[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'Stop'

function Section($title) {
    Write-Host ''
    Write-Host ('=' * 8) $title ('=' * 8) -ForegroundColor Green
}

function StatusUpdate($message) {
    Write-Host "✅ $message" -ForegroundColor Green
}

function WarningUpdate($message) {
    Write-Host "⚠️  $message" -ForegroundColor Yellow
}

Write-Host "Starting WinRM Configuration..." -ForegroundColor Cyan
Write-Host "This script will configure WinRM for remote management." -ForegroundColor Cyan
Write-Host ""

# Check if running as Administrator
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
$isAdmin = $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Write-Host "❌ ERROR: This script must be run as Administrator" -ForegroundColor Red
    Write-Host "Please run PowerShell as Administrator and try again." -ForegroundColor Red
    exit 1
}

StatusUpdate "Running as Administrator"

Section "Enable PowerShell Remoting"
try {
    Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
    StatusUpdate "PowerShell Remoting enabled"
} catch {
    WarningUpdate "PowerShell Remoting may already be enabled: $($_.Exception.Message)"
}

Section "Configure WinRM Service"
try {
    # Ensure WinRM service is set to automatic startup
    Set-Service -Name WinRM -StartupType Automatic
    Start-Service -Name WinRM
    StatusUpdate "WinRM service configured and started"
} catch {
    WarningUpdate "WinRM service configuration: $($_.Exception.Message)"
}

Section "Run WinRM Quick Configuration"
try {
    $quickConfigOutput = cmd /c "winrm quickconfig -quiet" 2>&1
    StatusUpdate "WinRM quick configuration completed"
} catch {
    WarningUpdate "WinRM quickconfig: $($_.Exception.Message)"
}

Section "Configure Authentication Methods"
try {
    # Enable Basic authentication for simplicity (can be disabled later for production)
    cmd /c 'winrm set winrm/config/service/auth @{Basic="true"}' | Out-Null
    StatusUpdate "Basic authentication enabled"

    # Allow unencrypted traffic for HTTP (can be disabled in production)
    cmd /c 'winrm set winrm/config/service @{AllowUnencrypted="true"}' | Out-Null
    StatusUpdate "Unencrypted communication allowed (for HTTP testing)"

} catch {
    WarningUpdate "Authentication configuration: $($_.Exception.Message)"
}

Section "Configure Firewall Rules"
try {
    # Enable Windows Remote Management firewall rules
    Enable-NetFirewallRule -DisplayGroup "Windows Remote Management" -ErrorAction SilentlyContinue
    StatusUpdate "Windows Remote Management firewall rules enabled"
} catch {
    WarningUpdate "Firewall configuration: $($_.Exception.Message)"
}

Section "Create HTTP Listener (if needed)"
try {
    # Check if HTTP listener exists
    $httpListener = winrm enumerate winrm/config/listener | Select-String "Transport = HTTP"
    if (-not $httpListener) {
        winrm create winrm/config/listener?Address=*+Transport=HTTP | Out-Null
        StatusUpdate "HTTP listener created on port 5985"
    } else {
        StatusUpdate "HTTP listener already exists"
    }
} catch {
    WarningUpdate "HTTP listener configuration: $($_.Exception.Message)"
}

Section "Test Local Connection"
try {
    $testSession = New-PSSession -ComputerName localhost -ErrorAction Stop
    Remove-PSSession $testSession -ErrorAction SilentlyContinue
    StatusUpdate "Local WinRM connection test successful"
} catch {
    WarningUpdate "Local connection test failed: $($_.Exception.Message)"
    Write-Host "   This may be normal if additional configuration is needed"
}

Section "Configuration Summary"
Write-Host ""
Write-Host "WinRM has been configured with the following settings:" -ForegroundColor Cyan
Write-Host ""

# Display current configuration
try {
    Write-Host "Service Status:" -ForegroundColor Yellow
    Get-Service WinRM | Select-Object Name, Status, StartType | Format-List

    Write-Host "Listeners:" -ForegroundColor Yellow
    winrm enumerate winrm/config/listener

    Write-Host "Authentication Methods:" -ForegroundColor Yellow
    winrm get winrm/config/service/auth

    Write-Host "Firewall Rules:" -ForegroundColor Yellow
    Get-NetFirewallRule -DisplayGroup "*Remote Management*" | Where-Object Enabled -eq $true |
        Select-Object DisplayName, Direction, Action | Format-Table -AutoSize

} catch {
    Write-Host "Could not retrieve full configuration details"
}

Section "Connection Information"
$ipAddresses = Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } | Select-Object -ExpandProperty IPAddress
$computerName = $env:COMPUTERNAME

Write-Host "Computer Name: $computerName" -ForegroundColor Cyan
Write-Host "IP Addresses: $($ipAddresses -join ', ')" -ForegroundColor Cyan
Write-Host ""
Write-Host "To test from a remote machine, use:" -ForegroundColor Yellow
Write-Host "Test-WSMan -ComputerName $($ipAddresses[0])" -ForegroundColor White
Write-Host "  or"
Write-Host "Test-WSMan -ComputerName $computerName" -ForegroundColor White
Write-Host ""
Write-Host "For PowerShell remoting:" -ForegroundColor Yellow
Write-Host "`$session = New-PSSession -ComputerName $($ipAddresses[0]) -Credential (Get-Credential)" -ForegroundColor White

Section "Security Notes"
Write-Host "⚠️  SECURITY CONSIDERATIONS:" -ForegroundColor Yellow
Write-Host ""
Write-Host "1. Basic authentication and unencrypted communication are enabled for testing" -ForegroundColor Yellow
Write-Host "2. For production use, consider:" -ForegroundColor Yellow
Write-Host "   - Disabling Basic auth: winrm set winrm/config/service/auth @{Basic=`"false`"}" -ForegroundColor White
Write-Host "   - Disabling unencrypted: winrm set winrm/config/service @{AllowUnencrypted=`"false`"}" -ForegroundColor White
Write-Host "   - Setting up HTTPS listener with proper certificates" -ForegroundColor White
Write-Host "   - Using Kerberos authentication in domain environments" -ForegroundColor White
Write-Host ""
Write-Host "🎉 WinRM configuration completed!" -ForegroundColor Green