; electron-builder NSIS customisation (auto-included: build/installer.nsh).
;
; Per-user install, no elevation (package.json build.nsis). This does three
; things beyond the default: put the bundled daemon on the user's PATH so
; `meshbay-node` works in a terminal; offer to add the inbound firewall rules
; in one elevated step instead of two "Allow access" dialogs later; and clean
; up the one piece of state that lives outside the install directory (the W3
; "run at sign-in" launcher).
;
; Deliberately NOT touched:
;   - %LOCALAPPDATA%\meshbay\  (node.toml, keystore.enc, unlock.key, data/) --
;     the keystore must survive an uninstall/reinstall; installers place files,
;     never remove secrets.

!include "WinMessages.nsh"
!include "WordFunc.nsh"
!include "LogicLib.nsh"
!insertmacro WordAdd
!insertmacro un.WordAdd

!define MB_PWSH "$SYSDIR\WindowsPowerShell\v1.0\powershell.exe"

; The dir electron-builder drops resources into. `meshbay-node.exe` and its
; frozen Python live directly in here. A fixed suffix of $INSTDIR, so both the
; add (install) and the remove (uninstall, where $INSTDIR is still known) match
; the exact same string.
!define MB_NODE_BIN "$INSTDIR\resources\node-runtime"

!macro customInstall
  ; resources\node-runtime\meshbay-node.exe is about to be overwritten; a
  ; daemon still running from a previous version holds the file open.
  nsExec::Exec 'taskkill /IM meshbay-node.exe /F'

  ; Add the daemon dir to the per-user PATH (HKCU\Environment). WordAdd is a
  ; stock NSIS macro over a ';'-delimited list -- it is a no-op if the entry is
  ; already there, so a reinstall does not double it. New shells only; the
  ; broadcast tells already-open Explorer/shells to reload the environment.
  ReadRegStr $0 HKCU "Environment" "Path"
  ${WordAdd} "$0" ";" "+${MB_NODE_BIN}" $1
  WriteRegExpandStr HKCU "Environment" "Path" "$1"
  SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000

  ; Firewall. MeshBay.exe and meshbay-node.exe each bind UDP sockets for WebRTC,
  ; and Windows prompts "Allow access" the first time each does. A per-user
  ; installer cannot pre-create a firewall rule (that needs admin), so offer to
  ; run one elevated helper now: one UAC prompt instead of two dialogs mid-use.
  ; firewall.ps1 is idempotent and does nothing if the exes are missing.
  ${IfNot} ${Silent}
    MessageBox MB_YESNO|MB_ICONQUESTION \
      "Allow MeshBay through Windows Firewall now?$\n$\nMeshBay connects to other devices on your local network. Choosing Yes adds the rules in one step (Windows will ask for administrator confirmation). Choosing No is fine too -- Windows will ask you to allow access the first time MeshBay connects." \
      /SD IDYES IDNO mb_skip_fw
      ExecShellWait "runas" "${MB_PWSH}" \
        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" add' \
        SW_HIDE
    mb_skip_fw:
  ${EndIf}
!macroend

!macro customUnInstall
  nsExec::Exec 'taskkill /IM meshbay-node.exe /F'

  ; Take our entry back out of PATH, leaving the rest of it alone.
  ReadRegStr $0 HKCU "Environment" "Path"
  ${un.WordAdd} "$0" ";" "-${MB_NODE_BIN}" $1
  WriteRegExpandStr HKCU "Environment" "Path" "$1"
  SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000

  ; Offer to take the firewall rules back out (needs admin again). A stale
  ; allow-rule pointing at a deleted exe is inert, so this is opt-in and
  ; default-No -- a silent uninstall skips it entirely. customUnInstall runs
  ; before the files are removed, so firewall.ps1 is still there.
  ${IfNot} ${Silent}
    MessageBox MB_YESNO|MB_ICONQUESTION \
      "Remove MeshBay's Windows Firewall rules? This needs one administrator confirmation. They are harmless if left." \
      /SD IDNO IDNO mb_keep_fw
      ExecShellWait "runas" "${MB_PWSH}" \
        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" remove' \
        SW_HIDE
    mb_keep_fw:
  ${EndIf}

  ; meshbay_node.platform._startup_vbs() -- if the user ran "meshbay-node
  ; autostart install" (or toggled it in the client), this points wscript at
  ; the binary we are about to delete, and would error at every sign-in.
  Delete "$APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\MeshBay Node.vbs"
!macroend