plugins/CleverReach/Public/setup/install-crapp.ps1
|
<# Function Install-CleverReach { # Calling the function without parameters does the whole part # Calling with one of the Flags, just does this part [cmdletbinding()] param( [Parameter(Mandatory=$false)][Switch]$ScriptsOnly ,[Parameter(Mandatory=$false)][Switch]$ModulesOnly ,[Parameter(Mandatory=$false)][Switch]$PackagesOnly ) Begin { } Process { $success = $true $debug = $true $configMode = $true ################################################ # # START # ################################################ #----------------------------------------------- # ASK FOR SETTINGSFILE #----------------------------------------------- # Default file $settingsFileDefault = "$( $scriptPath )\settings.json" # Ask for another path $settingsFile = Read-Host -Prompt "Where do you want the settings file to be saved? Just press Enter for this default [$( $settingsFileDefault )]" # ALTERNATIVE: The file dialog is not working from Visual Studio Code, but is working from PowerShell ISE or "normal" PowerShell Console #$settingsFile = Set-FileName -initialDirectory "$( $scriptPath )" -filter "JSON files (*.json)|*.json" # If prompt is empty, just use default path if ( $settingsFile -eq "" -or $null -eq $settingsFile) { $settingsFile = $settingsFileDefault } # Check if filename is valid if(Test-Path -LiteralPath $settingsFile -IsValid ) { Write-Host "SettingsFile '$( $settingsFile )' is valid" } else { Write-Host "SettingsFile '$( $settingsFile )' contains invalid characters" } #----------------------------------------------- # ASK FOR LOGFILE #----------------------------------------------- # Default file $logfileDefault = "$( $scriptPath )\cr.log" # Ask for another path $logfile = Read-Host -Prompt "Where do you want the log file to be saved? Just press Enter for this default [$( $logfileDefault )]" # ALTERNATIVE: The file dialog is not working from Visual Studio Code, but is working from PowerShell ISE or "normal" PowerShell Console #$settingsFile = Set-FileName -initialDirectory "$( $scriptPath )" -filter "JSON files (*.json)|*.json" # If prompt is empty, just use default path if ( $logfile -eq "" -or $null -eq $logfile) { $logfile = $logfileDefault } # Check if filename is valid if(Test-Path -LiteralPath $logfile -IsValid ) { Write-Host "Logfile '$( $logfile )' is valid" } else { Write-Host "Logfile '$( $logfile )' contains invalid characters" } #----------------------------------------------- # ASK FOR TOKENFILE #----------------------------------------------- # Default file $tokenFileDefault = "$( $scriptPath )\cr.token" # Ask for another path $tokenFile = Read-Host -Prompt "Where do you want the token file to be saved? Just press Enter for this default [$( $tokenFileDefault )]" # ALTERNATIVE: The file dialog is not working from Visual Studio Code, but is working from PowerShell ISE or "normal" PowerShell Console #$settingsFile = Set-FileName -initialDirectory "$( $scriptPath )" -filter "JSON files (*.json)|*.json" # If prompt is empty, just use default path if ( $tokenFile -eq "" -or $null -eq $tokenFile) { $tokenFile = $tokenFileDefault } # Check if filename is valid if(Test-Path -LiteralPath $tokenFile -IsValid ) { Write-Host "SettingsFile '$( $tokenFile )' is valid" } else { Write-Host "SettingsFile '$( $tokenFile )' contains invalid characters" } #----------------------------------------------- # LOAD LOGGING MODULE NOW #----------------------------------------------- $settings = @{ "logfile" = $logfile } # Setup the log and do the initial logging e.g. for input parameters . ".\bin\startup_logging.ps1" #----------------------------------------------- # LOG THE NEW SETTINGS CREATION #----------------------------------------------- Write-Log -message "Creating a new settings file" -severity ( [Logseverity]::WARNING ) ################################################ # # OBTAIN CLEVERREACH TOKEN # ################################################ #----------------------------------------------- # CONFIRM FOR NEXT STEPS #----------------------------------------------- # Confirm you want to proceed $proceed = $Host.UI.PromptForChoice("New Token", "This will create a NEW token. Previous tokens will be invalid immediatly. Please confirm you are sure to proceed?", @('&Yes'; '&No'), 1) # Leave if answer is not yes If ( $proceed -eq 0 ) { Write-Log -message "Asked for confirmation of new token creation. Answer was 'yes'" } else { Write-Log -message "Asked for confirmation of new token creation. Answer was 'No'" Write-Log -message "Leaving the script now" exit 0 } #----------------------------------------------- # SETTINGS FOR THE TOKEN CREATION #----------------------------------------------- $customProtocol = "apttoken$( Get-RandomString -length 6 -noSpecialChars )" $clientId = "ssCNo32SNf" # Certified CleverReach App for Apteco $authUrl = [uri]"https://rest.cleverreach.com/oauth/authorize.php" $tokenUrl = [uri]"https://rest.cleverreach.com/oauth/token.php" $callbackFile = "$( $env:TEMP )\crcallback.txt" # This path is also used in the callback.ps1 script # Ask APTECO to enter the client secret Write-Log -message "Asking Apteco about the CleverReach App client secret" $clientSecret = Read-Host -AsSecureString "Please ask Apteco to enter the client secret" $clientCred = New-Object PSCredential $clientId,$clientSecret $clientSecret = "" #----------------------------------------------- # PREPARE REGISTRY #----------------------------------------------- # current path - will get back to this at the end $currentLocation = Get-Location # Switch to registry - choose the current user to not need admin rights $root = "Registry::HKEY_CURRENT_USER\Software\Classes" # User registry - needs no elevated rights # $root = "Registry::HKEY_CLASSES_ROOT" # Global registry - needs admin rights Write-Log -message "Putting new registry entries into '$( $root )' with custom protocol '$( $customProtocol )'" Set-Location -Path $root # Remove the registry entries, if already existing If ( Test-Path -path $customProtocol ) { Write-Log -message "Custom protocol folder was already existing. Removing it now." Remove-Item -Path $customProtocol -Force } # Create the base entries now New-Item -Path $customProtocol New-ItemProperty -Path $customProtocol -Name "(Default)" -PropertyType String -Value "URL:$( $customProtocol )" New-ItemProperty -Path $customProtocol -Name "URL Protocol" -PropertyType String -Value "" # Create more keys and properties for sub items Set-Location -Path ".\$( $customProtocol )" New-Item -Path ".\DefaultIcon" New-Item -Path ".\shell\open\command" -force # Creates the items recursively New-ItemProperty -Path ".\shell\open\command" -Name "(Default)" -PropertyType String -Value """powershell.exe"" -File ""$( $scriptPath )\bin\callback.ps1"" ""%1""" # Go back to original path Set-Location -path $currentLocation.Path Write-Log -message "Created the registry entries" #----------------------------------------------- # CLEVERREACH OAUTHv2 PROCESS - STEP 1 #----------------------------------------------- # Prepare redirect URI $redirectUri = "$( $customProtocol )://localhost" # The www.apteco.de is only there for cleverreach, otherwise the url would be invalid and not accepted # STEP 1: Prepare the first call to let the user log into cleverreach # SOURCE: https://powershellmagazine.com/2019/06/14/pstip-a-better-way-to-generate-http-query-strings-in-powershell/ $nvCollection = [System.Web.HttpUtility]::ParseQueryString([String]::Empty) $nvCollection.Add('response_type','code') $nvCollection.Add('client_id',$clientId) $nvCollection.Add('grant',"basic") $nvCollection.Add('redirect_uri', $redirectUri) # a dummy url like apteco.de is needed # Create the url $uriRequest = [System.UriBuilder]$authUrl $uriRequest.Query = $nvCollection.ToString() # Remove callback file if it exists If ( Test-Path -Path $callbackFile ) { "Removing callback file '$( $callbackFile )'" Remove-Item $callbackFile -Force } # Open the default browser with the generated url Write-Log -message "Opening the browser now to allow the CleverReach Apteco APP access to the account" Write-Log -message "Please finish the process in your browser now" Write-Log -message "NOTE:" Write-Log -message " APTECO WILL NOT GET ACCESS TO YOUR DATA THROUGH THE APP!" Write-Log -message " ONLY THIS LOCAL GENERATED TOKEN CAN BE USED FOR ACCESS!" Start-Process $uriRequest.Uri.OriginalString # Wait Write-Log -message "Waiting for the callback file '$( $callbackFile )'" Do { Write-Host "." -NoNewline Start-Sleep -Milliseconds 500 } Until ( Test-Path -Path $callbackFile ) Write-Log -message "Callback file found '$( $callbackFile )'" # Read and parse callback file $callback = Get-Content -Path $callbackFile -Encoding utf8 $callbackUri = [uri]$callback $callbackUriSegments = [System.Web.HttpUtility]::ParseQueryString($callbackUri.Query) $code = $callbackUriSegments["code"] # Remove callback file Write-Log -message "Removing callback file now" Remove-Item $callbackFile -Force #----------------------------------------------- # CLEVERREACH OAUTHv2 PROCESS - STEP 2 #----------------------------------------------- # Prepare the second call to exchange the code quickly for a token $postParams = [Hashtable]@{ Method = "Post" Uri = $tokenUrl Body = [Hashtable]@{ "client_id" = $clientCred.UserName "client_secret" = $clientCred.GetNetworkCredential().Password "redirect_uri" = $redirectUri "grant_type" = "authorization_code" "code" = $code } Verbose = $true } $response = Invoke-RestMethod @postParams Write-Log -message "Got a token with scope '$( $response.scope )'" # Trying an API call try { $headers = @{ "Authorization" = "Bearer $( $response.access_token )" } $ttl = Invoke-RestMethod -Uri "https://rest.cleverreach.com/v3/debug/ttl.json" -Method Get -ContentType "application/json; charset=utf-8" -Headers $headers Write-Log -message "Used token for API call successfully. Token expires at '$( $ttl.date.toString() )'" } catch { Write-Log -message "API call was not successful. Aborting the whole script now!" -severity ( [Logseverity]::WARNING ) throw $_.Exception } # Clear the variables straight away $clientCred = $null #----------------------------------------------- # HOUSEKEEPING OF REGISTRY #----------------------------------------------- Write-Log -message "Removing temporary registry entries" # Switch to root path of registry Set-Location -Path $root # Remove item now Remove-Item $customProtocol -Recurse # Go back to original path Set-Location -path $currentLocation.Path ################################################ # # SETTINGS # ################################################ $login = @{ "accesstoken" = Get-PlaintextToSecure $response.access_token "refreshtoken" = Get-PlaintextToSecure $response.refresh_token "refreshTokenAutomatically" = $true "refreshTtl" = 604800 # seconds; refresh one week before expiration } #----------------------------------------------- # MAIL SETTINGS #----------------------------------------------- $smtpPass = Read-Host -AsSecureString "Please enter the SMTP password" $smtpPassEncrypted = Get-PlaintextToSecure ((New-Object PSCredential "dummy",$smtpPass).GetNetworkCredential().Password) $mailSettings = @{ smptServer = "smtp.example.com" port = 587 from = "admin@example.com" username = "admin@example.com" password = $smtpPassEncrypted deactivateServerCertificateValidation = $true # $true|$false useSsl = $true # $true|$false useCredentials = $true # $true|$false -> sometimes you have mailservers without user/pass } #----------------------------------------------- # ALL SETTINGS #----------------------------------------------- $settings = @{ # general "base" = "https://rest.cleverreach.com/v3/" "connectionTestUrl" = "https://rest.cleverreach.com/v3/debug/validate.json" "providername" = "CleverReach" "logfile" = $logfile "contentType" = "application/json; charset=utf-8" # Token specific "tokenfile" = "$( $scriptPath )\cr.token" "sendMailOnCheck" = $true "sendMailOnSuccess" = $true "sendMailOnFailure" = $true "notificationReceiver" = "admin@example.com" # Windows scheduled task settings "taskDefaultName" = "Apteco CleverReach Token Refresher" "powershellExePath" = "powershell.exe" # e.g. use pwsh.exe for PowerShell7 "dailyTaskSchedule" = 6 # runs every day at 6 local time in the morning # Mail settings for notification "mail" = $mailSettings # authentication "login" = $login # network "changeTLS" = $true } ################################################ # # PACK TOGETHER SETTINGS AND SAVE AS JSON # ################################################ # rename settings file if it already exists If ( Test-Path -Path $settingsFile ) { $backupPath = "$( $settingsFile ).$( $timestamp.ToString("yyyyMMddHHmmss") )" Write-Log -message "Moving previous settings file to $( $backupPath )" -severity ( [Logseverity]::WARNING ) Move-Item -Path $settingsFile -Destination $backupPath } else { Write-Log -message "There was no settings file existing yet" } # create json object $json = $settings | ConvertTo-Json -Depth 99 # -compress # print settings to console $json # save settings to file $json | Set-Content -path $settingsFile -Encoding UTF8 ################################################ # # EXPORT THE TOKEN # ################################################ # save token to file Write-Log -message "Saving token to '$( $settings.tokenfile )'" Get-SecureToPlaintext -String $settings.login.accesstoken | Set-Content -path "$( $settings.tokenfile )" -Encoding UTF8 -Force ################################################ # # CREATE WINDOWS TASK # ################################################ # Confirm you want a scheduled task $createTask = $Host.UI.PromptForChoice("Confirmation", "Do you want to create a scheduled task for the check and refreshment?", @('&Yes'; '&No'), 0) If ( $createTask -eq "0" ) { # Means yes and proceed Write-Log -message "Creating a scheduled task to check the token daily" # Default file $taskNameDefault = $settings.taskDefaultName # Replace task? $replaceTask = $Host.UI.PromptForChoice("Replace Task", "Do you want to replace the existing task if it exists?", @('&Yes'; '&No'), 0) If ( $replaceTask -eq 0 ) { # Check if the task already exists $matchingTasks = Get-ScheduledTask | where { $_.TaskName -eq $taskName } If ( $matchingTasks.count -ge 1 ) { Write-Log -message "Removing the previous scheduled task for recreation" # To replace the task, remove it without confirmation Unregister-ScheduledTask -TaskName $taskNameDefault -Confirm:$false } # Set the task name to default $taskName = $taskNameDefault } else { # Ask for task name or use default value $taskName = Read-Host -Prompt "Which name should the task have? [$( $taskNameDefault )]" if ( $taskName -eq "" -or $null -eq $taskName) { $taskName = $taskNameDefault } } Write-Log -message "Using name '$( $taskName )' for the task" # TODO [ ] Find a reliable method for credentials testing # TODO [ ] Check if a user has BatchJobrights ##[System.Security.Principal.WindowsIdentity]::GrantUserLogonAsBatchJob # Enter username and password $taskCred = Get-Credential # Parameters for scheduled task $taskParams = [Hashtable]@{ TaskPath = "\Apteco\" TaskName = $taskname Description = "Refreshes the token for CleverReach because it is only valid for 30 days" Action = New-ScheduledTaskAction -Execute "$( $settings.powershellExePath )" -Argument "-ExecutionPolicy Bypass -File ""$( $scriptPath )\cleverreach__05__check_token.ps1""" #Principal = New-ScheduledTaskPrincipal -UserId $taskCred.Name -LogonType "ServiceAccount" # Using this one is always interactive mode and NOT running in the background Trigger = New-ScheduledTaskTrigger -at ([Datetime]::Today.AddDays(1).AddHours($settings.dailyTaskSchedule)) -Daily # Starting tomorrow at six in the morning Settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 3) -MultipleInstances "Parallel" # Max runtime of 3 minutes User = $taskCred.UserName Password = $taskCred.GetNetworkCredential().Password #AsJob = $true } # Create the scheduled task try { Write-Log -message "Creating the scheduled task now" $newTask = Register-ScheduledTask @taskParams #T1 -InputObject $task } catch { Write-Log -message "Creation of task failed or is not completed, please check your scheduled tasks and try again" throw $_.Exception } # Check the scheduled task $task = $newTask #Get-ScheduledTask | where { $_.TaskName -eq $taskName } $taskInfo = $task | Get-ScheduledTaskInfo Write-Host "Task with name '$( $task.TaskName )' in '$( $task.TaskPath )' was created" Write-Host "Next run '$( $taskInfo.NextRunTime.ToLocalTime().ToString() )' local time" # The task will only be created if valid. Make sure it was created successfully } Write-Log -message "Done with settings creation" ################################################ # # WAIT FOR KEY # ################################################ Write-Host -NoNewLine 'Press any key to continue...'; $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown'); } End { #----------------------------------------------- # FINISH #----------------------------------------------- If ( $success -eq $true ) { Write-Verbose -Message "All good. Installation finished!" #-Severity INFO } else { Write-Error -Message "There was a problem. Please check the output in this window and retry again." #-Severity ERROR } } } #> |