param(
    [switch]$ResetPrusa,
    [switch]$ClearOnLogout,
    [string]$TargetUser,
    [string]$Material = "PLA"
)

# Makerspace Manager
# Version: 2.0.0
# Build Date: 13/09/2026 21:27

$SCRIPT_VERSION = "2.0.0"

$global:policiesJson = @'
[
  {
    "id": "chkReg",
    "name": "Registry Editor",
    "category": "System",
    "description": "Prevents users from launching regedit.exe or modifying system registry settings.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
        "name": "DisableRegistryTools",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkControl",
    "name": "Settings & Control Panel",
    "category": "System",
    "description": "Prevents users from accessing Windows Settings app and Control Panel.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "name": "NoControlPanel",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkInstall",
    "name": ".MSI Software Installations",
    "category": "System",
    "description": "Blocks installation of MSI software packages.",
    "keys": [
      {
        "path": "Software\\Policies\\Microsoft\\Windows\\Installer",
        "name": "DisableMSI",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkCmd",
    "name": "Command Line (CMD/PS/Terminal)",
    "category": "System",
    "description": "Blocks Command Prompt, PowerShell, and Windows Terminal.",
    "keys": [
      {
        "path": "Software\\Policies\\Microsoft\\Windows\\System",
        "name": "DisableCMD",
        "type": "DWord",
        "value": 2
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "name": "DisallowRun",
        "type": "DWord",
        "value": 1
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "1",
        "type": "String",
        "value": "powershell.exe"
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "2",
        "type": "String",
        "value": "pwsh.exe"
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "3",
        "type": "String",
        "value": "wt.exe"
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "4",
        "type": "String",
        "value": "cmd.exe"
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "5",
        "type": "String",
        "value": "WindowsTerminal.exe"
      }
    ]
  },
  {
    "id": "chkTaskMgr",
    "name": "Task Manager",
    "category": "System",
    "description": "Disables Task Manager (Ctrl+Shift+Esc / Ctrl+Alt+Del).",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
        "name": "DisableTaskMgr",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkNoDisp",
    "name": "Display Settings",
    "category": "System",
    "description": "Prevents changing display resolution and monitor options.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
        "name": "NoDispCPL",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkAdminTools",
    "name": "Administrator Tools (MMC/EventVwr)",
    "category": "System",
    "description": "Blocks MMC consoles, Event Viewer, and administrative utilities.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "name": "DisallowRun",
        "type": "DWord",
        "value": 1
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "10",
        "type": "String",
        "value": "mmc.exe"
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "11",
        "type": "String",
        "value": "eventvwr.exe"
      },
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun",
        "name": "12",
        "type": "String",
        "value": "eventvwr.msc"
      }
    ]
  },
  {
    "id": "chkNoRun",
    "name": "Run Command (Win+R)",
    "category": "Explorer",
    "description": "Removes the Run option from Start menu and disables Win+R shortcut.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "name": "NoRun",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkNoWallpaper",
    "name": "Desktop Wallpaper",
    "category": "Explorer",
    "description": "Locks desktop background and prevents user customization.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop",
        "name": "NoChangingWallPaper",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkClearRecent",
    "name": "Clear Recent Docs on Exit",
    "category": "Explorer",
    "description": "Automatically purges recent file list when the user logs off.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "name": "ClearRecentDocsOnExit",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkTaskbar",
    "name": "Taskbar Settings",
    "category": "Explorer",
    "description": "Prevents rearranging taskbar items or changing taskbar properties.",
    "keys": [
      {
        "path": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "name": "LockTaskbar",
        "type": "DWord",
        "value": 1
      }
    ]
  },
  {
    "id": "chkEdgePrivate",
    "name": "Private Browsing Mode (Edge/Chrome)",
    "category": "Browser",
    "description": "Forces Edge and Chrome to operate exclusively in Incognito/InPrivate mode.",
    "keys": [
      {
        "path": "Software\\Policies\\Microsoft\\Edge",
        "name": "InPrivateModeAvailability",
        "type": "DWord",
        "value": 2
      },
      {
        "path": "Software\\Policies\\Google\\Chrome",
        "name": "IncognitoModeAvailability",
        "type": "DWord",
        "value": 2
      }
    ]
  },
  {
    "id": "chkEdgeFav",
    "name": "Browser Favorites & Bookmarks",
    "category": "Browser",
    "description": "Prevents users from adding, editing, or deleting browser bookmarks.",
    "keys": [
      {
        "path": "Software\\Policies\\Microsoft\\Edge",
        "name": "EditFavoritesEnabled",
        "type": "DWord",
        "value": 0
      },
      {
        "path": "Software\\Policies\\Google\\Chrome",
        "name": "EditBookmarksEnabled",
        "type": "DWord",
        "value": 0
      }
    ]
  }
]
'@

$global:presetsJson = @'
{
    "makerspace":  {
                       "name":  "Makerspace",
                       "description":  "Standard lockdown for 3D printing, laser, and design stations. Blocks system settings, CMD, and admin tools while allowing USB file transfer.",
                       "policies":  [
                                        "chkReg",
                                        "chkControl",
                                        "chkInstall",
                                        "chkCmd",
                                        "chkTaskMgr",
                                        "chkNoDisp",
                                        "chkAdminTools",
                                        "chkNoRun",
                                        "chkNoWallpaper",
                                        "chkClearRecent",
                                        "chkTaskbar",
                                        "chkEdgePrivate",
                                        "chkEdgeFav"
                                    ]
                   },
    "gaming":  {
                   "name":  "Gaming",
                   "description":  "Protection for gaming stations. Blocks system settings, regedit, CMD, and installers, but leaves Task Manager open for frozen games and browser logins.",
                   "policies":  [
                                    "chkReg",
                                    "chkControl",
                                    "chkInstall",
                                    "chkCmd",
                                    "chkAdminTools",
                                    "chkNoRun",
                                    "chkNoDisp"
                                ]
               }
}
'@

$xaml = @'
<Window xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
        Title="Makerspace Manager" Height="680" Width="530" 
        WindowStartupLocation="CenterScreen" Topmost="False" ResizeMode="CanResize"
        Background="#1E1E1E" Foreground="#E0E0E0">
    <Window.Resources>
        <!-- Dark Popup Brushes for ComboBox Dropdowns -->
        <SolidColorBrush x:Key="{x:Static SystemColors.WindowBrushKey}" Color="#252525" />
        <SolidColorBrush x:Key="{x:Static SystemColors.WindowTextBrushKey}" Color="#FFFFFF" />
        <SolidColorBrush x:Key="{x:Static SystemColors.HighlightBrushKey}" Color="#0063B1" />
        <SolidColorBrush x:Key="{x:Static SystemColors.HighlightTextBrushKey}" Color="#FFFFFF" />

        <Style TargetType="TextBlock">
            <Setter Property="FontFamily" Value="Segoe UI"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>

        <Style TargetType="CheckBox">
            <Setter Property="Margin" Value="0,5"/>
            <Setter Property="FontSize" Value="13"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>

        <Style TargetType="RadioButton">
            <Setter Property="FontSize" Value="14"/>
            <Setter Property="FontWeight" Value="SemiBold"/>
            <Setter Property="Margin" Value="10,0"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>

        <Style TargetType="GroupBox">
            <Setter Property="Foreground" Value="#FFFFFF"/>
            <Setter Property="FontWeight" Value="Bold"/>
            <Setter Property="BorderBrush" Value="#444444"/>
            <Setter Property="Margin" Value="0,0,0,10"/>
            <Setter Property="Padding" Value="10"/>
        </Style>

        <Style TargetType="TextBox">
             <Setter Property="Background" Value="#252525"/>
             <Setter Property="Foreground" Value="#FFFFFF"/>
             <Setter Property="BorderBrush" Value="#404040"/>
             <Setter Property="BorderThickness" Value="1"/>
             <Setter Property="Padding" Value="6,4"/>
             <Setter Property="CaretBrush" Value="#0063B1"/>
             <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="TextBox">
                        <Border Name="Border" Background="{TemplateBinding Background}" BorderBrush="{TemplateBinding BorderBrush}" BorderThickness="1" CornerRadius="4">
                            <ScrollViewer x:Name="PART_ContentHost" />
                        </Border>
                    </ControlTemplate>
                </Setter.Value>
             </Setter>
        </Style>

        <!-- Dark ComboBox Item Template -->
        <Style TargetType="ComboBoxItem">
            <Setter Property="Background" Value="#252525"/>
            <Setter Property="Foreground" Value="#FFFFFF"/>
            <Setter Property="Padding" Value="8,5"/>
            <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="ComboBoxItem">
                        <Border Name="ItemBorder" Background="{TemplateBinding Background}" Padding="{TemplateBinding Padding}" CornerRadius="2">
                            <ContentPresenter />
                        </Border>
                        <ControlTemplate.Triggers>
                            <Trigger Property="IsMouseOver" Value="True">
                                <Setter TargetName="ItemBorder" Property="Background" Value="#0063B1"/>
                                <Setter Property="Foreground" Value="#FFFFFF"/>
                            </Trigger>
                            <Trigger Property="IsSelected" Value="True">
                                <Setter TargetName="ItemBorder" Property="Background" Value="#0063B1"/>
                                <Setter Property="Foreground" Value="#FFFFFF"/>
                            </Trigger>
                        </ControlTemplate.Triggers>
                    </ControlTemplate>
                </Setter.Value>
            </Setter>
        </Style>

        <!-- Dark ComboBox Template -->
        <Style TargetType="ComboBox">
            <Setter Property="Background" Value="#252525"/>
            <Setter Property="Foreground" Value="#FFFFFF"/>
            <Setter Property="BorderBrush" Value="#404040"/>
            <Setter Property="BorderThickness" Value="1"/>
            <Setter Property="Padding" Value="8,5"/>
            <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="ComboBox">
                        <Grid>
                            <ToggleButton Name="ToggleButton" 
                                          Focusable="false" 
                                          IsChecked="{Binding Path=IsDropDownOpen, Mode=TwoWay, RelativeSource={RelativeSource TemplatedParent}}" 
                                          ClickMode="Press">
                                <ToggleButton.Template>
                                    <ControlTemplate TargetType="ToggleButton">
                                        <Border Name="Border" Background="#252525" BorderBrush="#404040" BorderThickness="1" CornerRadius="4">
                                            <Grid>
                                                <Grid.ColumnDefinitions>
                                                    <ColumnDefinition />
                                                    <ColumnDefinition Width="20" />
                                                </Grid.ColumnDefinitions>
                                                <ContentPresenter Grid.Column="0" Content="{TemplateBinding Content}" Margin="8,4" VerticalAlignment="Center"/>
                                                <Path Grid.Column="1" HorizontalAlignment="Center" VerticalAlignment="Center" Data="M 0 0 L 4 4 L 8 0 Z" Fill="#E0E0E0" />
                                            </Grid>
                                        </Border>
                                        <ControlTemplate.Triggers>
                                            <Trigger Property="IsMouseOver" Value="True">
                                                <Setter TargetName="Border" Property="Background" Value="#333333" />
                                                <Setter TargetName="Border" Property="BorderBrush" Value="#666666" />
                                            </Trigger>
                                        </ControlTemplate.Triggers>
                                    </ControlTemplate>
                                </ToggleButton.Template>
                            </ToggleButton>
                            <ContentPresenter Name="ContentSite" IsHitTestVisible="False" Content="{TemplateBinding SelectionBoxItem}" ContentTemplate="{TemplateBinding SelectionBoxItemTemplate}" ContentTemplateSelector="{TemplateBinding ItemTemplateSelector}" Margin="10,5,25,5" VerticalAlignment="Center" HorizontalAlignment="Left" />
                            <Popup Name="Popup" Placement="Bottom" IsOpen="{TemplateBinding IsDropDownOpen}" AllowsTransparency="True" Focusable="False" PopupAnimation="Slide">
                                <Grid Name="DropDown" SnapsToDevicePixels="True" MinWidth="{TemplateBinding ActualWidth}" MaxHeight="250">
                                    <Border Name="DropDownBorder" Background="#252525" BorderBrush="#404040" BorderThickness="1" CornerRadius="4" Margin="0,2,0,2">
                                        <ScrollViewer Margin="2" SnapsToDevicePixels="True">
                                            <StackPanel IsItemsHost="True" KeyboardNavigation.DirectionalNavigation="Contained" />
                                        </ScrollViewer>
                                    </Border>
                                </Grid>
                            </Popup>
                        </Grid>
                    </ControlTemplate>
                </Setter.Value>
            </Setter>
        </Style>

        <Style TargetType="Button">
             <Setter Property="Background" Value="#333333"/>
             <Setter Property="Foreground" Value="#FFFFFF"/>
             <Setter Property="BorderBrush" Value="#404040"/>
             <Setter Property="BorderThickness" Value="1"/>
             <Setter Property="Cursor" Value="Hand"/>
             <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="Button">
                        <Border Name="BtnBorder" Background="{TemplateBinding Background}" BorderBrush="{TemplateBinding BorderBrush}" BorderThickness="1" CornerRadius="4">
                            <Grid>
                                <Border Name="Overlay" Background="Transparent" CornerRadius="3"/>
                                <ContentPresenter HorizontalAlignment="Center" VerticalAlignment="Center" Margin="{TemplateBinding Padding}"/>
                            </Grid>
                        </Border>
                        <ControlTemplate.Triggers>
                            <Trigger Property="IsMouseOver" Value="True">
                                <Setter TargetName="Overlay" Property="Background" Value="#1FFFFFFF"/>
                                <Setter TargetName="BtnBorder" Property="BorderBrush" Value="#666666"/>
                            </Trigger>
                            <Trigger Property="IsPressed" Value="True">
                                <Setter TargetName="Overlay" Property="Background" Value="#3F000000"/>
                            </Trigger>
                            <Trigger Property="IsEnabled" Value="False">
                                <Setter Property="Opacity" Value="0.45"/>
                            </Trigger>
                        </ControlTemplate.Triggers>
                    </ControlTemplate>
                </Setter.Value>
             </Setter>
        </Style>

        <Style TargetType="TabControl">
            <Setter Property="Background" Value="Transparent"/>
            <Setter Property="BorderThickness" Value="0"/>
        </Style>

        <Style TargetType="TabItem">
            <Setter Property="Foreground" Value="#EEEEEE"/>
            <Setter Property="FontSize" Value="14"/>
            <Setter Property="FontWeight" Value="Bold"/>
            <Setter Property="Padding" Value="20,10"/>
            <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="TabItem">
                        <Border Name="TabBorder" Background="#444444" BorderBrush="#555555" BorderThickness="1,1,1,0" CornerRadius="5,5,0,0" Margin="0,0,3,0">
                            <ContentPresenter ContentSource="Header" Margin="{TemplateBinding Padding}" HorizontalAlignment="Center" VerticalAlignment="Center"/>
                        </Border>
                        <ControlTemplate.Triggers>
                            <MultiTrigger>
                                <MultiTrigger.Conditions>
                                    <Condition Property="IsSelected" Value="False"/>
                                    <Condition Property="IsMouseOver" Value="True"/>
                                </MultiTrigger.Conditions>
                                <Setter TargetName="TabBorder" Property="Background" Value="#555555" />
                                <Setter TargetName="TabBorder" Property="BorderBrush" Value="#666666" />
                            </MultiTrigger>
                            <Trigger Property="IsSelected" Value="True">
                                <Setter TargetName="TabBorder" Property="Background" Value="#0063B1"/>
                                <Setter TargetName="TabBorder" Property="BorderBrush" Value="#0063B1"/>
                                <Setter Property="Foreground" Value="#FFFFFF"/>
                            </Trigger>
                        </ControlTemplate.Triggers>
                    </ControlTemplate>
                </Setter.Value>
            </Setter>
        </Style>
    </Window.Resources>
    
    <ScrollViewer VerticalScrollBarVisibility="Auto">
        <StackPanel Margin="20">
            
            <Grid Margin="0,0,0,15">
                <Grid.ColumnDefinitions>
                    <ColumnDefinition Width="*" />
                    <ColumnDefinition Width="Auto" />
                </Grid.ColumnDefinitions>
                <StackPanel Grid.Column="0">
                    <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
                        <TextBlock Text="Makerspace Manager" FontSize="22" FontWeight="Bold" Foreground="#0063B1"/>
                        <Button Name="btnUpdateScript" Content="Update Available" Visibility="Collapsed" Height="22" Margin="12,2,0,0" Padding="8,2" Background="#107C10" Foreground="White" FontWeight="Bold" FontSize="11" BorderThickness="0" Cursor="Hand"/>
                    </StackPanel>
                    <TextBlock Text="Last Updated: 13/09/2026 21:27" Foreground="#666666" FontSize="10" FontStyle="Italic" Margin="0,2,0,0"/>
                </StackPanel>
                <CheckBox Name="chkDebugMode" Grid.Column="1" Content="Debug Mode" FontSize="10" VerticalAlignment="Top" Foreground="#666666" Margin="0,5,0,0"/>
            </Grid>
            
            <StackPanel Margin="0,0,0,15">
                <TextBlock Text="Select Target User:" FontWeight="SemiBold" Margin="0,0,0,5" Foreground="#E0E0E0"/>
                
                <ListBox Name="listUsers" Height="40" Background="Transparent" BorderThickness="0" ScrollViewer.HorizontalScrollBarVisibility="Auto" ScrollViewer.VerticalScrollBarVisibility="Disabled">
                    <ListBox.ItemsPanel>
                        <ItemsPanelTemplate>
                            <WrapPanel Orientation="Horizontal" />
                        </ItemsPanelTemplate>
                    </ListBox.ItemsPanel>
                    <ListBox.ItemContainerStyle>
                        <Style TargetType="ListBoxItem">
                            <Setter Property="Background" Value="#2D2D2D"/>
                            <Setter Property="Foreground" Value="#E0E0E0"/>
                            <Setter Property="Margin" Value="0,0,6,0"/>
                            <Setter Property="Padding" Value="10,4"/>
                            <Setter Property="FontSize" Value="11"/>
                            <Setter Property="FontWeight" Value="SemiBold"/>
                            <Setter Property="Template">
                                <Setter.Value>
                                    <ControlTemplate TargetType="ListBoxItem">
                                        <Border CornerRadius="4" Background="{TemplateBinding Background}" Padding="{TemplateBinding Padding}" BorderBrush="#3D3D3D" BorderThickness="1">
                                            <ContentPresenter VerticalAlignment="Center" HorizontalAlignment="Center"/>
                                        </Border>
                                    </ControlTemplate>
                                </Setter.Value>
                            </Setter>
                            <Style.Triggers>
                                <Trigger Property="IsMouseOver" Value="True">
                                    <Setter Property="Background" Value="#3D3D3D"/>
                                    <Setter Property="BorderBrush" Value="#0063B1"/>
                                </Trigger>
                                <Trigger Property="IsSelected" Value="True">
                                    <Setter Property="Background" Value="#0063B1"/>
                                    <Setter Property="BorderBrush" Value="#0078D4"/>
                                    <Setter Property="Foreground" Value="White"/>
                                </Trigger>
                            </Style.Triggers>
                        </Style>
                    </ListBox.ItemContainerStyle>
                </ListBox>

            </StackPanel>

            <TabControl Background="#1E1E1E" BorderBrush="#0063B1" BorderThickness="0,2,0,0" Margin="0,0,0,15">
                <TabItem Header="Restrictions">
                    <StackPanel Margin="0,15,0,0">
                        <Border Background="#202020" Padding="12" CornerRadius="6" Margin="0,0,0,15" BorderBrush="#333333" BorderThickness="1">
                            <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
                                <RadioButton Name="rbLock" Content="BLOCK MODE" IsChecked="True" Foreground="#FF8C8C" Margin="0,0,20,0"/>
                                <RadioButton Name="rbUnlock" Content="UNBLOCK MODE" Foreground="#8CFF8C"/>
                            </StackPanel>
                        </Border>

                        <!-- Preset Selection Row -->
                        <Border Background="#202020" Padding="12" CornerRadius="6" Margin="0,0,0,15" BorderBrush="#333333" BorderThickness="1">
                            <Grid>
                                <Grid.ColumnDefinitions>
                                    <ColumnDefinition Width="Auto"/>
                                    <ColumnDefinition Width="*"/>
                                </Grid.ColumnDefinitions>
                                <TextBlock Text="Preset Profile:" VerticalAlignment="Center" FontWeight="SemiBold" Margin="0,0,10,0"/>
                                <ComboBox Name="cmbPresets" Grid.Column="1" Height="28"/>
                            </Grid>
                        </Border>

                        <!-- Dynamic Category GroupBoxes populated from policies.json -->
                        <StackPanel Name="panelPolicyCategories" Margin="0,0,0,5">
                        </StackPanel>

                        <Button Name="btnSelectAll" Content="SELECT ALL" Height="42" Margin="0,0,0,10" Background="#333333" FontSize="14" FontWeight="Bold"/>
                        
                        <Button Name="btnApply" Content="BLOCK" Height="42" Background="#C42B1C" Foreground="White" FontWeight="Bold" FontSize="14" BorderThickness="0"/>
                    </StackPanel>
                </TabItem>

                <TabItem Header="Tools">
                    <StackPanel Margin="0,15,0,0">

                        <GroupBox Header="PrusaSlicer" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Button Name="btnTogglePrusaSchedule" Content="Create Prusa Schedule" Height="42" Background="#0063B1" Foreground="White" FontWeight="Bold" FontSize="14"/>
                                <TextBlock Name="lblPrusaStatus" FontSize="10" Margin="0,5,0,0" Foreground="#888888" HorizontalAlignment="Center" TextWrapping="Wrap" TextAlignment="Center" Visibility="Collapsed"/>
                            </StackPanel>
                        </GroupBox>

                        <GroupBox Header="Clear On Logout (File Cleanup)" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Button Name="btnToggleClearOnLogout" Content="Enable Clear On Logout Schedule" Height="42" Background="#0063B1" Foreground="White" FontWeight="Bold" FontSize="14"/>
                            </StackPanel>
                        </GroupBox>

                        <GroupBox Header="Desktop Icons" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Button Name="btnToggleDesktopIcons" Content="Lock Desktop Icons" Height="42" Background="#0063B1" Foreground="White" FontWeight="Bold" FontSize="14"/>
                            </StackPanel>
                        </GroupBox>

                        <GroupBox Header="Create Shortcut" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Button Name="btnInstallShortcut" Content="Create Script Shortcut" Height="42" Background="#0063B1" Foreground="White" FontWeight="Bold"/>
                            </StackPanel>
                        </GroupBox>

                    </StackPanel>
                </TabItem>
            </TabControl>

            <GroupBox Header="Status Log" Padding="5" Margin="0,5,0,0">
                 <RichTextBox Name="txtLog" IsReadOnly="True" VerticalScrollBarVisibility="Auto" 
                             FontFamily="Consolas" FontSize="11" Background="#252526" BorderThickness="0" 
                             HorizontalAlignment="Stretch" Height="180">
                    <FlowDocument>
                        <Paragraph Margin="0"><Run Text="Ready..." Foreground="#888888"/></Paragraph>
                    </FlowDocument>
                </RichTextBox>
            </GroupBox>
        </StackPanel>
    </ScrollViewer>
 </Window>
'@

$global:prusaIni = @'
# generated by PrusaSlicer 2.9.4 on 2026-02-26 at 07:52:39 UTC
alert_when_supports_needed = 1
allow_auto_color_change = 1
allow_ip_resolve = 1
angle_precision = 1.
associate_3mf = 1
associate_stl = 1
auth_login_dialog_confirmed = 0
auto_toolbar_size = 77
background_processing = 0
clear_undo_redo_stack_on_new_project = 1
collapsed_sidebar = 0
color_mapinulation_panel = 0
connect_polling = 1
custom_toolbar_size = 100
dark_color_mode = 1
default_action_on_close_application = none
default_action_on_new_project = none
default_action_on_select_preset = none
downloader_url_registered = 1
drop_project_action = 1
export_sources_full_pathnames = 0
linear_precision = 0.005
no_controller = 1
no_defaults = 1
no_templates = 0
non_manifold_edges = 1
notify_release = none
order_volumes = 1
preset_update = 0
remember_output_path = 1
remember_output_path_removable = 1
restore_win_position = 1
reverse_mouse_wheel_zoom = 0
seq_top_layer_only = 1
show_drop_project_dialog = 1
show_estimated_times_in_dbl_slider = 1
show_hints = 0
show_incompatible_presets = 0
show_login_button = 0
show_ruler_bg_in_dbl_slider = 1
show_ruler_in_dbl_slider = 0
show_splash_screen = 1
show_step_import_parameters = 1
single_instance = 0
suppress_round_corners = 1
sys_menu_enabled = 1
url_downloader_dest = C:\Users\DefaultUser\Downloads
use_binary_gcode_when_supported = 1
use_custom_toolbar_size = 0
use_free_camera = 0
use_inches = 0
use_legacy_3DConnexion = 0
use_perspective_camera = 1
version = 2.9.4
version_online = 2.9.4
version_system_info_sent = 2.9.4
view_mode = expert
wifi_config_dialog_declined = 0

[filaments]
DefaultMaterial = 1
DefaultMaterial @Template = 1

[presets]
filament = DefaultMaterial
physical_printer = 
print = 0.15mm QUALITY @MK3
printer = Original Prusa i3 MK3S & MK3S+
sla_material = 
sla_print = 

[vendor:PrusaResearch]
model:MK3S = 0.4

# (Checksum removed to allow auto-generation)
'@

# ADMIN CHECK 
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "You must run this script as Administrator!"
    Start-Sleep -Seconds 3
    Exit
}

$ErrorActionPreference = "Stop"

# GLOBAL SETTINGS
$global:installDir = "$env:SystemDrive\MakerspaceManager"
$logDir = Join-Path $global:installDir "Logs"
if (-not (Test-Path $logDir)) {
    New-Item -Path $logDir -ItemType Directory -Force | Out-Null
}

try {
    if ($global:installDir -like "*MakerspaceManager") {
        $aclCmd = "icacls `"$global:installDir`" /inheritance:r /grant:r *S-1-5-32-544:(OI)(CI)F /grant:r *S-1-5-18:(OI)(CI)F /q"
        cmd.exe /c $aclCmd | Out-Null
    }
}
catch {}

$logTimestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")
$global:logFile = Join-Path $logDir "MakerspaceManager_${logTimestamp}.log"

# LOGGING
function Log ($msg, $color = "Normal") {
    $timestamp = (Get-Date).ToString("HH:mm:ss", [System.Globalization.CultureInfo]::InvariantCulture)
    $logEntry = "[$timestamp] $msg"

    if ($null -ne $txtLog) {
        try {
            $paragraph = New-Object System.Windows.Documents.Paragraph
            $paragraph.Margin = New-Object System.Windows.Thickness(0)
            $run = New-Object System.Windows.Documents.Run
            $run.Text = $logEntry
            if ($color -like "#*") {
                $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString($color)
            }
            else {
                switch ($color) {
                    "Red" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FF8C8C") }
                    "Green" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#8CFF8C") }
                    "Blue" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#60A5FA") }
                    "Cyan" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#60A5FA") }
                    "Yellow" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FFD93D") }
                    default { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#DDDDDD") }
                }
            }
            $paragraph.Inlines.Add($run)
            $txtLog.Document.Blocks.Add($paragraph)
            $txtLog.ScrollToEnd()
            
            $frame = New-Object System.Windows.Threading.DispatcherFrame
            [System.Windows.Threading.Dispatcher]::CurrentDispatcher.BeginInvoke([System.Windows.Threading.DispatcherPriority]::Background, [System.Action[System.Windows.Threading.DispatcherFrame]] { param($f) $f.Continue = $false }, $frame) | Out-Null
            [System.Windows.Threading.Dispatcher]::PushFrame($frame)
        }
        catch {
            Write-Host $logEntry
        }
    }
    else {
        Write-Host $logEntry
    }

    try {
        $logEntry | Out-File -FilePath $global:logFile -Append -Encoding UTF8
    }
    catch {}
}

function Debug-Log ($msg) {
    if ($null -ne $global:chkDebugMode -and $global:chkDebugMode.IsChecked -eq $true) {
        Log "[DEBUG] $msg" "#888888"
    }
}

# VERSION MIGRATION ENGINE
function Invoke-ScriptMigration {
    try {
        $regPath = "HKLM:\SOFTWARE\MakerspaceManager"
        if (-not (Test-Path $regPath)) {
            New-Item -Path $regPath -Force | Out-Null
        }
        $installedVersion = (Get-ItemProperty -Path $regPath -Name "Version" -ErrorAction SilentlyContinue).Version
        if ([string]::IsNullOrWhiteSpace($installedVersion) -or ([version]$installedVersion -lt [version]$SCRIPT_VERSION)) {
            Log "Executing version migration ($installedVersion -> $SCRIPT_VERSION)..." "Yellow"
            
            # Clean up obsolete temp files or legacy artifacts if present
            $legacyTemp = "$env:SystemDrive\MakerspaceManager\Temp"
            if (Test-Path $legacyTemp) {
                Remove-Item $legacyTemp -Recurse -Force -ErrorAction SilentlyContinue
            }

            Set-ItemProperty -Path $regPath -Name "Version" -Value $SCRIPT_VERSION -Force
            Log "Script migration to v$SCRIPT_VERSION complete." "Green"
        }
    }
    catch {
        Debug-Log "Script migration note: $_"
    }
}

# LOG MAINTENANCE
function Remove-OldLogs ($path, $maxFiles = 20, $maxSizeMB = 50) {
    try {
        if (-not (Test-Path $path)) { return }
        $files = Get-ChildItem -Path $path -Filter "*.log" | Sort-Object LastWriteTime -Descending
        
        if ($files.Count -gt $maxFiles) {
            $files | Select-Object -Skip $maxFiles | Remove-Item -Force -ErrorAction SilentlyContinue
            $files = Get-ChildItem -Path $path -Filter "*.log" | Sort-Object LastWriteTime -Descending
        }

        $totalSize = ($files | Measure-Object -Property Length -Sum).Sum
        if ($totalSize -gt ($maxSizeMB * 1MB)) {
            $currentSize = $totalSize
            foreach ($f in ($files | Sort-Object LastWriteTime)) {
                if ($currentSize -le ($maxSizeMB * 1MB)) { break }
                $currentSize -= $f.Length
                Remove-Item -Path $f.FullName -Force -ErrorAction SilentlyContinue
            }
        }
    }
    catch {}
}

# REGISTRY HELPERS
function Get-UserSID ($targetUser) {
    Debug-Log "Get-UserSID: Resolving SID for '$targetUser'..."
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $null }

    try {
        $acct = Get-WmiObject -Class Win32_UserAccount | Where-Object { $_.Name -eq $targetUser }
        if ($acct) {
            Debug-Log "Get-UserSID: Resolved via Win32_UserAccount -> SID: $($acct.SID)"
            return $acct.SID
        }
    }
    catch { Debug-Log "Get-UserSID: Win32_UserAccount lookup failed: $_" }

    try { 
        $sid = (New-Object System.Security.Principal.NTAccount($targetUser)).Translate([System.Security.Principal.SecurityIdentifier]).Value
        Debug-Log "Get-UserSID: Resolved via NTAccount -> SID: $sid"
        return $sid
    } 
    catch {
        $f = if ($targetUser -notmatch '\\') { ".\$targetUser" } else { $targetUser }
        try { 
            $sid = (New-Object System.Security.Principal.NTAccount($f)).Translate([System.Security.Principal.SecurityIdentifier]).Value
            Debug-Log "Get-UserSID: Resolved via NTAccount (prefixed) -> SID: $sid"
            return $sid
        }
        catch {}
    }

    Debug-Log "Get-UserSID: All methods failed for '$targetUser'"
    return $null
}

function Invoke-HiveUnload ($hiveName) {
    if (Test-Path "HKLM:\$hiveName") {
        & reg.exe unload "HKLM\$hiveName" *>$null
        if ($LASTEXITCODE -ne 0) {
            [System.GC]::Collect()
            [System.GC]::WaitForPendingFinalizers()
            Start-Sleep -Milliseconds 100
            & reg.exe unload "HKLM\$hiveName" *>$null
        }
    }
}

# SYSTEM CHECKS
function Test-IsAdmin ($targetUser) {
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $false }
    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
    if ($targetUser -eq $actualUser) { return $true }
    
    $isAdmin = $false
    try {
        $sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
        $localGroupName = ($sid.Translate([System.Security.Principal.NTAccount]).Value -split '\\' | Select-Object -Last 1)

        $admins = Get-LocalGroupMember -Group $localGroupName -ErrorAction SilentlyContinue
        if ($admins | Where-Object { ($_.Name -split '\\' | Select-Object -Last 1) -eq $targetUser }) { $isAdmin = $true }
        
        if (-not $isAdmin) {
            $netAdmins = & net localgroup $localGroupName 2>$null
            if ($netAdmins -match "\b$targetUser\b") { $isAdmin = $true }
        }
    }
    catch {}

    return $isAdmin
}

function Test-IsUserLoggedOn ($targetUser) {
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $false }
    try {
        $p = Get-Process -IncludeUserName -ErrorAction SilentlyContinue | Where-Object { $_.UserName -match "\\$targetUser$" -or $_.UserName -eq $targetUser }
        return ($null -ne $p -and $p.Count -gt 0)
    }
    catch { return $false }
}

function Get-UserProfilePath ($targetUser) {
    Debug-Log "Get-UserProfilePath: Finding profile for '$targetUser'..."
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $null }
    $sid = Get-UserSID $targetUser
    if (!$sid) { 
        Debug-Log "Get-UserProfilePath: Failing (No SID found)"
        return $null 
    }
    Debug-Log "Get-UserProfilePath: SID found: '$sid'"
    try {
        $path = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.SID -eq $sid } | Select-Object -ExpandProperty LocalPath -ErrorAction SilentlyContinue
        if ($path -and (Test-Path $path)) { 
            Debug-Log "Get-UserProfilePath: Found via WMI: $path"
            return $path 
        }
    }
    catch { Debug-Log "Get-UserProfilePath: WMI search failed: $_" }
    
    $fallback = "$env:SystemDrive\Users\$targetUser"
    Debug-Log "Get-UserProfilePath: Trying fallback path: $fallback"
    if (Test-Path $fallback) { 
        Debug-Log "Get-UserProfilePath: Found via Fallback"
        return $fallback 
    }
    Debug-Log "Get-UserProfilePath: Failing (Path not found)"
    return $null
}

function Get-UserDesktopPath ($targetUser) {
    $profileBase = Get-UserProfilePath $targetUser
    if (!$profileBase) { return $null }

    $names = @("Desktop", "Työpöytä", "Skrivbord")
    foreach ($n in $names) {
        $path = Join-Path $profileBase $n
        if (Test-Path $path) { return $path }
    }
    return $null
}

function Test-AppInstalled ($appName) {
    $regPaths = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    )
    foreach ($rp in $regPaths) {
        if (Get-ChildItem $rp -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { $_.DisplayName -like "*$appName*" }) {
            return $true
        }
    }
    return $false
}

function Test-PrusaInstalled {
    return (Test-AppInstalled "PrusaSlicer") -or
    (Test-Path "C:\Program Files\Prusa3D\PrusaSlicer\prusa-slicer.exe") -or
    (Test-Path "C:\Program Files (x86)\Prusa3D\PrusaSlicer\prusa-slicer.exe")
}

function Initialize-LocalScript {
    Debug-Log "Initialize-LocalScript: installDir='$global:installDir'"
    if ([string]::IsNullOrWhiteSpace($global:installDir)) {
        Log "Error: installDir is empty. Cannot create local script copy." "Red"
        return $null
    }

    $localPath = Join-Path $global:installDir "MakerspaceManager_Local.ps1"
    Debug-Log "Initialize-LocalScript: localPath='$localPath'"

    Debug-Log "Preparing local script copy..."

    if (-not (Test-Path $global:installDir)) {
        Debug-Log "Initialize-LocalScript: Creating installDir..."
        New-Item -Path $global:installDir -ItemType Directory -Force | Out-Null
    }

    $scriptContent = ""
    try {
        if (-not [string]::IsNullOrWhiteSpace($PSCommandPath) -and (Test-Path $PSCommandPath)) {
            $scriptContent = Get-Content $PSCommandPath -Raw
        }
        else {
            $scriptContent = Invoke-RestMethod "https://msm.samwhitley.com" -ErrorAction Stop
        }
    }
    catch {
        Log "Error creating local copy: $_" "Red"
        return $null
    }

    if ([string]::IsNullOrWhiteSpace($scriptContent)) {
        Log "Error: Script content was empty. Cannot save local copy." "Red"
        return $null
    }

    try {
        $scriptContent | Out-File $localPath -Encoding UTF8 -Force
        Debug-Log "Local copy saved to $localPath"
        return $localPath
    }
    catch {
        Log "Error writing local copy: $_" "Red"
        return $null
    }
}

# PARSE MANIFEST & PRESETS
$global:policiesManifest = @()
if (-not [string]::IsNullOrWhiteSpace($global:policiesJson)) {
    try { $global:policiesManifest = $global:policiesJson | ConvertFrom-Json } catch {}
}

# Fallback default policies manifest if empty/embedded not present
if ($null -eq $global:policiesManifest -or $global:policiesManifest.Count -eq 0) {
    $localPoliciesPath = Join-Path $PSScriptRoot "policies.json"
    if (Test-Path $localPoliciesPath) {
        try { $global:policiesManifest = Get-Content $localPoliciesPath -Raw | ConvertFrom-Json } catch {}
    }
}

$global:presetsData = @{}
if (-not [string]::IsNullOrWhiteSpace($global:presetsJson)) {
    try { $global:presetsData = $global:presetsJson | ConvertFrom-Json } catch {}
}

$global:policyCheckBoxes = @{}

# POLICY STATUS
function Invoke-StatusCheck ($targetUser, $clearLog) {
    if ($clearLog) { $txtLog.Document.Blocks.Clear() }

    if ([string]::IsNullOrWhiteSpace($targetUser)) {
        Log "Error: Please enter a username." "Red"
        return
    }

    $colorNeutral = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#EEEEEE") 
    $colorLocked = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FF8C8C")  
    $colorUnlocked = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#8CFF8C") 
    
    foreach ($chk in $global:policyCheckBoxes.Values) { $chk.Foreground = $colorNeutral }

    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
    $isCurrentUser = ($targetUser -eq $actualUser)
    Log "Checking status for '$targetUser'..." "Blue"

    $registry = $null
    $hiveName = "MSM_TempHive"
    $loadedViaReg = $false

    if ($isCurrentUser) {
        $registry = [Microsoft.Win32.Registry]::CurrentUser
    }
    else {
        $sid = Get-UserSID $targetUser
        if ($null -ne $sid) {
            $subKey = [Microsoft.Win32.Registry]::Users.OpenSubKey($sid)
            if ($null -ne $subKey) { $registry = $subKey }
        }

        if ($null -eq $registry) {
            $profilePath = Get-UserProfilePath $targetUser
            if (!$profilePath) { Log "Error: Could not find profile folder for '$targetUser'." "Red"; return }
            $userPath = Join-Path $profilePath "NTUSER.DAT"
            if (-not (Test-Path $userPath)) { Log "Error: NTUSER.DAT not found at: $userPath" "Red"; return }
            
            Invoke-HiveUnload $hiveName
            & reg.exe load "HKLM\$hiveName" "$userPath" *>$null
            
            if ($LASTEXITCODE -eq 0) {
                $registry = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($hiveName)
                $loadedViaReg = $true
            }
            else {
                Log "Could not load hive (Code $LASTEXITCODE)." "Red"
                return
            }
        }
    }

    if ($null -eq $registry) { 
        Log "Failed to access registry root." "Red"
        return 
    }

    try {
        $lockedCount = 0

        foreach ($policy in $global:policiesManifest) {
            $chk = $global:policyCheckBoxes[$policy.id]
            if ($null -eq $chk) { continue }

            $allKeysLocked = $true
            foreach ($k in $policy.keys) {
                $subKey = $registry.OpenSubKey($k.path)
                if ($null -eq $subKey) {
                    $allKeysLocked = $false
                    break
                }
                $val = $subKey.GetValue($k.name)
                $subKey.Close()

                if ($null -eq $val -or $val.ToString() -ne $k.value.ToString()) {
                    $allKeysLocked = $false
                    break
                }
            }

            if ($allKeysLocked) {
                $chk.Foreground = $colorLocked
                $lockedCount++
            }
            else {
                $chk.Foreground = $colorUnlocked
            }
        }

        Log "Status check complete. ($lockedCount restrictions active)" "Green"
    }
    finally {
        if ($null -ne $registry -and -not $isCurrentUser) { $registry.Close() }
        if ($loadedViaReg) { Invoke-HiveUnload $hiveName }
    }
}

# PRUSASLICER CLEANUP
function Start-PrusaReset ($targetUser, $material = "PLA") {
    if ([string]::IsNullOrWhiteSpace($targetUser)) { Log "Error: Please enter a username." "Red"; return }

    try {
        Log "Starting PrusaSlicer reset for $targetUser..." "Blue"

        $proc = Get-Process -Name "prusa-slicer" -ErrorAction SilentlyContinue
        if ($null -ne $proc) {
            Log "Stopping PrusaSlicer process..." "Yellow"
            $proc | Stop-Process -Force -ErrorAction SilentlyContinue
            Start-Sleep -Milliseconds 500
        }

        $profilePath = Get-UserProfilePath $targetUser
        if (!$profilePath) { Log "Error: Could not find profile folder for '$targetUser'." "Red"; return }
        
        $basePath = Join-Path $profilePath "AppData\Roaming\PrusaSlicer"
        if (-not (Test-Path $basePath)) {
            New-Item -Path $basePath -ItemType Directory -Force | Out-Null
        }

        $folders = @("print", "filament", "printer", "cache", "physical_printer")
        foreach ($f in $folders) {
            $fPath = Join-Path $basePath $f
            if (Test-Path $fPath) {
                Remove-Item -Path "$fPath" -Recurse -Force -ErrorAction SilentlyContinue
                New-Item -Path $fPath -ItemType Directory -Force | Out-Null
            }
        }

        $bakFile = Join-Path $basePath "PrusaSlicer.ini.bak"
        if (Test-Path $bakFile) { Remove-Item $bakFile -Force -ErrorAction SilentlyContinue }

        $destFile = Join-Path $basePath "PrusaSlicer.ini"
        $iniContent = ""
        if (Get-Variable -Name "prusaIni" -ErrorAction SilentlyContinue) { $iniContent = $global:prusaIni }
        else {
            $localIni = Join-Path $global:installDir "PrusaSlicer.ini"
            if (Test-Path $localIni) { $iniContent = Get-Content $localIni -Raw }
        }

        if ([string]::IsNullOrWhiteSpace($iniContent)) { Log "Error: Default PrusaSlicer.ini template not found." "Red"; return }

        $profileFolderName = Split-Path $profilePath -Leaf
        $iniContent = $iniContent.Trim()
        $iniContent = $iniContent.Replace("DefaultUser", $profileFolderName)
        $iniContent = $iniContent.Replace("DefaultMaterial", $material)

        [System.IO.File]::WriteAllText($destFile, $iniContent, (New-Object System.Text.UTF8Encoding $false))
        Log "SUCCESS: PrusaSlicer reset complete for $targetUser." "Green"
    }
    catch { Log "ERROR during PrusaSlicer reset: $_" "Red" }
}

function Update-PrusaScheduleStatus {
    try {
        if ($null -eq $global:lblPrusaStatus) { return }

        $exclude = @("Administrator", "Guest", "DefaultAccount", "WDAGUtilityAccount")
        $allUsers = Get-LocalUser | Where-Object { $_.Enabled -and $exclude -notcontains $_.Name } | Select-Object -ExpandProperty Name
        $allTasks = Get-ScheduledTask -TaskName "Makerspace_PrusaReset_*" -ErrorAction SilentlyContinue
        
        $scheduledUsers = @()
        if ($allTasks) {
            $scheduledUsers = $allTasks | ForEach-Object { $_.TaskName.Replace("Makerspace_PrusaReset_", "") }
        }

        $notScheduledUsers = $allUsers | Where-Object { $scheduledUsers -notcontains $_ }

        $global:lblPrusaStatus.Inlines.Clear()
        
        if ($scheduledUsers.Count -gt 0) {
            $run1 = New-Object System.Windows.Documents.Run("SCHEDULED: $($scheduledUsers -join ', ')")
            $run1.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#8CFF8C")
            $global:lblPrusaStatus.Inlines.Add($run1)
            $global:lblPrusaStatus.Visibility = [System.Windows.Visibility]::Visible
        }
        else {
            $global:lblPrusaStatus.Visibility = [System.Windows.Visibility]::Collapsed
        }
        
        # Update dynamic toggle button text and color for selected user
        if ($null -ne $global:btnTogglePrusaSchedule) {
            $selectedUser = if ($null -ne $global:listUsers) { $global:listUsers.SelectedItem } else { $null }
            $isUserScheduled = ($null -ne $selectedUser -and $scheduledUsers -contains $selectedUser)
            if ($isUserScheduled) {
                $global:btnTogglePrusaSchedule.Content = "Remove Prusa Schedule"
                $global:btnTogglePrusaSchedule.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#C42B1C")
            }
            else {
                $global:btnTogglePrusaSchedule.Content = "Create Prusa Schedule"
                $global:btnTogglePrusaSchedule.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#0063B1")
            }
        }
    }
    catch {
        if ($null -ne $global:lblPrusaStatus) {
            $global:lblPrusaStatus.Inlines.Clear()
            $global:lblPrusaStatus.Visibility = [System.Windows.Visibility]::Collapsed
        }
    }
}


function Update-DesktopIconsStatus {
    if ($null -eq $global:btnToggleDesktopIcons) { return }
    $targetUser = if ($null -ne $global:listUsers) { $global:listUsers.SelectedItem } else { $null }
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return }

    if (Test-IsAdmin $targetUser) {
        $global:btnToggleDesktopIcons.Content = "Lock Desktop Icons (Admin Excluded)"
        $global:btnToggleDesktopIcons.IsEnabled = $false
        $global:btnToggleDesktopIcons.Opacity = 0.45
        $global:btnToggleDesktopIcons.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#2A2A2A")
        return
    }

    $global:btnToggleDesktopIcons.IsEnabled = $true
    $global:btnToggleDesktopIcons.Opacity = 1.0
    $publicDesktop = [Environment]::GetFolderPath("CommonDesktopDirectory")
    $publicShortcuts = @(Get-ChildItem -Path $publicDesktop -Filter "*.lnk" -ErrorAction SilentlyContinue)
    $userDesktop = Get-UserDesktopPath $targetUser
    $userShortcuts = if ($userDesktop) { @(Get-ChildItem -Path $userDesktop -Filter "*.lnk" -ErrorAction SilentlyContinue) } else { @() }

    if ($userShortcuts.Count -eq 0 -and $publicShortcuts.Count -gt 0) {
        $global:btnToggleDesktopIcons.Content = "Unlock Desktop Icons"
        $global:btnToggleDesktopIcons.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#107C10")
    }
    else {
        $global:btnToggleDesktopIcons.Content = "Lock Desktop Icons"
        $global:btnToggleDesktopIcons.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#0063B1")
    }
}

function Update-ShortcutStatus {
    if ($null -eq $global:btnInstallShortcut) { return }
    $targetUser = if ($null -ne $global:listUsers) { $global:listUsers.SelectedItem } else { $null }
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return }

    if (-not (Test-IsAdmin $targetUser)) {
        $global:btnInstallShortcut.Content = "Create Script Shortcut (Admin Only)"
        $global:btnInstallShortcut.IsEnabled = $false
        $global:btnInstallShortcut.Opacity = 0.45
        $global:btnInstallShortcut.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#2A2A2A")
        return
    }

    $global:btnInstallShortcut.IsEnabled = $true
    $global:btnInstallShortcut.Opacity = 1.0
    $desktopPath = [Environment]::GetFolderPath("Desktop")
    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
    if ($targetUser -ne $actualUser) {
        $uDesktop = Get-UserDesktopPath $targetUser
        if ($uDesktop) { $desktopPath = $uDesktop }
    }

    $shortcutPath = Join-Path $desktopPath "MakerspaceManager.lnk"
    if (Test-Path $shortcutPath) {
        $global:btnInstallShortcut.Content = "Remove Script Shortcut"
        $global:btnInstallShortcut.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#C42B1C")
    }
    else {
        $global:btnInstallShortcut.Content = "Create Script Shortcut"
        $global:btnInstallShortcut.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#0063B1")
    }
}

function Start-ClearOnLogoutCleanup ($targetUser) {
    if ([string]::IsNullOrWhiteSpace($targetUser)) { Log "Error: Target username required." "Red"; return }

    try {
        Log "Starting Clear On Logout cleanup for '$targetUser'..." "Blue"

        $userProfilePath = Get-UserProfilePath $targetUser
        if (-not $userProfilePath -or -not (Test-Path $userProfilePath)) {
            Log "Error: User profile folder for '$targetUser' not found." "Red"
            return
        }

        # 1. Clean local user folders
        $foldersToClear = @("Downloads", "Music", "Videos", "Documents", "Pictures")
        foreach ($folder in $foldersToClear) {
            $fullPath = Join-Path $userProfilePath $folder
            if (Test-Path $fullPath) {
                try {
                    $items = Get-ChildItem -Path $fullPath -Force -ErrorAction SilentlyContinue
                    if ($items) {
                        $items | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
                        Log " [+] Cleared $folder" "Green"
                    }
                } catch {}
            }
        }

        # 2. Clean Desktop (preserve .lnk and .exe)
        $userDesktop = Get-UserDesktopPath $targetUser
        if ($userDesktop -and (Test-Path $userDesktop)) {
            $desktopExclude = @("*.lnk", "*.exe")
            try {
                $desktopItems = Get-ChildItem -Path $userDesktop -Exclude $desktopExclude -Force -ErrorAction SilentlyContinue
                if ($desktopItems) {
                    $desktopItems | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
                    Log " [+] Cleared User Desktop files" "Green"
                }
            } catch {}
        }

        # 3. Clean OneDrive folders if present
        try {
            $oneDriveFolders = Get-ChildItem -Path $userProfilePath -Directory -Filter "OneDrive*" -ErrorAction SilentlyContinue
            foreach ($od in $oneDriveFolders) {
                $odSubFolders = @("Desktop", "Documents", "Pictures", "Music", "Videos")
                foreach ($sf in $odSubFolders) {
                    $odPath = Join-Path $od.FullName $sf
                    if (Test-Path $odPath) {
                        $exclude = if ($sf -eq "Desktop") { @("*.lnk", "*.exe") } else { @() }
                        $odItems = Get-ChildItem -Path $odPath -Exclude $exclude -Force -ErrorAction SilentlyContinue
                        if ($odItems) {
                            $odItems | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
                            Log " [+] Cleared OneDrive \$sf" "Green"
                        }
                    }
                }
            }
        } catch {}

        # 4. Clean User Recycle Bin
        try {
            $sid = Get-UserSID $targetUser
            if ($sid) {
                $recyclePath = Join-Path "$env:SystemDrive\`$Recycle.Bin" $sid
                if (Test-Path $recyclePath) {
                    Get-ChildItem -Path $recyclePath -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
                    Log " [+] Cleared Recycle Bin" "Green"
                }
            }
        } catch {}

        Log "SUCCESS: Clear On Logout cleanup completed for '$targetUser'." "Green"
    }
    catch {
        Log "Error during Clear On Logout cleanup: $_" "Red"
    }
}

function Test-LegacyClearOnLogoutInstalled {
    $taskFound = $false
    try {
        $tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match "Puhdista|ClearOnLogout" -or $_.Actions.Arguments -match "PuhdistaUloskirjautuessa" }
        if ($tasks -and $tasks.Count -gt 0) { $taskFound = $true }
    } catch {}

    $filesFound = (Test-Path "C:\Scripts\PuhdistaUloskirjautuessa.ps1") -or (Test-Path "C:\Scripts\Set-C-Scripts-Permissions.ps1")
    return ($taskFound -or $filesFound)
}

function Invoke-RemoveLegacyClearOnLogout {
    try {
        Log "Checking for legacy ClearOnLogout installation..." "Yellow"

        # 1. Unregister Scheduled Tasks
        try {
            $tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match "Puhdista|ClearOnLogout" -or $_.Actions.Arguments -match "PuhdistaUloskirjautuessa" }
            if ($tasks) {
                foreach ($t in $tasks) {
                    Unregister-ScheduledTask -TaskName $t.TaskName -Confirm:$false -ErrorAction SilentlyContinue
                    Log " [+] Removed legacy scheduled task: $($t.TaskName)" "Green"
                }
            }
        } catch {}

        # 2. Delete legacy files in C:\Scripts\
        $legacyFiles = @("C:\Scripts\PuhdistaUloskirjautuessa.ps1", "C:\Scripts\Set-C-Scripts-Permissions.ps1", "C:\Scripts\virheloki.txt", "C:\Scripts\Puhdista tiedostot uloskirjautuessa.xml")
        foreach ($f in $legacyFiles) {
            if (Test-Path $f) {
                Remove-Item -Path $f -Force -ErrorAction SilentlyContinue
                Log " [+] Deleted legacy file: $f" "Green"
            }
        }

        # 3. Clean up empty C:\Scripts folder if empty
        if (Test-Path "C:\Scripts") {
            $remaining = Get-ChildItem -Path "C:\Scripts" -ErrorAction SilentlyContinue
            if ($null -eq $remaining -or $remaining.Count -eq 0) {
                Remove-Item -Path "C:\Scripts" -Force -ErrorAction SilentlyContinue
                Log " [+] Removed empty C:\Scripts directory" "Green"
            }
        }

        Log "SUCCESS: Legacy ClearOnLogout script and tasks removed successfully." "Green"
    }
    catch {
        Log "Error removing legacy ClearOnLogout script: $_" "Red"
    }
}

function Update-ClearOnLogoutStatus {
    if ($null -eq $global:btnToggleClearOnLogout) { return }
    $targetUser = if ($null -ne $global:listUsers) { $global:listUsers.SelectedItem } else { $null }
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return }

    $taskName = "Makerspace_ClearOnLogout_$targetUser"
    $isScheduled = [bool](Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue)

    if ($isScheduled) {
        $global:btnToggleClearOnLogout.Content = "Remove Clear On Logout Schedule"
        $global:btnToggleClearOnLogout.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#C42B1C")
    }
    else {
        $global:btnToggleClearOnLogout.Content = "Enable Clear On Logout Schedule"
        $global:btnToggleClearOnLogout.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#0063B1")
    }
}

function Test-RemoteScriptVersion {
    if ($null -eq $global:btnUpdateScript) { return }
    
    $action = [System.Action]{
        try {
            $remoteScript = Invoke-RestMethod "https://msm.samwhitley.com" -ErrorAction Stop -TimeoutSec 4
            if ($remoteScript -match '(?m)^\$SCRIPT_VERSION\s*=\s*"([^"]+)"') {
                $remoteVerStr = $matches[1]
                if ([version]$remoteVerStr -gt [version]$SCRIPT_VERSION) {
                    $global:window.Dispatcher.Invoke([Action]{
                        $global:btnUpdateScript.Content = "Update Available (v$remoteVerStr)"
                        $global:btnUpdateScript.Visibility = [System.Windows.Visibility]::Visible
                        Log "New version available (v$remoteVerStr). Click top update badge to install." "Yellow"
                    })
                }
            }
        }
        catch {}
    }
    [System.Threading.Tasks.Task]::Run($action) | Out-Null
}

# UI BOOTSTRAP 
Add-Type -AssemblyName PresentationFramework
Add-Type -AssemblyName System.Windows.Forms

$reader = [System.Xml.XmlReader]::Create([System.IO.StringReader]::new($xaml))
$global:window = [System.Windows.Markup.XamlReader]::Load($reader)
$global:window.Title = "Makerspace Manager"

function Get-Ctrl ($name) { $global:window.FindName($name) }

# Global Control References
$global:rbLock = Get-Ctrl "rbLock"
$global:rbUnlock = Get-Ctrl "rbUnlock"
$global:cmbPresets = Get-Ctrl "cmbPresets"
$global:panelPolicyCategories = Get-Ctrl "panelPolicyCategories"
$global:btnSelectAll = Get-Ctrl "btnSelectAll"
$global:btnApply = Get-Ctrl "btnApply"

$global:btnTogglePrusaSchedule = Get-Ctrl "btnTogglePrusaSchedule"
$global:lblPrusaStatus = Get-Ctrl "lblPrusaStatus"
$global:btnToggleClearOnLogout = Get-Ctrl "btnToggleClearOnLogout"
$global:btnRemoveLegacyClearOnLogout = Get-Ctrl "btnRemoveLegacyClearOnLogout"
$global:btnToggleDesktopIcons = Get-Ctrl "btnToggleDesktopIcons"
$global:btnInstallShortcut = Get-Ctrl "btnInstallShortcut"
$global:btnUpdateScript = Get-Ctrl "btnUpdateScript"
$global:listUsers = Get-Ctrl "listUsers"
$global:txtLog = Get-Ctrl "txtLog"
$global:chkDebugMode = Get-Ctrl "chkDebugMode"

$global:isUpdatingPreset = $false

# PRESET SELECTION ENGINE
function Apply-PresetProfile ($selectedName) {
    if ([string]::IsNullOrWhiteSpace($selectedName) -or $selectedName -eq "Custom") { return }

    # Find matching preset
    $targetPreset = $null
    if ($null -ne $global:presetsData) {
        foreach ($key in $global:presetsData.PSObject.Properties.Name) {
            if ($global:presetsData.$key.name -eq $selectedName) {
                $targetPreset = $global:presetsData.$key
                break
            }
        }
    }

    if ($null -ne $targetPreset) {
        if ($null -ne $txtLog) { $txtLog.Document.Blocks.Clear() }
        Log "Loaded preset: $($targetPreset.name)" "Cyan"
        $allowedPolicies = $targetPreset.policies

        $global:isUpdatingPreset = $true
        try {
            foreach ($id in $global:policyCheckBoxes.Keys) {
                $chk = $global:policyCheckBoxes[$id]
                if ($allowedPolicies -contains $id) {
                    $chk.IsChecked = $true
                }
                else {
                    $chk.IsChecked = $false
                }
            }
        }
        finally {
            $global:isUpdatingPreset = $false
        }
    }
}

if ($null -ne $global:cmbPresets) {
    $global:cmbPresets.Add_SelectionChanged({
        Apply-PresetProfile $global:cmbPresets.SelectedItem
    })
}

# DYNAMIC UI BUILDER
function Build-DynamicPolicyUI {
    if ($null -eq $global:panelPolicyCategories) { return }
    $global:panelPolicyCategories.Children.Clear()
    $global:policyCheckBoxes.Clear()

    # Group policies by Category
    $categories = $global:policiesManifest | Group-Object category

    foreach ($catGroup in $categories) {
        $gb = New-Object System.Windows.Controls.GroupBox
        $gb.Header = $catGroup.Name
        $gb.Margin = New-Object System.Windows.Thickness(0, 0, 0, 10)
        $gb.Padding = New-Object System.Windows.Thickness(5)

        $sp = New-Object System.Windows.Controls.StackPanel

        foreach ($p in $catGroup.Group) {
            $chk = New-Object System.Windows.Controls.CheckBox
            $chk.Name = $p.id
            $chk.Content = $p.name
            if ($p.description) { $chk.ToolTip = $p.description }
            
            # Auto-switch Preset dropdown to "Custom" if admin manually alters any checkbox
            $chk.Add_Click({
                if (-not $global:isUpdatingPreset) {
                    if ($null -ne $global:cmbPresets -and $global:cmbPresets.SelectedItem -ne "Custom") {
                        $global:cmbPresets.SelectedItem = "Custom"
                    }
                }
            })

            $global:policyCheckBoxes[$p.id] = $chk
            $sp.Children.Add($chk) | Out-Null
        }

        $gb.Content = $sp
        $global:panelPolicyCategories.Children.Add($gb) | Out-Null
    }

    # Populate Presets ComboBox (Makerspace, Gaming, Custom)
    if ($null -ne $global:cmbPresets) {
        $global:cmbPresets.Items.Clear()

        $orderedPresets = @("Makerspace", "Gaming")
        foreach ($pName in $orderedPresets) {
            [void]$global:cmbPresets.Items.Add($pName)
        }

        if ($null -ne $global:presetsData) {
            foreach ($key in $global:presetsData.PSObject.Properties.Name) {
                $pName = $global:presetsData.$key.name
                if ($orderedPresets -notcontains $pName -and $pName -ne "Custom") {
                    [void]$global:cmbPresets.Items.Add($pName)
                }
            }
        }

        [void]$global:cmbPresets.Items.Add("Custom")
        $global:cmbPresets.SelectedItem = "Makerspace"
        Apply-PresetProfile "Makerspace"
    }
}

Build-DynamicPolicyUI

# USER LIST POPULATOR
function Update-UserList {
    if ($null -eq $global:listUsers) { return }
    $global:listUsers.Items.Clear()
    $exclude = @("Administrator", "Guest", "DefaultAccount", "WDAGUtilityAccount")
    $foundUsers = @()

    try {
        $locals = Get-LocalUser | Where-Object { $_.Enabled -and $exclude -notcontains $_.Name } | Select-Object -ExpandProperty Name
        $foundUsers += $locals
    } catch {}
    
    try {
        $wmiFilter = "LocalAccount=True AND Disabled=False"
        $wmiUsers = if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) {
            Get-CimInstance -ClassName Win32_UserAccount -Filter $wmiFilter
        } else {
            Get-WmiObject -Class Win32_UserAccount -Filter $wmiFilter
        }
        $wNames = $wmiUsers | Where-Object { $exclude -notcontains $_.Name } | Select-Object -ExpandProperty Name
        $foundUsers += $wNames
    } catch {}

    try {
        $profiles = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false }
        $allAccounts = Get-WmiObject -Class Win32_UserAccount | Group-Object SID -AsHashTable -AsString
        foreach ($p in $profiles) {
            $acct = $allAccounts[$p.SID]
            if ($acct -and $exclude -notcontains $acct.Name) {
                $foundUsers += $acct.Name
            }
        }
    } catch {}

    $finalList = $foundUsers | Select-Object -Unique | Sort-Object
    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }

    foreach ($u in $finalList) {
        [void]$global:listUsers.Items.Add($u)
        if ($u -eq $actualUser) { $global:listUsers.SelectedItem = $u }
    }
    if ($null -eq $global:listUsers.SelectedItem -and $global:listUsers.Items.Count -gt 0) { $global:listUsers.SelectedIndex = 0 }
}

# MODE TOGGLES
$rbLock.Add_Checked({
    $txtLog.Document.Blocks.Clear()
    $btnApply.Content = "BLOCK"
    $btnApply.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#C42B1C")
    $btnApply.Foreground = [System.Windows.Media.Brushes]::White
    Log "Block mode selected" "#FF8C8C"
})

$rbUnlock.Add_Checked({
    $txtLog.Document.Blocks.Clear()
    $btnApply.Content = "UNBLOCK"
    $btnApply.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#107C10")
    $btnApply.Foreground = [System.Windows.Media.Brushes]::White
    Log "Unblock mode selected" "Green"
})

# SELECT ALL
$btnSelectAll.Add_Click({
    $allChecked = ($global:policyCheckBoxes.Values | Where-Object { $_.IsChecked }).Count -eq $global:policyCheckBoxes.Count
    $newState = -not $allChecked
    foreach ($chk in $global:policyCheckBoxes.Values) { $chk.IsChecked = $newState }
    $btnSelectAll.Content = if ($newState) { "UNSELECT ALL" } else { "SELECT ALL" }
})

$listUsers.Add_SelectionChanged({
    if ($listUsers.SelectedItem) {
        Invoke-StatusCheck $listUsers.SelectedItem $true
        Update-PrusaScheduleStatus
        Update-ClearOnLogoutStatus
        Update-DesktopIconsStatus
        Update-ShortcutStatus
    }
})

# APPLY POLICIES (DYNAMIC ENGINE)
$btnApply.Add_Click({
    $btnApply.IsEnabled = $false
    try {
        $txtLog.Document.Blocks.Clear()
        $isLockMode = $rbLock.IsChecked
        $targetUser = $listUsers.SelectedItem

        if (-not $targetUser) {
            Log "Error: Select a target user from the list first." "Red"
            return
        }

        $checkedPolicies = @()
        foreach ($p in $global:policiesManifest) {
            $chk = $global:policyCheckBoxes[$p.id]
            if ($null -ne $chk -and $chk.IsChecked) {
                $checkedPolicies += $p
            }
        }

        if ($checkedPolicies.Count -eq 0) {
            Log "Error: Select at least one restriction checkbox before applying." "Red"
            return
        }

        $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
        $isCurrentUser = ($targetUser -eq $actualUser)

        # Safety Check for Self-Lockout
        if ($isCurrentUser -and $isLockMode) {
            $msg = "WARNING: You are about to block system policies for YOUR OWN account ($targetUser).`n`nProceed?"
            $result = [System.Windows.Forms.MessageBox]::Show($msg, "Confirm Block", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Warning)
            if ($result -eq [System.Windows.Forms.DialogResult]::No) { Log "Operation cancelled by user." "Yellow"; return }
        }

        Log "Preparing to update policies for '$targetUser'..." "Blue"

        if ($isCurrentUser) {
            $basePath = "HKCU:"
            Log "Using current user hive (HKCU)..." "Yellow"
        }
        else {
            $sid = Get-UserSID $targetUser
            $isLoaded = $false
            if ($null -ne $sid -and (Test-Path "Registry::HKEY_USERS\$sid")) {
                $isLoaded = $true
                $basePath = "HKU:\$sid"
                if (-not (Get-PSDrive -Name HKU -ErrorAction SilentlyContinue)) {
                    New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null
                }
            }

            if (-not $isLoaded) {
                $profilePath = Get-UserProfilePath $targetUser
                if (!$profilePath) { Log "Error: Profile folder for '$targetUser' not found." "Red"; return }
                $userPath = Join-Path $profilePath "NTUSER.DAT"
                if (-not (Test-Path $userPath)) { Log "Error: NTUSER.DAT not found." "Red"; return }
                
                $hiveName = "MSM_TempHive"
                Invoke-HiveUnload $hiveName
                & reg.exe load "HKLM\$hiveName" "$userPath" *>$null
                
                if ($LASTEXITCODE -ne 0) { Log "Error: Failed to load hive (Code $LASTEXITCODE)." "Red"; return }
                $basePath = "HKLM:\$hiveName"
                $loadedViaReg = $true
            }
        }

        # Dynamic Policy Execution Loop
        foreach ($policy in $checkedPolicies) {
            Log "Processing '$($policy.name)'..." "Yellow"

            foreach ($k in $policy.keys) {
                $fullKey = "$basePath\$($k.path)"

                if ($isLockMode) {
                    if (-not (Test-Path $fullKey)) { New-Item -Path $fullKey -Force | Out-Null }
                    Set-ItemProperty -Path $fullKey -Name $k.name -Value $k.value -Type $k.type -Force
                }
                else {
                    if (Test-Path $fullKey) {
                        Remove-ItemProperty -Path $fullKey -Name $k.name -ErrorAction SilentlyContinue
                    }
                }
            }

            if ($isLockMode) {
                Log " [x] $($policy.name) BLOCKED" "Red"
            }
            else {
                Log " [x] $($policy.name) UNBLOCKED" "Green"
            }
        }

        # Handle DisallowRun master toggle cleanup if unblocking
        if (-not $isLockMode) {
            $disRunPath = "$basePath\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun"
            if (Test-Path $disRunPath) {
                $props = Get-ItemProperty -Path $disRunPath -ErrorAction SilentlyContinue
                $remainingValues = ($props.psobject.Properties | Where-Object { $_.Name -notmatch "^PS" }).Count
                if ($remainingValues -eq 0) {
                    Remove-ItemProperty -Path "$basePath\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "DisallowRun" -ErrorAction SilentlyContinue
                }
            }
        }

        Log "SUCCESS: Policies updated for '$targetUser'." "Green"
        Invoke-StatusCheck $targetUser $false
    }
    catch {
        Log "Unexpected error during policy apply: $_" "Red"
    }
    finally {
        if ($loadedViaReg) { Invoke-HiveUnload $hiveName }
        $btnApply.IsEnabled = $true
    }
})

# PRUSASLICER TOOLS 
$btnTogglePrusaSchedule.Add_Click({
    $btnApply.IsEnabled = $false
    try {
        $targetUser = $listUsers.SelectedItem
        if (-not $targetUser) { Log "Error: Select a target user." "Red"; return }

        $txtLog.Document.Blocks.Clear()
        $taskName = "Makerspace_PrusaReset_$targetUser"
        $taskExists = [bool](Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue)

        if ($taskExists) {
            # REMOVE SCHEDULE
            Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
            Log "SUCCESS: PrusaSlicer schedule removed for '$targetUser'." "Green"
        }
        else {
            # CREATE SCHEDULE
            if (-not (Test-PrusaInstalled)) { Log "Error: PrusaSlicer not installed." "Red"; return }

            Add-Type -AssemblyName Microsoft.VisualBasic
            $inst = "Select default filament material:`n`n 1 = Prusament PLA`n 2 = Generic ABS`n`nOr type custom name:"
            $matInput = [Microsoft.VisualBasic.Interaction]::InputBox($inst, "Select Default Material", "1")
            if ([string]::IsNullOrWhiteSpace($matInput)) { return }
            
            $selectedMaterial = switch ($matInput.Trim()) {
                "1" { "Prusament PLA" }
                "2" { "Generic ABS" }
                default { $matInput.Trim() }
            }

            $localScript = Initialize-LocalScript
            if ($null -eq $localScript) { Log "Error: Could not save local script copy." "Red"; return }

            $taskArgs = "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$localScript`" -ResetPrusa -TargetUser `"$targetUser`" -Material `"$selectedMaterial`""
            
            $action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument $taskArgs
            $triggers = @((New-ScheduledTaskTrigger -AtStartup), (New-ScheduledTaskTrigger -AtLogon))

            Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $triggers -User "System" -RunLevel Highest -Force
            Log "SUCCESS: PrusaSlicer schedule created for '$targetUser'." "Green"
        }

        Update-PrusaScheduleStatus
    }
    catch { Log "Error toggling schedule: $_" "Red" }
    finally { $btnApply.IsEnabled = $true }
})



# CLEAR ON LOGOUT TOOLS
$btnToggleClearOnLogout.Add_Click({
    $btnApply.IsEnabled = $false
    try {
        if ($null -ne $txtLog) { $txtLog.Document.Blocks.Clear() }
        $targetUser = $listUsers.SelectedItem
        if (-not $targetUser) { Log "Error: Select a target user." "Red"; return }

        $taskName = "Makerspace_ClearOnLogout_$targetUser"
        $taskExists = [bool](Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue)

        if ($taskExists) {
            # REMOVE SCHEDULE
            Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
            Log "SUCCESS: Clear On Logout schedule removed for '$targetUser'." "Green"
        }
        else {
            # ENABLE SCHEDULE - Clean up legacy scripts automatically if detected
            if (Test-LegacyClearOnLogoutInstalled) {
                Invoke-RemoveLegacyClearOnLogout
            }

            $localScript = Initialize-LocalScript
            if ($null -eq $localScript) { Log "Error: Could not save local script copy." "Red"; return }

            $taskArgs = "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$localScript`" -ClearOnLogout -TargetUser `"$targetUser`""
            
            $action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument $taskArgs
            $triggers = @(
                (New-ScheduledTaskTrigger -AtLogon),
                (New-ScheduledTaskTrigger -Daily -At "03:00")
            )

            Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $triggers -User "System" -RunLevel Highest -Force
            Log "SUCCESS: Clear On Logout schedule created for '$targetUser'." "Green"
        }

        Update-ClearOnLogoutStatus
    }
    catch { Log "Error toggling Clear On Logout schedule: $_" "Red" }
    finally { $btnApply.IsEnabled = $true }
})

# DESKTOP TOOLS
$btnToggleDesktopIcons.Add_Click({
    $btnApply.IsEnabled = $false
    try {
        if ($null -ne $txtLog) { $txtLog.Document.Blocks.Clear() }
        $targetUser = $listUsers.SelectedItem
        if (-not $targetUser) { Log "Error: Select a target user." "Red"; return }
        if (Test-IsAdmin $targetUser) { Log "Error: Target user is an Admin." "Red"; return }

        $publicDesktop = [Environment]::GetFolderPath("CommonDesktopDirectory")
        $userDesktop = Get-UserDesktopPath $targetUser
        if (!$userDesktop) { Log "Error: Desktop folder not found." "Red"; return }

        $shortcutsInPublic = @(Get-ChildItem -Path $publicDesktop -Filter "*.lnk" -ErrorAction SilentlyContinue)

        if ($shortcutsInPublic.Count -gt 0) {
            # UNLOCK DESKTOP ICONS
            $movedCount = 0
            foreach ($shortcut in $shortcutsInPublic) {
                Move-Item -Path $shortcut.FullName -Destination $userDesktop -Force
                Log " [^] Restored: $($shortcut.Name)" "Green"
                $movedCount++
            }
            Log "Done. $movedCount shortcuts restored." "Green"
        }
        else {
            # LOCK DESKTOP ICONS
            $shortcuts = Get-ChildItem -Path $userDesktop -Filter "*.lnk" -ErrorAction SilentlyContinue
            if ($shortcuts.Count -eq 0) { Log "No shortcuts found to lock." "Yellow"; return }

            $movedCount = 0
            foreach ($shortcut in $shortcuts) {
                $destPath = Join-Path $publicDesktop $shortcut.Name
                if (Test-Path $destPath) {
                    Remove-Item -Path $shortcut.FullName -Force -ErrorAction SilentlyContinue
                }
                else {
                    Copy-Item -Path $shortcut.FullName -Destination $destPath -Force
                    Remove-Item -Path $shortcut.FullName -Force
                    Log " [+] Locked: $($shortcut.Name)" "Red"
                    $movedCount++
                }
            }
            Log "Done. $movedCount shortcuts locked." "Green"
        }

        Update-DesktopIconsStatus
    }
    catch { Log "ERROR: $_" "Red" }
    finally { $btnApply.IsEnabled = $true }
})

# SCRIPT UPDATE HANDLER
if ($null -ne $global:btnUpdateScript) {
    $global:btnUpdateScript.Add_Click({
        $result = [System.Windows.Forms.MessageBox]::Show("A newer version of Makerspace Manager is available.`n`nWould you like to download and update now?", "Update Available", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Information)
        if ($result -eq [System.Windows.Forms.DialogResult]::Yes) {
            try {
                Log "Downloading update..." "Blue"
                $localScript = Initialize-LocalScript
                if ($null -ne $localScript) {
                    $freshContent = Invoke-RestMethod "https://msm.samwhitley.com" -ErrorAction Stop
                    $freshContent | Out-File $localScript -Encoding UTF8 -Force
                    Log "Update installed to $localScript. Launching updated version..." "Green"
                    Start-Process powershell.exe -ArgumentList "-ExecutionPolicy Bypass -NoProfile -File `"$localScript`""
                    $global:window.Close()
                }
            }
            catch {
                Log "Error applying script update: $_" "Red"
            }
        }
    })
}

# INSTALLER SHORTCUT
$btnInstallShortcut.Add_Click({
    $btnApply.IsEnabled = $false
    try {
        if ($null -ne $txtLog) { $txtLog.Document.Blocks.Clear() }
        $targetUser = $listUsers.SelectedItem
        if (-not $targetUser) { Log "Error: Select a target user." "Red"; return }
        if (-not (Test-IsAdmin $targetUser)) { Log "'$targetUser' is not an Admin. Shortcuts can only be managed for Admins." "Red"; return }

        $desktopPath = [Environment]::GetFolderPath("Desktop")
        $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
        if ($targetUser -ne $actualUser) {
            $userDesktop = Get-UserDesktopPath $targetUser
            if ($userDesktop) { $desktopPath = $userDesktop }
        }
        $shortcutPath = Join-Path $desktopPath "MakerspaceManager.lnk"

        if (Test-Path $shortcutPath) {
            # REMOVE SHORTCUT
            Remove-Item $shortcutPath -Force -ErrorAction SilentlyContinue
            Log "SUCCESS: Script shortcut removed from '$targetUser' desktop." "Green"
        }
        else {
            # CREATE SHORTCUT
            Log "Creating script shortcut..." "Blue"
            $localScript = Initialize-LocalScript
            if ($null -eq $localScript) { Log "Error: Could not save local script copy." "Red"; return }

            $WshShell = New-Object -ComObject WScript.Shell
            $psPath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
            $shortcut = $WshShell.CreateShortcut($shortcutPath)
            $shortcut.TargetPath = $psPath
            $shortcut.Arguments = "-NoProfile -ExecutionPolicy Bypass -Command `"`& { try { `$c = Invoke-RestMethod https://msm.samwhitley.com -ErrorAction Stop; `$c | Out-File '$localScript' -Force; Invoke-Expression `$c } catch { if (Test-Path '$localScript') { & '$localScript' } } }`""
            $shortcut.WorkingDirectory = $global:installDir
            $shortcut.IconLocation = "$psPath,0"
            $shortcut.Save()

            $bytes = [System.IO.File]::ReadAllBytes($shortcutPath)
            $bytes[21] = $bytes[21] -bor 0x20
            [System.IO.File]::WriteAllBytes($shortcutPath, $bytes)
            Log "SUCCESS: Script shortcut created on '$targetUser' desktop." "Green"
        }

        Update-ShortcutStatus
    }
    catch { Log "Error: $_" "Red" }
    finally { $btnApply.IsEnabled = $true }
})

# CLI EXECUTION
if ($ResetPrusa) {
    $timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")
    $global:logFile = Join-Path $logDir "MakerspaceManager_Task_Prusa_${timestamp}.log"
    Remove-OldLogs -path $logDir
    Log "=== CLI Mode: PrusaSlicer Reset ==="
    Start-PrusaReset -targetUser $TargetUser -material $Material
    Exit
}

if ($ClearOnLogout) {
    $timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")
    $global:logFile = Join-Path $logDir "MakerspaceManager_Task_ClearOnLogout_${timestamp}.log"
    Remove-OldLogs -path $logDir
    Log "=== CLI Mode: Clear On Logout Cleanup ==="
    Start-ClearOnLogoutCleanup -targetUser $TargetUser
    Exit
}

# STARTUP & MIGRATION
Remove-OldLogs -path $logDir
Invoke-ScriptMigration
Initialize-LocalScript | Out-Null
Update-UserList
Update-PrusaScheduleStatus
Update-ClearOnLogoutStatus
Update-DesktopIconsStatus
Update-ShortcutStatus
Test-RemoteScriptVersion
$global:window.ShowDialog() | Out-Null