@echo off
REM ===================================================================
REM  Starhigh laptop setup
REM
REM  Copy this file to a USB drive and double-click it on a new laptop.
REM  Nothing to type. It asks for administrator rights once, then sets
REM  up the machine: enrols it with the portal, installs Chocolatey and
REM  the standard software, and registers the agent so staff can
REM  install approved software without an admin password ever again.
REM
REM  The .ps1 files are used from this folder if present, and downloaded
REM  from the portal if not -- so the USB can carry just this file.
REM
REM  Also available at https://setup.starhighgroup.com
REM ===================================================================

setlocal
title Starhigh Group - Workstation Setup

set "PORTAL=https://portal.starhighgroup.com"

REM No secret here by design. The wizard signs the admin in with a one-time
REM emailed code, and the token that returns is what authorises enrolment -- so
REM this file carries nothing worth protecting and can be handed out freely.

REM --- Re-launch elevated if we are not already administrator. This is
REM --- the single UAC prompt for the whole process.
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo Starting Starhigh Workstation Setup...
    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
    exit /b
)

cd /d "%~dp0"

REM --- Prefer the scripts sitting next to this file; fall back to the
REM --- portal so a bare USB still works.
if exist "%~dp0Setup-Wizard.ps1" (
    if exist "%~dp0install-agent.ps1" (
        if exist "%~dp0starhigh-agent.ps1" (
            set "WORKDIR=%~dp0"
            goto :run
        )
    )
)

echo  Downloading setup scripts...
set "WORKDIR=%TEMP%\starhigh-setup"
if not exist "%WORKDIR%" mkdir "%WORKDIR%"
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "[Net.ServicePointManager]::SecurityProtocol=3072;" ^
  "try {" ^
  "  Invoke-WebRequest '%PORTAL%/agent/install-agent.ps1' -OutFile '%WORKDIR%\install-agent.ps1' -UseBasicParsing;" ^
  "  Invoke-WebRequest '%PORTAL%/agent/starhigh-agent.ps1' -OutFile '%WORKDIR%\starhigh-agent.ps1' -UseBasicParsing;" ^
  "  Invoke-WebRequest '%PORTAL%/agent/Setup-Wizard.ps1' -OutFile '%WORKDIR%\Setup-Wizard.ps1' -UseBasicParsing;" ^
  "} catch { Write-Host ''; Write-Host ('  Download failed: ' + $_.Exception.Message) -ForegroundColor Red; exit 1 }"
if %errorLevel% neq 0 goto :failed

:run
REM --- Files arriving from a USB drive or the internet carry a
REM --- mark-of-the-web that blocks execution; clear it.
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "Get-ChildItem '%WORKDIR%\*.ps1' | Unblock-File -ErrorAction SilentlyContinue"

REM The wizard hides this console itself once it starts, and reports any
REM startup failure in a dialog -- so there is no silent-failure risk in
REM launching it minimised.
start "" /min powershell -NoProfile -ExecutionPolicy Bypass -File "%WORKDIR%\Setup-Wizard.ps1" -PortalUrl "%PORTAL%" -ScriptDir "%WORKDIR%"
exit /b 0

:failed
echo.
echo  ------------------------------------------------
echo   SETUP DID NOT COMPLETE
echo.
echo   Check the laptop has internet access, then run
echo   this again. If it keeps failing, send a photo of
echo   this window to IT.
echo  ------------------------------------------------
echo.
pause
exit /b 1