<#
.SYNOPSIS
    Deploys DataMagik Extend extension policy for Chrome and/or Edge via registry.
    Upload this script to Intune as a Platform Script for zero-touch deployment.

.DESCRIPTION
    Sets registry keys to:
    1. Force-install the DataMagik Extend extension
    2. Configure managed storage (bearer token, environment, lock)

    This approach writes registry keys directly — no ADMX template import required.
    Works for both Chrome and Edge on Windows.

.NOTES
    Intune deployment: Devices > Scripts and remediations > Platform scripts > Add
    - Run this script using the logged-on credentials: No
    - Run script in 64-bit PowerShell: Yes
    - Enforce script signature check: No (or sign the script)

.PARAMETER BearerToken
    Required. The DataMagik API bearer token (starts with dcp_).

.PARAMETER Environment
    Optional. "production" (default) or "staging".

.PARAMETER LockEnvironment
    Optional. If set, users cannot change the environment in settings.

.PARAMETER Browsers
    Optional. Which browsers to configure: "Both" (default), "Chrome", or "Edge".

.PARAMETER ExtensionId
    Optional. Override the extension ID (default: hppahoaiaihchdpnoegknnodnjleogdi).
#>

# ============================================================================
# CONFIGURATION — Edit these values before uploading to Intune
# ============================================================================

$BearerToken     = "dcp_YOUR_BEARER_TOKEN_HERE"    # REQUIRED: Replace with your token
$Environment     = "production"                     # "production" or "staging"
$LockEnvironment = $false                           # $true to lock environment switching
$Browsers        = "Both"                           # "Both", "Chrome", or "Edge"
$ExtensionId     = "hppahoaiaihchdpnoegknnodnjleogdi"

# ============================================================================
# DO NOT EDIT BELOW THIS LINE
# ============================================================================

$ErrorActionPreference = "Stop"

function Deploy-ExtensionPolicy {
    param(
        [string]$BrowserName,
        [string]$PolicyRoot,
        [string]$ExtId,
        [string]$Token,
        [string]$Env,
        [bool]$Lock
    )

    Write-Output "[$BrowserName] Configuring extension policy..."

    # --- 1. Force Install via ExtensionSettings ---
    $extSettingsPath = "HKLM:\SOFTWARE\Policies\$PolicyRoot"

    # Ensure the policy root exists
    if (-not (Test-Path $extSettingsPath)) {
        New-Item -Path $extSettingsPath -Force | Out-Null
    }

    # ExtensionSettings as JSON string value
    $extSettings = @{
        $ExtId = @{
            installation_mode = "force_installed"
            update_url = "https://clients2.google.com/service/update2/crx"
        }
    } | ConvertTo-Json -Compress

    # Check for existing ExtensionSettings and merge if present
    $existingSettings = $null
    try {
        $existingSettings = (Get-ItemProperty -Path $extSettingsPath -Name "ExtensionSettings" -ErrorAction SilentlyContinue).ExtensionSettings
    } catch {}

    if ($existingSettings) {
        try {
            $parsed = $existingSettings | ConvertFrom-Json
            # Add or update our extension entry
            $parsed | Add-Member -NotePropertyName $ExtId -NotePropertyValue @{
                installation_mode = "force_installed"
                update_url = "https://clients2.google.com/service/update2/crx"
            } -Force
            $extSettings = $parsed | ConvertTo-Json -Compress
            Write-Output "[$BrowserName] Merged into existing ExtensionSettings"
        } catch {
            Write-Output "[$BrowserName] Could not parse existing ExtensionSettings, overwriting"
        }
    }

    Set-ItemProperty -Path $extSettingsPath -Name "ExtensionSettings" -Value $extSettings -Type String
    Write-Output "[$BrowserName] ExtensionSettings configured (force_installed)"

    # --- 2. Managed Storage (3rdparty) ---
    $managedPath = "HKLM:\SOFTWARE\Policies\$PolicyRoot\3rdparty\extensions\$ExtId\policy"

    # Create the full path
    if (-not (Test-Path $managedPath)) {
        New-Item -Path $managedPath -Force | Out-Null
    }

    # Set bearer token
    Set-ItemProperty -Path $managedPath -Name "bearerToken" -Value $Token -Type String
    Write-Output "[$BrowserName] bearerToken set"

    # Set environment
    Set-ItemProperty -Path $managedPath -Name "environment" -Value $Env -Type String
    Write-Output "[$BrowserName] environment set to: $Env"

    # Set lockEnvironment
    $lockDword = if ($Lock) { 1 } else { 0 }
    Set-ItemProperty -Path $managedPath -Name "lockEnvironment" -Value $lockDword -Type DWord
    Write-Output "[$BrowserName] lockEnvironment set to: $Lock"

    Write-Output "[$BrowserName] Policy deployment complete"
}

# --- Validation ---
if ($BearerToken -eq "dcp_YOUR_BEARER_TOKEN_HERE" -or [string]::IsNullOrWhiteSpace($BearerToken)) {
    Write-Error "BearerToken is not configured. Edit the CONFIGURATION section at the top of this script before deploying."
    exit 1
}

if ($Environment -ne "production" -and $Environment -ne "staging") {
    Write-Error "Environment must be 'production' or 'staging'. Got: '$Environment'"
    exit 1
}

Write-Output "=== DataMagik Extend Policy Deployment ==="
Write-Output "Extension ID: $ExtensionId"
Write-Output "Environment:  $Environment"
Write-Output "Lock:         $LockEnvironment"
Write-Output "Browsers:     $Browsers"
Write-Output "Date:         $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
Write-Output "Computer:     $env:COMPUTERNAME"
Write-Output ""

# --- Deploy ---
if ($Browsers -eq "Chrome" -or $Browsers -eq "Both") {
    Deploy-ExtensionPolicy -BrowserName "Chrome" -PolicyRoot "Google\Chrome" `
        -ExtId $ExtensionId -Token $BearerToken -Env $Environment -Lock $LockEnvironment
    Write-Output ""
}

if ($Browsers -eq "Edge" -or $Browsers -eq "Both") {
    Deploy-ExtensionPolicy -BrowserName "Edge" -PolicyRoot "Microsoft\Edge" `
        -ExtId $ExtensionId -Token $BearerToken -Env $Environment -Lock $LockEnvironment
    Write-Output ""
}

Write-Output "=== Deployment Complete ==="
Write-Output "Users must restart their browser for policies to take effect."
Write-Output "Verify at chrome://policy or edge://policy after restart."
exit 0