@echo off
setlocal EnableDelayedExpansion
title GrowXer - install CA certificate

rem ---------------------------------------------------------------------------
rem  Installs the GrowXer root CA so the Growtopia client stops failing with
rem  "Check your internet and make sure you are not using VPN".
rem
rem    install-cert.bat              install for the current user (no admin)
rem    install-cert.bat /machine     install for all users (asks for admin)
rem    install-cert.bat /uninstall   remove it again
rem ---------------------------------------------------------------------------

set "SERVER=http://52.65.175.30"
set "CA_URL=%SERVER%/growxer-ca.crt"
set "CA_URL_TLS=https://52.65.175.30/growxer-ca.crt"
set "CA_NAME=GrowXer Local CA"
set "CA_LOCAL=%~dp0growxer-ca.crt"
set "CA_FILE=%TEMP%\growxer-ca.crt"

set "MODE=user"
if /i "%~1"=="/machine"   set "MODE=machine"
if /i "%~1"=="-machine"   set "MODE=machine"
if /i "%~1"=="/uninstall" goto uninstall
if /i "%~1"=="-uninstall" goto uninstall

echo.
echo  ============================================
echo   GrowXer - certificate setup
echo  ============================================
echo.

rem ---------------------------------------------------------------- elevation
if /i "%MODE%"=="machine" (
    fltmc >nul 2>&1
    if errorlevel 1 (
        net session >nul 2>&1
    )
    if errorlevel 1 (
        echo  [*] Asking for administrator rights...
        powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -ArgumentList '/machine' -Verb RunAs"
        exit /b
    )
)

rem ------------------------------------------------------------------ download
if exist "%CA_LOCAL%" (
    echo  [i] Using %CA_LOCAL%
    copy /y "%CA_LOCAL%" "%CA_FILE%" >nul
) else (
    echo  [*] Downloading %CA_URL%
    del /f /q "%CA_FILE%" >nul 2>&1

    curl -fsSL -o "%CA_FILE%" "%CA_URL%" 2>nul
    findstr /c:"-----BEGIN CERTIFICATE-----" "%CA_FILE%" >nul 2>&1
    if errorlevel 1 (
        echo  [*] plain HTTP failed, trying HTTPS...
        curl -k -fsSL -o "%CA_FILE%" "%CA_URL_TLS%" 2>nul
    )
    findstr /c:"-----BEGIN CERTIFICATE-----" "%CA_FILE%" >nul 2>&1
    if errorlevel 1 (
        echo  [*] curl failed, trying PowerShell...
        powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; [Net.ServicePointManager]::ServerCertificateValidationCallback={$true}; (New-Object Net.WebClient).DownloadFile('%CA_URL_TLS%','%CA_FILE%')" >nul 2>&1
    )
)

if not exist "%CA_FILE%" (
    echo.
    echo  [x] Could not download the certificate.
    echo      Download %CA_URL% manually into this folder as growxer-ca.crt
    echo      and run this script again.
    echo.
    pause
    exit /b 1
)

rem sanity check: it has to be a PEM certificate
findstr /c:"-----BEGIN CERTIFICATE-----" "%CA_FILE%" >nul 2>&1
if errorlevel 1 (
    echo.
    echo  [x] %CA_FILE% does not look like a PEM certificate.
    echo.
    pause
    exit /b 1
)

rem ------------------------------------------------------------------- install
if /i "%MODE%"=="machine" (
    echo  [*] Installing into LocalMachine\Root ^(all users^)...
    certutil -addstore -f "Root" "%CA_FILE%" >nul
) else (
    echo  [*] Installing into CurrentUser\Root ^(this Windows account^)...
    certutil -user -addstore -f "Root" "%CA_FILE%" >nul
)
if errorlevel 1 goto failed

rem ---------------------------------------------------------------- verify
if /i "%MODE%"=="machine" (
    certutil -store "Root" 2>nul | findstr /i "%CA_NAME%" >nul
) else (
    certutil -user -store "Root" 2>nul | findstr /i "%CA_NAME%" >nul
)
if errorlevel 1 goto failed

echo  [ok] Installed and verified: %CA_NAME%
echo.
echo  Next steps:
echo    1. Make sure www.growtopia1.com and www.growtopia2.com point at
echo       52.65.175.30 in C:\Windows\System32\drivers\etc\hosts
echo    2. Open https://www.growtopia1.com/growtopia/server_data.php in a
echo       browser - it must load with no certificate warning
echo    3. Start the game
echo.
echo  A "Security Warning" popup while installing is expected - click Yes.
echo.
pause
exit /b 0

:failed
echo.
echo  [x] Installation failed.
echo      Try running this file as Administrator, or run:
echo        certutil -user -addstore -f "Root" "%CA_FILE%"
echo.
pause
exit /b 1

:uninstall
echo.
echo  [*] Removing %CA_NAME%...
certutil -user -delstore "Root" "%CA_NAME%" >nul 2>&1
certutil -delstore "Root" "%CA_NAME%" >nul 2>&1
echo  [ok] Done ^(the certificate is gone if it was present^).
echo.
pause
exit /b 0