# OpenSSH invokes this through SSH_ASKPASS. stdout goes only to OpenSSH.
# Never log or pass plaintext as a process argument. Persist only user-bound DPAPI ciphertext.
$ErrorActionPreference = 'Stop'
[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
# A Codex PowerShell 7 parent may supply a different PSModulePath.
Import-Module (Join-Path $PSHOME 'Modules/Microsoft.PowerShell.Security/Microsoft.PowerShell.Security.psd1')
Import-Module (Join-Path $PSHOME 'Modules/Microsoft.PowerShell.Management/Microsoft.PowerShell.Management.psd1')
if ($env:CAIWU_DEPLOY_PASSWORD_UPDATE -ne '1' -and (Test-Path -LiteralPath $env:CAIWU_DEPLOY_PASSWORD_CACHE)) {
    $secure = (Get-Content -LiteralPath $env:CAIWU_DEPLOY_PASSWORD_CACHE -Raw).Trim() | ConvertTo-SecureString
    $credential = [Management.Automation.PSCredential]::new('deploy', $secure)
    [Console]::Out.WriteLine($credential.GetNetworkCredential().Password)
    exit 0
}
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing
$form = New-Object Windows.Forms.Form
$form.Text = '财务系统：部署登录'
$form.ClientSize = New-Object Drawing.Size(430, 155)
$form.StartPosition = 'CenterScreen'
$form.TopMost = $true
$label = New-Object Windows.Forms.Label
$label.Text = "请输入服务器 $env:CAIWU_DEPLOY_LOGIN 的密码："
$label.SetBounds(15, 15, 400, 40)
$inputBox = New-Object Windows.Forms.TextBox
$inputBox.UseSystemPasswordChar = $true
$inputBox.SetBounds(15, 60, 400, 25)
$ok = New-Object Windows.Forms.Button
$ok.Text = '登录'
$ok.SetBounds(250, 105, 75, 30)
$ok.DialogResult = [Windows.Forms.DialogResult]::OK
$cancel = New-Object Windows.Forms.Button
$cancel.Text = '取消'
$cancel.SetBounds(335, 105, 75, 30)
$cancel.DialogResult = [Windows.Forms.DialogResult]::Cancel
$form.Controls.AddRange(@($label, $inputBox, $ok, $cancel))
$form.AcceptButton = $ok
$form.CancelButton = $cancel
try {
    if ($form.ShowDialog() -ne [Windows.Forms.DialogResult]::OK) { exit 1 }
    # DPAPI ciphertext, restricted to this Windows user, reused by later deployments.
    $secure = ConvertTo-SecureString -String $inputBox.Text -AsPlainText -Force
    $secure | ConvertFrom-SecureString | Set-Content -LiteralPath $env:CAIWU_DEPLOY_PASSWORD_CACHE -Encoding ASCII
    [Console]::Out.WriteLine($inputBox.Text)
} finally {
    $inputBox.Clear()
    $form.Dispose()
}