# deploy-tray-1.0.1.ps1 — replace installed tray with the freshly built 1.0.1 binary.
# Only the tray changed (NoState/login, logout, add-server auth-key, popup-loop, auth-URL fixes),
# so the tailscaled service is left untouched (VPN stays up).
$ErrorActionPreference = "Stop"

$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
    [Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    $log = "$env:TEMP\deploy-tray-1.0.1-log.txt"
    Remove-Item $log -ErrorAction SilentlyContinue
    Start-Process powershell -Verb RunAs -Wait `
        -ArgumentList "-ExecutionPolicy Bypass -File `"$PSCommandPath`""
    Start-Sleep -Milliseconds 600
    if (Test-Path $log) { Get-Content $log } else { Write-Warning "No log / UAC denied" }
    exit
}

Start-Transcript -Path "$env:TEMP\deploy-tray-1.0.1-log.txt" -Force | Out-Null

$src  = "C:\Users\huanld\Desktop\TailscaleCustom\tailscale-custom\dist\tailscale-tray.exe"
$dest = "C:\Program Files (x86)\Tailscale-Custom\tailscale-tray.exe"

if (-not (Test-Path $src)) { Write-Error "Khong tim thay build moi: $src"; Stop-Transcript | Out-Null; exit 1 }

# Best-effort code signing (matches existing deploy scripts; tray runs fine unsigned too).
$cert = Get-ChildItem Cert:\LocalMachine\My -ErrorAction SilentlyContinue |
    Where-Object { $_.Subject -match "Tailscale-Custom" -and $_.HasPrivateKey } |
    Sort-Object NotAfter -Descending | Select-Object -First 1
if ($cert) {
    try {
        $r = Set-AuthenticodeSignature -FilePath $src -Certificate $cert -HashAlgorithm SHA256 -ErrorAction Stop
        Write-Host "[sign] $($r.Status)"
    } catch { Write-Host "[sign] SKIP: $($_.Exception.Message)" }
} else { Write-Host "[sign] no cert, deploying unsigned (giong ban cu)" }

Write-Host "==> Dung tray cu..."
Stop-Process -Name tailscale-tray -Force -ErrorAction SilentlyContinue
Start-Sleep -Seconds 1

Write-Host "==> Copy binary 1.0.1 -> Program Files (x86)..."
Copy-Item $src $dest -Force
$fi = Get-Item $dest
Write-Host "    $dest"
Write-Host "    $([math]::Round($fi.Length/1MB,2)) MB | $($fi.LastWriteTime)"

# Launch the tray in the interactive desktop session (not the elevated session 0
# this script may run in) via a one-shot scheduled task running as the logged-in user.
Write-Host "==> Khoi dong tray moi trong session nguoi dung..."
$activeUser = (Get-CimInstance Win32_ComputerSystem).UserName  # DOMAIN\user of console session
$task = "TS-Custom-Tray-Deploy-Launch"
schtasks /Create /TN $task /TR "`"$dest`"" /SC ONCE /ST 23:59 /RL LIMITED /F /IT /RU $activeUser | Out-Null
schtasks /Run /TN $task | Out-Null
Start-Sleep -Seconds 3
schtasks /Delete /TN $task /F | Out-Null

$p = Get-Process tailscale-tray -ErrorAction SilentlyContinue | Select-Object -First 1
Write-Host "    Started PID=$($p.Id) Path=$($p.Path)"

Write-Host "==> HOAN THANH (1.0.1)"
Stop-Transcript | Out-Null