<#
.SYNOPSIS
    Intune Remediation — Remediation script for DataMagik Extend policy.
    Re-applies the extension policy when detection finds it non-compliant.

.NOTES
    Intune: Devices > Scripts and remediations > Remediations > Create
    Upload Detect-DataMagikPolicy.ps1 as the Detection script.
    Upload this as the Remediation script.
#>

# ============================================================================
# CONFIGURATION — Must match the values in Deploy-DataMagikExtension.ps1
# ============================================================================

$BearerToken     = "dcp_YOUR_BEARER_TOKEN_HERE"    # REQUIRED: Replace with your token
$Environment     = "production"                     # "production" or "staging"
$LockEnvironment = $false                           # $true to lock environment switching
$ExtensionId     = "hppahoaiaihchdpnoegknnodnjleogdi"

# ============================================================================

$ErrorActionPreference = "Stop"

if ($BearerToken -eq "dcp_YOUR_BEARER_TOKEN_HERE") {
    Write-Output "ERROR: BearerToken not configured in remediation script"
    exit 1
}

function Set-BrowserPolicy {
    param([string]$Name, [string]$Root)

    $policyPath = "HKLM:\SOFTWARE\Policies\$Root"
    $managedPath = "$policyPath\3rdparty\extensions\$ExtensionId\policy"

    # ExtensionSettings
    if (-not (Test-Path $policyPath)) {
        New-Item -Path $policyPath -Force | Out-Null
    }

    $extSettings = @{ $ExtensionId = @{ installation_mode = "force_installed"; update_url = "https://clients2.google.com/service/update2/crx" } } | ConvertTo-Json -Compress
    Set-ItemProperty -Path $policyPath -Name "ExtensionSettings" -Value $extSettings -Type String

    # Managed storage
    if (-not (Test-Path $managedPath)) {
        New-Item -Path $managedPath -Force | Out-Null
    }

    Set-ItemProperty -Path $managedPath -Name "bearerToken" -Value $BearerToken -Type String
    Set-ItemProperty -Path $managedPath -Name "environment" -Value $Environment -Type String
    Set-ItemProperty -Path $managedPath -Name "lockEnvironment" -Value ([int]$LockEnvironment) -Type DWord

    Write-Output "$Name policy applied"
}

Set-BrowserPolicy -Name "Chrome" -Root "Google\Chrome"
Set-BrowserPolicy -Name "Edge" -Root "Microsoft\Edge"

Write-Output "Remediation complete"
exit 0