param(
    [string]$CaUrl = "https://10.10.40.53",
    [string]$Fingerprint = "5fc8c379cab1119c1a9ac7038225f6bcf3a2ffb0e71b257af796b2bd6c71d594",
    [string]$StepVersion = "0.28.7",
    [switch]$Force
)

$ErrorActionPreference = "Stop"

function Write-Log {
    param([string]$Message)
    Write-Host ""
    Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
}

function Ensure-Step {
    if (Get-Command step -ErrorAction SilentlyContinue) {
        Write-Log "step CLI already installed"
        return
    }

    $msi = "step-cli_${StepVersion}_amd64.msi"
    $url = "https://github.com/smallstep/cli/releases/download/v${StepVersion}/${msi}"
    $tmp = Join-Path $env:TEMP $msi

    Write-Log "Downloading step CLI"
    Invoke-WebRequest -Uri $url -OutFile $tmp

    Write-Log "Installing step CLI"
    Start-Process msiexec.exe -Wait -ArgumentList "/i `"$tmp`" /qn"
    Remove-Item $tmp -Force

    $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" +
                [System.Environment]::GetEnvironmentVariable("Path", "User")

    if (-not (Get-Command step -ErrorAction SilentlyContinue)) {
        throw "step CLI installation failed"
    }
}

function Bootstrap-Step {
    if ($Force) {
        $stepDir = Join-Path $HOME ".step"
        if (Test-Path $stepDir) {
            Remove-Item -Recurse -Force $stepDir
        }
    }

    Write-Log "Bootstrapping against $CaUrl"
    & step ca bootstrap --ca-url $CaUrl --fingerprint $Fingerprint --install --force
}

function Install-WindowsTrust {
    $rootCert = Join-Path $HOME ".step\certs\root_ca.crt"
    if (-not (Test-Path $rootCert)) {
        throw "Root certificate not found at $rootCert"
    }

    Write-Log "Installing root CA into Local Machine Root store"
    Import-Certificate -FilePath $rootCert -CertStoreLocation "Cert:\LocalMachine\Root" | Out-Null
}

function Verify-Install {
    $rootCert = Join-Path $HOME ".step\certs\root_ca.crt"
    Write-Log "Installed root CA:"
    & step certificate inspect $rootCert --short
    Write-Host ""
    Write-Host "Done."
}

Ensure-Step
Bootstrap-Step
Install-WindowsTrust
Verify-Install