[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'SilentlyContinue'

function Section($title) {
    Write-Host ''
    Write-Host ('=' * 8) $title ('=' * 8) -ForegroundColor Green
}

function StatusCheck($description, $condition, $recommendation = "") {
    $status = if ($condition) { "✅ OK" } else { "❌ NOT OK" }
    Write-Host "$description`: $status" -ForegroundColor $(if ($condition) { "Green" } else { "Red" })
    if (-not $condition -and $recommendation) {
        Write-Host "   💡 $recommendation" -ForegroundColor Yellow
    }
}

Section "WinRM Service Status"
$winrmService = Get-Service -Name WinRM -ErrorAction SilentlyContinue
if ($winrmService) {
    StatusCheck "WinRM Service Exists" $true
    StatusCheck "WinRM Service Running" ($winrmService.Status -eq "Running") "Run: Start-Service WinRM"
    StatusCheck "WinRM Service Startup" ($winrmService.StartType -eq "Automatic") "Run: Set-Service WinRM -StartupType Automatic"
} else {
    StatusCheck "WinRM Service Exists" $false "WinRM service not found - this is unusual for Windows 10/11"
}

Section "WinRM Configuration"
try {
    $winrmConfig = winrm get winrm/config 2>$null
    StatusCheck "WinRM Config Accessible" ($winrmConfig -ne $null) "Run: winrm quickconfig -quiet"

    if ($winrmConfig) {
        # Parse basic config
        $allowUnencrypted = ($winrmConfig | Select-String "AllowUnencrypted = true") -ne $null
        $basicAuth = ($winrmConfig | Select-String "Basic = true") -ne $null

        StatusCheck "Allow Unencrypted" $allowUnencrypted "For testing: winrm set winrm/config/service @{AllowUnencrypted=`"true`"}"
        StatusCheck "Basic Auth Enabled" $basicAuth "Run: winrm set winrm/config/service/auth @{Basic=`"true`"}"
    }
} catch {
    StatusCheck "WinRM Config Accessible" $false "Run: winrm quickconfig -quiet"
}

Section "WinRM Listeners"
try {
    $listeners = winrm enumerate winrm/config/listener 2>$null
    $httpListener = ($listeners | Select-String "Transport = HTTP") -ne $null
    $httpsListener = ($listeners | Select-String "Transport = HTTPS") -ne $null

    StatusCheck "HTTP Listener (Port 5985)" $httpListener "Run: winrm create winrm/config/listener?Address=*+Transport=HTTP"
    StatusCheck "HTTPS Listener (Port 5986)" $httpsListener "Optional: Create HTTPS listener for secure connection"

    if ($listeners) {
        Write-Host "`nListener Details:"
        Write-Host $listeners
    }
} catch {
    StatusCheck "WinRM Listeners Available" $false "Run: winrm quickconfig -quiet"
}

Section "PowerShell Remoting"
try {
    $psSessionConfig = Get-PSSessionConfiguration -Name Microsoft.PowerShell -ErrorAction SilentlyContinue
    StatusCheck "PowerShell Remoting Enabled" ($psSessionConfig -ne $null) "Run: Enable-PSRemoting -Force"

    if ($psSessionConfig) {
        StatusCheck "PS Remoting Not Disabled" ($psSessionConfig.Permission -notmatch "AccessDenied") "Check session configuration permissions"
    }
} catch {
    StatusCheck "PowerShell Remoting Accessible" $false "Run: Enable-PSRemoting -Force"
}

Section "Firewall Rules"
$firewallRules = Get-NetFirewallRule -DisplayGroup "*Remote Management*" -ErrorAction SilentlyContinue
$winrmHttpRule = $firewallRules | Where-Object { $_.DisplayName -match "Windows Remote Management.*HTTP" -and $_.Enabled -eq $true }
$winrmHttpsRule = $firewallRules | Where-Object { $_.DisplayName -match "Windows Remote Management.*HTTPS" -and $_.Enabled -eq $true }

StatusCheck "WinRM HTTP Firewall Rule" ($winrmHttpRule -ne $null) "Run: Enable-NetFirewallRule -DisplayGroup 'Windows Remote Management'"
StatusCheck "WinRM HTTPS Firewall Rule" ($winrmHttpsRule -ne $null) "Optional for HTTPS"

# Show current firewall rules
if ($firewallRules) {
    Write-Host "`nCurrent WinRM Firewall Rules:"
    $firewallRules | Select-Object DisplayName, Enabled, Direction, Action | Format-Table -AutoSize
}

Section "Network Connectivity Test"
$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
$computerName = $env:COMPUTERNAME
$ipAddresses = Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } | Select-Object -ExpandProperty IPAddress

Write-Host "Current User: $currentUser"
Write-Host "Computer Name: $computerName"
Write-Host "IP Addresses: $($ipAddresses -join ', ')"

# Test local WinRM connectivity
try {
    $testSession = New-PSSession -ComputerName localhost -ErrorAction Stop
    Remove-PSSession $testSession -ErrorAction SilentlyContinue
    StatusCheck "Local WinRM Test" $true
} catch {
    StatusCheck "Local WinRM Test" $false "Local connection failed: $($_.Exception.Message)"
}

Section "Authentication Methods"
try {
    $authConfig = winrm get winrm/config/service/auth 2>$null
    if ($authConfig) {
        Write-Host "Available Authentication Methods:"
        Write-Host $authConfig
    }
} catch {
    Write-Host "Could not retrieve authentication configuration"
}

Section "Recommended Actions"
Write-Host "If WinRM is not properly configured, run these commands as Administrator:" -ForegroundColor Cyan
Write-Host ""
Write-Host "# Enable PowerShell Remoting and WinRM" -ForegroundColor Yellow
Write-Host "Enable-PSRemoting -Force"
Write-Host "winrm quickconfig -quiet"
Write-Host ""
Write-Host "# Configure basic authentication (for testing)" -ForegroundColor Yellow
Write-Host "winrm set winrm/config/service/auth '@{Basic=`"true`"}'"
Write-Host "winrm set winrm/config/service '@{AllowUnencrypted=`"true`"}'"
Write-Host ""
Write-Host "# Enable firewall rules" -ForegroundColor Yellow
Write-Host "Enable-NetFirewallRule -DisplayGroup 'Windows Remote Management'"
Write-Host ""
Write-Host "# Test from remote machine:" -ForegroundColor Yellow
Write-Host "Test-WSMan -ComputerName $($ipAddresses[0]) -Authentication Basic"

Section "Current Status Summary"
$winrmRunning = $winrmService -and ($winrmService.Status -eq "Running")
$configExists = try { winrm get winrm/config >$null 2>&1; $true } catch { $false }
$listenersExist = try { winrm enumerate winrm/config/listener >$null 2>&1; $true } catch { $false }
$firewallEnabled = ($winrmHttpRule -ne $null)

if ($winrmRunning -and $configExists -and $listenersExist -and $firewallEnabled) {
    Write-Host "🎉 WinRM appears to be ready for remote connections!" -ForegroundColor Green
} elseif ($winrmRunning -and $configExists) {
    Write-Host "⚠️  WinRM is partially configured - may need firewall or listener setup" -ForegroundColor Yellow
} else {
    Write-Host "❌ WinRM requires configuration before remote access will work" -ForegroundColor Red
}