 erzwingen (Wichtig für GitHub Downloads auf Windows Server)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 2. Variablen definieren
$Repo = "fosrl/newt"
$InstallDir = "C:\Program Files\me-msp-newt"
$ServiceName = "MAIEREDV-Managed-Site-Client"
$Symlink = "$InstallDir\newt_latest.exe"
$TaskName = "Newt-Updater"

# Helfer für bunte Ausgaben
function Write-Info($msg) { Write-Host "[INFO] $msg" -ForegroundColor Green }
function Write-Warn($msg) { Write-Host "[WARN] $msg" -ForegroundColor Yellow }
function Write-ErrorMsg($msg) { Write-Host "[ERROR] $msg" -ForegroundColor Red; exit 1 }

# 3. Neueste Version von GitHub holen (API)
function Get-LatestVersion {
    try {
        $url = "https://api.github.com/repos/$Repo/releases/latest"
        $json = Invoke-RestMethod -Uri $url -UseBasicParsing
        return $json.tag_name.TrimStart('v')
    } catch {
        Write-ErrorMsg "Konnte Version nicht von GitHub abrufen."
    }
}

# 4. Download via BITS (Server-sicher)
function Download-Newt {
    param($Version)
    $Arch = if ([Environment]::Is64BitOperatingSystem) { "newt_windows_amd64.exe" } else { "newt_windows_386.exe" }
    $Url = "https://github.com/$Repo/releases/download/v$Version/$Arch"
    $Target = "$InstallDir\newt_$Version.exe"

    if (!(Test-Path $InstallDir)) { New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null }

    Write-Info "⬇️ Downloading $Url via BITS..."
    try {
        Start-BitsTransfer -Source $Url -Destination $Target -ErrorAction Stop
        Copy-Item -Path $Target -Destination $Symlink -Force
        Write-Info "✅ Installiert: newt $Version unter $Target"
    } catch {
        Write-ErrorMsg "Download fehlgeschlagen: $_"
    }
}

# 5. Dienst erstellen (Nativ mit PowerShell-Wrapper)
function Setup-Service {
    $PangolinID = Read-Host "🆔 Bitte Pangolin ID eingeben"
    $PangolinSecret = Read-Host "🔑 Bitte Secret eingeben"
    $PangolinEndpoint = Read-Host "🌐 Bitte Endpoint eingeben (z.B. https://pangolin.domain.com)"

    $ArgList = "--id $PangolinID --secret $PangolinSecret --endpoint $PangolinEndpoint"
    
    # Da newt.exe kein nativer Windows-Service ist, nutzen wir einen PowerShell-Wrapper
    # Dieser verhindert den "Dienst antwortete nicht rechtzeitig" Fehler.
    $BinaryPath = "powershell.exe -WindowStyle Hidden -Command `"$Symlink $ArgList`""

    if (Get-Service $ServiceName -ErrorAction SilentlyContinue) {
        Write-Warn "Dienst existiert bereits. Aktualisiere Konfiguration..."
        Stop-Service $ServiceName -Force -ErrorAction SilentlyContinue
        # Set-Service kann den BinaryPath nicht direkt ändern, daher sc.exe (nativ)
        & sc.exe config $ServiceName binPath= $BinaryPath
    } else {
        New-Service -Name $ServiceName `
                    -BinaryPathName $BinaryPath `
                    -DisplayName "MAIEREDV Managed Site Client" `
                    -StartupType Automatic
    }
    
    Start-Service $ServiceName
    Write-Info "🛠️ Dienst $ServiceName gestartet."
}

# 6. Täglicher Update-Task (Pendant zum systemd timer)
function Setup-UpdateTask {
    if (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue) {
        Write-Info "⏳ Update-Task existiert bereits."
        return
    }

    $ScriptPath = $MyInvocation.MyCommand.Path
    # Falls als One-Liner ausgeführt, hier festen Pfad oder URL eintragen:
    $ActionCommand = "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command `"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('DEINE_GITEA_URL_ZUM_SCRIPT')) -mode update`""
    
    $Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $ActionCommand
    $Trigger = New-ScheduledTaskTrigger -Daily -At 3am
    
    Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName $TaskName -User "SYSTEM" -Force | Out-Null
    Write-Info "✅ Täglicher Update-Task (03:00 Uhr) erstellt."
}

# 7. Modi
function Mode-Install {
    $v = Get-LatestVersion
    if (Test-Path "$InstallDir\newt_$v.exe") {
        Write-Warn "⚠️ Version $v ist bereits installiert. Nutze --reinstall."
        Setup-UpdateTask
        return
    }
    Download-Newt $v
    Setup-Service
    Setup-UpdateTask
    Write-Info "🚀 Installation abgeschlossen!"
}

function Mode-Update {
    $v = Get-LatestVersion
    if (Test-Path "$InstallDir\newt_$v.exe") {
        Write-Info "✅ Version $v ist aktuell. Nichts zu tun."
        return
    }
    Download-Newt $v
    Restart-Service $ServiceName
    Write-Info "🚀 Update auf $v abgeschlossen!"
}

function Mode-Uninstall {
    Write-Warn "⚠️ Deinstalliere Newt..."
    if (Get-Service $ServiceName -ErrorAction SilentlyContinue) {
        Stop-Service $ServiceName -Force
        $service = Get-CimInstance Win32_Service -Filter "Name='$ServiceName'"
        $service | Remove-CimInstance
    }
    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
    Write-Info "🧹 Dienst und Task entfernt. Ordner $InstallDir bitte manuell löschen falls gewünscht."
}

# 8. Main Logic
param([string]$mode = "install")

switch ($mode) {
    "install"   { Mode-Install }
    "update"    { Mode-Update }
    "reinstall" { Download-Newt (Get-LatestVersion); Setup-Service; Setup-UpdateTask }
    "uninstall" { Mode-Uninstall }
    default     { Write-ErrorMsg "Unbekannter Parameter: $mode (Nutze install, update, reinstall, uninstall)" }
}