#Requires -Version 5.1
<#
.SYNOPSIS
  JD Tech Activation Bootstrapper — activate2
  Activation type: HWID
  
  This script contains NO secrets and NO protected code.
  It guides you through verification before downloading the real launcher.
#>
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

$ApiBase = 'https://cbsdan-activation.onrender.com'
$EndpointId = 'activate2'

function Write-Header {
    Write-Host ""
    Write-Host "  ╔══════════════════════════════════════════════╗" -ForegroundColor Cyan
    Write-Host "  ║       JD Tech Authorization System           ║" -ForegroundColor Cyan
    Write-Host "  ║          Activation: HWID                    ║" -ForegroundColor Cyan
    Write-Host "  ╚══════════════════════════════════════════════╝" -ForegroundColor Cyan
    Write-Host ""
}

function Get-VerificationCode {
    Write-Host "  Please enter your 6-digit verification code." -ForegroundColor Yellow
    Write-Host "  Codes expire in 5 minutes and are single-use." -ForegroundColor DarkGray
    Write-Host ""
    
    $attempts = 0
    $maxAttempts = 3
    
    while ($attempts -lt $maxAttempts) {
        $code = Read-Host "  Enter code"
        
        if ($code -notmatch '^[0-9]{6}$') {
            Write-Host "  [!] Code must be exactly 6 digits." -ForegroundColor Red
            $attempts++
            continue
        }
        
        Write-Host "  [>] Verifying..." -ForegroundColor DarkCyan
        
        try {
            $body = @{ code = $code; endpointId = $EndpointId } | ConvertTo-Json -Compress
            $response = Invoke-RestMethod `
                -Uri "$ApiBase/api/auth/verify" `
                -Method POST `
                -ContentType 'application/json' `
                -Body $body `
                -UseBasicParsing
            
            return $response.grant
        } catch {
            $statusCode = $_.Exception.Response.StatusCode.value__
            if ($statusCode -eq 401 -or $statusCode -eq 400) {
                $errorBody = $_.ErrorDetails.Message | ConvertFrom-Json -ErrorAction SilentlyContinue
                $msg = if ($errorBody.error) { $errorBody.error } else { "Invalid code." }
                Write-Host "  [!] $msg" -ForegroundColor Red
            } elseif ($statusCode -eq 429) {
                Write-Host "  [!] Too many attempts. Please wait before trying again." -ForegroundColor Red
                exit 1
            } else {
                Write-Host "  [!] Network error. Check your connection." -ForegroundColor Red
            }
            $attempts++
        }
    }
    
    Write-Host "  [!] Maximum attempts reached. Exiting." -ForegroundColor Red
    exit 1
}

function Invoke-ProtectedScript {
    param([string]$GrantToken)
    
    Write-Host "  [>] Downloading authorized launcher..." -ForegroundColor DarkCyan
    
    try {
        $headers = @{ Authorization = "Bearer $GrantToken" }
        $response = Invoke-RestMethod `
            -Uri "$ApiBase/api/script/$EndpointId" `
            -Method GET `
            -Headers $headers `
            -UseBasicParsing
        
        $scriptContent = $response.script
        $expectedHash  = $response.hash
        
        # Verify script integrity before execution
        $stream = [System.IO.MemoryStream]::new([System.Text.Encoding]::UTF8.GetBytes($scriptContent))
        $sha256 = [System.Security.Cryptography.SHA256]::Create()
        $hashBytes = $sha256.ComputeHash($stream)
        $actualHash = ($hashBytes | ForEach-Object { $_.ToString('x2') }) -join ''
        
        if ($actualHash -ne $expectedHash) {
            Write-Host "  [!] SECURITY ALERT: Script integrity check FAILED." -ForegroundColor Red
            Write-Host "  [!] Expected: $expectedHash" -ForegroundColor Red
            Write-Host "  [!] Got:      $actualHash" -ForegroundColor Red
            Write-Host "  [!] Execution aborted to protect your system." -ForegroundColor Red
            exit 1
        }
        
        Write-Host "  [✓] Script integrity verified." -ForegroundColor Green
        Write-Host "  [>] Executing activation..." -ForegroundColor DarkCyan
        Write-Host ""
        
        & ([ScriptBlock]::Create($scriptContent))
        
    } catch {
        $statusCode = $_.Exception.Response.StatusCode.value__
        if ($statusCode -eq 403) {
            Write-Host "  [!] Grant expired or already used. Please run the command again." -ForegroundColor Red
        } else {
            Write-Host "  [!] Failed to retrieve launcher: $_" -ForegroundColor Red
        }
        exit 1
    }
}

# ── Main ─────────────────────────────────────────────────────────────────────

Write-Header

$grant = Get-VerificationCode
Write-Host "  [✓] Verification successful!" -ForegroundColor Green
Write-Host ""

Invoke-ProtectedScript -GrantToken $grant

Write-Host ""
Write-Host "  [✓] Activation complete." -ForegroundColor Green
Write-Host ""