# TLS aktivieren (Windows Server 2016)
[Net.ServicePointManager]::SecurityProtocol = `
    [Net.SecurityProtocolType]::Tls12 -bor `
    [Net.SecurityProtocolType]::Tls11 -bor `
    [Net.SecurityProtocolType]::Tls

# Adminrechte pruefen
$isAdmin = ([Security.Principal.WindowsPrincipal] `
    [Security.Principal.WindowsIdentity]::GetCurrent() `
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Start-Process powershell.exe `
        "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" `
        -Verb RunAs
    exit
}

Write-Host "============================================================"
Write-Host " upterm Setup (Pre-built Binary)"
Write-Host "============================================================"
Write-Host ""

# Hilfsfunktion: Download mit SSL-Bypass-Fallback
function Download-File($url, $dest) {
    try {
        (New-Object System.Net.WebClient).DownloadFile($url, $dest)
        return $true
    } catch {}
    Write-Host "      SSL-Bypass aktiv (Server 2016 Zertifikatskette)..."
    $cb = [Net.ServicePointManager]::ServerCertificateValidationCallback
    [Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
    try {
        (New-Object System.Net.WebClient).DownloadFile($url, $dest)
        return $true
    } catch {
        Write-Host "FEHLER: Download fehlgeschlagen: $_"
        return $false
    } finally {
        [Net.ServicePointManager]::ServerCertificateValidationCallback = $cb
    }
}

# 1. upterm Binary herunterladen
$version    = "v0.24.0"
$tarGz      = "C:\Windows\Temp\upterm-windows.tar.gz"
$extractDir = "C:\Windows\Temp\upterm-extract"
$downloadUrl = "https://github.com/owenthereal/upterm/releases/download/$version/upterm_windows_amd64.tar.gz"

Write-Host "[1/2] Lade upterm $version (Windows amd64)..."
if (-not (Download-File $downloadUrl $tarGz)) {
    Read-Host "Enter zum Beenden"; exit 1
}
Write-Host "      OK"

# 2. Entpacken (tar.gz via tar.exe - verfuegbar ab Windows 10 1803 / Server 2019)
#    Fallback: 7-Zip oder manuelle Methode
Write-Host "[2/2] Entpacke und installiere..."
if (Test-Path $extractDir) { Remove-Item -Recurse -Force $extractDir }
New-Item -ItemType Directory -Force -Path $extractDir | Out-Null

$tarExe = "$env:SystemRoot\System32\tar.exe"
if (Test-Path $tarExe) {
    & $tarExe -xzf $tarGz -C $extractDir 2>&1 | Out-Null
} else {
    # Fallback: 7-Zip
    $7zip = "C:\Program Files\7-Zip\7z.exe"
    if (Test-Path $7zip) {
        & $7zip x $tarGz -o"$extractDir" -y | Out-Null
        $innerTar = Get-ChildItem $extractDir -Filter "*.tar" | Select-Object -First 1
        if ($innerTar) { & $7zip x $innerTar.FullName -o"$extractDir" -y | Out-Null }
    } else {
        Write-Host "FEHLER: Weder tar.exe noch 7-Zip gefunden."
        Write-Host "        Bitte 7-Zip installieren: https://www.7-zip.org/"
        Read-Host "Enter zum Beenden"; exit 1
    }
}

$uptermExe = Get-ChildItem $extractDir -Recurse -Filter "upterm.exe" | Select-Object -First 1
if (-not $uptermExe) {
    Write-Host "FEHLER: upterm.exe nicht im Archiv gefunden."
    Read-Host "Enter zum Beenden"; exit 1
}

Copy-Item $uptermExe.FullName "C:\Windows\System32\upterm.exe" -Force
Remove-Item $tarGz, $extractDir -Recurse -Force -ErrorAction SilentlyContinue
Write-Host "      OK - upterm $version installiert"

# 3. SSH-Key erzeugen (upterm benoetigt publickey-Auth)
Write-Host "[3/3] Pruefe SSH-Key..."
$sshDir    = "$env:USERPROFILE\.ssh"
$keyFile   = "$sshDir\id_ed25519"
New-Item -ItemType Directory -Force -Path $sshDir | Out-Null

if (Test-Path $keyFile) {
    Write-Host "      OK (Key vorhanden: $keyFile)"
} else {
    $sshKeygen = "$env:SystemRoot\System32\OpenSSH\ssh-keygen.exe"
    if (-not (Test-Path $sshKeygen)) { $sshKeygen = "ssh-keygen" }
    Write-Host "      Generiere neuen ed25519-Key..."
    & $sshKeygen -t ed25519 -N '""' -f $keyFile 2>&1 | Out-Null
    if (Test-Path $keyFile) {
        Write-Host "      OK (Key erstellt: $keyFile)"
    } else {
        Write-Host "      WARNUNG: ssh-keygen nicht verfuegbar."
        Write-Host "      Bitte OpenSSH-Client installieren:"
        Write-Host "      Einstellungen > Apps > Optionale Features > OpenSSH-Client"
        Write-Host "      Danach: ssh-keygen -t ed25519 -N """" -f $keyFile"
    }
}

Write-Host ""
Write-Host "============================================================"
Write-Host " Installation abgeschlossen!"
Write-Host "============================================================"
Write-Host ""
Write-Host " Session teilen mit:"
Write-Host ""
Write-Host "   upterm host --server ssh://upterm.ebesch.de:2222 --accept"
Write-Host ""
Write-Host " Client verbindet sich mit:"
Write-Host "   ssh TOKEN:HASH@upterm.ebesch.de -p 2222"
Write-Host ""
Read-Host "Enter zum Beenden"