param(
    [string]$FrhApiHost = 'frh.ftrindade.com',
    [string]$RepHost = '10.254.104.6',
    [int]$RepPort = 51000,
    [switch]$AllowBridgeInboundHealth
)

$ErrorActionPreference = 'Stop'

function Assert-Admin {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
        throw 'Execute este script como Administrador.'
    }
}

function Ensure-OutboundRule {
    param(
        [Parameter(Mandatory = $true)][string]$Name,
        [Parameter(Mandatory = $true)][string]$RemoteAddress,
        [Parameter(Mandatory = $true)][string]$RemotePort
    )

    $rule = Get-NetFirewallRule -DisplayName $Name -ErrorAction SilentlyContinue
    if ($rule) {
        Remove-NetFirewallRule -DisplayName $Name -ErrorAction SilentlyContinue | Out-Null
    }

    New-NetFirewallRule -DisplayName $Name -Direction Outbound -Action Allow -Protocol TCP -RemoteAddress $RemoteAddress -RemotePort $RemotePort -Profile Any | Out-Null
}

function Ensure-InboundRule {
    param(
        [Parameter(Mandatory = $true)][string]$Name,
        [Parameter(Mandatory = $true)][string]$LocalPort
    )

    $rule = Get-NetFirewallRule -DisplayName $Name -ErrorAction SilentlyContinue
    if ($rule) {
        Remove-NetFirewallRule -DisplayName $Name -ErrorAction SilentlyContinue | Out-Null
    }

    New-NetFirewallRule -DisplayName $Name -Direction Inbound -Action Allow -Protocol TCP -LocalPort $LocalPort -Profile Any | Out-Null
}

Assert-Admin

# Saida para API FRH (TLS)
Ensure-OutboundRule -Name 'FRH TopdataBridge -> API 443' -RemoteAddress $FrhApiHost -RemotePort '443'

# Saida para o equipamento REP via SDK COM/TCP
Ensure-OutboundRule -Name 'FRH TopdataBridge -> REP 51000' -RemoteAddress $RepHost -RemotePort ([string]$RepPort)

if ($AllowBridgeInboundHealth) {
    # Opcional: somente se houver monitoramento remoto local do cliente.
    Ensure-InboundRule -Name 'FRH TopdataBridge Local Health 8085' -LocalPort '8085'
}

'=== FIREWALL BASELINE (CLIENT) ==='
Get-NetFirewallRule -Enabled True -Action Allow |
    Where-Object { $_.DisplayName -like 'FRH TopdataBridge*' } |
    ForEach-Object {
        $pf = Get-NetFirewallPortFilter -AssociatedNetFirewallRule $_ -ErrorAction SilentlyContinue
        $af = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $_ -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Name = $_.DisplayName
            Direction = $_.Direction
            LocalPort = if ($pf) { $pf.LocalPort } else { '' }
            RemotePort = if ($pf) { $pf.RemotePort } else { '' }
            RemoteAddress = if ($af) { $af.RemoteAddress } else { '' }
        }
    } |
    Sort-Object Direction, Name |
    Format-Table -AutoSize