#requires -Version 5.1

[CmdletBinding()]
param(
    [switch]$ElevatedChild,
    [string]$CleanupPath,
    [switch]$AllowFallback,

    # Windows PowerShell 5.1 does not natively bind GNU-style long options.
    # Capture them explicitly so --allow-fallback works as requested.
    [Parameter(ValueFromRemainingArguments = $true)]
    [string[]]$RemainingArguments
)

$ErrorActionPreference = "Stop"

# =========================================================
# Windows 11 DoH template registration
#
# - Registers every provider below without showing a menu.
# - Enables automatic DoH upgrade for every server address.
# - Disables plaintext fallback by default.
# - Accepts --allow-fallback to permit UDP/TCP fallback.
# - Does not change any network adapter's current DNS servers.
# =========================================================

$ScriptUri = "https://configure-doh.hcha.site/"
$AllowFallbackEnabled = (
    [bool]$AllowFallback -or
    ($RemainingArguments -contains "--allow-fallback")
)

$Providers = @(
    [PSCustomObject]@{
        Name = "阿里公共 DNS"
        Addresses = @("223.5.5.5", "223.6.6.6")
        Template = "https://dns.alidns.com/dns-query"
    }
    [PSCustomObject]@{
        Name = "腾讯云 DNSPod"
        Addresses = @("119.29.29.29")
        Template = "https://doh.pub/dns-query"
    }
    [PSCustomObject]@{
        Name = "360 安全 DNS"
        Addresses = @("101.226.4.6", "218.30.118.6")
        Template = "https://doh.360.cn/dns-query"
    }
    [PSCustomObject]@{
        Name = "百度 DNS"
        Addresses = @("180.76.76.76")
        Template = "https://doh.baidu.com/dns-query"
    }
    [PSCustomObject]@{
        Name = "Cloudflare"
        Addresses = @("1.1.1.1", "1.0.0.1")
        Template = "https://cloudflare-dns.com/dns-query"
    }
    [PSCustomObject]@{
        Name = "Google Public DNS"
        Addresses = @("8.8.8.8", "8.8.4.4")
        Template = "https://dns.google/dns-query"
    }
    [PSCustomObject]@{
        Name = "Quad9"
        Addresses = @("9.9.9.9", "149.112.112.112")
        Template = "https://dns.quad9.net/dns-query"
    }
    [PSCustomObject]@{
        Name = "AdGuard DNS"
        Addresses = @("94.140.14.14", "94.140.15.15")
        Template = "https://dns.adguard-dns.com/dns-query"
    }
    [PSCustomObject]@{
        Name = "CleanBrowsing Security"
        Addresses = @("185.228.168.10", "185.228.169.11")
        Template = "https://doh.cleanbrowsing.org/doh/security-filter/"
    }
)

function Test-IsAdministrator {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)

    return $principal.IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator
    )
}

function Start-ElevatedRegistration {
    param(
        [bool]$FallbackToUdp
    )

    $launchPath = $PSCommandPath
    $temporaryPath = $null

    try {
        # Invoke-Expression has no backing .ps1 file. Download one stable copy
        # so the elevated process receives a valid path through -File.
        if ([string]::IsNullOrWhiteSpace($launchPath) -or
            -not (Test-Path -LiteralPath $launchPath -PathType Leaf)) {
            $temporaryPath = Join-Path `
                ([IO.Path]::GetTempPath()) `
                ("configure-doh-{0}.ps1" -f [Guid]::NewGuid())

            Invoke-WebRequest `
                -UseBasicParsing `
                -Uri $ScriptUri `
                -OutFile $temporaryPath `
                -ErrorAction Stop

            $launchPath = $temporaryPath
        }

        $arguments = @(
            "-NoProfile"
            "-NonInteractive"
            "-WindowStyle"
            "Hidden"
            "-ExecutionPolicy"
            "Bypass"
            "-File"
            "`"$launchPath`""
            "-ElevatedChild"
        )

        if ($FallbackToUdp) {
            $arguments += "-AllowFallback"
        }

        if ($temporaryPath) {
            $arguments += @(
                "-CleanupPath"
                "`"$temporaryPath`""
            )
        }

        $process = Start-Process `
            -FilePath "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" `
            -Verb RunAs `
            -WindowStyle Hidden `
            -ArgumentList $arguments `
            -PassThru `
            -Wait `
            -ErrorAction Stop

        return $process.ExitCode
    }
    catch {
        if ($temporaryPath -and (Test-Path -LiteralPath $temporaryPath)) {
            Remove-Item `
                -LiteralPath $temporaryPath `
                -Force `
                -ErrorAction SilentlyContinue
        }
        return 1
    }
}

function Register-AllDohTemplates {
    param(
        [bool]$FallbackToUdp
    )

    $hadFailure = $false

    foreach ($provider in $Providers) {
        foreach ($address in $provider.Addresses) {
            try {
                $existing = Get-DnsClientDohServerAddress |
                    Where-Object { $_.ServerAddress -eq $address } |
                    Select-Object -First 1

                if ($existing) {
                    Set-DnsClientDohServerAddress `
                        -ServerAddress $address `
                        -DohTemplate $provider.Template `
                        -AllowFallbackToUdp $FallbackToUdp `
                        -AutoUpgrade $true `
                        -ErrorAction Stop
                }
                else {
                    Add-DnsClientDohServerAddress `
                        -ServerAddress $address `
                        -DohTemplate $provider.Template `
                        -AllowFallbackToUdp $FallbackToUdp `
                        -AutoUpgrade $true `
                        -ErrorAction Stop
                }
            }
            catch {
                $hadFailure = $true
            }
        }
    }

    if ($hadFailure) {
        return 1
    }

    return 0
}

$exitCode = 0

try {
    if (-not (Test-IsAdministrator)) {
        $exitCode = Start-ElevatedRegistration `
            -FallbackToUdp $AllowFallbackEnabled
        return
    }

    if (-not (Get-Command Add-DnsClientDohServerAddress -ErrorAction SilentlyContinue) -or
        -not (Get-Command Set-DnsClientDohServerAddress -ErrorAction SilentlyContinue)) {
        $exitCode = 1
    }
    else {
        $exitCode = Register-AllDohTemplates `
            -FallbackToUdp $AllowFallbackEnabled
    }
}
catch {
    $exitCode = 1
}
finally {
    if (-not [string]::IsNullOrWhiteSpace($CleanupPath) -and
        (Test-Path -LiteralPath $CleanupPath -PathType Leaf)) {
        Remove-Item `
            -LiteralPath $CleanupPath `
            -Force `
            -ErrorAction SilentlyContinue
    }
}

if ($ElevatedChild) {
    exit $exitCode
}