# ClassMan Agent installer - run once as Administrator
# Usage: powershell -ExecutionPolicy Bypass -File install-agent.ps1 -Server https://classman.dbt-kbtc.app
param(
  [string]$Server = "https://classman.dbt-kbtc.app"
)
$ErrorActionPreference = "Stop"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$DIR = "C:\ProgramData\CoreSync"
$AGENT = Join-Path $DIR "agent.ps1"
$TASK = "CoreSync"

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  Write-Host "ERROR: run as Administrator" -ForegroundColor Red
  exit 1
}

Write-Host "== ClassMan agent install =="

# 0. Windows Defender exclusion for agent folder (AMSI flags classroom-control signatures)
if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {
  try { Add-MpPreference -ExclusionPath $DIR; Write-Host "Defender exclusion added: $DIR" } catch { Write-Host "WARNING: could not add Defender exclusion: $($_.Exception.Message)" -ForegroundColor Yellow }
}

# 1. download agent
New-Item -ItemType Directory -Path $DIR -Force | Out-Null
Invoke-WebRequest -Uri "$Server/api/agent/script" -OutFile $AGENT -TimeoutSec 60
if ((Get-Item $AGENT).Length -lt 1KB) { Write-Host "ERROR: agent download failed" -ForegroundColor Red; exit 1 }
Write-Host "agent.ps1 downloaded"

# 2. check winget, hint if missing (not fatal)
if (-not (Get-Command winget -ErrorAction SilentlyContinue)) {
  Write-Host "WARNING: winget missing - install/uninstall jobs will fail until App Installer is installed" -ForegroundColor Yellow
}

# 3. scheduled task: at startup + every 5 min (agent self-loops 30s)
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$AGENT`""
$trigger1 = New-ScheduledTaskTrigger -AtStartup
$trigger2 = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 3650)
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit (New-TimeSpan -Hours 0)

Register-ScheduledTask -TaskName $TASK -Action $action -Trigger $trigger1, $trigger2 -Principal $principal -Settings $settings -Force | Out-Null
Write-Host "task '$TASK' registered (SYSTEM)"

# 4. start now
Start-ScheduledTask -TaskName $TASK
Write-Host "started - device will appear in dashboard within 30 seconds (pending approval)"
Write-Host "DONE"