@echo off
REM ============================================================
REM  set-password.bat - setup of the web access password.
REM  Asks for the password, generates a hash and saves it together
REM  with the VNC password to webvnc.conf (gitignored). AFTER that
REM  (so the web password is configured even if the next step fails)
REM  it syncs the UltraVNC service password via ensure-vnc-password.ps1.
REM
REM  If the "web-vnc" autostart task is installed, this script also
REM  restarts it (elevated, via restart-autostart.bat) so the
REM  running gateway reloads the new password. The restart is skipped
REM  only when the password did not actually change. restart-autostart.bat
REM  checks whether web-vnc.exe is running and stops+starts it, or just
REM  starts it.
REM ============================================================
cd /d "%~dp0"

echo.
echo === web-vnc: password setup ===
echo.

REM --- 1. Binary (needed for --gen-hash) ---
if exist "web-vnc.exe" goto havebin
where go >nul 2>nul
if errorlevel 1 (
  echo [error] web-vnc.exe not found and Go is not installed.
  echo Build it first with: go build -o web-vnc.exe .\cmd\web-vnc
  echo or run run.bat once interactively.
  pause
  exit /b 1
)
echo Building web-vnc.exe ...
go build -o web-vnc.exe .\cmd\web-vnc
if errorlevel 1 (
  echo Build failed.
  pause
  exit /b 1
)
:havebin

REM --- 2. Remember the previous password (to detect a real change) ---
set "OLD_PW="
if exist "webvnc.conf" (
  for /f "tokens=1,* delims==" %%a in (webvnc.conf) do if /i "%%a"=="VNC_PASSWORD" set "OLD_PW=%%b"
)

REM --- 3. Ask password ---
:getpw
set "PW="
set /p "PW=Enter access password (ASCII, max 8 chars for VNC): "
if "%PW%"=="" (
  echo Password cannot be empty.
  goto getpw
)

REM --- 4. Generate hash ---
echo Generating password hash ...
set "HASH="
for /f "delims=" %%i in ('web-vnc.exe --gen-hash "%PW%"') do set "HASH=%%i"
if "%HASH%"=="" (
  echo [error] Could not generate the password hash.
  pause
  exit /b 1
)

REM --- 5. Save to webvnc.conf (overwrite) ---
REM     Done BEFORE the UltraVNC sync so the web password is configured
REM     even if the sync below fails or is cancelled (UAC).
echo HASH=%HASH%> "webvnc.conf"
echo VNC_PASSWORD=%PW%>> "webvnc.conf"
set "HASH="
echo Saved to webvnc.conf.

REM --- 6. Sync UltraVNC service password (UAC only if it differs) ---
echo Syncing UltraVNC password with the one entered ...
powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0scripts\ensure-vnc-password.ps1" -Password "%PW%"
if errorlevel 1 echo [warning] Could not sync the UltraVNC password - the web password is still saved.

REM --- 7. Apply to the running gateway (if the autostart task is installed) ---
REM     web-vnc.exe reads the hash + VNC password only at startup, so a
REM     restart is required for the new password to take effect.
schtasks /Query /TN "web-vnc" >nul 2>nul
if errorlevel 1 goto no_task

REM Skip the restart if the password did not change (the running gateway
REM already accepts it; PBKDF2 hash is always new due to salt, so we compare
REM the entered password with the old VNC_PASSWORD from webvnc.conf).
if not defined OLD_PW goto do_restart
if /i not "%OLD_PW%"=="%PW%" goto do_restart
echo.
echo Password unchanged - the running gateway keeps accepting it. No restart needed.
echo If the gateway is not running, start it with: restart-autostart.bat ^(admin^)
goto cleanup

:do_restart
echo.
echo Applying the new password to the "web-vnc" task ^(needs admin^) ...
powershell -NoProfile -Command "Start-Process -FilePath '%~dp0restart-autostart.bat' -Verb RunAs -Wait"
goto cleanup

:no_task
echo.
echo Autostart task "web-vnc" is not installed.
echo To start on every boot, run once as administrator:
echo   install-autostart.bat

:cleanup
set "PW="
set "OLD_PW="
echo.
pause