; electron-builder NSIS customisation (auto-included: build/installer.nsh).
;
; Per-user install, no elevation (package.json build.nsis) -- that part never
; changes. What this adds, all conditional on interactive setup (never
; ${Silent}):
;   - the bundled daemon dir on the user's PATH, so `meshbay-node` works in a
;     terminal;
;   - a choice of autostart: the normal per-user Startup-folder launcher (no
;     admin, starts at sign-in -- see meshbay_node.platform._startup_vbs),
;     or a background-service mode (one admin confirmation, starts at boot,
;     no sign-in required -- see meshbay_node.platform.service_install and
;     packaging/win/service.ps1);
;   - the inbound firewall rules, folded into that SAME elevation when service
;     mode is chosen, or offered on their own otherwise -- never two UAC
;     prompts for one install;
;   - cleanup of whichever of those is outside $INSTDIR on the way out (the
;     Startup .vbs; the scheduled task and firewall rules, together, if the
;     user opts in).
;
; Deliberately NOT touched:
;   - %LOCALAPPDATA%\meshbay\  (node.toml, keystore.enc, unlock.key, data/) --
;     the keystore must survive an uninstall/reinstall; installers place files,
;     never remove secrets. This is also why service mode needs no code
;     changes to platform.py: it runs as this same user (S4U), so it is the
;     same profile either way.

!include "WinMessages.nsh"
!include "WordFunc.nsh"
!include "LogicLib.nsh"
!insertmacro WordAdd
!insertmacro un.WordAdd

!define MB_PWSH "$SYSDIR\WindowsPowerShell\v1.0\powershell.exe"

; The dir electron-builder drops resources into. `meshbay-node.exe` and its
; frozen Python live directly in here. A fixed suffix of $INSTDIR, so both the
; add (install) and the remove (uninstall, where $INSTDIR is still known) match
; the exact same string.
!define MB_NODE_BIN "$INSTDIR\resources\node-runtime"

!macro customInstall
  ; resources\node-runtime\meshbay-node.exe is about to be overwritten; a
  ; daemon still running from a previous version holds the file open.
  nsExec::Exec 'taskkill /IM meshbay-node.exe /F'

  ; Add the daemon dir to the per-user PATH (HKCU\Environment). WordAdd is a
  ; stock NSIS macro over a ';'-delimited list -- it is a no-op if the entry is
  ; already there, so a reinstall does not double it. New shells only; the
  ; broadcast tells already-open Explorer/shells to reload the environment.
  ReadRegStr $0 HKCU "Environment" "Path"
  ${WordAdd} "$0" ";" "+${MB_NODE_BIN}" $1
  WriteRegExpandStr HKCU "Environment" "Path" "$1"
  SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000

  ${IfNot} ${Silent}
    ; Already configured -- an upgrade, or a repair install -- asks nothing.
    ; Checked unelevated: reading firewall rules needs no admin, only
    ; creating them does (same reasoning as the service task below). Whether
    ; service mode or per-user mode was chosen last time, firewall rules
    ; existing already means there is nothing left for this dialog to do.
    nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check'
    Pop $0
    ${If} $0 == 0
      Goto mb_mode_done
    ${EndIf}

    ; The choice. Service mode needs admin to CREATE (a boot trigger touches
    ; system-wide scheduler state -- the same reason /sc onlogon needed it
    ; too); day-to-day start/stop from the Node page does not, once the task
    ; exists, because Task Scheduler grants the owning user that much itself.
    MessageBox MB_YESNO|MB_ICONQUESTION \
      "Run MeshBay Node as a background service?$\n$\nIt starts automatically at boot, even before you sign in, and needs one administrator confirmation now (which also sets up the Windows Firewall rules, in the same step).$\n$\nChoose No for the normal per-user mode instead: it starts when you sign in, no admin needed, and you will be asked about the firewall rules separately." \
      IDNO mb_peruser_mode

      ; -- Service mode: one elevation, both jobs --------------------------
      ExecShellWait "runas" "${MB_PWSH}" \
        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action install' \
        SW_HIDE
      Goto mb_mode_done

    mb_peruser_mode:
      ; -- Per-user mode: the firewall question stands on its own ----------
      MessageBox MB_YESNO|MB_ICONQUESTION \
        "Allow MeshBay through Windows Firewall now?$\n$\nMeshBay connects to other devices on your local network. Choosing Yes adds the rules in one step (Windows will ask for administrator confirmation). Choosing No is fine too -- Windows will ask you to allow access the first time MeshBay connects." \
        /SD IDYES IDNO mb_mode_done
        ExecShellWait "runas" "${MB_PWSH}" \
          '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" add' \
          SW_HIDE

    mb_mode_done:
  ${EndIf}
!macroend

!macro customUnInstall
  nsExec::Exec 'taskkill /IM meshbay-node.exe /F'

  ; Take our entry back out of PATH, leaving the rest of it alone.
  ReadRegStr $0 HKCU "Environment" "Path"
  ${un.WordAdd} "$0" ";" "-${MB_NODE_BIN}" $1
  WriteRegExpandStr HKCU "Environment" "Path" "$1"
  SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000

  ; Offer to take the firewall rules, and the service task if one was set up,
  ; back out together (needs admin again -- one prompt for both, same as
  ; install). Both underlying removes are no-ops when there is nothing to
  ; remove, so this is safe to run unconditionally regardless of which mode
  ; was chosen. Stale rules/tasks are inert if left, so this is opt-in and
  ; default-No; a silent uninstall skips it entirely. customUnInstall runs
  ; before the files are removed, so service-mode.ps1 is still there.
  ${IfNot} ${Silent}
    MessageBox MB_YESNO|MB_ICONQUESTION \
      "Remove MeshBay's Windows Firewall rules and its boot-time service task, if you set one up? This needs one administrator confirmation. Both are harmless if left." \
      /SD IDNO IDNO mb_keep_privileged
      ExecShellWait "runas" "${MB_PWSH}" \
        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action remove' \
        SW_HIDE
    mb_keep_privileged:
  ${EndIf}

  ; meshbay_node.platform._startup_vbs() -- if the user ran "meshbay-node
  ; autostart install" (or toggled it in the client), this points wscript at
  ; the binary we are about to delete, and would error at every sign-in.
  Delete "$APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\MeshBay Node.vbs"
!macroend