# تثبيت مقام على Windows — installs an unsigned build, and says plainly what that costs.
#
# ## Why this script exists at all
#
# مقام is not signed with an Authenticode certificate. Windows marks every file
# arriving from a browser with a Mark-of-the-Web, and SmartScreen uses that mark
# to decide whether to interrupt. An unsigned installer has no reputation to
# check against, so the interruption is a blue box saying «Windows protected
# your PC» with the Run button hidden behind «More info».
#
# This script does what that box does, in the open:
#
#   1. Checks the download against a SHA-256 you can read on maqademy.com.
#   2. Removes the Mark-of-the-Web, so SmartScreen has nothing to flag.
#   3. Runs the installer.
#
# ## What step 2 actually means — read this
#
# Removing the mark is telling Windows «I know where this came from». After
# that, Windows stops asking. What replaces its check is step 1 and nothing
# else: if you skip the checksum, you are installing a file you cannot
# identify. The script will say so rather than quietly proceeding.
#
# ## NOT VERIFIED ON A WINDOWS MACHINE
#
# This was written on macOS and has not been run. The logic is straightforward
# and the cmdlets are the documented ones, but «should work» is not «was seen
# to work» — the first person to run it is testing it. If it fails, the manual
# route is at the bottom of this file and always works.

[CmdletBinding()]
param(
    [Parameter(Position = 0)]
    [string]$Installer,
    [string]$Sha256
)

$ErrorActionPreference = 'Stop'

function Fail($msg) { Write-Host "`n✗ $msg" -ForegroundColor Red; exit 1 }

# ── 1. Find the download ─────────────────────────────────────────────────────
if (-not $Installer) {
    $downloads = Join-Path $env:USERPROFILE 'Downloads'
    # Newest match wins: someone who downloaded twice because the first attempt
    # looked like it failed should get the one they just fetched.
    $Installer = Get-ChildItem -Path $downloads -Filter 'Maqam*' -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Extension -in '.exe', '.msi' } |
        Sort-Object LastWriteTime -Descending |
        Select-Object -First 1 -ExpandProperty FullName
}

if (-not $Installer -or -not (Test-Path $Installer)) {
    Fail "لم أجد ملف التثبيت. مرّر مساره: .\install-windows.ps1 C:\path\Maqam_0.1.0_x64-setup.exe"
}

Write-Host "الملف: $Installer"

# ── 2. Verify, or refuse to pretend we did ───────────────────────────────────
$actual = (Get-FileHash -Path $Installer -Algorithm SHA256).Hash.ToLower()

if (-not $Sha256) {
    # A checksum nobody compared is decoration. Print it, name what is missing,
    # and make continuing a deliberate act rather than the default.
    Write-Host ""
    Write-Host "⚠ لم تُمرَّر بصمة للتحقق." -ForegroundColor Yellow
    Write-Host "  بصمة هذا الملف: $actual"
    Write-Host "  قارنها بالمنشورة على https://maqademy.com/download"
    Write-Host ""
    Write-Host "  بدون هذه المقارنة لا شيء يثبت أن هذا الملف هو ما نشرناه،"
    Write-Host "  والتثبيت سيُلغي فحص SmartScreen الذي كان سيحميك."
    Write-Host ""
    $ans = Read-Host "  أكملُ رغم ذلك؟ [y/N]"
    if ($ans -ne 'y' -and $ans -ne 'Y') { Fail "أُلغي التثبيت." }
} else {
    # Case-insensitive: people paste checksums out of web pages in either case,
    # and failing them for it would teach them to skip the check.
    if ($actual -ne $Sha256.ToLower()) {
        Write-Host ""
        Write-Host "  المتوقَّع: $($Sha256.ToLower())"
        Write-Host "  الفعلي  : $actual"
        Fail "البصمة لا تطابق. لا تُثبّت هذا الملف — أعد تنزيله من maqademy.com."
    }
    Write-Host "✓ البصمة مطابقة." -ForegroundColor Green
}

# ── 3. Drop the Mark-of-the-Web ──────────────────────────────────────────────
# Only after the checksum passed. Doing it earlier would strip the one signal
# Windows had while the file was still unverified.
Write-Host "أزيل علامة «من الإنترنت»…"
try {
    Unblock-File -Path $Installer
} catch {
    Write-Host "⚠ تعذّرت الإزالة. قد تظهر نافذة SmartScreen — اضغط «More info» ثم «Run anyway»." -ForegroundColor Yellow
}

# ── 4. Run it ────────────────────────────────────────────────────────────────
Write-Host "أشغّل المثبِّت…"
if ([System.IO.Path]::GetExtension($Installer) -eq '.msi') {
    # msiexec needs to be invoked as the program, with the package as an argument;
    # Start-Process on the .msi directly relies on a file association that a
    # locked-down machine may not have.
    Start-Process -FilePath 'msiexec.exe' -ArgumentList '/i', "`"$Installer`"" -Wait
} else {
    Start-Process -FilePath $Installer -Wait
}

Write-Host ""
Write-Host "✓ انتهى المثبِّت. ابحث عن «Maqam» في قائمة ابدأ." -ForegroundColor Green
Write-Host ""
Write-Host "  ملاحظة: هذه نسخة غير موقّعة رسمياً. لا يستطيع Windows أن يخبرك"
Write-Host "  أنها منّا — البصمة أعلاه هي ما يخبرك بذلك."

# ── إن فشل هذا السكربت ───────────────────────────────────────────────────────
#
# The manual route, which always works:
#
#   1. Right-click the downloaded file → Properties.
#   2. If there is an «Unblock» checkbox at the bottom, tick it → OK.
#   3. Double-click the installer.
#   4. If SmartScreen appears: «More info» → «Run anyway».
#
# And if PowerShell refuses to run this file at all, that is the execution
# policy, not the script. Run it as:
#
#   powershell -ExecutionPolicy Bypass -File .\install-windows.ps1