#Requires -RunAsAdministrator
<#
  Installs My Anything for Windows (beta).

  Why administrator: the beta is signed with our own certificate ("CN=Express Corporate Housing"), not yet one that Windows trusts
  out of the box. Windows only installs an app package whose signature it trusts, so this script first adds our beta signing
  certificate to this PC's "Trusted People" store (Cert:\LocalMachine\TrustedPeople), where App Installer looks for sideloaded
  packages' certificates. It never touches Trusted Root. Changing a machine-wide certificate store needs administrator rights. The
  certificate is only trusted for checking app-package signatures from that store; it can't sign anything on your PC. When we move to
  our final signing certificate you'll reinstall once, and you can then remove this one (Manage computer certificates (certlm.msc) >
  Trusted People > Certificates > "Express Corporate Housing").

  Then it installs the app with App Installer from MyAnything.appinstaller, which also keeps it up to date, and opens it.

  Run in Windows PowerShell as administrator, either as one line (the /download page's "Beta install", design #88):
    irm https://downloads.skanything.com/windows/stable/Install-MyAnything.ps1 | iex
  or from a downloaded copy:
    powershell -ExecutionPolicy Bypass -File .\Install-MyAnything.ps1

  Kept to plain ASCII and published without a byte-order mark: "irm | iex" runs the text as it arrives, and a BOM (or a character
  decoded in the wrong code page) in front of the param block breaks it.
#>
param(
    # stable (everyone) or dev (testers); CI writes each channel's default.
    [ValidateSet('stable', 'dev')] [string] $Channel = 'stable'
)
# A script block, so "irm | iex" doesn't leave its variables or ErrorActionPreference behind in the PowerShell window it ran in.
& {
    $ErrorActionPreference = 'Stop'
    # "#Requires -RunAsAdministrator" only applies to a script file; "irm | iex" skips it, so check here.
    $principal = New-Object Security.Principal.WindowsPrincipal ([Security.Principal.WindowsIdentity]::GetCurrent())
    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
        throw 'Run this in Windows PowerShell as administrator (Start > type PowerShell > Run as administrator). Nothing was changed.'
    }
    $base = "https://downloads.skanything.com/windows/$Channel"
    # The certificate this script expects (written by CI when it signs the build): a swapped certificate on the server is refused.
    $expectedThumbprint = 'F39173F21FFEF8EED47CC5F16A46B75B56765A6B'

    Write-Host "My Anything for Windows ($Channel)"
    $cer = Join-Path ([IO.Path]::GetTempPath()) 'MyAnything-beta-signing.cer'
    try {
        Write-Host '1/3  Trusting the My Anything beta signing certificate (Trusted People)...'
        Invoke-WebRequest -Uri "$base/MyAnything-beta-signing.cer" -OutFile $cer -UseBasicParsing
        $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList $cer
        if ($cert.Thumbprint -ne $expectedThumbprint -or $cert.Subject -ne 'CN=Express Corporate Housing') {
            throw "The downloaded certificate isn't the My Anything beta certificate ($($cert.Subject), $($cert.Thumbprint)). Nothing was installed."
        }
        if (-not (Get-ChildItem Cert:\LocalMachine\TrustedPeople | Where-Object Thumbprint -eq $cert.Thumbprint)) {
            Import-Certificate -FilePath $cer -CertStoreLocation Cert:\LocalMachine\TrustedPeople | Out-Null
        }

        Write-Host '2/3  Installing My Anything (App Installer keeps it up to date)...'
        Add-AppxPackage -AppInstallerFile "$base/MyAnything.appinstaller"

        Write-Host '3/3  Opening My Anything...'
        $pkg = Get-AppxPackage -Name 'ExpressCorporateHousing.MyAnything' | Sort-Object Version -Descending | Select-Object -First 1
        if ($pkg) { Start-Process "shell:AppsFolder\$($pkg.PackageFamilyName)!App" }
        Write-Host 'Done. My Anything is in the Start menu and in the notification area by the clock.'
    }
    finally {
        Remove-Item $cer -ErrorAction SilentlyContinue
    }
}