# TLS 1.2 erzwingen (Windows Server 2016 / aeltere Systeme)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Adminrechte pruefen und ggf. neu starten
$isAdmin = ([Security.Principal.WindowsPrincipal] `
    [Security.Principal.WindowsIdentity]::GetCurrent() `
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Start-Process powershell.exe `
        "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" `
        -Verb RunAs
    exit
}

Write-Host "============================================================"
Write-Host " upterm Setup"
Write-Host "============================================================"
Write-Host ""

# 1. Execution Policy pruefen
Write-Host "[1/4] Pruefe Execution Policy..."
$policy = Get-ExecutionPolicy -Scope CurrentUser
if ($policy -in @('Bypass', 'Unrestricted', 'RemoteSigned')) {
    Write-Host "      OK (aktuell: $policy)"
} else {
    try {
        Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
        Write-Host "      OK"
    } catch {
        # GPO ueberschreibt - wenn aktuelle Policy ausfuehrbar ist, weitermachen
        $effective = Get-ExecutionPolicy
        if ($effective -in @('Bypass', 'Unrestricted', 'RemoteSigned')) {
            Write-Host "      GPO-Ueberschreibung - aktuelle Policy '$effective' ist ausreichend"
        } else {
            Write-Host "FEHLER: Execution Policy '$effective' blockiert Ausfuehrung."
            Read-Host "Enter zum Beenden"
            exit 1
        }
    }
}

# 2. Scoop pruefen / installieren
Write-Host "[2/4] Pruefe Scoop..."
$scoopShims = "$env:USERPROFILE\scoop\shims"
$scoopInstalled = (Test-Path "$scoopShims\scoop.ps1") -or (Test-Path "$scoopShims\scoop.cmd")

if (-not $scoopInstalled) {
    Write-Host "      Scoop nicht gefunden - wird installiert..."
    Invoke-RestMethod -Uri https://get.scoop.sh | Invoke-Expression
    Write-Host "      Scoop installiert."
} else {
    Write-Host "      Scoop bereits vorhanden."
}

# PATH dieser Session aktualisieren
if ($env:PATH -notlike "*$scoopShims*") {
    $env:PATH = "$env:PATH;$scoopShims"
}

# 3. 7zip mit lessmsi-Workaround
Write-Host "[3/4] Installiere 7zip via lessmsi..."
scoop config use_lessmsi true
$7zipOk = $false
try {
    scoop install 7zip 2>&1 | Out-Null
    $7zipOk = $true
} catch {}

if (-not $7zipOk) {
    Write-Host "      7zip fehlgeschlagen - bereinige und versuche erneut..."
    scoop uninstall 7zip 2>$null
    scoop cache rm 7zip 2>$null
    Remove-Item -Recurse -Force "$env:USERPROFILE\scoopppszip" -ErrorAction SilentlyContinue
    scoop install 7zip
}
Write-Host "      OK"

# 4. upterm
Write-Host "[4/4] Installiere upterm..."
scoop bucket add upterm https://github.com/owenthereal/scoop-upterm 2>&1 | Out-Null
scoop install upterm
Write-Host "      OK"

Write-Host ""
Write-Host "============================================================"
Write-Host " Installation abgeschlossen!"
Write-Host "============================================================"
Write-Host ""
Write-Host " PowerShell NEU STARTEN, dann Session teilen mit:"
Write-Host ""
Write-Host "   upterm host --server ssh://upterm.ebesch.de:2222 --accept"
Write-Host ""
Write-Host " Client verbindet sich mit:"
Write-Host "   ssh TOKEN:HASH@upterm.ebesch.de -p 2222"
Write-Host ""
Read-Host "Enter zum Beenden"