@echo off
setlocal EnableExtensions EnableDelayedExpansion
title AetherForge — Cloudflare Tunnel Setup

:: Must run elevated (Windows service install requires Administrator).
net session >nul 2>&1
if errorlevel 1 (
    echo.
    echo   [CF] ERROR: Administrator rights required.
    echo   Right-click LAUNCH.bat and choose "Run as administrator" once.
    echo.
    exit /b 1
)

set "ROOT=%~1"
if "%ROOT:~-1%"=="\" set "ROOT=%ROOT:~0,-1%"
if "%ROOT%"=="" (
    echo   [CF] ERROR: Missing deck root argument.
    exit /b 1
)

set "CF_CONFIG_JSON=%ROOT%\cloudflare\tunnel-config.json"
set "CF_MSI=%ROOT%\cloudflare\cloudflared-windows-amd64.msi"
set "CF_PORTABLE=%ROOT%\cloudflare\cloudflared.exe"
set "CF_DIR=%ProgramData%\AetherForge\.cloudflared"
set "DEST_DIR=%ProgramData%\AetherForge\bin"
set "CF_EXE=%DEST_DIR%\cloudflared.exe"
set "CF_CONFIG=%CF_DIR%\config.yml"
set "CF_WRITER=%ROOT%\cloudflare\write-tunnel-config.ps1"

echo.
echo  ================================================================
echo       AetherForge  —  Cloudflare Tunnel Install
echo  ================================================================
echo   Deck:       %ROOT%
echo   Config:     %CF_CONFIG%
echo  ================================================================
echo.

if not exist "%CF_CONFIG_JSON%" (
    echo   [CF] ERROR: Missing %CF_CONFIG_JSON%
    exit /b 1
)
if not exist "%CF_WRITER%" (
    echo   [CF] ERROR: Missing %CF_WRITER%
    exit /b 1
)

if not exist "%DEST_DIR%" mkdir "%DEST_DIR%"

:: Obtain cloudflared.exe — stable path on this PC, not the USB drive.
if exist "%CF_EXE%" goto have_bin

if exist "%CF_PORTABLE%" (
    echo   [CF] Copying bundled cloudflared.exe to ProgramData...
    copy /y "%CF_PORTABLE%" "%CF_EXE%" >nul
    if exist "%CF_EXE%" goto have_bin
)

if exist "%ProgramFiles%\cloudflare\cloudflared\cloudflared.exe" (
    echo   [CF] Copying installed cloudflared to ProgramData...
    copy /y "%ProgramFiles%\cloudflare\cloudflared\cloudflared.exe" "%CF_EXE%" >nul
    if exist "%CF_EXE%" goto have_bin
)

if exist "%CF_MSI%" (
    echo   [CF] Installing cloudflared from MSI...
    msiexec /i "%CF_MSI%" /quiet /norestart
    echo   [CF] Waiting for MSI to finish...
    ping -n 15 127.0.0.1 >nul
    if exist "%ProgramFiles%\cloudflare\cloudflared\cloudflared.exe" (
        copy /y "%ProgramFiles%\cloudflare\cloudflared\cloudflared.exe" "%CF_EXE%" >nul
        if exist "%CF_EXE%" goto have_bin
    )
)

echo   [CF] ERROR: cloudflared binary not found.
exit /b 1

:have_bin
echo   [CF] Binary ready: %CF_EXE%

:: Write credentials.json + config.yml with explicit local ingress route.
echo   [CF] Writing local tunnel config: hostname to origin...

powershell -NoProfile -ExecutionPolicy Bypass -File "%CF_WRITER%" -ConfigJson "%CF_CONFIG_JSON%" -CloudflaredDir "%CF_DIR%" > "%TEMP%\af-cf-writer.out" 2>&1
for /f "usebackq tokens=1,* delims==" %%A in ("%TEMP%\af-cf-writer.out") do (
    if /i "%%A"=="TUNNEL_ID" set "TUNNEL_ID=%%B"
    if /i "%%A"=="HOSTNAME" set "CF_HOSTNAME=%%B"
    if /i "%%A"=="ORIGIN" set "CF_ORIGIN=%%B"
)

if not exist "%CF_CONFIG%" (
    echo   [CF] ERROR: Failed to write %CF_CONFIG%
    exit /b 1
)

echo   [CF] Route:  https://!CF_HOSTNAME!  -^>  !CF_ORIGIN!
echo   [CF] Config: %CF_CONFIG%
type "%CF_CONFIG%"
echo.

echo   [CF] Validating ingress rules...
"%CF_EXE%" --config "%CF_CONFIG%" tunnel ingress validate
if errorlevel 1 (
    echo   [CF] WARNING: ingress validation failed - check config.yml
)

:: Re-register service so it uses config.yml - not token-only remote routing.
sc query cloudflared >nul 2>&1
if errorlevel 1 goto cf_register_service
echo   [CF] Removing old cloudflared service - switching to local config routing...
net stop cloudflared >nul 2>&1
sc delete cloudflared >nul 2>&1
ping -n 3 127.0.0.1 >nul

:cf_register_service
echo   [CF] Registering Windows service with local config.yml...
"%CF_EXE%" --config "%CF_CONFIG%" service install
if errorlevel 1 (
    echo   [CF] ERROR: service install failed.
    exit /b 1
)
ping -n 3 127.0.0.1 >nul

echo   [CF] Ensuring DNS route for !CF_HOSTNAME!...
"%CF_EXE%" --config "%CF_CONFIG%" tunnel route dns !TUNNEL_ID! !CF_HOSTNAME!
if errorlevel 1 goto cf_dns_manual
goto cf_dns_done
:cf_dns_manual
set "CF_CNAME_TARGET=%TUNNEL_ID%.cfargotunnel.com"
echo   [CF] NOTE: DNS route command failed - add CNAME in Cloudflare DNS manually:
echo         %CF_HOSTNAME%  CNAME  %CF_CNAME_TARGET%
:cf_dns_done

sc query cloudflared | findstr /I "RUNNING" >nul 2>&1
if errorlevel 1 goto cf_start_service
goto show_status
:cf_start_service
echo   [CF] Starting cloudflared service...
net start cloudflared

:show_status
echo.
echo   --- cloudflared service status ---
sc query cloudflared
echo   --------------------------------
echo.
echo   --- expected ingress - local config ---
type "%CF_CONFIG%"
echo   -------------------------------------
echo.

sc query cloudflared | findstr /I "RUNNING" >nul 2>&1
if errorlevel 1 (
    echo   [CF] Tunnel connector is NOT running on this PC.
    exit /b 1
)

echo   [CF] Tunnel connector running with LOCAL routing config.
echo   [CF] Public URL when AetherForge is on !CF_ORIGIN!: https://!CF_HOSTNAME!
echo   [CF] Run cloudflare\verify-tunnel.bat to test DNS + local + public reachability.
exit /b 0