<#
  Remote Support - permanent (unattended) access   https://support.thisandthatoh.com
  Installs RustDesk 1.5.0 as a Windows service, points it at the private server
  rd.thisandthatoh.com, sets a unique random password, and prints the ID + password to save in Passbolt.

  Run in PowerShell AS ADMINISTRATOR:
      irm https://support.thisandthatoh.com/install.ps1 | iex
  Optional: also remove AnyDesk:
      $RemoveAnyDesk = $true; irm https://support.thisandthatoh.com/install.ps1 | iex

  Safe to re-run (it keeps the existing ID; it sets a NEW password each time).
#>
$ErrorActionPreference = 'Stop'
$Version  = '1.5.0'
$Url      = 'https://support.thisandthatoh.com/files/rustdesk-1.5.0-x86_64.exe'
$Sha256   = '8555777215510D83D2D61C9DC984E4FCC838BD7E79F9D18A42585431F5E8BB47'
$Server   = 'rd.thisandthatoh.com'
$Key      = '1imVcxQGRuOlHOwUJbxK07YOe49SRmteHnBcPBw9sFk='
$Exe      = Join-Path $env:ProgramFiles 'RustDesk\rustdesk.exe'

function Say($m, $c = 'Gray') { Write-Host "[$(Get-Date -Format HH:mm:ss)] $m" -ForegroundColor $c }

$admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
          [Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $admin) { Say 'Please run PowerShell as Administrator (right-click > Run as administrator) and try again.' Red; return }

# 1. Install (or upgrade) RustDesk
$installed = (Test-Path $Exe) -and ((Get-Item $Exe).VersionInfo.ProductVersion -like "$Version*")
if (-not $installed) {
    $tmp = Join-Path $env:TEMP "rustdesk-$Version.exe"
    Say "Downloading RustDesk $Version..."
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    Invoke-WebRequest -UseBasicParsing -Uri $Url -OutFile $tmp
    if ((Get-FileHash $tmp -Algorithm SHA256).Hash -ne $Sha256) { Remove-Item $tmp -Force; throw 'Download failed its integrity check; nothing was installed.' }
    Say 'Installing (silent)...'
    Start-Process $tmp -ArgumentList '--silent-install' -Wait
    for ($i = 0; $i -lt 30 -and -not (Get-Service RustDesk -ErrorAction SilentlyContinue); $i++) { Start-Sleep 2 }
    Remove-Item $tmp -Force -ErrorAction SilentlyContinue
    if (-not (Get-Service RustDesk -ErrorAction SilentlyContinue)) { throw 'RustDesk service did not appear after install.' }
} else { Say "RustDesk $Version already installed." }

# 2. Point it at our server (service profile + every existing user profile)
$toml = @"
rendezvous_server = '${Server}:21116'
nat_type = 1
serial = 0

[options]
custom-rendezvous-server = '$Server'
relay-server = '$Server'
key = '$Key'
"@
Say 'Configuring server...'
Stop-Service RustDesk -ErrorAction SilentlyContinue
$dirs = @("$env:WINDIR\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config")
$dirs += Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object { Join-Path $_.FullName 'AppData\Roaming\RustDesk\config' } |
         Where-Object { Test-Path (Split-Path (Split-Path $_)) }
foreach ($d in $dirs) {
    New-Item -ItemType Directory -Force -Path $d | Out-Null
    $f = Join-Path $d 'RustDesk2.toml'
    if (Test-Path $f) { Copy-Item $f "$f.bak" -Force }
    Set-Content -Path $f -Value $toml -Encoding ASCII
}
Start-Service RustDesk; Start-Sleep 5

# 3. Unique password for unattended access
$chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789'
$rng = [Security.Cryptography.RandomNumberGenerator]::Create(); $bytes = New-Object byte[] 14; $rng.GetBytes($bytes)
$Password = -join ($bytes | ForEach-Object { $chars[$_ % $chars.Length] })
& $Exe --password $Password | Out-Null
Start-Sleep 2
$Id = (& $Exe --get-id | Out-String).Trim()

# 4. Optionally remove AnyDesk
if ($RemoveAnyDesk) {
    foreach ($a in @("${env:ProgramFiles(x86)}\AnyDesk\AnyDesk.exe", "$env:ProgramFiles\AnyDesk\AnyDesk.exe")) {
        if (Test-Path $a) { Say 'Removing AnyDesk...'; Start-Process $a -ArgumentList '--remove' -Wait }
    }
}

Write-Host ''
Write-Host '  Remote support is installed.' -ForegroundColor Green
Write-Host "  Computer : $env:COMPUTERNAME"
Write-Host "  ID       : $Id" -ForegroundColor Cyan
Write-Host "  Password : $Password" -ForegroundColor Cyan
Write-Host '  Save these in Passbolt now; the password is not stored anywhere else.' -ForegroundColor Yellow
Write-Host ''