# Turn on REAL auto-update for the Mango wallet extension on this Windows machine.
#
# WHY A REGISTRY KEY IS UNAVOIDABLE. Since Chrome 73 a Chromium browser on Windows will
# not install a .crx that did not come from the Chrome Web Store: dragging the file onto
# chrome://extensions is refused, and there is no toggle in the UI that changes that. The
# one supported way to install an off-store extension is enterprise policy, which on
# Windows is a registry value under HKLM\SOFTWARE\Policies. That is what this script
# writes, and it is the whole of what it does.
#
# WHAT YOU GET. ExtensionInstallForcelist takes "<id>;<update_url>". The browser installs
# the extension from our own update server at first launch and then polls that URL about
# every five hours, installing any newer version on its own. No download, no Reload, no
# developer mode - that is the difference between this and update-mango-extension.ps1.
#
# WHAT YOU GIVE UP, SAY IT PLAINLY. A force-installed extension cannot be disabled or
# removed from chrome://extensions - it shows as "Installed by enterprise policy". To get
# rid of it you run this script again with -Uninstall. That is the trade for auto-update
# without a Web Store listing.
#
# ADMIN. HKLM needs an elevated PowerShell: right-click PowerShell, "Run as
# administrator". The script checks and stops rather than failing halfway.
#
# Run it:
#   powershell -ExecutionPolicy Bypass -File .\scripts\install-mango-autoupdate.ps1
#   powershell -ExecutionPolicy Bypass -File .\scripts\install-mango-autoupdate.ps1 -Uninstall
#
# Not executed before shipping: this repository lives on a Linux laptop with no
# PowerShell on it. Read it before you run it.

[CmdletBinding()]
param(
    [string] $UpdateUrl = 'https://namid.net/mango/updates.xml',
    # Which browsers to configure. Each is a vendor key under HKLM\SOFTWARE\Policies.
    [ValidateSet('Chrome', 'Brave', 'Edge')]
    [string[]] $Browsers = @('Chrome', 'Brave', 'Edge'),
    [switch] $Uninstall
)

$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest

$ExtensionId = 'pfeojhejabjihflngblcidnjpicekigb'
$entry       = "$ExtensionId;$UpdateUrl"

$policyRoots = @{
    Chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
    Brave  = 'HKLM:\SOFTWARE\Policies\BraveSoftware\Brave'
    Edge   = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
}

$admin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()
         ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $admin) {
    Write-Host "This writes machine policy under HKLM and needs an elevated shell." -ForegroundColor Red
    Write-Host "Close this window, right-click PowerShell, 'Run as administrator', and run it again."
    exit 1
}

foreach ($b in $Browsers) {
    $root = $policyRoots[$b]
    $list = Join-Path $root 'ExtensionInstallForcelist'

    if ($Uninstall) {
        if (-not (Test-Path -LiteralPath $list)) { Write-Host "$b : nothing to remove"; continue }
        $removed = 0
        foreach ($p in (Get-Item -LiteralPath $list).Property) {
            if ((Get-ItemProperty -LiteralPath $list -Name $p).$p -like "$ExtensionId;*") {
                Remove-ItemProperty -LiteralPath $list -Name $p
                $removed++
            }
        }
        Write-Host "$b : removed $removed forcelist entry/entries" -ForegroundColor Green
        continue
    }

    New-Item -Path $list -Force | Out-Null

    # Already there? Leave it alone rather than writing a duplicate under a second index.
    $existing = (Get-Item -LiteralPath $list).Property | Where-Object {
        (Get-ItemProperty -LiteralPath $list -Name $_).$_ -like "$ExtensionId;*"
    }
    if ($existing) {
        foreach ($p in $existing) { Set-ItemProperty -LiteralPath $list -Name $p -Value $entry }
        Write-Host "$b : updated existing entry $existing" -ForegroundColor Green
        continue
    }

    # The policy is a numbered list of REG_SZ values starting at 1; take the first free slot
    # instead of clobbering another extension's entry.
    $used = @((Get-Item -LiteralPath $list).Property | Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ })
    $slot = 1
    while ($used -contains $slot) { $slot++ }
    New-ItemProperty -LiteralPath $list -Name "$slot" -Value $entry -PropertyType String -Force | Out-Null
    Write-Host "$b : $list\$slot = $entry" -ForegroundColor Green
}

Write-Host ""
if ($Uninstall) {
    Write-Host "Done. Restart the browser; the extension stops being force-installed." -ForegroundColor Yellow
    exit 0
}
Write-Host "Done. Now, once, by hand:" -ForegroundColor Yellow
Write-Host "  1. If an OLD unpacked Mango wallet card (any earlier name) is still on"
Write-Host "     chrome://extensions, click Remove on it. Same id, so your data stays;"
Write-Host "     the policy copy takes over."
Write-Host "  2. Quit the browser completely and start it again."
Write-Host "  3. Open chrome://extensions. The Mango wallet card should say"
Write-Host "     'Installed by enterprise policy' and carry the id $ExtensionId."
Write-Host "  4. chrome://policy -> 'Reload policies' shows ExtensionInstallForcelist if"
Write-Host "     you want to see the policy the browser actually read."
Write-Host ""
Write-Host "From then on it updates itself from $UpdateUrl - roughly every five hours,"
Write-Host "and immediately if you press 'Update' on chrome://extensions."