# uninstall-shopdbagent.ps1
# ShopDB Endpoint Agent uninstaller. Run from an ELEVATED (admin) PowerShell on
# the endpoint. Reverses everything install-shopdbagent.ps1 and the site agent
# generator's install.ps1 create:
#   - stops and deletes the Windows service
#   - kills any running agent/tray processes
#   - removes the tray logon Run key (64-bit and 32-bit views)
#   - removes the credential hive HKLM\SOFTWARE\GE\ShopDB (both views)
#   - removes the Defender path exclusion for the install directory
#   - deletes the install directory and the ProgramData data/log tree
#
# Every step is best-effort and idempotent: a missing service, key, process, or
# folder is a no-op, so the script is safe to re-run and safe on a partially
# installed host. Nothing here fails the run just because an artifact is already
# gone; only an unexpected error on a present artifact surfaces as a warning.

[CmdletBinding()]
param(
	[string] $InstallDir = "C:\Program Files\ShopDB\EndpointAgent",
	[string] $ServiceName = "ShopDbEndpointAgent",
	[string] $TrayExeName = "shopdb-endpoint-tray.exe",

	# Also remove any server TLS certificate the site-agent installer imported
	# into the machine Trusted Root store. Off by default because a root cert is
	# shared trust material: only pull it when you are sure no other service on
	# this host relies on it. Match is by subject CN substring.
	[string] $RemoveRootCertMatching = "",

	# Keep the ProgramData logs (C:\ProgramData\ShopDB) for post-mortem instead
	# of deleting them with everything else.
	[switch] $KeepLogs
)

$ErrorActionPreference = "Stop"

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
	throw "This script must be run from an elevated (Run as administrator) PowerShell."
}

# Delete an HKLM value or subkey from BOTH the 64-bit and 32-bit registry views.
# The installer writes both views (a stale WOW6432Node copy would otherwise be
# read first by the agent), so a clean uninstall has to clear both.
function Remove-HklmBothViews {
	param(
		[Parameter(Mandatory)] [string] $SubKey,
		[string] $Name
	)
	foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,
						[Microsoft.Win32.RegistryView]::Registry32)) {
		$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey(
			[Microsoft.Win32.RegistryHive]::LocalMachine, $view)
		try {
			if ($Name) {
				$key = $base.OpenSubKey($SubKey, $true)
				if ($key) {
					try {
						if ($null -ne $key.GetValue($Name)) { $key.DeleteValue($Name, $false) }
					}
					finally { $key.Dispose() }
				}
			}
			else {
				if ($base.OpenSubKey($SubKey)) {
					$base.DeleteSubKeyTree($SubKey, $false)
				}
			}
		}
		catch {
			Write-Warning "  registry cleanup ($view $SubKey $Name): $($_.Exception.Message)"
		}
		finally { $base.Dispose() }
	}
}

Write-Host "== ShopDB endpoint agent uninstall ==" -ForegroundColor Cyan
Write-Host "InstallDir  : $InstallDir"
Write-Host "ServiceName : $ServiceName"

# 1. Stop and delete the Windows service.
$service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
if ($service) {
	Write-Host "[1/6] Stopping and deleting service $ServiceName ..."
	if ($service.Status -ne "Stopped") {
		try { Stop-Service -Name $ServiceName -Force -ErrorAction Stop }
		catch { Write-Warning "  could not stop service: $($_.Exception.Message)" }
	}
	sc.exe delete $ServiceName | Out-Null
	Start-Sleep -Seconds 2
}
else {
	Write-Host "[1/6] Service $ServiceName not present; skipping."
}

# 2. Kill any lingering agent/tray processes (service host, tray, and anything
# still running out of the install directory holding files open).
Write-Host "[2/6] Stopping agent and tray processes ..."
$trayBase = [System.IO.Path]::GetFileNameWithoutExtension($TrayExeName)
foreach ($name in @("shopdbagent", $trayBase)) {
	foreach ($proc in (Get-Process -Name $name -ErrorAction SilentlyContinue)) {
		try { Stop-Process -Id $proc.Id -Force -ErrorAction Stop; Write-Host "  killed $name (pid $($proc.Id))" }
		catch { Write-Warning "  could not stop $name (pid $($proc.Id)): $($_.Exception.Message)" }
	}
}
foreach ($proc in (Get-Process -ErrorAction SilentlyContinue |
		Where-Object { $_.Path -and $_.Path.StartsWith($InstallDir, [StringComparison]::OrdinalIgnoreCase) })) {
	try { Stop-Process -Id $proc.Id -Force -ErrorAction Stop; Write-Host "  killed $($proc.ProcessName) from install dir (pid $($proc.Id))" }
	catch { Write-Warning "  could not stop pid $($proc.Id): $($_.Exception.Message)" }
}
Start-Sleep -Seconds 1

# 3. Remove the tray logon Run key entry (both views) and the credential hive.
Write-Host "[3/6] Removing registry entries ..."
Remove-HklmBothViews -SubKey "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "ShopDbEndpointTray"
Remove-HklmBothViews -SubKey "SOFTWARE\GE\ShopDB"
# Drop the parent GE key only if we emptied it (some sites nest siblings under
# GE such as SFLD; never tree-delete a key we do not own).
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,
					[Microsoft.Win32.RegistryView]::Registry32)) {
	$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey(
		[Microsoft.Win32.RegistryHive]::LocalMachine, $view)
	try {
		$ge = $base.OpenSubKey("SOFTWARE\GE")
		if ($ge -and $ge.SubKeyCount -eq 0 -and $ge.ValueCount -eq 0) {
			$ge.Dispose()
			$base.DeleteSubKey("SOFTWARE\GE", $false)
			Write-Host "  removed empty SOFTWARE\GE ($view)"
		}
		elseif ($ge) { $ge.Dispose() }
	}
	catch { Write-Warning "  GE key cleanup ($view): $($_.Exception.Message)" }
	finally { $base.Dispose() }
}

# 4. Remove the Defender path exclusion the installer added for the install dir.
Write-Host "[4/6] Removing Defender exclusion ..."
if (Get-Command Remove-MpPreference -ErrorAction SilentlyContinue) {
	try {
		Remove-MpPreference -ExclusionPath $InstallDir -ErrorAction Stop
		Write-Host "  removed Defender exclusion for $InstallDir"
	}
	catch { Write-Warning "  could not remove Defender exclusion (tamper protection or policy?): $($_.Exception.Message)" }
}
else {
	Write-Host "  Defender cmdlets not present; skipping."
}

# 5. Optionally remove an imported server root certificate.
if (-not [string]::IsNullOrWhiteSpace($RemoveRootCertMatching)) {
	Write-Host "[5/6] Removing Trusted Root certs matching '$RemoveRootCertMatching' ..."
	$matches = Get-ChildItem Cert:\LocalMachine\Root -ErrorAction SilentlyContinue |
		Where-Object { $_.Subject -like "*$RemoveRootCertMatching*" }
	foreach ($cert in $matches) {
		try {
			Remove-Item -Path $cert.PSPath -Force -ErrorAction Stop
			Write-Host "  removed $($cert.Subject) [$($cert.Thumbprint)]"
		}
		catch { Write-Warning "  could not remove $($cert.Thumbprint): $($_.Exception.Message)" }
	}
	if (-not $matches) { Write-Host "  no matching root certs found." }
}
else {
	Write-Host "[5/6] Skipping root-cert removal (pass -RemoveRootCertMatching to enable)."
}

# 6. Delete the install directory and the ProgramData data/log tree.
Write-Host "[6/6] Removing files ..."
if (Test-Path $InstallDir) {
	try { Remove-Item -Path $InstallDir -Recurse -Force -ErrorAction Stop; Write-Host "  removed $InstallDir" }
	catch { Write-Warning "  could not remove $InstallDir (a file may still be locked): $($_.Exception.Message)" }
}
else { Write-Host "  $InstallDir not present." }

$dataDir = Join-Path $env:ProgramData "ShopDB"
if (-not $KeepLogs -and (Test-Path $dataDir)) {
	try { Remove-Item -Path $dataDir -Recurse -Force -ErrorAction Stop; Write-Host "  removed $dataDir" }
	catch { Write-Warning "  could not remove $dataDir : $($_.Exception.Message)" }
}
elseif ($KeepLogs) { Write-Host "  keeping $dataDir (-KeepLogs)." }

# Also prune an empty C:\Program Files\ShopDB parent left behind.
$parent = Split-Path -Parent $InstallDir
if ((Test-Path $parent) -and -not (Get-ChildItem -Path $parent -Force -ErrorAction SilentlyContinue)) {
	try { Remove-Item -Path $parent -Force -ErrorAction Stop; Write-Host "  removed empty $parent" } catch { }
}

Write-Host "`nUninstall complete." -ForegroundColor Green
Write-Host "Verify with: Get-Service $ServiceName ; Get-Process shopdbagent,$trayBase ; reg query 'HKLM\SOFTWARE\GE\ShopDB'"