# --- ELEVAZIONE PRIVILEGI (UAC) ---
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    if ($PSCommandPath) {
        # Caso 1: Eseguito da un file .ps1 fisico
        Start-Process powershell.exe -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    } elseif ($MyInvocation.MyCommand.ScriptBlock) {
        # Caso 2: Eseguito in memoria (stile Massgravel: irm | iex)
        $ScriptContent = $MyInvocation.MyCommand.ScriptBlock.ToString()
        $Encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($ScriptContent))
        Start-Process powershell.exe -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -EncodedCommand $Encoded"
    } else {
        # Caso 3: Fallback d'emergenza (es. copia-incolla riga per riga in console limitata)
        Add-Type -AssemblyName System.Windows.Forms
        [System.Windows.Forms.MessageBox]::Show("Impossibile auto-elevare i permessi in questa modalità.`r`nApri PowerShell come Amministratore per eseguire questo script.", "Accesso Negato", "OK", "Warning")
    }
    exit
}

# --- CARICAMENTO GRAFICA ---
try {
    Add-Type -AssemblyName System.Windows.Forms
    Add-Type -AssemblyName System.Drawing
} catch {
    Write-Host "Errore critico caricamento grafica: $($_.Exception.Message)" -ForegroundColor Red
    Start-Sleep -Seconds 10
    exit
}

# --- LETTURA CONFIG ---
$Config = @{ Domain = "roncadelle.local"; RdpIP = "172.19.0.7" }
$ScriptPath = $PSScriptRoot
if ([string]::IsNullOrEmpty($ScriptPath)) { $ScriptPath = $PWD.Path }
$IniFile = Join-Path $ScriptPath "config.ini"

if (Test-Path $IniFile) {
    try {
        Get-Content $IniFile | ForEach-Object {
            if ($_ -match "=") {
                $parts = $_ -split "=", 2
                if ($Config.ContainsKey($parts[0].Trim())) { $Config[$parts[0].Trim()] = $parts[1].Trim() }
            }
        }
    } catch {}
}

# --- SETUP RETE E TEMP ---
# Forza TLS 1.2 e 1.3 tramite i valori numerici per il fallback .NET
[System.Net.ServicePointManager]::Expect100Continue = $true
[System.Net.ServicePointManager]::SecurityProtocol = 3072 -bor 12288 -bor 768 -bor 192
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

# User-agent finto (Chrome) per evitare blocchi
$UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"

$TempDir = "C:\TempInstall"
if (!(Test-Path $TempDir)) { New-Item -ItemType Directory -Force -Path $TempDir | Out-Null }

# --- FUNZIONI DI SUPPORTO ---
function Log-Gui {
    param([string]$Text, [string]$Color="Black")
    $rtbLog.SelectionStart = $rtbLog.Text.Length
    $rtbLog.SelectionColor = [System.Drawing.Color]::FromName($Color)
    $rtbLog.AppendText("[$((Get-Date).ToString('HH:mm:ss'))] $Text`r`n")
    $rtbLog.ScrollToCaret()
    [System.Windows.Forms.Application]::DoEvents()
}

function Wait-ProcessUI {
    param($Process)
    if ($null -eq $Process) { return $null }
    while (-not $Process.HasExited) {
        [System.Windows.Forms.Application]::DoEvents()
        Start-Sleep -Milliseconds 200
    }
    return $Process.ExitCode
}

# Download robusto usando curl nativo (bypass totale di Invoke-WebRequest e limiti .NET)
function Invoke-RobustDownload {
    param([string]$Url, [string]$OutFile)
    
    # Metodo 1: curl.exe nativo di Windows (Infallibile per TLS/Cipher)
    $curl = Get-Command "curl.exe" -ErrorAction SilentlyContinue
    if ($curl) {
        $args = @("-s", "-L", "-A", $UserAgent, "-o", $OutFile, $Url)
        $proc = Start-Process -FilePath "curl.exe" -ArgumentList $args -NoNewWindow -Wait -PassThru
        if ($proc.ExitCode -eq 0 -and (Test-Path $OutFile) -and ((Get-Item $OutFile).Length -gt 0)) { return $true }
    }

    # Metodo 2: Fallback su WebClient
    try {
        $wc = New-Object System.Net.WebClient
        $wc.Headers.Add("User-Agent", $UserAgent)
        $wc.DownloadFile($Url, $OutFile)
        if ((Test-Path $OutFile) -and ((Get-Item $OutFile).Length -gt 0)) { return $true }
    } catch {}

    # Metodo 3: Fallback finale su Invoke-WebRequest
    try {
        Invoke-WebRequest -Uri $Url -OutFile $OutFile -UseBasicParsing -UserAgent $UserAgent -ErrorAction Stop
        if ((Test-Path $OutFile) -and ((Get-Item $OutFile).Length -gt 0)) { return $true }
    } catch {}
    
    return $false
}

# Fetch testo robusto
function Get-RobustContent {
    param([string]$Url)
    $curl = Get-Command "curl.exe" -ErrorAction SilentlyContinue
    if ($curl) {
        try { 
            $output = & curl.exe -s -L -A $UserAgent $Url
            return $output -join "`n" 
        } catch {}
    }
    try { return (Invoke-WebRequest -Uri $Url -UseBasicParsing -UserAgent $UserAgent).Content } catch { return $null }
}

# Recupero dinamico link PDF24 dal changelog
function Get-Pdf24-Link {
    try {
        $ChangelogUrl = "https://creator.pdf24.org/changelog/en.html"
        $Content = Get-RobustContent -Url $ChangelogUrl
        if ($Content -match 'Version\s+(\d+\.\d+\.\d+)') {
            return "https://download.pdf24.org/pdf24-creator-$($matches[1])-x64.exe"
        }
        return $null
    } catch { return $null }
}

# Recupero dinamico link Kerio VPN Client dalle Release Notes
function Get-Kerio-Link {
    try {
        $Url = "https://www.gfi.com/products-and-solutions/network-security-solutions/kerio-control/release-notes"
        $Content = Get-RobustContent -Url $Url
        if ($Content -match 'Kerio Control\s+(\d+\.\d+\.\d+)\s+build\s+(\d+)') {
            $ver = $matches[1]
            $build = $matches[2]
            return "https://cdn.kerio.com/dwn/control/control-$ver-$build/kerio-control-vpnclient-$ver-$build-win64.msi"
        }
        return $null
    } catch { return $null }
}

# --- GUI ---
$form = New-Object System.Windows.Forms.Form
$form.Text = "Configurazione Workstation"
$form.Size = New-Object System.Drawing.Size(600, 950)
$form.StartPosition = "CenterScreen"
$form.FormBorderStyle = "FixedDialog"
$form.MaximizeBox = $false
$form.BackColor = [System.Drawing.Color]::WhiteSmoke

# SEZIONE 1
$gbDomain = New-Object System.Windows.Forms.GroupBox
$gbDomain.Location = New-Object System.Drawing.Point(10, 10); $gbDomain.Size = New-Object System.Drawing.Size(560, 145); $gbDomain.Text = "1. Configurazione Nome, Dominio e Utente"

$chkJoin = New-Object System.Windows.Forms.CheckBox
$chkJoin.Text = "Rinomina PC e Unisci al Dominio"; $chkJoin.Location = New-Object System.Drawing.Point(20, 25); $chkJoin.Size = New-Object System.Drawing.Size(200, 20)

$lblPCName = New-Object System.Windows.Forms.Label; $lblPCName.Text = "Nuovo Nome:"; $lblPCName.Location = New-Object System.Drawing.Point(20, 55); $lblPCName.Size = New-Object System.Drawing.Size(80, 20)
$txtPCName = New-Object System.Windows.Forms.TextBox; $txtPCName.Location = New-Object System.Drawing.Point(100, 52); $txtPCName.Size = New-Object System.Drawing.Size(120, 20)

$lblDomain = New-Object System.Windows.Forms.Label; $lblDomain.Text = "Dominio:"; $lblDomain.Location = New-Object System.Drawing.Point(240, 55); $lblDomain.Size = New-Object System.Drawing.Size(60, 20)
$txtDomain = New-Object System.Windows.Forms.TextBox; $txtDomain.Location = New-Object System.Drawing.Point(300, 52); $txtDomain.Size = New-Object System.Drawing.Size(150, 20); $txtDomain.Text = $Config["Domain"]

# Nuovi campi per la password utente locale
$chkLocalPwd = New-Object System.Windows.Forms.CheckBox
$chkLocalPwd.Text = "Imposta Password Utente Locale"; $chkLocalPwd.Location = New-Object System.Drawing.Point(20, 85); $chkLocalPwd.Size = New-Object System.Drawing.Size(250, 20)

$lblLocalUser = New-Object System.Windows.Forms.Label; $lblLocalUser.Text = "Utente:"; $lblLocalUser.Location = New-Object System.Drawing.Point(20, 115); $lblLocalUser.Size = New-Object System.Drawing.Size(50, 20)
$txtLocalUser = New-Object System.Windows.Forms.TextBox; $txtLocalUser.Location = New-Object System.Drawing.Point(70, 112); $txtLocalUser.Size = New-Object System.Drawing.Size(100, 20); $txtLocalUser.Text = $env:USERNAME

$lblLocalPwd = New-Object System.Windows.Forms.Label; $lblLocalPwd.Text = "Password:"; $lblLocalPwd.Location = New-Object System.Drawing.Point(180, 115); $lblLocalPwd.Size = New-Object System.Drawing.Size(65, 20)
$txtLocalPwd = New-Object System.Windows.Forms.TextBox; $txtLocalPwd.Location = New-Object System.Drawing.Point(245, 112); $txtLocalPwd.Size = New-Object System.Drawing.Size(130, 20); $txtLocalPwd.PasswordChar = '*'

$gbDomain.Controls.AddRange(@($chkJoin, $lblPCName, $txtPCName, $lblDomain, $txtDomain, $chkLocalPwd, $lblLocalUser, $txtLocalUser, $lblLocalPwd, $txtLocalPwd))

# SEZIONE 2 (Layout riorganizzato a 3 colonne)
$gbSoft = New-Object System.Windows.Forms.GroupBox
$gbSoft.Location = New-Object System.Drawing.Point(10, 165); $gbSoft.Size = New-Object System.Drawing.Size(560, 215); $gbSoft.Text = "2. Selezione Software"

function New-AppChk ($ParentGroup, $name, $x, $y, $tag) {
    $c = New-Object System.Windows.Forms.CheckBox
    $c.Text = $name; $c.Location = New-Object System.Drawing.Point($x, $y); $c.Size = New-Object System.Drawing.Size(170, 20); $c.Checked = $true; $c.Tag = $tag 
    $ParentGroup.Controls.Add($c)
}

# Colonna 1 (Browser e Utility Base)
New-AppChk $gbSoft "Google Chrome" 20 25 @{Type="Winget"; Id="Google.Chrome"; Path="$env:ProgramFiles\Google\Chrome\Application\chrome.exe"}
New-AppChk $gbSoft "Mozilla Firefox" 20 50 @{Type="Url"; Url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=it"; Name="firefox.exe"; Args="-ms"; Path="$env:ProgramFiles\Mozilla Firefox\firefox.exe"}
New-AppChk $gbSoft "Adobe Acrobat Reader" 20 75 @{Type="Winget"; Id="Adobe.Acrobat.Reader.64-bit"; Path="$env:ProgramFiles\Adobe\Acrobat DC\Acrobat\Acrobat.exe"}
New-AppChk $gbSoft "WinRAR" 20 100 @{Type="Winget"; Id="RARLab.WinRAR"; Path="$env:ProgramFiles\WinRAR\WinRAR.exe"}
New-AppChk $gbSoft "LibreOffice" 20 125 @{Type="Winget"; Id="TheDocumentFoundation.LibreOffice"; Path="$env:ProgramFiles\LibreOffice\program\soffice.exe"}
New-AppChk $gbSoft "K-Lite Codecs" 20 150 @{Type="Winget"; Id="CodecGuide.K-LiteCodecPack.Full"; Path="$env:ProgramFiles\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe"}

# Colonna 2 (Strumenti di Lavoro)
New-AppChk $gbSoft "AnyDesk" 200 25 @{Type="Url"; Url="https://download.anydesk.com/AnyDesk.exe"; Name="anydesk.exe"; Args="--install `"${env:ProgramFiles(x86)}\AnyDesk`" --start-with-win --silent"; Path="${env:ProgramFiles(x86)}\AnyDesk\AnyDesk.exe"}
New-AppChk $gbSoft "PDF24 Creator" 200 50 @{Type="Url"; Url="https://download.pdf24.org/pdf24-creator-installer.exe"; Name="pdf24.exe"; Args="/VERYSILENT /NORESTART"; Path="$env:ProgramFiles\PDF24\pdf24.exe"}
New-AppChk $gbSoft "Java 8u181" 200 75 @{Type="Url"; Url="https://base.crabinformatica.it/java.exe"; Name="java.exe"; Args="/s"; Path="${env:ProgramFiles(x86)}\Java\jre1.8.0_181\bin\java.exe"}
New-AppChk $gbSoft "Kerio VPN Client" 200 100 @{Type="Url"; Url="https://cdn.kerio.com/dwn/control/control-9.6.0-9189/kerio-control-vpnclient-9.6.0-9189-win64.msi"; Name="kerio.msi"; Args="/qn /norestart"; Path="${env:ProgramFiles}\Kerio\VPN Client\kvpncsvc.exe"}
New-AppChk $gbSoft "OpenVPN Connect" 200 125 @{Type="Url"; Url="https://base.crabinformatica.it/openvpn.msi"; Name="openvpn.msi"; Args="/qn /norestart"; Path="${env:ProgramFiles}\OpenVPN Connect\OpenVPNConnect.exe"}
New-AppChk $gbSoft "ArubaSign" 200 150 @{Type="Url"; Url="https://updatesfirma.aruba.it/downloads/ArubaSign-latest(standard).msi"; Name="arubasign.msi"; Args="ALLUSERS=1 /qn /norestart"; Path="${env:ProgramFiles}\ArubaSign\ArubaSign.exe"}

# Colonna 3 (Driver Smartcard)
New-AppChk $gbSoft "Driver Bit4ID" 380 25 @{Type="Driver"; Url="https://base.crabinformatica.it/bit4id.exe"; Name="bit4id"; Args="/S"}
New-AppChk $gbSoft "Driver Cyberneid" 380 50 @{Type="Driver"; Url="https://base.crabinformatica.it/cyber.exe"; Name="cyber"; Args="/S"}
New-AppChk $gbSoft "Driver SafeDive" 380 75 @{Type="Driver"; Url="https://base.crabinformatica.it/safedive.exe"; Name="safedive"; Args="/VERYSILENT /SUPPRESSMSGBOXES /NORESTART"}

$btnSelAll = New-Object System.Windows.Forms.Button; $btnSelAll.Text = "Tutti"; $btnSelAll.Location = New-Object System.Drawing.Point(20, 180); $btnSelAll.Size = New-Object System.Drawing.Size(60, 25)
$btnSelAll.Add_Click({ $gbSoft.Controls | Where-Object { $_ -is [System.Windows.Forms.CheckBox] } | ForEach-Object { $_.Checked = $true } })
$gbSoft.Controls.Add($btnSelAll)

$btnDeSel = New-Object System.Windows.Forms.Button; $btnDeSel.Text = "Nessuno"; $btnDeSel.Location = New-Object System.Drawing.Point(90, 180); $btnDeSel.Size = New-Object System.Drawing.Size(60, 25)
$btnDeSel.Add_Click({ $gbSoft.Controls | Where-Object { $_ -is [System.Windows.Forms.CheckBox] } | ForEach-Object { $_.Checked = $false } })
$gbSoft.Controls.Add($btnDeSel)

# SEZIONE 3
$gbMisc = New-Object System.Windows.Forms.GroupBox
$gbMisc.Location = New-Object System.Drawing.Point(10, 390); $gbMisc.Size = New-Object System.Drawing.Size(560, 140); $gbMisc.Text = "3. Opzioni Varie & Desktop Remoto"

$chkRdp = New-Object System.Windows.Forms.CheckBox; $chkRdp.Text = "Crea collegamento RDP Desktop"; $chkRdp.Location = New-Object System.Drawing.Point(20, 25); $chkRdp.Size = New-Object System.Drawing.Size(200, 20); $chkRdp.Checked = $true
$lblRdpIP = New-Object System.Windows.Forms.Label; $lblRdpIP.Text = "IP Server:"; $lblRdpIP.Location = New-Object System.Drawing.Point(40, 50); $lblRdpIP.Size = New-Object System.Drawing.Size(60, 20)
$txtRdpIP = New-Object System.Windows.Forms.TextBox; $txtRdpIP.Location = New-Object System.Drawing.Point(100, 47); $txtRdpIP.Size = New-Object System.Drawing.Size(100, 20); $txtRdpIP.Text = $Config["RdpIP"]

$chkOfficeScrub = New-Object System.Windows.Forms.CheckBox; $chkOfficeScrub.Text = "Esegui Office Scrubber (GitHub)"; $chkOfficeScrub.Location = New-Object System.Drawing.Point(20, 80); $chkOfficeScrub.Size = New-Object System.Drawing.Size(250, 20); $chkOfficeScrub.Checked = $false

$chkFastBoot = New-Object System.Windows.Forms.CheckBox; $chkFastBoot.Text = "Disabilita Avvio Rapido"; $chkFastBoot.Location = New-Object System.Drawing.Point(280, 25); $chkFastBoot.Size = New-Object System.Drawing.Size(200, 20); $chkFastBoot.Checked = $true
$chkNoOneDrive = New-Object System.Windows.Forms.CheckBox; $chkNoOneDrive.Text = "Disabilita OneDrive (TUTTI UTENTI)"; $chkNoOneDrive.Location = New-Object System.Drawing.Point(280, 50); $chkNoOneDrive.Size = New-Object System.Drawing.Size(250, 20); $chkNoOneDrive.Checked = $true
$chkPhotoViewer = New-Object System.Windows.Forms.CheckBox; $chkPhotoViewer.Text = "Ripristina Visualizzatore Foto Classico"; $chkPhotoViewer.Location = New-Object System.Drawing.Point(280, 75); $chkPhotoViewer.Size = New-Object System.Drawing.Size(250, 20); $chkPhotoViewer.Checked = $true

$gbMisc.Controls.AddRange(@($chkRdp, $lblRdpIP, $txtRdpIP, $chkOfficeScrub, $chkFastBoot, $chkNoOneDrive, $chkPhotoViewer))

# AVVIO
$btnRun = New-Object System.Windows.Forms.Button
$btnRun.Text = "AVVIA PROCEDURA"
$btnRun.Font = New-Object System.Drawing.Font("Arial", 12, [System.Drawing.FontStyle]::Bold)
$btnRun.Location = New-Object System.Drawing.Point(10, 540)
$btnRun.Size = New-Object System.Drawing.Size(560, 40)
$btnRun.BackColor = [System.Drawing.Color]::LightGreen

$rtbLog = New-Object System.Windows.Forms.RichTextBox
$rtbLog.Location = New-Object System.Drawing.Point(10, 590); $rtbLog.Size = New-Object System.Drawing.Size(560, 230); $rtbLog.ReadOnly = $true; $rtbLog.Font = New-Object System.Drawing.Font("Consolas", 9); $rtbLog.BackColor = [System.Drawing.Color]::Black; $rtbLog.ForeColor = [System.Drawing.Color]::White

# Ripristinata altezza Form ideale per layout compatto
$form.Size = New-Object System.Drawing.Size(600, 870)

$btnRun.Add_Click({
    $btnRun.Enabled = $false; $btnRun.Text = "In Esecuzione..."; Log-Gui "--- START ---" "Cyan"

    try {
        # --- FASE 1: DOMINIO E UTENTI ---
        if ($chkJoin.Checked) {
            $dom = $txtDomain.Text; $newname = $txtPCName.Text
            Log-Gui "Inizio operazione Dominio..." "Yellow"
            try {
                $form.Hide()
                $creds = Get-Credential -Message "Admin Dominio per $dom"
                
                if ($newname) { 
                    Add-Computer -DomainName $dom -Credential $creds -NewName $newname -Force -ErrorAction Stop
                    Log-Gui "Join Dominio + Rename completato. (Richiesto Riavvio)" "Green" 
                } else { 
                    Add-Computer -DomainName $dom -Credential $creds -Force -ErrorAction Stop
                    Log-Gui "Join Dominio completato. (Richiesto Riavvio)" "Green" 
                }
            } catch { 
                Log-Gui "ERRORE Dominio: $($_.Exception.Message)" "Red" 
            } finally {
                $form.Show()
            }
        }

        # Impostazione Password Utente Locale
        if ($chkLocalPwd.Checked) {
            $locUser = $txtLocalUser.Text
            $locPwd = $txtLocalPwd.Text
            if (-not [string]::IsNullOrWhiteSpace($locUser) -and -not [string]::IsNullOrWhiteSpace($locPwd)) {
                Log-Gui "Impostazione password per l'utente locale '$locUser'..." "Yellow"
                try {
                    $SecurePwd = ConvertTo-SecureString $locPwd -AsPlainText -Force
                    $UserAccount = Get-LocalUser -Name $locUser -ErrorAction Stop
                    $UserAccount | Set-LocalUser -Password $SecurePwd -ErrorAction Stop
                    Log-Gui "Password dell'utente '$locUser' impostata correttamente." "Green"
                } catch {
                    Log-Gui "Errore impostazione password: $($_.Exception.Message)" "Red"
                }
            } else {
                Log-Gui "Avviso: Impossibile impostare password, campi vuoti." "Yellow"
            }
        }

        # --- FASE 2: SOFTWARE ---
        $selectedApps = @($gbSoft.Controls | Where-Object { $_ -is [System.Windows.Forms.CheckBox] -and $_.Checked })
        
        foreach ($chk in $selectedApps) {
            $data = $chk.Tag; if (!$data) {continue}
            
            # Forziamo le app che non controlliamo per Path in modo da aggiornarle
            $forceInstall = ("AnyDesk", "PDF24 Creator", "Kerio VPN Client", "ArubaSign") -contains $chk.Text
            if (-not $forceInstall -and $data.Type -ne "Driver" -and $data.Path -and (Test-Path $data.Path)) { 
                Log-Gui "$($chk.Text) gia presente, salto." "Green"; continue 
            }
            
            Log-Gui "Installazione $($chk.Text)..." "Yellow"

            # Determiniamo l'URL finale (Dinamico se possibile)
            $installUrl = $data.Url
            if ($chk.Text -eq "PDF24 Creator") {
                Log-Gui " -> Recupero ultima versione PDF24..." "Yellow"
                $dynamicUrl = Get-Pdf24-Link
                if ($dynamicUrl) { $installUrl = $dynamicUrl }
            }
            elseif ($chk.Text -eq "Kerio VPN Client") {
                Log-Gui " -> Recupero ultima versione Kerio..." "Yellow"
                $dynamicUrl = Get-Kerio-Link
                if ($dynamicUrl) { $installUrl = $dynamicUrl }
                Stop-Process -Name "kvpnc*" -Force -ErrorAction SilentlyContinue
            }

            if ($chk.Text -eq "AnyDesk") {
                Stop-Process -Name "AnyDesk" -Force -ErrorAction SilentlyContinue
                Start-Sleep -Seconds 1
            }

            try {
                if ($data.Type -eq "Winget") {
                    $wingetArgs = "install --id $($data.Id) --exact --source winget --silent --accept-package-agreements --accept-source-agreements --force"
                    if ($data.Args) { $wingetArgs += " " + $data.Args }
                    
                    $proc = Start-Process -FilePath "winget" -ArgumentList $wingetArgs -NoNewWindow -PassThru -ErrorAction Stop
                    $exitCode = Wait-ProcessUI $proc
                    if ($null -eq $exitCode -or $exitCode -eq 0) { Log-Gui " -> OK Winget." "Green" } else { Log-Gui " -> Concluso (Codice: $exitCode)" "Yellow" }
                    
                } elseif ($data.Type -eq "Url" -or $data.Type -eq "Driver") {
                    $destName = if ($data.Type -eq "Driver") { "$($data.Name).exe" } else { $data.Name }
                    $dest = Join-Path $TempDir $destName
                    
                    Log-Gui " -> Download in corso..." "Yellow"
                    
                    # Usa la nuova funzione robusta che non soffre del bug TLS!
                    $dlSuccess = Invoke-RobustDownload -Url $installUrl -OutFile $dest
                    
                    if (-not $dlSuccess) {
                        throw "Download fallito. Il server potrebbe essere irraggiungibile o rifiutare la connessione."
                    }
                    
                    if ($data.Type -eq "Url") {
                        if ($dest.EndsWith(".msi", [System.StringComparison]::OrdinalIgnoreCase)) {
                            $proc = Start-Process -FilePath "msiexec.exe" -ArgumentList "/i `"$dest`" $($data.Args)" -PassThru -ErrorAction Stop
                        } else {
                            $proc = Start-Process -FilePath $dest -ArgumentList $data.Args -PassThru -ErrorAction Stop
                        }
                    } else {
                        $driverArgs = if ($data.Args) { $data.Args } else { "/S" }
                        $proc = Start-Process -FilePath $dest -ArgumentList $driverArgs -PassThru -ErrorAction Stop
                    }
                    
                    $exitCode = Wait-ProcessUI $proc
                    if ($null -eq $exitCode -or $exitCode -eq 0) { Log-Gui " -> Esecuzione terminata." "Green" } else { Log-Gui " -> Concluso (Codice: $exitCode)" "Yellow" }
                }
            } catch { Log-Gui " -> ERRORE: $($_.Exception.Message)" "Red" }

            # --- AZIONI POST-INSTALLAZIONE SPECIFICHE ---
            if ($chk.Text -eq "AnyDesk" -and (Test-Path $data.Path)) {
                try {
                    $WshShell = New-Object -comObject WScript.Shell
                    $Shortcut = $WshShell.CreateShortcut("$env:PUBLIC\Desktop\AnyDesk.lnk")
                    $Shortcut.TargetPath = $data.Path
                    $Shortcut.Save()
                    Log-Gui " -> Collegamento AnyDesk creato sul Desktop." "Green"
                } catch {
                    Log-Gui " -> Errore creazione collegamento AnyDesk: $($_.Exception.Message)" "Red"
                }
            }
        }

        # --- FASE 3: MISC ---
        if ($chkOfficeScrub.Checked) {
            Log-Gui "Download ed esecuzione Office Scrubber..." "Yellow"
            try {
                $scrubberUrl = "https://raw.githubusercontent.com/abbodi1406/BatUtil/master/OfficeScrubber/OfficeScrubberAIO.cmd"
                $scrubberPath = Join-Path $TempDir "OfficeScrubberAIO.cmd"
                
                $dlSuccess = Invoke-RobustDownload -Url $scrubberUrl -OutFile $scrubberPath
                if (-not $dlSuccess) { throw "Download Scrubber fallito." }
                
                $proc = Start-Process -FilePath "cmd.exe" -ArgumentList "/c `"$scrubberPath`"" -PassThru -ErrorAction Stop
                $exitCode = Wait-ProcessUI $proc
                Log-Gui "Office Scrubber terminato (Codice: $exitCode)." "Green"
            } catch { 
                Log-Gui "Errore Office Scrubber: $($_.Exception.Message)" "Red" 
            }
        }

        if ($chkRdp.Checked) {
            Log-Gui "Creazione RDP in corso..." "Yellow"
            try {
                $tip = if ([string]::IsNullOrWhiteSpace($txtRdpIP.Text)) { "172.19.0.7" } else { $txtRdpIP.Text }
                $rdpPath = "$env:PUBLIC\Desktop\ServerTs.rdp"
                $rdpContent = "full address:s:$tip`r`nredirectprinters:i:0`r`nredirectclipboard:i:1`r`nauthentication level:i:2"
                [System.IO.File]::WriteAllText($rdpPath, $rdpContent, [System.Text.Encoding]::UTF8)
                Log-Gui "RDP Creato in Desktop Pubblico ($tip)." "Green"
            } catch { Log-Gui "Errore RDP: $($_.Exception.Message)" "Red" }
        }

        if ($chkFastBoot.Checked) {
            try { 
                Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" -Name "HiberbootEnabled" -Value 0 -Type DWord -ErrorAction Stop
                Log-Gui "FastBoot Disabilitato." "Green" 
            } catch { Log-Gui "Errore FastBoot: $($_.Exception.Message)" "Red" }
        }

        if ($chkNoOneDrive.Checked) {
            Log-Gui "Blocco OneDrive per tutto il PC..." "Yellow"
            try {
                $policyKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive"
                if (!(Test-Path $policyKey)) { New-Item -Path $policyKey -Force | Out-Null }
                Set-ItemProperty -Path $policyKey -Name "DisableFileSyncNGSC" -Value 1 -Type DWord -Force -ErrorAction Stop
                Log-Gui "OneDrive Bloccato (GPO Locale)." "Green"
            } catch { Log-Gui "Errore Blocco OneDrive: $($_.Exception.Message)" "Red" }
        }

        if ($chkPhotoViewer.Checked) {
            Log-Gui "Ripristino Foto..." "Yellow"
            try {
                $Exts = @(".jpg", ".jpeg", ".png", ".bmp", ".tif", ".tiff")
                foreach ($ext in $Exts) {
                     New-Item -Path "HKCR\$ext" -Force | Out-Null
                     Set-ItemProperty -Path "HKCR\$ext" -Name "(Default)" -Value "PhotoViewer.FileAssoc.Tiff" -ErrorAction SilentlyContinue
                }
                New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" -Force | Out-Null
                foreach ($ext in $Exts) {
                    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" -Name $ext -Value "PhotoViewer.FileAssoc.Tiff"
                }
                Log-Gui "Chiavi Registro Visualizzatore Inserite." "Green"
            } catch { Log-Gui "Errore PhotoViewer: $($_.Exception.Message)" "Red" }
        }

    } finally {
        Start-Sleep -Seconds 2
        try { Remove-Item -Path $TempDir -Recurse -Force -ErrorAction SilentlyContinue } catch { Log-Gui "Avviso: Impossibile svuotare Temp." "Yellow" }
        Log-Gui "--- PROCEDURA COMPLETATA ---" "Cyan"
        $btnRun.Text = "COMPLETATO"
        $btnRun.BackColor = [System.Drawing.Color]::LightGray
        [System.Windows.Forms.MessageBox]::Show("Configurazione terminata con successo! Riavvia il PC.", "Info", "OK", "Information")
    }
})

$form.Controls.AddRange(@($gbDomain, $gbSoft, $gbMisc, $btnRun, $rtbLog))
$form.ShowDialog() | Out-Null