# Local DGB Core installer for Windows — puts a pruned indexer at
# D:\Program Files\DigiByte\ and prints the RPC credentials for
# @dgb-wallet/rpc.
#
# Usage:  Run from an elevated PowerShell:
#   Set-ExecutionPolicy -Scope Process Bypass
#   .\setup-local.ps1
#
# Optional flags:
#   -InstallDir "E:\dgb"           override install location
#   -Version "8.26.2"              pick a different Core release
#   -SkipDefenderExclusion         don't add the data folder to Defender exclusions
#   -SkipStartup                   don't create a startup shortcut
#
# The script is idempotent: safe to re-run to upgrade / repair.

param(
    [string]$InstallDir = "D:\Program Files\DigiByte",
    [string]$Version = "8.26.2",
    [switch]$SkipDefenderExclusion,
    [switch]$SkipStartup
)

$ErrorActionPreference = "Stop"

function Log($msg) { Write-Host "`n>>> $msg" -ForegroundColor Cyan }

# --- Elevation check (Defender exclusion requires admin) ---
$isAdmin = ([Security.Principal.WindowsPrincipal] `
    [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
    [Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin -and -not $SkipDefenderExclusion) {
    Write-Warning "Not running as Administrator. Defender exclusion will be skipped."
    Write-Warning "Right-click PowerShell → Run as Administrator to add the exclusion (recommended — cuts sync time 3x)."
    $SkipDefenderExclusion = $true
}

# DGB Core's Windows release ships as an NSIS installer (.exe) — not a
# portable ZIP. We run it silently with /S /D=<path>. The installer
# writes daemon binaries into <InstallDir>\daemon\ and the GUI wallet
# into <InstallDir>\; our BinDir is therefore <InstallDir>\daemon.
$BinDir  = Join-Path $InstallDir "daemon"
$DataDir = Join-Path $InstallDir "data"
$ConfPath = Join-Path $InstallDir "digibyte.conf"

Log "Step 0/6: check for a running digibyted.exe"
$Running = Get-Process digibyted -ErrorAction SilentlyContinue
if ($Running) {
    Write-Warning "digibyted.exe is already running (PID $($Running.Id -join ', '))."
    Write-Warning "This script will not touch it — running installers over a live node corrupts data."
    Write-Warning "Stop it first from an elevated PowerShell:"
    Write-Warning "    Stop-Process -Id $($Running.Id -join ',') -Force"
    Write-Warning "Then re-run setup-local.ps1."
    exit 1
}

Log "Step 1/6: create $InstallDir"
New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null
New-Item -ItemType Directory -Force -Path $DataDir | Out-Null

# --- Download + install Core ---
Log "Step 2/6: download DigiByte Core $Version (Windows NSIS installer)"
$Installer = "digibyte-$Version-win64-setup.exe"
$Url       = "https://github.com/DigiByte-Core/digibyte/releases/download/v$Version/$Installer"
$Tmp = Join-Path $env:TEMP "dgb-install"
New-Item -ItemType Directory -Force -Path $Tmp | Out-Null
$InstallerPath = Join-Path $Tmp $Installer

$ExistingExe = Join-Path $BinDir "digibyted.exe"
$AlreadyInstalled = $false
if (Test-Path $ExistingExe) {
    $ver = & $ExistingExe -version 2>$null | Select-String -Pattern "DigiByte Core version" | Select-Object -First 1
    if ($ver -match [regex]::Escape($Version)) {
        Write-Host "  digibyted.exe $Version already installed at $ExistingExe"
        $AlreadyInstalled = $true
    }
}

if (-not $AlreadyInstalled) {
    Write-Host "  Downloading $Url ..."
    Invoke-WebRequest -Uri $Url -OutFile $InstallerPath -UseBasicParsing

    # The v8.26.2 release does not publish a SHA256SUMS file. We compute
    # and record the local hash so future upgrades can detect drift and
    # you have a value to cross-check against the community if you want.
    $ActualHash = (Get-FileHash $InstallerPath -Algorithm SHA256).Hash.ToLower()
    Write-Host "  Downloaded SHA-256: $ActualHash"
    Write-Host "  (No SHA256SUMS published in this release; trust chain is GitHub HTTPS + DigiByte-Core org.)"
    Set-Content -Path (Join-Path $InstallDir "installed-version.txt") -Value @"
version: $Version
installer: $Installer
sha256:   $ActualHash
url:      $Url
"@

    Write-Host "  Running silent install to $InstallDir ..."
    # /S = silent; /D= must be last and unquoted; spaces in the path are OK
    # because /D takes everything after "=" as the destination.
    $proc = Start-Process -FilePath $InstallerPath `
        -ArgumentList "/S", "/D=$InstallDir" `
        -Wait -PassThru
    if ($proc.ExitCode -ne 0) {
        throw "Installer exited with code $($proc.ExitCode). Check $InstallDir for a partial install."
    }
    if (-not (Test-Path $ExistingExe)) {
        throw "Installer completed but digibyted.exe not found at $ExistingExe. Try running $InstallerPath manually to see where it installed."
    }
    Remove-Item -Force $InstallerPath
    Write-Host "  Installed to $InstallDir (daemon binaries in $BinDir)"
}

# --- digibyte.conf ---
Log "Step 3/6: write digibyte.conf"
# The NSIS installer drops its own commented-out sample digibyte.conf in
# $InstallDir. We must distinguish that from a real user config generated
# by this script — the marker line 'Generated by ops/setup-local.ps1'
# is the tell.
$IsOurConfig = $false
if (Test-Path $ConfPath) {
    $existing = Get-Content $ConfPath -Raw
    $IsOurConfig = $existing -match 'Generated by ops/setup-local\.ps1'
}

if ($IsOurConfig) {
    Write-Host "  $ConfPath already exists (previously generated by this script) — leaving in place"
    $conf = Get-Content $ConfPath -Raw
    $RpcUser     = if ($conf -match "(?m)^rpcuser=(.+)$")     { $Matches[1].Trim() } else { $null }
    $RpcPassword = if ($conf -match "(?m)^rpcpassword=(.+)$") { $Matches[1].Trim() } else { $null }
} else {
    if (Test-Path $ConfPath) {
        $backup = "$ConfPath.installer-sample.bak"
        Move-Item -Force $ConfPath $backup
        Write-Host "  Detected the NSIS installer's sample digibyte.conf — backed it up to $backup and writing our own."
    }
    $RpcUser = "dgb_" + -join ((48..57) + (97..122) | Get-Random -Count 8 | ForEach-Object { [char]$_ })
    $RpcPasswordBytes = New-Object byte[] 30
    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($RpcPasswordBytes)
    $RpcPassword = [Convert]::ToBase64String($RpcPasswordBytes) -replace '[+/=]', ''
    $RpcPassword = $RpcPassword.Substring(0, [Math]::Min(40, $RpcPassword.Length))

@"
# DigiByte Core — pruned local backend for @dgb-wallet
# Generated by ops/setup-local.ps1 on $(Get-Date -Format u).

# --- Storage ---
datadir=$($DataDir -replace '\\', '/')
prune=550
txindex=0

# --- Wallet: DISABLED (client-side keys only) ---
disablewallet=1

# --- RPC (localhost only) ---
server=1
rpcbind=127.0.0.1
rpcallowip=127.0.0.1
rpcport=14022
rpcuser=$RpcUser
rpcpassword=$RpcPassword
rpcworkqueue=32
rpcthreads=4

# --- P2P ---
listen=1
maxconnections=40
port=12024

# --- Perf ---
dbcache=1024
maxmempool=100
"@ | Set-Content -Encoding ASCII $ConfPath
    Write-Host "  Wrote $ConfPath with random 40-char RPC password"
}

# --- Windows Defender exclusion (real speedup) ---
if (-not $SkipDefenderExclusion) {
    Log "Step 4/6: add Windows Defender exclusion for $DataDir"
    try {
        Add-MpPreference -ExclusionPath $DataDir -ErrorAction Stop
        Write-Host "  Excluded $DataDir from real-time scanning."
    } catch {
        Write-Warning "  Could not add exclusion: $_"
        Write-Warning "  Add manually: Settings > Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions > Add $DataDir"
    }
} else {
    Log "Step 4/6: SKIPPED Defender exclusion"
}

# --- Startup shortcut (runs digibyted at logon) ---
if (-not $SkipStartup) {
    Log "Step 5/6: install startup shortcut"
    $StartupDir = [Environment]::GetFolderPath('Startup')
    $ShortcutPath = Join-Path $StartupDir "DigiByte Core.lnk"
    $WshShell = New-Object -ComObject WScript.Shell
    $Shortcut = $WshShell.CreateShortcut($ShortcutPath)
    $Shortcut.TargetPath = Join-Path $BinDir "digibyted.exe"
    $Shortcut.Arguments = "-conf=`"$ConfPath`""
    $Shortcut.WorkingDirectory = $BinDir
    $Shortcut.WindowStyle = 7  # minimized
    $Shortcut.Description = "DigiByte Core pruned indexer for DigiByte.X Wallet"
    $Shortcut.Save()
    Write-Host "  Installed shortcut at $ShortcutPath (starts at logon, minimized)"
} else {
    Log "Step 5/6: SKIPPED startup shortcut"
}

# --- First-run launch ---
Log "Step 6/6: launch DigiByte Core now (background)"
$ExistingProc = Get-Process -Name "digibyted" -ErrorAction SilentlyContinue
if ($ExistingProc) {
    Write-Host "  digibyted.exe already running (PID $($ExistingProc.Id)) — leaving it alone."
} else {
    Start-Process -FilePath (Join-Path $BinDir "digibyted.exe") `
                  -ArgumentList "-conf=`"$ConfPath`"" `
                  -WindowStyle Hidden
    Start-Sleep -Seconds 3
    $Proc = Get-Process -Name "digibyted" -ErrorAction SilentlyContinue
    if ($Proc) {
        Write-Host "  digibyted.exe started (PID $($Proc.Id))."
    } else {
        Write-Warning "  digibyted did not appear to start. Check the log:"
        Write-Warning "    Get-Content (Join-Path $DataDir 'debug.log') -Tail 50"
    }
}

Write-Host ""
Write-Host "--------------------------------------------------------------------" -ForegroundColor Green
Write-Host "DigiByte Core installed and running locally." -ForegroundColor Green
Write-Host "--------------------------------------------------------------------" -ForegroundColor Green
Write-Host ""
Write-Host "RPC endpoint:  http://127.0.0.1:14022"
Write-Host "Username:      $RpcUser"
Write-Host "Password:      $RpcPassword"
Write-Host ""
Write-Host "Sync progress:"
Write-Host "  & `"$BinDir\digibyte-cli.exe`" -conf=`"$ConfPath`" getblockchaininfo | Select-Object -First 20"
Write-Host ""
Write-Host "Initial pruned sync takes ~4-8 hours on this machine (16 GB RAM,"
Write-Host "dbcache=1024). RPC is available during sync but scantxoutset"
Write-Host "returns incomplete results until it reaches the current tip."
Write-Host ""
Write-Host "Wallet-side test (once sync catches up):"
Write-Host "  cd `"D:\Dev\SilentCode\Digibyte`""
Write-Host "  `$env:DGB_RPC_URL='http://127.0.0.1:14022'"
Write-Host "  `$env:DGB_RPC_USER='$RpcUser'"
Write-Host "  `$env:DGB_RPC_PASSWORD='$RpcPassword'"
Write-Host "  npm run demo -w @dgb-wallet/rpc"
Write-Host ""