# One-click: enable OpenSSH Server on Windows and authorize the Mac key
$ErrorActionPreference = 'Stop'
$url = 's.bupt.app'
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  Write-Host '需要管理员权限，正在请求提权...' -ForegroundColor Yellow
  Start-Process powershell -Verb RunAs -ArgumentList "-NoExit -ExecutionPolicy Bypass -Command irm $url|iex"
  return
}

Write-Host '[1/5] 安装 OpenSSH Server...' -ForegroundColor Cyan
function Test-Sshd { [bool](Get-Service sshd -ErrorAction SilentlyContinue) }
$wu = Get-Service wuauserv -ErrorAction SilentlyContinue
if (-not (Test-Sshd) -and $wu -and $wu.StartType -ne 'Disabled') {
  try { Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null } catch { Write-Host "系统组件安装出错: $_" -ForegroundColor Yellow }
}
if (-not (Test-Sshd) -and (Get-Command winget -ErrorAction SilentlyContinue)) {
  Write-Host '系统组件没装上，改用 winget...' -ForegroundColor Yellow
  try { winget install --id Microsoft.OpenSSH.Preview -e --accept-source-agreements --accept-package-agreements } catch {}
}
if (-not (Test-Sshd)) {
  Write-Host '改为从 GitHub 下载 Win32-OpenSSH...' -ForegroundColor Yellow
  [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
  $zip = "$env:TEMP\OpenSSH-Win64.zip"
  Invoke-WebRequest -UseBasicParsing 'https://github.com/PowerShell/Win32-OpenSSH/releases/latest/download/OpenSSH-Win64.zip' -OutFile $zip
  Expand-Archive $zip -DestinationPath $env:ProgramFiles -Force
  Get-ChildItem "$env:ProgramFiles\OpenSSH-Win64" -Recurse | Unblock-File
  powershell -NoProfile -ExecutionPolicy Bypass -File "$env:ProgramFiles\OpenSSH-Win64\install-sshd.ps1"
}
if (-not (Test-Sshd)) { throw '无法安装 OpenSSH Server，请检查网络后重试' }

Write-Host '[2/5] 启动服务并设为开机自启...' -ForegroundColor Cyan
Set-Service sshd -StartupType Automatic
Start-Service sshd

Write-Host '[3/5] 放行防火墙 22 端口...' -ForegroundColor Cyan
if (-not (Get-NetFirewallRule -Name sshd-oneclick -ErrorAction SilentlyContinue)) {
  New-NetFirewallRule -Name sshd-oneclick -DisplayName 'OpenSSH Server (22)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -Profile Any | Out-Null
}

Write-Host '[4/5] 写入 Mac 公钥（免密登录）...' -ForegroundColor Cyan
$key = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7io0L0NzltufJR+pH+zDp+FlQXoR6UMpgBICONO0/L github-2026-03-17'
$adminKeys = "$env:ProgramData\ssh\administrators_authorized_keys"
$userDir = "$env:USERPROFILE\.ssh"
New-Item -ItemType Directory -Force -Path $userDir, "$env:ProgramData\ssh" | Out-Null
foreach ($f in @($adminKeys, "$userDir\authorized_keys")) {
  if (-not ((Test-Path $f) -and (Select-String -Path $f -SimpleMatch $key -Quiet))) { Add-Content -Path $f -Value $key -Encoding ascii }
}
icacls.exe $adminKeys /inheritance:r /grant 'Administrators:F' /grant 'SYSTEM:F' | Out-Null

Write-Host '[5/5] 默认 Shell 设为 PowerShell...' -ForegroundColor Cyan
New-Item -Path 'HKLM:\SOFTWARE\OpenSSH' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force | Out-Null
Restart-Service sshd

$user = $env:USERNAME
$ips = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.IPAddress -notmatch '^(127\.|169\.254\.)' -and $_.PrefixOrigin -ne 'WellKnown' }).IPAddress
Write-Host ''
Write-Host '完成！在 Mac 终端执行：' -ForegroundColor Green
foreach ($ip in $ips) { Write-Host "  ssh $user@$ip" -ForegroundColor Green }