# ensure-vnc-firewall.ps1
# Idempotent inbound firewall rules for VNC port 5900 on all network profiles.
# Called by Install-FromManifest with Type=PS1, DetectionMethod=Always (runs
# every enforcement cycle; the Remove + New pattern makes repeat runs cheap
# and always end in a known-good state).
#
# Exit 0 on success, 1 on failure. SYSTEM context.

$ErrorActionPreference = 'Continue'

$rules = @(
    @{ Name = 'GE Shopfloor VNC 5900 TCP'; Protocol = 'TCP'; LocalPort = 5900 }
    @{ Name = 'GE Shopfloor VNC 5900 UDP'; Protocol = 'UDP'; LocalPort = 5900 }
)

$failed = 0
foreach ($r in $rules) {
    try {
        Remove-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue
        New-NetFirewallRule `
            -DisplayName $r.Name `
            -Direction Inbound `
            -Protocol $r.Protocol `
            -LocalPort $r.LocalPort `
            -Action Allow `
            -Profile Domain,Private,Public `
            -Description 'VNC remote access for shopfloor ops (5900). Managed by GE Shopfloor Enforce.' `
            -ErrorAction Stop | Out-Null
        Write-Host "[OK]    $($r.Name) ($($r.Protocol) $($r.LocalPort))"
    } catch {
        Write-Host "[FAIL]  $($r.Name): $_"
        $failed++
    }
}

if ($failed -gt 0) { exit 1 }
exit 0