#Requires -Version 5.1
<#
.SYNOPSIS
  TSK-0003 pilot: activate ReBreak DNS-only protection on Windows via CLI and
  report the result back through AgentHub — in one run, one UAC prompt.

.DESCRIPTION
  Self-contained validation script for a fresh Windows machine. It:
    1. claims TSK-0003 in AgentHub (best-effort)
    2. pairs + registers this device with the ReBreak staging backend
    3. resolves the DoH server and self-elevates to apply DNS/DoH/firewall/
       browser-policy protection (the magic-reviewed HOF-0001 flow)
    4. verifies, then reports back via `agenthub memory add` + `task done`

  Run from a normal PowerShell. You get exactly one UAC prompt.
  Protection is the critical part; all AgentHub calls are best-effort and never
  block the protection itself.

  Scope: DNS-only. NOT fail-closed (no tamper-service) — that is TSK-0005.
#>

$ErrorActionPreference = "Stop"

# --- Config -----------------------------------------------------------------
$BASE_URL        = "https://staging.rebreak.org"
$DEBUG_CODE      = "000000"                  # test-only debug bypass (staging)
$DOH_HOST        = "dns.rebreak.org"
$DOH_FALLBACK_IP = "178.105.101.137"
# Mac AgentHub hub — adjust if the Mac's LAN IP changes:
$AGENTHUB_SERVER = "http://192.168.178.30:3377"
$AGENT_NAME      = "windows-ps"

$env:AGENTHUB_SERVER = $AGENTHUB_SERVER

function Test-Admin {
  $id = [Security.Principal.WindowsIdentity]::GetCurrent()
  return (New-Object Security.Principal.WindowsPrincipal($id)).IsInRole(
    [Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Invoke-AgentHub {
  param([string[]]$Args)
  # Best-effort: never let an AgentHub hiccup abort the protection test.
  try {
    if (-not (Get-Command agenthub -ErrorAction SilentlyContinue)) {
      Write-Host "  (agenthub CLI not found on PATH — skipping coordination)"
      return
    }
    & agenthub @Args 2>&1 | ForEach-Object { Write-Host "  $_" }
  } catch {
    Write-Host "  (agenthub call failed: $($_.Exception.Message))"
  }
}

# --- 0. Claim the task ------------------------------------------------------
Write-Host "[0/6] Claiming TSK-0003 in AgentHub ($AGENTHUB_SERVER)..."
Invoke-AgentHub @("task", "claim", "TSK-0003", "--agent", $AGENT_NAME)

# --- 1. Pairing -------------------------------------------------------------
Write-Host "[1/6] Pairing with debug code $DEBUG_CODE ..."
$pair = Invoke-RestMethod -Uri "$BASE_URL/api/magic/pair/redeem" `
  -Method POST -ContentType "application/json" `
  -Body (@{ code = $DEBUG_CODE; label = "win-pilot" } | ConvertTo-Json -Compress)
if ($pair -is [string]) { $pair = $pair | ConvertFrom-Json }
$token = $pair.data.token
if (-not $token) { throw "Pairing failed: no session token returned." }
Write-Host "      Session token acquired."

# --- 2. Device registration -------------------------------------------------
Write-Host "[2/6] Registering this device ..."
$machineGuid = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Cryptography').MachineGuid
$deviceId = "win-$machineGuid"
$headers = @{ Authorization = "Bearer $token" }
$regBody = @{
  deviceId  = $deviceId
  hostname  = $env:COMPUTERNAME
  model     = "Windows CLI"
  osVersion = (Get-CimInstance Win32_OperatingSystem).Version
  platform  = "windows"
} | ConvertTo-Json
$reg = Invoke-RestMethod -Uri "$BASE_URL/api/magic/register" `
  -Method POST -Headers $headers -ContentType "application/json" -Body $regBody
if ($reg -is [string]) { $reg = $reg | ConvertFrom-Json }
$dnsToken = $reg.data.dnsToken
if (-not $dnsToken) { throw "Registration failed: no dnsToken returned." }
Write-Host "      DNS token acquired ($deviceId)."

# --- 3. Resolve DoH IP ------------------------------------------------------
Write-Host "[3/6] Resolving $DOH_HOST ..."
try {
  $dohIp = (Resolve-DnsName -Name $DOH_HOST -Type A -ErrorAction Stop | Select-Object -First 1).IPAddress
} catch {
  $dohIp = $DOH_FALLBACK_IP
}
$template = "https://$DOH_HOST/dns-query/$dnsToken"
Write-Host "      DoH IP: $dohIp"

# --- 4. Build + run elevated apply script -----------------------------------
Write-Host "[4/6] Applying protection (one UAC prompt) ..."
$applyScript = @"
`$ErrorActionPreference = "Stop"
`$ip = "$dohIp"
`$template = "$template"

Remove-DnsClientDohServerAddress -ServerAddress `$ip -ErrorAction Ignore
Add-DnsClientDohServerAddress -ServerAddress `$ip -DohTemplate `$template -AllowFallbackToUdp `$False -AutoUpgrade `$True

`$adapters = Get-NetAdapter -IncludeHidden | Where-Object { `$_.Status -eq "Up" -and `$_.InterfaceDescription -notmatch "Loopback" }
if (-not `$adapters) { throw "Kein aktiver Netzwerkadapter gefunden." }
foreach (`$adapter in `$adapters) {
  Set-DnsClientServerAddress -InterfaceIndex `$adapter.ifIndex -ServerAddresses `$ip
  `$guid = `$adapter.InterfaceGuid
  `$dohPath = "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters`$guid\DohInterfaceSettings\Doh`$ip"
  New-Item -Path `$dohPath -Force | Out-Null
  New-ItemProperty -Path `$dohPath -Name "DohFlags" -Value 1 -PropertyType QWORD -Force | Out-Null
}

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -Name "EnableAutoDoh" -Value 2 -Type DWord

function Set-ChromiumDnsPolicy(`$base) {
  if (-not (Test-Path `$base)) { New-Item -Path `$base -Force | Out-Null }
  Set-ItemProperty -Path `$base -Name "DnsOverHttpsMode" -Value "off" -Type String
  Set-ItemProperty -Path `$base -Name "BuiltInDnsClientEnabled" -Value 0 -Type DWord
}
Set-ChromiumDnsPolicy "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
Set-ChromiumDnsPolicy "HKLM:\SOFTWARE\Policies\Google\Chrome"
Set-ChromiumDnsPolicy "HKLM:\SOFTWARE\Policies\BraveSoftware\Brave"

`$ff = "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS"
if (-not (Test-Path `$ff)) { New-Item -Path `$ff -Force | Out-Null }
Set-ItemProperty -Path `$ff -Name "Enabled" -Value 0 -Type DWord
Set-ItemProperty -Path `$ff -Name "Locked" -Value 1 -Type DWord

Remove-NetFirewallRule -DisplayName "ReBreak Protection - Block DNS UDP" -ErrorAction Ignore
Remove-NetFirewallRule -DisplayName "ReBreak Protection - Block DNS TCP" -ErrorAction Ignore
Remove-NetFirewallRule -DisplayName "ReBreak Protection - Block DNS over TLS" -ErrorAction Ignore
New-NetFirewallRule -DisplayName "ReBreak Protection - Block DNS UDP" -Direction Outbound -Action Block -Protocol UDP -RemotePort 53 -Profile Any | Out-Null
New-NetFirewallRule -DisplayName "ReBreak Protection - Block DNS TCP" -Direction Outbound -Action Block -Protocol TCP -RemotePort 53 -Profile Any | Out-Null
New-NetFirewallRule -DisplayName "ReBreak Protection - Block DNS over TLS" -Direction Outbound -Action Block -Protocol TCP -RemotePort 853 -Profile Any | Out-Null

Clear-DnsClientCache
Write-Host "Protection applied successfully."
"@

$tmp = Join-Path $env:TEMP "rebreak-apply-protection-elevated.ps1"
Set-Content -Path $tmp -Value $applyScript -Encoding UTF8

$applyOk = $false
if (Test-Admin) {
  & $tmp
  $applyOk = $true
} else {
  $proc = Start-Process powershell.exe -Verb RunAs -Wait -PassThru `
    -ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', $tmp)
  $applyOk = ($proc.ExitCode -eq 0)
}
Remove-Item $tmp -ErrorAction Ignore

# --- 5. Verify --------------------------------------------------------------
Write-Host "[5/6] Verifying ..."
$dohList = ""
try { $dohList = (Get-DnsClientDohServerAddress | Where-Object { $_.ServerAddress -eq $dohIp } | Out-String).Trim() } catch {}
$lottoResult = ""
try {
  Clear-DnsClientCache
  $lottoResult = (Resolve-DnsName -Name "lotto.de" -ErrorAction Stop | Out-String).Trim()
} catch {
  $lottoResult = "BLOCKED / not resolved: $($_.Exception.Message)"
}
Write-Host "      DoH endpoint present: $([bool]$dohList)"
Write-Host "      lotto.de -> $lottoResult"

# --- 6. Report back via AgentHub --------------------------------------------
Write-Host "[6/6] Reporting result to AgentHub ..."
$status = if ($applyOk) { "SUCCESS" } else { "FAILED (elevated apply exit non-zero)" }
$report = "TSK-0003 Windows-Pilot: $status. device=$deviceId, dohIp=$dohIp, dohPresent=$([bool]$dohList), lotto.de=$lottoResult"
Invoke-AgentHub @("memory", "add", "--title", "TSK-0003 Windows-Schutz Test", "--category", "implementation", "--content", $report)
if ($applyOk) {
  Invoke-AgentHub @("task", "done", "TSK-0003")
}

Write-Host ""
Write-Host "==================== DONE: $status ===================="
Write-Host $report