#Requires -Version 5.1

[CmdletBinding()]
param()

$ErrorActionPreference = "Stop"
$ProgressPreference = "SilentlyContinue"

$Version = "1.4.9"
$DownloadBase = "https://rustdesk.bosner.de/downloads"
$IdServer = "rustdesk.bosner.de"
$RelayServer = "rustdesk.bosner.de"
$ApiServer = "https://rustdesk.bosner.de"
$PublicKey = "2V5DxRrXp4mTyUqlmpRF2DRcOivfL2GcSLViXHXVJUg="
$DirectAccessPort = 21118
$FirewallRuleName = "RustDesk Direct Access (Bosner LAN)"
$Config = "host=$IdServer,relay=$RelayServer,api=$ApiServer,key=$PublicKey"

function Test-Administrator {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

if (-not (Test-Administrator)) {
    Write-Host "Fordere Administratorrechte an ..."
    $arguments = "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    $process = Start-Process -FilePath "powershell.exe" -Verb RunAs -ArgumentList $arguments -Wait -PassThru
    exit $process.ExitCode
}

$nativeArchitecture = if ($env:PROCESSOR_ARCHITEW6432) {
    $env:PROCESSOR_ARCHITEW6432
} else {
    $env:PROCESSOR_ARCHITECTURE
}

switch ($nativeArchitecture.ToUpperInvariant()) {
    "ARM64" {
        $architecture = "aarch64"
        $expectedSha256 = "c717bf52fdd601c58419e46c503176dd87187d174ebf8b3b5854ca381e8e9145"
    }
    default {
        $architecture = "x86_64"
        $expectedSha256 = "eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274"
    }
}

$assetName = "rustdesk-$Version-$architecture-host=$IdServer,key=$PublicKey,.exe"
$assetUrl = "$DownloadBase/$assetName"
$temporaryDirectory = Join-Path ([IO.Path]::GetTempPath()) ("rustdesk-bosner-" + [Guid]::NewGuid().ToString("N"))
$downloadPath = Join-Path $temporaryDirectory $assetName

try {
    New-Item -ItemType Directory -Path $temporaryDirectory | Out-Null
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

    Write-Host "Lade RustDesk $Version ($architecture) ..."
    Invoke-WebRequest -UseBasicParsing -Uri $assetUrl -OutFile $downloadPath

    $actualSha256 = (Get-FileHash -Algorithm SHA256 -Path $downloadPath).Hash.ToLowerInvariant()
    if ($actualSha256 -ne $expectedSha256) {
        throw "SHA-256-Pruefung fehlgeschlagen. Erwartet: $expectedSha256, erhalten: $actualSha256"
    }

    Write-Host "Installiere RustDesk ..."
    $install = Start-Process -FilePath $downloadPath -ArgumentList "--silent-install" -Wait -PassThru
    if ($install.ExitCode -ne 0) {
        throw "RustDesk-Installation wurde mit Exit-Code $($install.ExitCode) beendet."
    }

    $installedBinary = Join-Path $env:ProgramFiles "RustDesk\RustDesk.exe"
    $deadline = (Get-Date).AddSeconds(60)
    while (-not (Test-Path $installedBinary) -and (Get-Date) -lt $deadline) {
        Start-Sleep -Seconds 1
    }
    if (-not (Test-Path $installedBinary)) {
        throw "Installierte RustDesk-Datei wurde nicht gefunden: $installedBinary"
    }

    Write-Host "Setze ID- und Relay-Server ..."
    $configure = Start-Process -FilePath $installedBinary -ArgumentList @("--config", $Config) -Wait -PassThru
    if ($configure.ExitCode -ne 0) {
        throw "RustDesk-Konfiguration wurde mit Exit-Code $($configure.ExitCode) beendet."
    }

    Write-Host "Aktiviere direkten Zugriff im lokalen Netz auf TCP $DirectAccessPort ..."
    & $installedBinary --option allow-websocket Y
    & $installedBinary --option direct-server Y
    & $installedBinary --option direct-access-port $DirectAccessPort

    $firewallRule = Get-NetFirewallRule -DisplayName $FirewallRuleName -ErrorAction SilentlyContinue
    if ($null -eq $firewallRule) {
        New-NetFirewallRule `
            -DisplayName $FirewallRuleName `
            -Description "Erlaubt RustDesk-Direktzugriff ausschliesslich aus dem lokalen Subnetz." `
            -Direction Inbound `
            -Action Allow `
            -Enabled True `
            -Profile Any `
            -Protocol TCP `
            -LocalPort $DirectAccessPort `
            -RemoteAddress LocalSubnet `
            -Program $installedBinary | Out-Null
    } else {
        Set-NetFirewallRule -DisplayName $FirewallRuleName -Enabled True -Action Allow -Profile Any | Out-Null
    }

    $service = Get-Service -Name "RustDesk" -ErrorAction SilentlyContinue
    if ($null -eq $service) {
        throw "Der installierte RustDesk-Dienst wurde nicht gefunden."
    }

    Write-Host "Starte den RustDesk-Dienst mit der neuen Konfiguration neu ..."
    Restart-Service -Name "RustDesk" -Force
    $service.WaitForStatus([System.ServiceProcess.ServiceControllerStatus]::Running, [TimeSpan]::FromSeconds(30))
    Start-Sleep -Seconds 3

    $configuredServer = (& $installedBinary --option custom-rendezvous-server | Out-String).Trim()
    $configuredRelay = (& $installedBinary --option relay-server | Out-String).Trim()
    $configuredApi = (& $installedBinary --option api-server | Out-String).Trim()
    $configuredKey = (& $installedBinary --option key | Out-String).Trim()
    $configuredWebSocket = (& $installedBinary --option allow-websocket | Out-String).Trim()
    $configuredDirectServer = (& $installedBinary --option direct-server | Out-String).Trim()
    $configuredDirectPort = (& $installedBinary --option direct-access-port | Out-String).Trim()
    if ($configuredServer -ne $IdServer -or
        $configuredRelay -ne $RelayServer -or
        $configuredApi -ne $ApiServer -or
        $configuredKey -ne $PublicKey -or
        $configuredWebSocket -ne "Y" -or
        $configuredDirectServer -ne "Y" -or
        $configuredDirectPort -ne "$DirectAccessPort") {
        throw "Konfiguration konnte nicht verifiziert werden. ID='$configuredServer', Relay='$configuredRelay', API='$configuredApi', Direkt='${configuredDirectServer}:$configuredDirectPort'."
    }

    $clientId = (& $installedBinary --get-id | Out-String).Trim()
    Write-Host "Fertig. RustDesk-ID: $clientId"
    Write-Host "ID-Server: $configuredServer"
    Write-Host "Relay-Server: $configuredRelay"
    Write-Host "Management-API: $configuredApi"
    Write-Host "Sicherer Kontotransport: WebSocket/TLS aktiv"
    Write-Host "LAN-Direktzugriff: TCP $configuredDirectPort (nur lokales Subnetz)"
} finally {
    if (Test-Path $temporaryDirectory) {
        Remove-Item -LiteralPath $temporaryDirectory -Recurse -Force
    }
}