@echo off
REM ============================================================
REM  set-password.bat - setup of the web access password.
REM  Asks for the password, syncs the UltraVNC service password,
REM  generates a hash and saves both to webvnc.conf (gitignored).
REM  After this, run.bat and the autostart task start without asking.
REM
REM  If the "web-vnc" autostart task is installed, this script also
REM  restarts it (elevated, via scripts\restart-autostart.bat) so the
REM  running gateway reloads the new password. The restart is skipped
REM  only when the password did not actually change (the running gateway
REM  already accepts it). restart-autostart.bat checks whether
REM  web-vnc.exe is running and stops+starts it, or just starts it.
REM ============================================================
cd /d "%~dp0"

echo.
echo === web-vnc: password setup ===
echo.

REM --- 1. Binary (needed for --gen-hash) ---
if exist "web-vnc.exe" goto havebin
where go >nul 2>nul
if errorlevel 1 (
  echo [error] web-vnc.exe not found and Go is not installed.
  echo Build it first with: go build -o web-vnc.exe .\cmd\web-vnc
  echo or run run.bat once interactively.
  pause
  exit /b 1
)
echo Building web-vnc.exe ...
go build -o web-vnc.exe .\cmd\web-vnc
if errorlevel 1 (
  echo Build failed.
  pause
  exit /b 1
)
:havebin

REM --- 2. Remember the previous password (to detect a real change) ---
set "OLD_PW="
if exist "webvnc.conf" (
  for /f "tokens=1,* delims==" %%a in (webvnc.conf) do if /i "%%a"=="VNC_PASSWORD" set "OLD_PW=%%b"
)

REM --- 3. Ask password ---
:getpw
set "PW="
set /p "PW=Enter access password (ASCII, max 8 chars for VNC): "
if "%PW%"=="" (
  echo Password cannot be empty.
  goto getpw
)

REM --- 4. Sync UltraVNC service password (UAC only if it differs) ---
echo Syncing UltraVNC password with the one entered ...
powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0scripts\ensure-vnc-password.ps1" -Password "%PW%"
if errorlevel 1 echo [warning] Could not sync the UltraVNC password - continuing.

REM --- 5. Generate hash ---
echo Generating password hash ...
set "HASH="
for /f "delims=" %%i in ('web-vnc.exe --gen-hash "%PW%"') do set "HASH=%%i"
if "%HASH%"=="" (
  echo [error] Could not generate the password hash.
  pause
  exit /b 1
)

REM --- 6. Save to webvnc.conf (overwrite) ---
echo HASH=%HASH%> "webvnc.conf"
echo VNC_PASSWORD=%PW%>> "webvnc.conf"
set "HASH="
echo Saved to webvnc.conf.

REM --- 7. Apply to the running gateway (if the autostart task is installed) ---
REM     web-vnc.exe reads the hash + VNC password only at startup, so a
REM     restart is required for the new password to take effect.
schtasks /Query /TN "web-vnc" >nul 2>nul
if errorlevel 1 goto no_task

REM Skip the restart if the password did not change (the running gateway
REM already accepts it; PBKDF2 hash is always new due to salt, so we compare
REM the entered password with the old VNC_PASSWORD from webvnc.conf).
if not defined OLD_PW goto do_restart
if /i not "%OLD_PW%"=="%PW%" goto do_restart
echo.
echo Password unchanged - the running gateway keeps accepting it. No restart needed.
echo If the gateway is not running, start it with: scripts\restart-autostart.bat ^(admin^)
goto cleanup

:do_restart
echo.
echo Applying the new password to the "web-vnc" task ^(needs admin^) ...
powershell -NoProfile -Command "Start-Process -FilePath '%~dp0scripts\restart-autostart.bat' -Verb RunAs -Wait"
goto cleanup

:no_task
echo.
echo Autostart task "web-vnc" is not installed.
echo To start on every boot, run once as administrator:
echo   scripts\install-autostart.bat

:cleanup
set "PW="
set "OLD_PW="
echo.
pause