<#
.SYNOPSIS
    Windows-Installer für den Newt-Client mit NSSM.
    Version 4 - Finaler Download-Fix via Chocolatey CDN.
#>
param([string]$mode = "install")

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8

$Repo = "fosrl/newt"
$InstallDir = "C:\Program Files\me-msp-newt"
$ServiceName = "MAIEREDV-Managed-Site-Client"
$Symlink = "$InstallDir\newt_latest.exe"
$NssmPath = "$InstallDir\nssm.exe"
$UpdaterTaskName = "MAIEREDV-Newt-Updater"
$GiteaUrl = "https://gitea.vmd55888.de/manuel.maier/update-install-newt/raw/branch/main/install_newt-msp-site_v2.ps1"

function Write-Log($msg, $color = "White") { Write-Host "[$(Get-Date -Format 'HH:mm:ss')] $msg" -ForegroundColor $color }

function Get-NSSM {
    if (Test-Path $NssmPath) { return }
    if (!(Test-Path $InstallDir)) { New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null }
    
    Write-Log "NSSM wird von Chocolatey Mirror geladen..." "Cyan"
    $tempZip = "$env:TEMP\nssm_pkg.zip"
    
    # Chocolatey nutzt ein sehr stabiles CDN. Das Paket ist ein ZIP (nupkg).
    $nssmDownloadUrl = "https://community.chocolatey.org/api/v2/package/nssm/2.24.101"
    
    try {
        Invoke-WebRequest -Uri $nssmDownloadUrl -OutFile $tempZip -UseBasicParsing -ErrorAction Stop
        
        # Entpacken (nupkg ist ein Zip-Format)
        $extractPath = "$env:TEMP\nssm_temp"
        if (Test-Path $extractPath) { Remove-Item $extractPath -Recurse -Force }
        
        Add-Type -AssemblyName System.IO.Compression.FileSystem
        [System.IO.Compression.ZipFile]::ExtractToDirectory($tempZip, $extractPath)
        
        $archDir = if ([Environment]::Is64BitOperatingSystem) { "win64" } else { "win32" }
        # Im Chocolatey Paket liegen die Exes unter /tools
        Copy-Item "$extractPath\tools\$archDir\nssm.exe" -Destination $NssmPath -Force
        
        Write-Log "NSSM erfolgreich bereitgestellt." "Green"
    } catch {
        Write-Log "FEHLER: Download von $nssmDownloadUrl fehlgeschlagen: $_" "Red"
        exit 1
    } finally {
        if (Test-Path $tempZip) { Remove-Item $tempZip -Force }
        if (Test-Path $extractPath) { Remove-Item $extractPath -Recurse -Force }
    }
}

function Get-LatestVersion {
    try {
        $url = "https://api.github.com/repos/$Repo/releases/latest"
        $json = Invoke-RestMethod -Uri $url -UseBasicParsing
        return $json.tag_name
    } catch {
        Write-Log "FEHLER: Konnte Newt-Version nicht abrufen." "Red"; exit 1
    }
}

function Download-Newt {
    param($FullVersion)
    $ArchSuffix = if ([Environment]::Is64BitOperatingSystem) { "windows_amd64.exe" } else { "windows_386.exe" }
    $VersionOnly = $FullVersion.TrimStart('v')
    $Url = "https://github.com/$Repo/releases/download/$VersionOnly/newt_$ArchSuffix"
    $Target = "$InstallDir\newt_$VersionOnly.exe"

    Get-NSSM
    Write-Log "Download Newt $VersionOnly..." "Cyan"
    try {
        Invoke-WebRequest -Uri $Url -OutFile $Target -UseBasicParsing -ErrorAction Stop
        Copy-Item -Path $Target -Destination $Symlink -Force
    } catch {
        Write-Log "FEHLER beim Newt-Download: $_" "Red"; exit 1
    }
}

function Setup-Service {
    if (!(Get-Service $ServiceName -ErrorAction SilentlyContinue)) {
        Write-Log "--- Dienst-Konfiguration ---" "Yellow"
        $PangolinID = Read-Host "Bitte Pangolin ID eingeben"
        $PangolinSecret = Read-Host "Bitte Secret eingeben"
        $PangolinEndpoint = Read-Host "Bitte Endpoint eingeben"

        $ArgList = "--id $PangolinID --secret $PangolinSecret --endpoint $PangolinEndpoint"
        
        Write-Log "Erstelle Dienst mit NSSM..." "Cyan"
        & $NssmPath install $ServiceName "$Symlink" $ArgList
        & $NssmPath set $ServiceName Description "MAIEREDV Managed Site Client"
        & $NssmPath set $ServiceName AppExit Default Restart
        & $NssmPath set $ServiceName AppRestartDelay 5000
        & $NssmPath set $ServiceName AppStdout "$InstallDir\newt_service.log"
        & $NssmPath set $ServiceName AppStderr "$InstallDir\newt_service.log"
        
        Start-Service $ServiceName
        Write-Log "Dienst erfolgreich gestartet." "Green"
    } else {
        Write-Log "Dienst wird aktualisiert..." "Yellow"
        Restart-Service $ServiceName
    }
}

function Setup-UpdaterTask {
    $ActionCommand = "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command `"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('$GiteaUrl')) -mode update`""
    $Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $ActionCommand
    $Trigger = New-ScheduledTaskTrigger -Daily -At 3am
    Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName $UpdaterTaskName -User "SYSTEM" -Force | Out-Null
    Write-Log "Update-Task erstellt." "Green"
}

# --- Execution ---
switch ($mode) {
    "install" {
        $v = Get-LatestVersion
        Download-Newt $v
        Setup-Service
        Setup-UpdaterTask
        Write-Log "Installation abgeschlossen!" "Green"
    }
    "update" {
        $v = Get-LatestVersion
        $vOnly = $v.TrimStart('v')
        if (Test-Path "$InstallDir\newt_$vOnly.exe") {
            Write-Log "Bereits aktuell." "Cyan"
        } else {
            Download-Newt $v
            Restart-Service $ServiceName
            Write-Log "Update fertig." "Green"
        }
    }
    "uninstall" {
        Write-Log "Deinstallation..." "Yellow"
        if (Get-Service $ServiceName -ErrorAction SilentlyContinue) {
            Stop-Service $ServiceName -Force -ErrorAction SilentlyContinue
            & $NssmPath remove $ServiceName confirm
        }
        Unregister-ScheduledTask -TaskName $UpdaterTaskName -Confirm:$false -ErrorAction SilentlyContinue
        Write-Log "Entfernt." "Green"
    }
}