# Force-install the monitoring Edge extension via group policy so a standard
# user cannot disable or remove it from edge://extensions.
#
# Prerequisite: the extension has been packed into a .crx and you have its
# extension ID. To pack:
#   1. Open Edge → edge://extensions → Developer mode ON
#   2. Click "Pack extension" → Extension root: <path to extension/ folder>
#   3. Edge produces extension.crx and extension.pem (KEEP the .pem safe;
#      it determines the extension ID and is required to repack updates)
#   4. Drag the .crx onto edge://extensions to install once and copy the
#      "ID" shown there.
#
# Then host the .crx and an updates.xml on a local web server (or a file
# share) reachable by the target machines. The simplest "local web server"
# is the monitoring backend itself — drop them in backend/static/.
#
# Run elevated:
#   .\install_extension_policy.ps1 `
#     -ExtensionId "abcdefghijklmnopabcdefghijklmnop" `
#     -UpdateUrl "http://192.168.1.50:8088/static/extension/updates.xml"

param(
    [Parameter(Mandatory=$true)][string]$ExtensionId,
    [Parameter(Mandatory=$true)][string]$UpdateUrl
)

if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw "Run this script from an elevated (Administrator) PowerShell."
}

if ($ExtensionId.Length -ne 32) {
    Write-Warning "Extension IDs are typically 32 lowercase letters. Got length $($ExtensionId.Length)."
}

$key = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
if (-not (Test-Path $key)) {
    New-Item -Path $key -Force | Out-Null
}

# Find the next free ordinal
$existing = (Get-Item $key).Property | Where-Object { $_ -match '^\d+$' } | Sort-Object {[int]$_}
$next = if ($existing) { ([int]($existing | Select-Object -Last 1)) + 1 } else { 1 }

$value = "$ExtensionId;$UpdateUrl"
Set-ItemProperty -Path $key -Name $next.ToString() -Value $value -Type String

Write-Host "Force-install policy applied."
Write-Host "  HKLM:\...\ExtensionInstallForcelist\$next = $value"
Write-Host ""
Write-Host "Edge will pick this up within ~5 minutes (or restart Edge to apply now)."
Write-Host "Verify at edge://policy — search for 'ExtensionInstallForcelist'."