# TLS aktivieren (Windows Server 2016)
[Net.ServicePointManager]::SecurityProtocol = `
    [Net.SecurityProtocolType]::Tls12 -bor `
    [Net.SecurityProtocolType]::Tls11 -bor `
    [Net.SecurityProtocolType]::Tls

# Adminrechte pruefen
$isAdmin = ([Security.Principal.WindowsPrincipal] `
    [Security.Principal.WindowsIdentity]::GetCurrent() `
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Start-Process powershell.exe `
        "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" `
        -Verb RunAs
    exit
}

Write-Host "============================================================"
Write-Host " upterm Build-Setup (Go from Source)"
Write-Host "============================================================"
Write-Host ""

# Hilfsfunktion: Download mit SSL-Bypass-Fallback
function Download-File($url, $dest) {
    try {
        (New-Object System.Net.WebClient).DownloadFile($url, $dest)
        return $true
    } catch {}
    Write-Host "      SSL-Bypass aktiv (Server 2016 Zertifikatskette)..."
    $cb = [Net.ServicePointManager]::ServerCertificateValidationCallback
    [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
    try {
        (New-Object System.Net.WebClient).DownloadFile($url, $dest)
        return $true
    } catch {
        Write-Host "FEHLER: Download fehlgeschlagen: $_"
        return $false
    } finally {
        [Net.ServicePointManager]::ServerCertificateValidationCallback = $cb
    }
}

# 1. Go pruefen / als ZIP installieren (kein MSI = kein Exit 1603)
Write-Host "[1/3] Pruefe Go..."
$goRoot = "C:\Go"
$goExe  = "$goRoot\bin\go.exe"

if (-not (Test-Path $goExe)) {
    $goVersion = "1.22.4"
    $goZip     = "C:\Windows\Temp\go-windows.zip"
    $goUrl     = "https://golang.org/dl/go$goVersion.windows-amd64.zip"

    Write-Host "      Go nicht gefunden - lade go$goVersion (ZIP) herunter..."
    if (-not (Download-File $goUrl $goZip)) {
        Read-Host "Enter zum Beenden"; exit 1
    }

    Write-Host "      Entpacke nach $goRoot ..."
    if (Test-Path $goRoot) { Remove-Item -Recurse -Force $goRoot }
    Expand-Archive -Path $goZip -DestinationPath "C:\" -Force
    Remove-Item $goZip -ErrorAction SilentlyContinue

    if (-not (Test-Path $goExe)) {
        Write-Host "FEHLER: go.exe nach Entpacken nicht gefunden."
        Read-Host "Enter zum Beenden"; exit 1
    }
}

# Go in PATH dieser Session
if ($env:PATH -notlike "*$goRoot\bin*") {
    $env:PATH = "$env:PATH;$goRoot\bin"
}
$goVer = & $goExe version 2>&1
Write-Host "      OK ($goVer)"

# 2. upterm bauen via go install
Write-Host "[2/3] Baue upterm (go install)..."
$env:GOPATH = "$env:USERPROFILE\go"
if ($env:PATH -notlike "*$env:GOPATH\bin*") {
    $env:PATH = "$env:PATH;$env:GOPATH\bin"
}
try {
    & $goExe install github.com/owenthereal/upterm/cmd/upterm@latest
} catch {
    Write-Host "FEHLER: go install fehlgeschlagen: $_"
    Read-Host "Enter zum Beenden"; exit 1
}

$uptermExe = "$env:USERPROFILE\go\bin\upterm.exe"
if (-not (Test-Path $uptermExe)) {
    Write-Host "FEHLER: upterm.exe nicht gefunden nach Build."
    Read-Host "Enter zum Beenden"; exit 1
}
Write-Host "      OK ($uptermExe)"

# 3. Systemweit verfuegbar machen
Write-Host "[3/3] Kopiere upterm.exe nach C:\Windows\System32..."
try {
    Copy-Item $uptermExe "C:\Windows\System32\upterm.exe" -Force
    Write-Host "      OK - upterm steht allen Nutzern zur Verfuegung"
} catch {
    Write-Host "      Hinweis: Kopieren fehlgeschlagen."
    Write-Host "      Binary liegt unter: $uptermExe"
}

Write-Host ""
Write-Host "============================================================"
Write-Host " Build abgeschlossen!"
Write-Host "============================================================"
Write-Host ""
Write-Host " PowerShell NEU STARTEN, dann Session teilen mit:"
Write-Host ""
Write-Host "   upterm host --server ssh://upterm.ebesch.de:2222 --accept"
Write-Host ""
Write-Host " Client verbindet sich mit:"
Write-Host "   ssh TOKEN:HASH@upterm.ebesch.de -p 2222"
Write-Host ""
Read-Host "Enter zum Beenden"