<#
.SYNOPSIS
    Universal Idempotent OpenSSH Server Installer & Ansible Bootstrapper
#>
$ErrorActionPreference = 'Stop'

# 1. Administrator Check
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Warning "Administrator privileges required. Please open PowerShell as Admin and try again."
    return
}

# 2. Fix SMB Guest Access instantly
Write-Host "Enabling insecure guest auth for SMB..." -ForegroundColor Cyan
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name "AllowInsecureGuestAuth" -Value 1 -PropertyType DWORD -Force | Out-Null

# 3. Define local and network paths
$targetDir = "C:\install"
$smbShare = "\\10.10.1.1\install\admin\systools\WinMonitor"

Write-Host "Staging files to $targetDir..." -ForegroundColor Cyan
if (-not (Test-Path $targetDir)) { New-Item -ItemType Directory -Path $targetDir | Out-Null }

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

# 4. OS Detection & Dynamic File Queue
$filesToCopy = @("create_admin.ps1")
$osCaption = (Get-WmiObject Win32_OperatingSystem).Caption

if ($osCaption -match "Windows 7") {
    Write-Host " -> $osCaption detected. Queuing legacy OpenSSH binaries." -ForegroundColor Yellow
    $filesToCopy += "OpenSSH-Win64"
    $filesToCopy += "OpenSSH-Win32"
} else {
    Write-Host " -> $osCaption detected. Skipping legacy OpenSSH binaries." -ForegroundColor Green
}


# 5. Securely pull files from the internal network
Write-Host "`nCopying installer files from the internal network..." -ForegroundColor Cyan
foreach ($item in $filesToCopy) {
    $sourcePath = Join-Path $smbShare $item
    $destPath = Join-Path $targetDir $item
    if (Test-Path $sourcePath) {
        Write-Host "  -> Copying $item"
        Copy-Item -Path $sourcePath -Destination $destPath -Recurse -Force
    }
}


# ====================================================================
# 8. Modular Extensions (Run remote payloads)
# ====================================================================
Write-Host "`n[TASK] Fetching and running modular extensions..." -ForegroundColor Yellow

# Read the passwords securely from the local network
$secretPath = "\\10.10.1.1\install\admin\systools\WinMonitor\admin_secret.txt"
$ansiblePass = $null
$autologinPass = $null

if (Test-Path $secretPath) {
    Write-Host "         -> Reading credentials from secure LAN share..." -ForegroundColor Cyan
    $secrets = @(Get-Content $secretPath | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
    
    if ($secrets.Count -ge 1) { $ansiblePass = $secrets[0].Trim() }
    if ($secrets.Count -ge 2) { $autologinPass = $secrets[1].Trim() }
    else { Write-Warning "         -> [WARN] Only one password found in secret file. AutoLogon may fail." }
} else {
    Write-Warning "         -> [ERROR] Local secret file not found!"
}

# Define your queue of scripts and their arguments here
$extensions = @(
    @{
        Name = "Configure Ansible Admin Account"
        Url  = "https://get.calo.group/scripts/create_admin.txt"
        Args = @{ servicePass = $ansiblePass }
    },
    @{
        Name = "Install SSH"
        Url  = "https://get.calo.group/scripts/install_ssh.txt"
        Args = @{} # No arguments needed for this one
    },
    @{
        Name = "Configure Firewall Rules"
        Url  = "https://get.calo.group/scripts/set_firewall.txt"
        Args = @{}
    }
    @{
        Name = "Check Windows Activation"
        Url  = "https://get.calo.group/scripts/check_activation.txt"
        Args = @{} # No arguments needed for this one
    },
    @{
        Name = "Configure Current User AutoLogon"
        Url  = "https://get.calo.group/scripts/set_autologin.txt"
        Args = @{ TargetPass = $autologinPass }
    },
    @{
        Name = "Apply LA_ORIENTAL Wallpaper"
        Url  = "https://get.calo.group/scripts/change_background.txt"
        Args = @{ ImageUrl = "https://get.calo.group/images/la_oriental_logo.jpg"; FileName = "la_oriental.jpg" }
    },
    @{
        Name = "Set Regional Settings"
        Url  = "https://get.calo.group/scripts/set_regional.txt"
        Args = @{ 
            TargetLocale   = "es-AR"; 
            "BaseLang" = "es-ES";
            TargetGeoId    = 11; 
            TargetTimeZone = "Argentina Standard Time" 
        }
    },
    @{
        Name = "Provision Base Software"
        Url  = "https://get.calo.group/scripts/install_software.txt"
        Args = @{}
    }
)

foreach ($ext in $extensions) {
    Write-Host "      -> Executing $($ext.Name)..." -ForegroundColor Cyan
    try {
        # Download and compile the remote script
        $rawScript = irm $ext.Url
        $scriptBlock = [scriptblock]::Create($rawScript)
        
        # Execute the script block. The @ symbol "splats" the arguments hashtable.
        $argsHash = $ext.Args
        & $scriptBlock @argsHash
        
    } catch {
        Write-Warning "      -> Failed to fetch or execute $($ext.Name). Error: $($_.Exception.Message)"
    }
}

# ====================================================================
# 10. System Info, Workgroup, & Optional Rename
# ====================================================================
$computerName = $env:COMPUTERNAME
$ipAddress = (Get-NetIPAddress -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object InterfaceAlias -NotMatch "Loopback" | Select-Object -ExpandProperty IPAddress) -join ", "

Write-Host "`n=================================================" -ForegroundColor Cyan
Write-Host " Target is ready for Ansible over SSH." -ForegroundColor Green
Write-Host "-------------------------------------------------" -ForegroundColor Cyan
Write-Host " Current Hostname : $computerName" -ForegroundColor Yellow
Write-Host " IPs              : $ipAddress" -ForegroundColor Yellow
Write-Host "=================================================`n" -ForegroundColor Cyan

$needsReboot = $false

# Apply Workgroup
$targetWorkgroup = "LA_ORIENTAL"
$currentWorkgroup = (Get-WmiObject Win32_ComputerSystem).Workgroup

if ($currentWorkgroup -ne $targetWorkgroup) {
    Write-Host "Joining workgroup '$targetWorkgroup'..." -ForegroundColor Cyan
    try {
        Add-Computer -WorkgroupName $targetWorkgroup -Force
        Write-Host " -> Successfully joined workgroup '$targetWorkgroup'." -ForegroundColor Green
        $needsReboot = $true
    } catch {
        Write-Host " -> Failed to join workgroup. Error: $($_.Exception.Message)" -ForegroundColor Red
    }
} else {
    Write-Host "Computer is already in workgroup '$targetWorkgroup'." -ForegroundColor DarkGray
}

# Optional Rename
$newName = Read-Host "`nEnter a new computer name (or press Enter to skip)"
if ([string]::IsNullOrWhiteSpace($newName)) {
    Write-Host "Skipping rename." -ForegroundColor DarkGray
} else {
    try {
        Rename-Computer -NewName $newName -Force
        Write-Host " -> Hostname changed to '$newName'." -ForegroundColor Green
        $needsReboot = $true
    } catch {
        Write-Host " -> Failed to rename computer. Error: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Final Reboot Check
if ($needsReboot) {
    $reboot = Read-Host "`nA reboot is required to apply the new name and/or workgroup. Reboot now? (Y/N)"
    if ($reboot -match "^[Yy]") {
        Write-Host "Rebooting..." -ForegroundColor Cyan
        Restart-Computer -Force
    } else {
        Write-Host "Please remember to manually reboot before connecting via Ansible." -ForegroundColor Yellow
    }
} else {
    Write-Host "`nSetup is completely finished! No reboot required." -ForegroundColor Green
}