# GATE - Secure Access Layer
# Usage: irm https://api.0pp.ch/win | iex

$ErrorActionPreference = "Stop"
$API_BASE = if ($env:GATE_API) { $env:GATE_API } else { "https://api.0pp.ch" }

function Test-Admin {
    $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Get-Platform {
    $arch = if ([Environment]::Is64BitOperatingSystem) { "x86_64" } else { "i686" }
    return "windows-$arch"
}

function Get-BestTerminal {
    # Check for Windows Terminal (best experience)
    $wt = Get-Command wt.exe -ErrorAction SilentlyContinue
    if ($wt) { return "wt" }

    # Check for modern PowerShell (pwsh)
    $pwsh = Get-Command pwsh.exe -ErrorAction SilentlyContinue
    if ($pwsh) { return "pwsh" }

    # Fallback to CMD (works everywhere, good TUI support)
    return "cmd"
}

# Quick banner for initial window
Write-Host ""
Write-Host "  GATE - Secure Access Layer" -ForegroundColor Magenta
Write-Host ""

# If not admin, elevate with best available terminal
if (-not (Test-Admin)) {
    Write-Host "  Requesting administrator privileges..." -ForegroundColor Yellow
    Write-Host ""

    $installDir = "$env:LOCALAPPDATA\gate"
    $binary = "$installDir\gate.exe"
    $platform = Get-Platform

    # Create install directory
    if (-not (Test-Path $installDir)) {
        New-Item -ItemType Directory -Path $installDir -Force | Out-Null
    }

    # Download binary first (doesn't need admin)
    Write-Host "  Downloading GATE..." -ForegroundColor Cyan
    $downloadUrl = "$API_BASE/api/download/tui/$platform"
    try {
        Invoke-WebRequest -Uri $downloadUrl -OutFile $binary -UseBasicParsing
    } catch {
        Invoke-WebRequest -Uri "$API_BASE/api/download/tui" -OutFile $binary -UseBasicParsing
    }
    Write-Host "  Downloaded to: $binary" -ForegroundColor Green
    Write-Host ""

    # Add to user PATH (doesn't need admin)
    $userPath = [Environment]::GetEnvironmentVariable("Path", "User")
    if ($userPath -notlike "*$installDir*") {
        [Environment]::SetEnvironmentVariable("Path", "$installDir;$userPath", "User")
    }

    # Detect best terminal
    $terminal = Get-BestTerminal
    Write-Host "  Starting with elevated privileges..." -ForegroundColor Magenta
    Write-Host ""

    switch ($terminal) {
        "wt" {
            # Windows Terminal - best experience
            Start-Process wt.exe -ArgumentList "new-tab --title GATE cmd /c `"$binary --api $API_BASE && pause`"" -Verb RunAs
        }
        "pwsh" {
            # Modern PowerShell
            Start-Process pwsh.exe -ArgumentList "-NoExit -Command `"& '$binary' --api '$API_BASE'`"" -Verb RunAs
        }
        default {
            # CMD - reliable fallback, good TUI support
            Start-Process cmd.exe -ArgumentList "/k `"$binary --api $API_BASE`"" -Verb RunAs
        }
    }

    exit
}

# Already running as admin - execute directly
$platform = Get-Platform
$installDir = "$env:LOCALAPPDATA\gate"
$binary = "$installDir\gate.exe"

# Ensure binary exists (in case started directly as admin)
if (-not (Test-Path $binary)) {
    if (-not (Test-Path $installDir)) {
        New-Item -ItemType Directory -Path $installDir -Force | Out-Null
    }

    Write-Host "  Downloading GATE..." -ForegroundColor Cyan
    $downloadUrl = "$API_BASE/api/download/tui/$platform"
    try {
        Invoke-WebRequest -Uri $downloadUrl -OutFile $binary -UseBasicParsing
    } catch {
        Invoke-WebRequest -Uri "$API_BASE/api/download/tui" -OutFile $binary -UseBasicParsing
    }
}

# Run the TUI
& $binary --api $API_BASE