@echo off
REM ===================================================================
REM  Starhigh laptop setup
REM
REM  Copy this file to a USB drive and double-click it on a new laptop.
REM  Nothing to type. It asks for administrator rights once, then sets
REM  up the machine: enrols it with the portal, installs Chocolatey and
REM  the standard software, and registers the agent so staff can
REM  install approved software without an admin password ever again.
REM
REM  The .ps1 files are used from this folder if present, and downloaded
REM  from the portal if not -- so the USB can carry just this file.
REM
REM  Also available at https://setup.starhighgroup.com
REM ===================================================================

setlocal
title Starhigh Group - Workstation Setup

set "PORTAL=https://portal.starhighgroup.com"

REM No secret here by design. The wizard signs the admin in with a one-time
REM emailed code, and the token that returns is what authorises enrolment -- so
REM this file carries nothing worth protecting and can be handed out freely.

REM --- Re-launch elevated if we are not already administrator. This is
REM --- the single UAC prompt for the whole process.
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo Starting Starhigh Workstation Setup...
    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
    if %errorLevel% neq 0 (
        echo.
        echo  Setup needs administrator approval. Run it again and
        echo  click Yes when Windows asks for permission.
        echo.
        pause
    )
    exit /b
)

cd /d "%~dp0"

REM --- Prefer the scripts sitting next to this file; fall back to the
REM --- portal so a bare USB still works.
if exist "%~dp0Setup-Wizard.ps1" (
    if exist "%~dp0install-agent.ps1" (
        if exist "%~dp0starhigh-agent.ps1" (
            set "WORKDIR=%~dp0"
            goto :run
        )
    )
)

echo  Downloading setup scripts...
set "WORKDIR=%TEMP%\starhigh-setup"
if not exist "%WORKDIR%" mkdir "%WORKDIR%"
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "[Net.ServicePointManager]::SecurityProtocol=3072;" ^
  "try {" ^
  "  Invoke-WebRequest '%PORTAL%/agent/install-agent.ps1' -OutFile '%WORKDIR%\install-agent.ps1' -UseBasicParsing;" ^
  "  Invoke-WebRequest '%PORTAL%/agent/starhigh-agent.ps1' -OutFile '%WORKDIR%\starhigh-agent.ps1' -UseBasicParsing;" ^
  "  Invoke-WebRequest '%PORTAL%/agent/Setup-Wizard.ps1' -OutFile '%WORKDIR%\Setup-Wizard.ps1' -UseBasicParsing;" ^
  "  Invoke-WebRequest '%PORTAL%/agent/starhigh-notify.ps1' -OutFile '%WORKDIR%\starhigh-notify.ps1' -UseBasicParsing;" ^
  "} catch { Write-Host ''; Write-Host ('  Download failed: ' + $_.Exception.Message) -ForegroundColor Red; exit 1 }"
if %errorLevel% neq 0 goto :failed

REM --- A Wi-Fi network that wants a browser sign-in answers every request
REM --- with its login page, and the download above would happily save that
REM --- page as a script and run it. Every real script here starts with a
REM --- PowerShell comment block; anything else is not ours.
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "$bad = @(Get-ChildItem '%WORKDIR%\*.ps1' | Where-Object { ((Get-Content $_.FullName -TotalCount 1 -ErrorAction SilentlyContinue) -join '') -notmatch '^\s*<#' });" ^
  "if ($bad.Count) { Write-Host ''; Write-Host '  The download did not return setup files. If this Wi-Fi needs a browser sign-in, do that first, then run this again.' -ForegroundColor Red; exit 1 }"
if %errorLevel% neq 0 goto :failed

:run
REM --- Files arriving from a USB drive or the internet carry a
REM --- mark-of-the-web that blocks execution; clear it.
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "Get-ChildItem '%WORKDIR%\*.ps1' | Unblock-File -ErrorAction SilentlyContinue"

REM The wizard hides this console itself once it starts, and reports any
REM startup failure in a dialog -- so there is no silent-failure risk in
REM launching it minimised.
start "" /min powershell -NoProfile -ExecutionPolicy Bypass -File "%WORKDIR%\Setup-Wizard.ps1" -PortalUrl "%PORTAL%" -ScriptDir "%WORKDIR%"
exit /b 0

:failed
echo.
echo  ------------------------------------------------
echo   SETUP DID NOT COMPLETE
echo.
echo   Check the laptop has internet access and that its
echo   date and time are correct, then run this again.
echo   If it keeps failing, send a photo of this window
echo   to IT.
echo  ------------------------------------------------
echo.
pause
exit /b 1