<#
.SYNOPSIS
    Diagnoses DataMagik Extend Chrome extension enterprise policy configuration.

.DESCRIPTION
    Checks Windows registry for Chrome and Edge managed policy settings
    required for DataMagik Extend auto-login via Intune or GPO.
    Reports what is configured, what is missing, and recommends fixes.

.EXAMPLE
    .\Check-DataMagikPolicy.ps1

.EXAMPLE
    .\Check-DataMagikPolicy.ps1 -ExtensionId "your-extension-id"

.EXAMPLE
    .\Check-DataMagikPolicy.ps1 -Browser Edge
#>

param(
    [string]$ExtensionId = "hppahoaiaihchdpnoegknnodnjleogdi",
    [ValidateSet("Chrome", "Edge", "Both")]
    [string]$Browser = "Both"
)

$ErrorActionPreference = "Continue"

# --- Helpers ---

function Write-Status {
    param([string]$Label, [string]$Status, [string]$Detail = "")
    $color = switch ($Status) {
        "OK"      { "Green" }
        "WARNING" { "Yellow" }
        "FAIL"    { "Red" }
        "INFO"    { "Cyan" }
        default   { "White" }
    }
    $symbol = switch ($Status) {
        "OK"      { "[OK]" }
        "WARNING" { "[!!]" }
        "FAIL"    { "[X]" }
        "INFO"    { "[i]" }
        default   { "[ ]" }
    }
    Write-Host "  $symbol " -ForegroundColor $color -NoNewline
    Write-Host "$Label" -NoNewline
    if ($Detail) {
        Write-Host " - $Detail" -ForegroundColor Gray
    } else {
        Write-Host ""
    }
}

function Test-RegistryPath {
    param([string]$Path)
    return Test-Path "Registry::$Path"
}

function Get-RegistryValueSafe {
    param([string]$Path, [string]$Name)
    try {
        $val = Get-ItemProperty -Path "Registry::$Path" -Name $Name -ErrorAction Stop
        return $val.$Name
    } catch {
        return $null
    }
}

function Test-BrowserInstalled {
    param([string]$BrowserName)
    $paths = switch ($BrowserName) {
        "Chrome" {
            @(
                "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
                "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
                "${env:LocalAppData}\Google\Chrome\Application\chrome.exe"
            )
        }
        "Edge" {
            @(
                "${env:ProgramFiles}\Microsoft\Edge\Application\msedge.exe",
                "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe"
            )
        }
    }
    foreach ($p in $paths) {
        if (Test-Path $p) { return $true }
    }
    return $false
}

function Check-BrowserPolicy {
    param(
        [string]$BrowserName,
        [string]$PolicyRoot,    # e.g. HKLM\SOFTWARE\Policies\Google\Chrome
        [string]$ExtId
    )

    $issues = @()
    $recommendations = @()

    Write-Host ""
    Write-Host "=== $BrowserName Policy Check ===" -ForegroundColor Cyan
    Write-Host ""

    # 1. Check browser installed
    $installed = Test-BrowserInstalled -BrowserName $BrowserName
    if ($installed) {
        Write-Status "$BrowserName Installation" "OK" "Browser is installed"
    } else {
        Write-Status "$BrowserName Installation" "WARNING" "Browser not found in standard paths"
    }

    # 2. Check ExtensionSettings (force install)
    Write-Host ""
    Write-Host "  --- Force Install Policy ---" -ForegroundColor White
    $extSettingsPath = "$PolicyRoot\ExtensionSettings"
    $extSettingsExists = Test-RegistryPath $extSettingsPath

    if (-not $extSettingsExists) {
        # Also check for the JSON-based ExtensionSettings key
        $extSettingsVal = Get-RegistryValueSafe -Path $PolicyRoot -Name "ExtensionSettings"
        if ($extSettingsVal) {
            # Parse JSON to check for our extension
            try {
                $parsed = $extSettingsVal | ConvertFrom-Json
                $extConfig = $parsed.$ExtId
                if ($extConfig) {
                    Write-Status "ExtensionSettings" "OK" "Extension found in JSON policy"
                    if ($extConfig.installation_mode -eq "force_installed") {
                        Write-Status "Installation Mode" "OK" "force_installed"
                    } else {
                        Write-Status "Installation Mode" "WARNING" "Set to '$($extConfig.installation_mode)' instead of 'force_installed'"
                        $issues += "Installation mode is not 'force_installed'"
                        $recommendations += "Set installation_mode to 'force_installed' in ExtensionSettings"
                    }
                    if ($extConfig.update_url) {
                        Write-Status "Update URL" "OK" $extConfig.update_url
                    } else {
                        Write-Status "Update URL" "WARNING" "Not set"
                        $issues += "update_url is missing from ExtensionSettings"
                        $recommendations += "Add update_url: 'https://clients2.google.com/service/update2/crx'"
                    }
                } else {
                    Write-Status "ExtensionSettings" "FAIL" "Extension ID '$ExtId' not found in policy"
                    $issues += "Extension not in ExtensionSettings policy"
                    $recommendations += "Add the extension to ExtensionSettings with installation_mode: force_installed"
                }
            } catch {
                Write-Status "ExtensionSettings" "WARNING" "Could not parse JSON value"
            }
        } else {
            # Check the allowlist/blocklist approach
            $allowListPath = "$PolicyRoot\ExtensionInstallAllowlist"
            $forceListPath = "$PolicyRoot\ExtensionInstallForcelist"
            $foundInForceList = $false

            if (Test-RegistryPath $forceListPath) {
                $forceEntries = Get-ItemProperty -Path "Registry::$forceListPath" -ErrorAction SilentlyContinue
                if ($forceEntries) {
                    $props = $forceEntries.PSObject.Properties | Where-Object { $_.Value -like "$ExtId*" }
                    if ($props) {
                        Write-Status "ExtensionInstallForcelist" "OK" "Extension found in force install list"
                        $foundInForceList = $true
                    }
                }
            }

            if (-not $foundInForceList) {
                Write-Status "Force Install" "FAIL" "Extension not found in any force-install policy"
                $issues += "Extension is not force-installed"
                $recommendations += "Deploy ExtensionSettings policy with force_installed mode for extension ID: $ExtId"
            }
        }
    } else {
        # Check individual extension key under ExtensionSettings
        $extKeyPath = "$extSettingsPath\$ExtId"
        if (Test-RegistryPath $extKeyPath) {
            Write-Status "ExtensionSettings" "OK" "Extension key exists"
        } else {
            Write-Status "ExtensionSettings" "FAIL" "Extension ID not found under ExtensionSettings"
            $issues += "Extension not configured in ExtensionSettings"
            $recommendations += "Add ExtensionSettings entry for extension ID: $ExtId"
        }
    }

    # 3. Check 3rdparty managed storage
    Write-Host ""
    Write-Host "  --- Managed Storage (3rdparty) ---" -ForegroundColor White
    $managedPath = "$PolicyRoot\3rdparty\extensions\$ExtId\policy"
    $managedExists = Test-RegistryPath $managedPath

    if (-not $managedExists) {
        Write-Status "Managed Storage Path" "FAIL" "Registry path does not exist"
        Write-Status "Expected Path" "INFO" $managedPath
        $issues += "Managed storage policy path does not exist"
        $recommendations += "Create registry path: $managedPath"
        $recommendations += "Or deploy via Intune OMA-URI to the 3rdparty managed storage path"
    } else {
        Write-Status "Managed Storage Path" "OK" "Registry path exists"

        # Check bearerToken
        $token = Get-RegistryValueSafe -Path $managedPath -Name "bearerToken"
        if ($token) {
            $preview = $token.Substring(0, [Math]::Min(10, $token.Length)) + "..."
            Write-Status "bearerToken" "OK" "Present ($preview)"

            # Check token format
            if ($token -match "^dcp_") {
                Write-Status "Token Format" "OK" "Starts with 'dcp_' prefix"
            } else {
                Write-Status "Token Format" "WARNING" "Does not start with 'dcp_' — may be incorrect"
                $issues += "bearerToken does not start with 'dcp_' prefix"
                $recommendations += "Verify the bearer token was copied correctly from DataMagik Settings > API Keys"
            }

            # Validate token against API
            Write-Host ""
            Write-Host "  --- Token Validation ---" -ForegroundColor White
            try {
                $headers = @{
                    "Authorization" = "Bearer $token"
                    "Content-Type" = "application/json"
                }
                $env = Get-RegistryValueSafe -Path $managedPath -Name "environment"
                $baseUrl = if ($env -eq "staging") { "https://staging.data-magik.com" } else { "https://data-magik.com" }
                $response = Invoke-WebRequest -Uri "$baseUrl/api/user/me" -Headers $headers -Method GET -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
                if ($response.StatusCode -eq 200) {
                    Write-Status "API Validation" "OK" "Token authenticated successfully against $baseUrl"
                    try {
                        $userData = $response.Content | ConvertFrom-Json
                        if ($userData.first_name) {
                            Write-Status "Authenticated User" "INFO" "$($userData.first_name) $($userData.last_name)"
                        }
                        if ($userData.company_name) {
                            Write-Status "Company" "INFO" $userData.company_name
                        }
                    } catch {
                        # Could not parse user data, that's fine
                    }
                }
            } catch {
                $statusCode = $null
                if ($_.Exception.Response) {
                    $statusCode = [int]$_.Exception.Response.StatusCode
                }
                if ($statusCode -eq 401 -or $statusCode -eq 403) {
                    Write-Status "API Validation" "FAIL" "Token is unauthorized or expired (HTTP $statusCode)"
                    $issues += "bearerToken failed API validation (HTTP $statusCode)"
                    $recommendations += "Generate a new bearer token from DataMagik Settings > API Keys"
                } elseif ($statusCode) {
                    Write-Status "API Validation" "FAIL" "Server returned HTTP $statusCode"
                    $issues += "API validation returned unexpected status: HTTP $statusCode"
                } else {
                    Write-Status "API Validation" "WARNING" "Could not reach server: $($_.Exception.Message)"
                    $issues += "Could not validate token — network error"
                    $recommendations += "Ensure this machine can reach $baseUrl"
                }
            }
        } else {
            Write-Status "bearerToken" "FAIL" "Not set"
            $issues += "bearerToken is missing from managed storage"
            $recommendations += "Add bearerToken (REG_SZ) to: $managedPath"
        }

        # Check environment
        $envVal = Get-RegistryValueSafe -Path $managedPath -Name "environment"
        if ($envVal) {
            if ($envVal -eq "production" -or $envVal -eq "staging") {
                Write-Status "environment" "OK" $envVal
            } else {
                Write-Status "environment" "FAIL" "'$envVal' is not valid (must be 'production' or 'staging')"
                $issues += "environment is set to '$envVal' — invalid value"
                $recommendations += "Set environment to 'production' or 'staging'"
            }
        } else {
            Write-Status "environment" "INFO" "Not set (will default to 'production')"
        }

        # Check lockEnvironment
        $lockVal = Get-RegistryValueSafe -Path $managedPath -Name "lockEnvironment"
        if ($null -ne $lockVal) {
            $lockBool = [bool]$lockVal
            Write-Status "lockEnvironment" "OK" "$lockBool"
        } else {
            Write-Status "lockEnvironment" "INFO" "Not set (will default to false)"
        }
    }

    # 4. Check if Chrome ADMX templates are present (Chrome only)
    if ($BrowserName -eq "Chrome") {
        Write-Host ""
        Write-Host "  --- Chrome ADMX Templates ---" -ForegroundColor White
        $admxPath = "HKLM\SOFTWARE\Policies\Google\Chrome"
        if (Test-RegistryPath $admxPath) {
            Write-Status "Chrome Policy Root" "OK" "HKLM\SOFTWARE\Policies\Google\Chrome exists"
        } else {
            Write-Status "Chrome Policy Root" "FAIL" "Chrome policy root not found"
            $issues += "Chrome ADMX templates may not be imported into Intune or applied via GPO"
            $recommendations += "Import Chrome ADMX templates: https://chromeenterprise.google/policies/"
        }
    }

    return @{
        Issues = $issues
        Recommendations = $recommendations
    }
}

# --- Main ---

Write-Host ""
Write-Host "=============================================" -ForegroundColor Cyan
Write-Host "  DataMagik Extend - Policy Diagnostic Tool" -ForegroundColor Cyan
Write-Host "=============================================" -ForegroundColor Cyan
Write-Host ""
Write-Host "  Extension ID: $ExtensionId" -ForegroundColor Gray
Write-Host "  Checking:     $Browser" -ForegroundColor Gray
Write-Host "  Date:         $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Gray
Write-Host "  Computer:     $env:COMPUTERNAME" -ForegroundColor Gray
Write-Host "  User:         $env:USERNAME" -ForegroundColor Gray

$allIssues = @()
$allRecommendations = @()

if ($Browser -eq "Chrome" -or $Browser -eq "Both") {
    $result = Check-BrowserPolicy -BrowserName "Chrome" -PolicyRoot "HKLM\SOFTWARE\Policies\Google\Chrome" -ExtId $ExtensionId
    $allIssues += $result.Issues
    $allRecommendations += $result.Recommendations
}

if ($Browser -eq "Edge" -or $Browser -eq "Both") {
    $result = Check-BrowserPolicy -BrowserName "Edge" -PolicyRoot "HKLM\SOFTWARE\Policies\Microsoft\Edge" -ExtId $ExtensionId
    $allIssues += $result.Issues
    $allRecommendations += $result.Recommendations
}

# --- Summary ---

Write-Host ""
Write-Host "=============================================" -ForegroundColor Cyan
Write-Host "  Summary" -ForegroundColor Cyan
Write-Host "=============================================" -ForegroundColor Cyan
Write-Host ""

if ($allIssues.Count -eq 0) {
    Write-Host "  All checks passed! Policy appears to be configured correctly." -ForegroundColor Green
    Write-Host ""
    Write-Host "  Next steps:" -ForegroundColor White
    Write-Host "    1. Restart the browser completely (close all windows)" -ForegroundColor Gray
    Write-Host "    2. Navigate to chrome://policy and click 'Reload policies'" -ForegroundColor Gray
    Write-Host "    3. Open the DataMagik Extend popup - it should auto-login" -ForegroundColor Gray
    Write-Host "    4. Check Settings page for 'Enterprise Managed' indicator" -ForegroundColor Gray
} else {
    Write-Host "  Found $($allIssues.Count) issue(s):" -ForegroundColor Red
    Write-Host ""
    $i = 1
    foreach ($issue in $allIssues) {
        Write-Host "    $i. $issue" -ForegroundColor Red
        $i++
    }

    if ($allRecommendations.Count -gt 0) {
        Write-Host ""
        Write-Host "  Recommendations:" -ForegroundColor Yellow
        Write-Host ""
        $i = 1
        foreach ($rec in ($allRecommendations | Select-Object -Unique)) {
            Write-Host "    $i. $rec" -ForegroundColor Yellow
            $i++
        }
    }
}

Write-Host ""
Write-Host "  For more information, see the deployment guide:" -ForegroundColor Gray
Write-Host "  https://github.com/DataMagik/DataMagikExtend/docs/intune-deployment-guide.md" -ForegroundColor Gray
Write-Host ""