@echo off
setlocal enableextensions
chcp 65001 >nul 2>nul
cd /d "%~dp0"

REM ============================================================================
REM  BestPerf 开放网络权限(防火墙)
REM  小白用户:直接双击本文件,弹出窗口点"是"即可。不用懂防火墙。
REM
REM  作用:开放"别人测向这台机器"所需的入站端口:
REM    UDP 39700-39899  探针 + 压力流
REM    TCP 39800-39899  TCP 吞吐测试
REM    TCP 8768         控制台(对端协调 / 拉取结果)
REM  用端口"段"规则:即使二进制改名/升级也仍然有效。
REM ============================================================================

if not defined FIELDREPLAY_FIREWALL_OUT set "FIELDREPLAY_FIREWALL_OUT=%CD%"
if not exist "%FIELDREPLAY_FIREWALL_OUT%" mkdir "%FIELDREPLAY_FIREWALL_OUT%" >nul 2>nul
set "FIELDREPLAY_FIREWALL_REPORT=%FIELDREPLAY_FIREWALL_OUT%\firewall_report.latest.json"
set "FIELDREPLAY_FIREWALL_SUMMARY=%FIELDREPLAY_FIREWALL_OUT%\firewall_summary.latest.txt"
set "FIELDREPLAY_FIREWALL_LOG=%FIELDREPLAY_FIREWALL_OUT%\bestperf-firewall.latest.log"

REM 是不是管理员?是 -> 直接开;不是 -> 自动请求授权(弹一次 UAC,用户点"是")。
net session >nul 2>nul
if %errorlevel%==0 goto do_open

echo.
echo BestPerf 需要一次 Windows 授权来"开放网络权限"。
echo 接下来会弹出一个窗口,请点击 "是" / "Yes"。
echo.
powershell -NoProfile -ExecutionPolicy Bypass -Command "try { Start-Process -FilePath '%~f0' -Verb RunAs -ErrorAction Stop } catch { exit 1 }"
if errorlevel 1 goto elevate_failed
echo 已在另一个(管理员)窗口里继续开放。完成后那个窗口会提示"完成"。
exit /b 0

:elevate_failed
echo.
echo 没能获得授权(可能这台电脑不是管理员账号,或你点了"否")。
echo - 如果你是管理员:重新双击本文件,在弹窗里点 "是"。
echo - 如果不是管理员:请找管理员 / IT 帮忙运行一次本文件。
echo.
> "%FIELDREPLAY_FIREWALL_REPORT%" echo {"schema":"field_replay.windows_firewall_fix.v1","status":"needs_admin","run_result":"admin_required","is_admin":false}
> "%FIELDREPLAY_FIREWALL_SUMMARY%" echo 状态: 需要管理员权限。请用管理员账号重新双击 "BestPerf Fix UDP.bat",或找 IT 运行一次。
pause
exit /b 2

:do_open
echo 正在开放 BestPerf 网络权限(防火墙)...
> "%FIELDREPLAY_FIREWALL_LOG%" echo BestPerf firewall open %DATE% %TIME%

set "FW_FAIL=0"
netsh advfirewall firewall delete rule name="BestPerf UDP" >nul 2>&1
netsh advfirewall firewall delete rule name="BestPerf TCP" >nul 2>&1
netsh advfirewall firewall delete rule name="BestPerf Console" >nul 2>&1

netsh advfirewall firewall add rule name="BestPerf UDP" dir=in action=allow protocol=UDP localport=39700-39899 >>"%FIELDREPLAY_FIREWALL_LOG%" 2>&1
if errorlevel 1 set "FW_FAIL=1"
netsh advfirewall firewall add rule name="BestPerf TCP" dir=in action=allow protocol=TCP localport=39800-39899 >>"%FIELDREPLAY_FIREWALL_LOG%" 2>&1
if errorlevel 1 set "FW_FAIL=1"
netsh advfirewall firewall add rule name="BestPerf Console" dir=in action=allow protocol=TCP localport=8768 >>"%FIELDREPLAY_FIREWALL_LOG%" 2>&1
if errorlevel 1 set "FW_FAIL=1"

if "%FW_FAIL%"=="0" (set "FW_STATUS=ready") else (set "FW_STATUS=failed")

> "%FIELDREPLAY_FIREWALL_REPORT%" echo {
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo   "schema": "field_replay.windows_firewall_fix.v1",
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo   "status": "%FW_STATUS%",
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo   "is_admin": true,
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo   "rules": [
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo     {"name": "BestPerf UDP", "protocol": "UDP", "localport": "39700-39899"},
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo     {"name": "BestPerf TCP", "protocol": "TCP", "localport": "39800-39899"},
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo     {"name": "BestPerf Console", "protocol": "TCP", "localport": "8768"}
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo   ]
>> "%FIELDREPLAY_FIREWALL_REPORT%" echo }

> "%FIELDREPLAY_FIREWALL_SUMMARY%" echo BestPerf 防火墙开放结果
>> "%FIELDREPLAY_FIREWALL_SUMMARY%" echo.
if "%FW_STATUS%"=="ready" (
  >> "%FIELDREPLAY_FIREWALL_SUMMARY%" echo 状态: 已开放。现在局域网内其他电脑可以"测向"这台机器了。
) else (
  >> "%FIELDREPLAY_FIREWALL_SUMMARY%" echo 状态: 开放失败。请把 bestperf-firewall.latest.log 发给支持人员。
)
>> "%FIELDREPLAY_FIREWALL_SUMMARY%" echo 端口: UDP 39700-39899, TCP 39800-39899, TCP 8768

echo.
echo === 当前 BestPerf 防火墙规则 ===
netsh advfirewall firewall show rule name="BestPerf UDP" | findstr /I "Rule LocalPort Action Enabled"
netsh advfirewall firewall show rule name="BestPerf Console" | findstr /I "Rule LocalPort Action Enabled"
echo.
if "%FW_STATUS%"=="ready" (
  echo 完成!现在局域网内其他电脑可以"测向"这台机器了。
) else (
  echo 开放失败。请把日志发给支持人员: %FIELDREPLAY_FIREWALL_LOG%
)
echo 报告: %FIELDREPLAY_FIREWALL_REPORT%
echo.
pause
exit /b 0
