@echo off
setlocal EnableDelayedExpansion

:: ============================================================================
:: iWinNAC Uninstall
:: Must be run as Administrator
:: ============================================================================

set PORT=12030
set "LOG_FILE=%~dp0iWinNAC_uninstall.log"
set "CERT_HELPER=%~dp0iWinNAC-CertHelper.ps1"
set "MSI_FILE=%~dp0iWinNACSetup.msi"
set "ERR_FILE=%~dp0iWinNAC_last_error.txt"

echo ============================================================ > "%LOG_FILE%"
echo iWinNAC uninstall started: %DATE% %TIME% >> "%LOG_FILE%"
echo Computer: %COMPUTERNAME% >> "%LOG_FILE%"
echo ============================================================ >> "%LOG_FILE%"

net session >nul 2>&1
if errorlevel 1 goto :UninstallFail

echo [1/5] Stopping Integra WinNAC service...
sc query "Integra WinNAC" >nul 2>&1
if errorlevel 1 (
    echo Service not found. Continuing... >> "%LOG_FILE%"
) else (
    sc stop "Integra WinNAC" >> "%LOG_FILE%" 2>&1
    if errorlevel 1 (
        echo [WARN] Could not stop service. It may already be stopped. >> "%LOG_FILE%"
    )
)
timeout /t 5 /nobreak >nul

echo [2/5] Uninstalling iWinNAC MSI...
if not exist "%MSI_FILE%" (
    echo [WARN] MSI not found: %MSI_FILE% >> "%LOG_FILE%"
    echo [WARN] Skipping MSI uninstall. >> "%LOG_FILE%"
) else (
    msiexec /x "%MSI_FILE%" /qn >> "%LOG_FILE%" 2>&1
    if errorlevel 1 (
        echo [WARN] MSI uninstall returned an error. The product may not be installed. >> "%LOG_FILE%"
    )
)

echo [3/5] Removing HTTP.SYS SSL bindings...
netsh http delete sslcert ipport=0.0.0.0:%PORT% >> "%LOG_FILE%" 2>&1
netsh http delete sslcert ipport=127.0.0.1:%PORT% >> "%LOG_FILE%" 2>&1
netsh http delete sslcert ipport=[::1]:%PORT% >> "%LOG_FILE%" 2>&1

echo [4/5] Removing TLS certificates...
if exist "%ERR_FILE%" del /f /q "%ERR_FILE%" >nul 2>&1

if exist "%CERT_HELPER%" (
    powershell -NoProfile -ExecutionPolicy Bypass -File "%CERT_HELPER%" -Action Cleanup 1>> "%LOG_FILE%" 2> "%ERR_FILE%"
    if errorlevel 1 goto :CertCleanupFail
) else (
    echo [WARN] Certificate helper not found. Removing legacy certificate only. >> "%LOG_FILE%"
    certutil -delstore My F3C26347A7224962CF5E37BBE70831FEDDEE63B >> "%LOG_FILE%" 2>&1
    certutil -delstore Root F3C26347A7224962CF5E37BBE70831FEDDEE63B >> "%LOG_FILE%" 2>&1
)

echo [5/5] Uninstall complete.
echo.
echo [SUCCESS] iWinNAC uninstall finished.
echo Log file: %LOG_FILE%
pause
exit /b 0

:CertCleanupFail
echo.
echo ============================================================
echo [ERROR] Certificate cleanup failed
echo ============================================================
echo.
echo Reason:
echo   Could not remove per-kiosk or legacy TLS certificates.
echo.
echo Action:
echo   Run uninstall.bat as Administrator.
echo   Manually remove certs named iWinNAC-HTTPS-* from certmgr.msc
echo   under Local Computer ^> Personal and Trusted Root.
echo.
echo Log file:
echo   %LOG_FILE%
echo.
if exist "%ERR_FILE%" (
    echo Last certificate error:
    type "%ERR_FILE%"
)
echo ============================================================
pause
exit /b 1

:UninstallFail
echo.
echo ============================================================
echo [ERROR] Administrator privileges required
echo ============================================================
echo.
echo Reason:
echo   uninstall.bat must be run as Administrator.
echo.
echo Action:
echo   Right-click uninstall.bat and select 'Run as administrator'.
echo.
echo ============================================================
pause
exit /b 1
