<#
.SYNOPSIS
    One-time installer for game-stream-app on Windows.

.DESCRIPTION
    - Downloads the latest MediaMTX Windows amd64 release from GitHub
      into bin/mediamtx.exe.
    - Creates a disabled Windows Firewall rule "GameStream-UDP-8189" that
      the OBS script will toggle on/off with stream lifecycle.

    Must be run from an elevated (Administrator) PowerShell prompt.

.EXAMPLE
    PS> cd C:\Users\bheth\Documents\game-stream-app
    PS> .\scripts\install.ps1
#>

#Requires -RunAsAdministrator

[CmdletBinding()]
param(
    [string]$FirewallRuleName = "GameStream-UDP-48189",
    [int]$UdpPort = 48189
)

$ErrorActionPreference = 'Stop'

$projectRoot = Split-Path -Parent $PSScriptRoot
$binDir      = Join-Path $projectRoot 'bin'

function Write-Step { param([string]$msg) Write-Host "==> $msg" -ForegroundColor Cyan }
function Write-Ok   { param([string]$msg) Write-Host "    $msg" -ForegroundColor Green }
function Write-Warn2 { param([string]$msg) Write-Host "    $msg" -ForegroundColor Yellow }

# ---------------------------------------------------------------------------
# 1. Download MediaMTX
# ---------------------------------------------------------------------------

Write-Step "Locating latest MediaMTX release"
$releaseApi = 'https://api.github.com/repos/bluenviron/mediamtx/releases/latest'
$headers    = @{ 'User-Agent' = 'game-stream-app-installer' }
$release    = Invoke-RestMethod -Uri $releaseApi -Headers $headers

$asset = $release.assets |
    Where-Object { $_.name -match 'windows_amd64\.zip$' } |
    Select-Object -First 1

if (-not $asset) {
    throw "Could not find a windows_amd64 asset in the latest MediaMTX release"
}

Write-Ok "Found $($asset.name) ($($release.tag_name))"

if (-not (Test-Path $binDir)) {
    New-Item -ItemType Directory -Path $binDir | Out-Null
}

$zipPath = Join-Path $env:TEMP $asset.name
Write-Step "Downloading MediaMTX"
Invoke-WebRequest -Uri $asset.browser_download_url -OutFile $zipPath -UseBasicParsing
Write-Ok "Downloaded to $zipPath"

Write-Step "Extracting to $binDir"
Expand-Archive -Path $zipPath -DestinationPath $binDir -Force
Remove-Item $zipPath -Force

$mediamtxExe = Join-Path $binDir 'mediamtx.exe'
if (-not (Test-Path $mediamtxExe)) {
    throw "mediamtx.exe was not found after extraction - check the archive contents"
}
Write-Ok "mediamtx.exe installed at $mediamtxExe"

# ---------------------------------------------------------------------------
# 2. Create (or refresh) the Windows Firewall rule in DISABLED state
# ---------------------------------------------------------------------------

Write-Step "Configuring Windows Firewall rule '$FirewallRuleName'"
$existing = Get-NetFirewallRule -DisplayName $FirewallRuleName -ErrorAction SilentlyContinue
if ($existing) {
    Write-Warn2 "Rule already exists - updating"
    $existing | Remove-NetFirewallRule
}

New-NetFirewallRule `
    -DisplayName $FirewallRuleName `
    -Description "game-stream-app: WebRTC media (toggled by OBS script)" `
    -Direction Inbound `
    -Action Allow `
    -Protocol UDP `
    -LocalPort $UdpPort `
    -Profile Any `
    -Enabled False | Out-Null

Write-Ok "Firewall rule created (currently DISABLED)"

# ---------------------------------------------------------------------------
# 3. Next-step instructions
# ---------------------------------------------------------------------------

Write-Host ""
Write-Host "Install complete." -ForegroundColor Green
Write-Host ""
Write-Host "Next steps:"
Write-Host "  1. Open OBS -> Tools -> Scripts -> + and add:"
Write-Host "       $(Join-Path $projectRoot 'obs-script\game_stream.py')"
Write-Host "  2. In the script properties panel, set:"
Write-Host "       MediaMTX binary : $mediamtxExe"
Write-Host "       MediaMTX config : $(Join-Path $projectRoot 'config\mediamtx.yml')"
Write-Host "       Frontend dir    : $(Join-Path $projectRoot 'frontend')"
Write-Host "  3. Configure OBS Stream output:"
Write-Host "       Service  : Custom"
Write-Host "       Protocol : WHIP"
Write-Host "       Server   : http://localhost:48889/game/whip"
Write-Host "  4. See docs/ for NPM + Authentik setup on your reverse proxy host."
Write-Host ""