<#
.SYNOPSIS
    Intune Remediation — Detection script for DataMagik Extend policy.
    Checks if the extension policy is correctly configured.

.NOTES
    Intune: Devices > Scripts and remediations > Remediations > Create
    Upload this as the Detection script.
    Upload Remediate-DataMagikPolicy.ps1 as the Remediation script.

    Exit 0 = Compliant (policy is correct)
    Exit 1 = Non-compliant (remediation needed)
#>

$ExtensionId = "hppahoaiaihchdpnoegknnodnjleogdi"

# Check both Chrome and Edge
$browsers = @(
    @{ Name = "Chrome"; Path = "HKLM:\SOFTWARE\Policies\Google\Chrome" },
    @{ Name = "Edge";   Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge" }
)

$anyBrowserConfigured = $false

foreach ($browser in $browsers) {
    $policyPath = "$($browser.Path)\3rdparty\extensions\$ExtensionId\policy"

    if (-not (Test-Path $policyPath)) {
        continue
    }

    # Check bearerToken exists and is not the placeholder
    $token = $null
    try {
        $token = (Get-ItemProperty -Path $policyPath -Name "bearerToken" -ErrorAction Stop).bearerToken
    } catch {}

    if (-not $token -or $token -eq "dcp_YOUR_BEARER_TOKEN_HERE") {
        Write-Output "$($browser.Name): bearerToken missing or placeholder"
        exit 1
    }

    # Check environment is valid
    $env = $null
    try {
        $env = (Get-ItemProperty -Path $policyPath -Name "environment" -ErrorAction Stop).environment
    } catch {}

    if ($env -and $env -ne "production" -and $env -ne "staging") {
        Write-Output "$($browser.Name): environment is invalid: $env"
        exit 1
    }

    # Check ExtensionSettings
    $extSettings = $null
    try {
        $extSettings = (Get-ItemProperty -Path $browser.Path -Name "ExtensionSettings" -ErrorAction Stop).ExtensionSettings
    } catch {}

    if ($extSettings) {
        try {
            $parsed = $extSettings | ConvertFrom-Json
            if (-not $parsed.$ExtensionId) {
                Write-Output "$($browser.Name): Extension not in ExtensionSettings"
                exit 1
            }
        } catch {
            Write-Output "$($browser.Name): ExtensionSettings is not valid JSON"
            exit 1
        }
    } else {
        Write-Output "$($browser.Name): ExtensionSettings not found"
        exit 1
    }

    $anyBrowserConfigured = $true
}

if (-not $anyBrowserConfigured) {
    Write-Output "No browser has DataMagik policy configured"
    exit 1
}

Write-Output "DataMagik policy is correctly configured"
exit 0