# mehelper remote maintenance bootstrap for pc1
$Slot = "pc1"
$Version = "v0.1.0"
$ZipUrl = "https://github.com/aginchan-spec/mehelper-client/releases/download/$Version/$Slot.zip"

# 0. 自动管理员提权（确保具备完整系统维修、驱动与服务管理权限）
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Write-Host "============================================================" -ForegroundColor Yellow
    Write-Host "  正在请求 Windows 管理员权限以支持完整系统维修诊断..." -ForegroundColor Yellow
    Write-Host "  请在稍后弹出的 UAC 提示窗口中点击【是】。" -ForegroundColor Yellow
    Write-Host "============================================================" -ForegroundColor Yellow
    try {
        Start-Process powershell.exe -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -Command `"& { irm https://knowsayin.com/$Slot | iex }`""
        exit
    } catch {
        Write-Host ">>> 用户未授予管理员权限，将以普通用户权限继续运行（部分底层系统维护操作可能受限）..." -ForegroundColor DarkYellow
    }
}

# 工作目录：优先使用当前用户独占的应用数据目录（天然具备完全控制权，多账号互不冲突，免管理员权限）
if ($env:LOCALAPPDATA) {
    $WorkDir = "$env:LOCALAPPDATA\mehelper\$Slot"
} elseif ($env:USERPROFILE) {
    $WorkDir = "$env:USERPROFILE\AppData\Local\mehelper\$Slot"
} else {
    $WorkDir = "$env:SystemDrive\mehelper\$Slot"
}

Write-Host "============================================================" -ForegroundColor Cyan
Write-Host "  mehelper 远程协助一键连接 ($Slot)" -ForegroundColor Cyan
Write-Host "============================================================" -ForegroundColor Cyan

# 1. 启用 TLS 1.2 / 1.3
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13

# 2. 准备目录
if (-not (Test-Path $WorkDir)) {
    New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null
}

# 3. 下载与解压
$ZipPath = "$env:TEMP\$Slot.zip"
if (-not (Test-Path "$WorkDir\itagent.exe") -or -not (Test-Path "$WorkDir\run.bat")) {
    Write-Host ">>> 正在下载组件包 ($Slot)..." -ForegroundColor Cyan
    try {
        if (Get-Command curl.exe -ErrorAction SilentlyContinue) {
            & curl.exe -sL -o "$ZipPath" "$ZipUrl"
        } else {
            Invoke-WebRequest -Uri $ZipUrl -OutFile $ZipPath -UseBasicParsing
        }
    } catch {
        Write-Host "下载失败: $_" -ForegroundColor Red
        return
    }

    Write-Host ">>> 正在解压运行时..." -ForegroundColor Cyan
    try {
        if (Get-Command tar.exe -ErrorAction SilentlyContinue) {
            & tar.exe -xf "$ZipPath" -C "$WorkDir"
        } else {
            Expand-Archive -Path $ZipPath -DestinationPath $WorkDir -Force
        }
    } catch {
        Write-Host "解压失败: $_" -ForegroundColor Red
        return
    } finally {
        Remove-Item $ZipPath -Force -ErrorAction SilentlyContinue
    }
}

# 4. 修复 OpenSSH 密钥安全权限（必须剥离 Users/Everyone 继承，仅授予 SYSTEM、Administrators 及当前用户）
try {
    $KeysDir = "$WorkDir\keys"
    $HostKey = "$KeysDir\sshd_host_key"
    $Keygen = "$WorkDir\sshd\ssh-keygen.exe"

    if (-not (Test-Path $KeysDir)) {
        New-Item -ItemType Directory -Path $KeysDir -Force | Out-Null
    }

    # 如果 host key 尚未生成，先用自带的 ssh-keygen 生成
    if (-not (Test-Path $HostKey) -and (Test-Path $Keygen)) {
        & $Keygen -t ed25519 -f $HostKey -N '""' -C "sshd-host" | Out-Null
    }

    $CurrentUser = [Environment]::UserName
    $UserSid = ""
    try { $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value } catch {}

    $KeyDirAcl = @("*S-1-5-32-544:(OI)(CI)F", "*S-1-5-18:(OI)(CI)F", "${CurrentUser}:(OI)(CI)F")
    $KeyFileAcl = @("*S-1-5-32-544:F", "*S-1-5-18:F", "${CurrentUser}:F")
    if ($UserSid) {
        $KeyDirAcl += "*${UserSid}:(OI)(CI)F"
        $KeyFileAcl += "*${UserSid}:F"
    }

    if (Test-Path $KeysDir) {
        & icacls $KeysDir /inheritance:r /grant:r $KeyDirAcl | Out-Null
        Get-ChildItem -Path $KeysDir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            & icacls $_.FullName /inheritance:r /grant:r $KeyFileAcl | Out-Null
        }
    }
} catch {}

# 5. 生成桌面快捷图标（方便下次直接重连，支持自动管理员提权）
try {
    $DesktopDir = [Environment]::GetFolderPath("Desktop")
    if ($DesktopDir -and (Test-Path $DesktopDir)) {
        $DesktopBat = "$DesktopDir\远程协助-$Slot.bat"
        $BatContent = "@echo off`r`nnet session >nul 2>&1`r`nif %errorLevel% neq 0 (`r`n    powershell -NoProfile -ExecutionPolicy Bypass -Command `"Start-Process cmd -ArgumentList '/c cd /d `"`"%WorkDir`"`" && call run.bat' -Verb RunAs`"`r`n    exit /b`r`n)`r`ncd /d `"$WorkDir`"`r`ncall run.bat"
        [IO.File]::WriteAllText($DesktopBat, $BatContent, [System.Text.Encoding]::Default)
    }
} catch {}

# 6. 启动连接
Write-Host "============================================================" -ForegroundColor Green
Write-Host "  远程协助服务已就绪，正在建立安全连接..." -ForegroundColor Green
Write-Host "  提示: 维护期间请保持此窗口打开；关闭本窗口即可离线。" -ForegroundColor Green
Write-Host "============================================================" -ForegroundColor Green

Set-Location $WorkDir
& "$WorkDir\run.bat"