# 09-Setup-Keyence.ps1 - Keyence type setup (runs during shopfloor-setup phase).
#
# Performs the imaging-time install of one of three Keyence model variants:
#   VR-3000 G2 / VR-5000 / VR-6000
# based on C:\Enrollment\keyence-model.txt (vr3000 / vr5000 / vr6000), set
# during the WinPE menu. Per-model manifest + installers live at
# <model>/manifest.json + <model>/installers/. Ongoing enforcement is handled
# by GE-Enforce reading keyence/manifest.json from the tsgwp00525 share.
#
# Layout at $PSScriptRoot (xcopied by startnet.cmd only for PCTYPE=Keyence):
#   09-Setup-Keyence.ps1   (this file)
#   vr3000\manifest.json + installers\VR-3000 G2 Series Software.msi + Data*.cab
#   vr5000\manifest.json + installers\VR-5000 Series Software.msi + Data1.cab
#   vr6000\manifest.json + installers\VR-6000 Series Software.msi + Data1.cab
#                        + drivers\keyence_vr_series.inf (legacy - only VR-6000)
#
# Library lookup: the imaging-time install uses the common Install-FromManifest
# library at ..\common\lib\Install-FromManifest.ps1 (relative to $PSScriptRoot).
#
# Log: C:\Logs\Keyence\09-Setup-Keyence.log
#      C:\Logs\Keyence\install.log   (written by Install-FromManifest)

$ErrorActionPreference = 'Continue'

$libSource = Join-Path $PSScriptRoot '..\common\lib\Install-FromManifest.ps1'

# Resolve which Keyence model variant to install. WinPE writes the choice
# (vr3000 / vr5000 / vr6000) into C:\Enrollment\keyence-model.txt during
# the imaging menu. If the file is missing, default to vr6000 since that
# was the original single-model setup before this refactor.
$modelFile = 'C:\Enrollment\keyence-model.txt'
if (Test-Path -LiteralPath $modelFile) {
    $model = (Get-Content -LiteralPath $modelFile -First 1 -ErrorAction SilentlyContinue).Trim().ToLower()
}
if (-not $model) { $model = 'vr6000' }

# Manifest comes via shopfloor-setup tree xcopy (small file, git-tracked).
# Installer payload (MSI + Data*.cab) comes via installers-post stage at
# C:\KeyenceInstall\<model>\ - placed there by startnet.cmd's keyence-stage
# block. So manifest paths reference installers\... which resolve relative
# to InstallerRoot=C:\KeyenceInstall\<model>.
$modelRoot     = Join-Path $PSScriptRoot $model
$manifestPath  = Join-Path $modelRoot 'manifest.json'
$stagingRoot   = "C:\KeyenceInstall\$model"

$logDir         = 'C:\Logs\Keyence'
$installLog     = Join-Path $logDir 'install.log'
$transcriptLog  = Join-Path $logDir '09-Setup-Keyence.log'

if (-not (Test-Path $logDir)) {
    New-Item -Path $logDir -ItemType Directory -Force | Out-Null
}

try { Start-Transcript -Path $transcriptLog -Append -Force | Out-Null } catch {}

function Write-KeyenceLog {
    param([string]$Message, [string]$Level = 'INFO')
    $stamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    Write-Host "[$stamp] [$Level] $Message"
}

Write-KeyenceLog "================================================================"
Write-KeyenceLog "=== Keyence Setup (imaging-time) session start (PID $PID) ==="
Write-KeyenceLog "Running as: $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)"
Write-KeyenceLog "Script root: $PSScriptRoot"
Write-KeyenceLog "================================================================"

# Status push to PXE webapp - best-effort, never blocks imaging.
$pxeStatusLib = Join-Path $PSScriptRoot '..\Shopfloor\lib\Send-PxeStatus.ps1'
if (Test-Path $pxeStatusLib) {
    try { . $pxeStatusLib; Send-PxeStatus -Stage '09-Setup-Keyence: starting' -StageIndex 3 -StageTotal 8 } catch { }
}

# Diagnostic dump
foreach ($file in @('pc-type.txt','pc-subtype.txt','machine-number.txt')) {
    $path = "C:\Enrollment\$file"
    if (Test-Path -LiteralPath $path) {
        $content = (Get-Content -LiteralPath $path -First 1 -ErrorAction SilentlyContinue).Trim()
        Write-KeyenceLog "  $file = $content"
    } else {
        Write-KeyenceLog "  $file = (not present)"
    }
}

# ============================================================================
# Step 0: Pre-stage Keyence VR Series USB driver + trust the publisher cert.
# ============================================================================
# The VR-6000 MSI invokes dpinst.exe internally as a custom action to install
# the USB driver. dpinst inherits the MSI's silent context inconsistently and
# usually pops a Setup-wizard GUI even with /qn on the parent MSI.
#
# Two pre-steps suppress the prompt:
#   1. pnputil /add-driver /install stages the INF + co-installers into the
#      Windows DriverStore. dpinst then sees the driver as already present and
#      skips its install path (the GUI lives behind the "needs to install"
#      branch).
#   2. Add the publisher cert (extracted from the catalog file) to
#      LocalMachine\TrustedPublisher so dpinst's "Would you like to install
#      this device software?" Windows Security dialog auto-accepts.
#
# If either step fails, log + continue - the MSI is still expected to install
# successfully; the only fallout is the GUI prompt the operator would have
# had to click through anyway.
# Drivers come via the staging dir now. Only VR-6000 ships an external .inf;
# VR-3000 + VR-5000 embed drivers inside the MSI so the pre-stage step is a
# no-op for those models (no file found, log + continue).
$driverInf = Join-Path $stagingRoot 'drivers\keyence_vr_series.inf'
$driverCat = Join-Path $stagingRoot 'drivers\KEYENCE_VR_SERIES.cat'

if (Test-Path -LiteralPath $driverInf) {
    Write-KeyenceLog "Pre-staging USB driver via pnputil (suppresses dpinst GUI inside MSI)"
    try {
        $pnpOut = & pnputil /add-driver $driverInf /install 2>&1
        Write-KeyenceLog "  pnputil exit $LASTEXITCODE"
        foreach ($line in ($pnpOut | Where-Object { $_ })) { Write-KeyenceLog "    $line" }
    } catch {
        Write-KeyenceLog "  pnputil failed: $_" 'WARN'
    }
} else {
    Write-KeyenceLog "Driver INF not found at $driverInf - skipping pre-stage" 'WARN'
}

if (Test-Path -LiteralPath $driverCat) {
    Write-KeyenceLog "Adding Keyence publisher cert to LocalMachine\TrustedPublisher store"
    try {
        $sig = Get-AuthenticodeSignature -FilePath $driverCat -ErrorAction Stop
        if ($sig -and $sig.SignerCertificate) {
            $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('TrustedPublisher','LocalMachine')
            $store.Open('ReadWrite')
            $store.Add($sig.SignerCertificate)
            $store.Close()
            Write-KeyenceLog "  Added: $($sig.SignerCertificate.Subject) thumb=$($sig.SignerCertificate.Thumbprint)"
        } else {
            Write-KeyenceLog "  Catalog is not signed - cert pre-trust skipped" 'WARN'
        }
    } catch {
        Write-KeyenceLog "  Cert add failed: $_" 'WARN'
    }
} else {
    Write-KeyenceLog "Driver catalog not found at $driverCat - cert pre-trust skipped" 'WARN'
}

# ============================================================================
# Step 1: Install via manifest (imaging-time)
# ============================================================================
if (-not (Test-Path $manifestPath)) {
    Write-KeyenceLog "keyence-manifest.json not found at $manifestPath" "ERROR"
} elseif (-not (Test-Path $libSource)) {
    Write-KeyenceLog "Install-FromManifest.ps1 not found at $libSource" "ERROR"
} else {
    Write-KeyenceLog "Running Install-FromManifest (InstallerRoot=$stagingRoot)"
    & $libSource -ManifestPath $manifestPath -InstallerRoot $stagingRoot -LogFile $installLog
    $rc = $LASTEXITCODE
    Write-KeyenceLog "Install-FromManifest returned $rc"
}

# ============================================================================
# Step 1.5: Install Keyence-bundled DirectX End-User Runtimes
# ============================================================================
# VR-6000's MSI deploys DXSETUP.exe to the install dir but never runs it.
# Without DirectX, the app's first launch errors: "Runtime required to move
# the application is not installed correctly. Install from the following
# folder: C:\Program Files\Keyence\VR-6000\Common\DirectX End-User Runtimes\
# DXSETUP.exe". Run it silently here; /silent suppresses all UI + reboot.
# Probe both VR-3000 G2, VR-5000, VR-6000 install paths under both Program Files
# roots. Whichever model's MSI installed will have its DXSETUP at one of these.
$dxCandidates = @()
foreach ($pf in @('C:\Program Files\KEYENCE','C:\Program Files (x86)\KEYENCE')) {
    foreach ($prod in @('VR-3000 G2','VR-5000','VR-6000')) {
        $dxCandidates += (Join-Path $pf "$prod\Common\DirectX End-User Runtimes\DXSETUP.exe")
    }
}
$dxPath = $dxCandidates | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1

if ($dxPath) {
    Write-KeyenceLog "Running DirectX End-User Runtimes: $dxPath /silent"
    try {
        $p = Start-Process -FilePath $dxPath -ArgumentList '/silent' -Wait -PassThru -NoNewWindow
        Write-KeyenceLog "  DXSETUP exit $($p.ExitCode)"
    } catch {
        Write-KeyenceLog "  DXSETUP failed: $_" 'WARN'
    }
} else {
    Write-KeyenceLog "DXSETUP.exe not found under either Program Files - DirectX install skipped" 'WARN'
}

# ============================================================================
# Step 1.6: FIPS opt-out for Keyence .NET apps (VR-3000 G2 only)
# ============================================================================
# REQUIREMENT BEFORE IMAGING: the bay's hostname must be reported to GE
# InfoSec and added to the documented FIPS-exception list. Do not image a
# VR-3000 G2 bay through this path without that ticket on record.
#
# Why: Keyence VR-series Viewer / Analyzer / Inspection apps read EEPROM
# calibration from the probe and verify it via MD5CryptoServiceProvider.
# Under Intune-enforced LSA FIPS policy that ctor throws (see
# keyence3000.txt / .png in pxe-images for the dialog + stack trace).
# Patch every .exe.config under C:\Program Files\KEYENCE\<model>\ with
# <runtime><enforceFIPSPolicy enabled="false"/></runtime>.
#
# Scope: app-level CLR only. Does NOT touch OS-wide Lsa policy. Intune /
# Defender baselines on the Lsa key remain enforced. CMMC posture: scoped
# exception, non-CUI integrity hash, documented in SSP. Currently only
# approved for VR-3000 G2 model; vr5000 / vr6000 bays do not auto-apply.
if ($model -eq 'vr3000') {
    $fipsPatch = Join-Path $PSScriptRoot 'common\Patch-KeyenceFipsConfigs.ps1'
    if (Test-Path -LiteralPath $fipsPatch) {
        Write-KeyenceLog "Running FIPS opt-out patch (VR-3000 G2): $fipsPatch"
        Write-KeyenceLog "  REMINDER: confirm bay hostname is on InfoSec FIPS-exception list before production cutover"
        try {
            & $fipsPatch 2>&1 | ForEach-Object { Write-KeyenceLog "  $_" }
        } catch {
            Write-KeyenceLog "  FIPS patch failed: $_" 'WARN'
        }
    } else {
        Write-KeyenceLog "Patch-KeyenceFipsConfigs.ps1 not found at $fipsPatch - FIPS opt-out skipped" 'WARN'
    }
} else {
    Write-KeyenceLog "FIPS opt-out patch not applied: model=$model (only vr3000 currently approved)"
}

# ============================================================================
# Step 2: OpenText auto-start at login (HostExplorer "WJ Shopfloor" session)
# ============================================================================
$autoStartLib = Join-Path $PSScriptRoot '..\Shopfloor\lib\Set-OpenTextAutoStart.ps1'
if (Test-Path -LiteralPath $autoStartLib) {
    Write-KeyenceLog "Calling $autoStartLib"
    & $autoStartLib
} else {
    Write-KeyenceLog "Set-OpenTextAutoStart.ps1 not found at $autoStartLib - OpenText auto-start NOT configured" 'WARN'
}

if (Get-Command Send-PxeStatus -ErrorAction SilentlyContinue) {
    $finalStatus = if ($rc -eq 0) { 'in_progress' } else { 'failed' }
    $finalErr    = if ($rc -ne 0) { "Install-FromManifest exit $rc" } else { '' }
    Send-PxeStatus -Stage '09-Setup-Keyence: complete' -StageIndex 4 -StageTotal 8 -Status $finalStatus -Error_ $finalErr
}

Write-KeyenceLog "================================================================"
Write-KeyenceLog "=== Keyence Setup session end ==="
Write-KeyenceLog "================================================================"

try { Stop-Transcript | Out-Null } catch {}