<#
.SYNOPSIS
    Install the AutoFirmer extension from our own update server, via policy.

.DESCRIPTION
    Chrome will not side-load an extension on Windows — dropping a CRX on
    chrome://extensions is refused — and it will not update an unpacked one. The
    supported way to run an extension you host yourself is a policy:
    ExtensionInstallForcelist names the extension id and the update manifest, and
    from then on Chrome installs it, keeps it updated on its own schedule, and
    re-installs it if it goes missing.

    Defaults to the current user's policy hive, which needs no elevation.
    -Scope Machine writes to HKLM instead, for every account on the box; that
    one does need an elevated shell. Where both exist, HKLM wins.

    After this runs:
      * Remove the unpacked copy from chrome://extensions. It has the same id
        now, and Chrome will not load both.
      * Restart Chrome, or open chrome://policy and press "Reload policies".
      * A force-installed extension cannot be disabled or removed from the
        extensions page. Re-run with -Remove to take it off.

.EXAMPLE
    powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1

.EXAMPLE
    powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Scope Machine -Browser Edge
#>
[CmdletBinding()]
param(
    [ValidateSet('Chrome', 'Edge', 'Brave')]
    [string]$Browser = 'Chrome',

    [ValidateSet('User', 'Machine')]
    [string]$Scope = 'User',

    # Derived from the signing key on the droplet. It only changes if the key does.
    [string]$Id = 'lkjbblagjjbldlkeaaffhiopdlhniaan',

    [string]$UpdateUrl = 'https://ext.juicerroom.com/updates.xml',

    [switch]$Remove
)

$ErrorActionPreference = 'Stop'

$vendors = @{
    Chrome = 'Google\Chrome'
    Edge   = 'Microsoft\Edge'
    Brave  = 'BraveSoftware\Brave'
}

$hive = if ($Scope -eq 'Machine') { 'HKLM:' } else { 'HKCU:' }

if ($Scope -eq 'Machine') {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
            [Security.Principal.WindowsBuiltInRole]::Administrator)) {
        throw 'Run this from an elevated PowerShell for -Scope Machine, or drop the flag to install it for this user only.'
    }
}

$key   = "$hive\SOFTWARE\Policies\$($vendors[$Browser])\ExtensionInstallForcelist"
$entry = "$Id;$UpdateUrl"

if ($Remove) {
    if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no $Scope forcelist for $Browser."; exit 0 }
    $props = Get-ItemProperty $key
    $found = $false
    foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notlike 'PS*' })) {
        if ($props.$name -like "$Id;*") {
            Remove-ItemProperty -Path $key -Name $name
            Write-Host "Removed $name ($($props.$name))"
            $found = $true
        }
    }
    if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser $Scope forcelist." }
    Write-Host "`nRestart $Browser to let the change take effect."
    exit 0
}

if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }

# The forcelist is a list expressed as numbered values, so adding to it means
# finding a free number rather than overwriting whatever is already there —
# another extension may well be in the list.
$props    = Get-ItemProperty $key
$existing = $props.PSObject.Properties |
            Where-Object { $_.Name -notlike 'PS*' -and $_.Value -like "$Id;*" }

if ($existing) {
    Set-ItemProperty -Path $key -Name $existing.Name -Value $entry
    Write-Host "Updated the $Browser $Scope forcelist entry $($existing.Name):"
} else {
    $used = $props.PSObject.Properties.Name |
            Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ }
    $slot = if ($used) { (($used | Measure-Object -Maximum).Maximum + 1) } else { 1 }
    New-ItemProperty -Path $key -Name "$slot" -Value $entry -PropertyType String -Force | Out-Null
    Write-Host "Added $Browser $Scope forcelist entry ${slot}:"
}

Write-Host "  $key"
Write-Host "  $entry"
Write-Host @"

Next:
  1. Remove the unpacked copy from chrome://extensions (same id — both cannot load).
  2. Restart $Browser, or open chrome://policy and press "Reload policies".
  3. Check chrome://extensions: the card should say "Installed by enterprise policy".

From here $Browser updates it on its own. The extension also asks for a check as
soon as the dashboard reports a newer version, so a release normally lands in
seconds rather than waiting out Chrome's own cycle.
"@