<#
.SYNOPSIS
    Enrol this machine's Chrome in Chrome Enterprise Core.

.DESCRIPTION
    Chrome refuses to force-install an extension from outside its own web store
    unless the machine counts as enterprise managed. Enrolment is the way to
    qualify without joining a domain: one machine-level token, and from the next
    launch Chrome takes policy from the Google Admin console and the off-store
    restriction lifts. install-extension-policy.ps1 then works as intended.

    The token comes from the Admin console: Devices > Chrome > Managed browsers >
    the enrollment-token button. One token can enrol any number of machines, and
    it is only used at enrolment.

    Needs an elevated PowerShell — the token is machine-scoped, and Chrome does
    not read it from the user hive.

.EXAMPLE
    powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token abcd1234-...
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory = $true, ParameterSetName = 'Enrol')]
    [string]$Token,

    # Refuse to start Chrome at all if enrolment fails. Sound on a fleet, risky
    # on a trading PC: a revoked token would leave you with no browser.
    [Parameter(ParameterSetName = 'Enrol')]
    [switch]$Mandatory,

    [Parameter(Mandatory = $true, ParameterSetName = 'Remove')]
    [switch]$Remove,

    # Fail instead of asking for elevation. Also the loop-breaker: the elevated
    # copy is launched with this set, so it can never spawn another.
    [switch]$NoElevate
)

$ErrorActionPreference = 'Stop'

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator)) {
    if ($NoElevate) {
        throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.'
    }

    # Relaunch elevated rather than making the caller do it. setup-windows.bat
    # runs unelevated on purpose — nothing else it does needs admin — so this is
    # the one UAC prompt in the whole install, and it is raised here where the
    # arguments are already parsed and can be passed on intact.
    Write-Host 'Asking for administrator rights — the enrolment token is machine-level.'
    $psArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-NoElevate')
    if ($Remove) { $psArgs += '-Remove' }
    else {
        $psArgs += @('-Token', $Token)
        if ($Mandatory) { $psArgs += '-Mandatory' }
    }

    $elevated = Start-Process -FilePath (Get-Process -Id $PID).Path -Verb RunAs -Wait -PassThru `
                              -ArgumentList $psArgs
    exit $elevated.ExitCode
}

$key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }

if ($Remove) {
    foreach ($name in 'CloudManagementEnrollmentToken', 'CloudManagementEnrollmentMandatory') {
        if ($null -ne (Get-ItemProperty -Path $key -Name $name -ErrorAction SilentlyContinue)) {
            Remove-ItemProperty -Path $key -Name $name
            Write-Host "Removed $name"
        }
    }
    Write-Host @"

Restart Chrome. Note this stops Chrome asking for policy, but does not undo the
enrolment on Google's side — delete the browser from Devices > Chrome > Managed
browsers as well, or it keeps a seat and shows as stale.
"@
    exit 0
}

New-ItemProperty -Path $key -Name 'CloudManagementEnrollmentToken' `
    -Value $Token -PropertyType String -Force | Out-Null
Write-Host "Wrote CloudManagementEnrollmentToken to $key"

if ($Mandatory) {
    New-ItemProperty -Path $key -Name 'CloudManagementEnrollmentMandatory' `
        -Value 1 -PropertyType DWord -Force | Out-Null
    Write-Host 'Enrolment is now mandatory — Chrome will not start unenrolled.'
}

Write-Host @"

Next:
  1. Restart Chrome completely (check Task Manager for stray chrome.exe).
  2. chrome://policy should name the Admin console as a policy source, and
     chrome://management should say the browser is managed.
  3. The machine appears under Devices > Chrome > Managed browsers.
  4. Then install the extension, which is no longer blocked:
       powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Browser Chrome
     Or skip that and force-install it from the Admin console instead, which
     covers every enrolled machine at once.
"@