param(
  [Parameter(Mandatory = $true)]
  [string] $PfxPath,

  [Parameter(Mandatory = $true)]
  [string] $CerPath,

  [Parameter(Mandatory = $true)]
  [string] $Password,

  [Parameter(Mandatory = $true)]
  [string] $Subject,

  [string] $VerifyPath = ''
)

$ErrorActionPreference = 'Stop'
$securityModule = Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1'
$pkiModule = Join-Path $PSHOME 'Modules\PKI\PKI.psd1'
Import-Module $securityModule -ErrorAction Stop
Import-Module $pkiModule -ErrorAction Stop

if ($VerifyPath) {
  if (-not (Test-Path -LiteralPath $VerifyPath)) {
    throw "Signed artifact was not found: $VerifyPath"
  }
  if (-not (Test-Path -LiteralPath $CerPath)) {
    throw "Signing certificate was not found: $CerPath"
  }

  $certificate = [Security.Cryptography.X509Certificates.X509Certificate2]::new($CerPath)
  $signature = Get-AuthenticodeSignature -FilePath $VerifyPath
  if (-not $signature.SignerCertificate) {
    throw "Signed artifact does not expose a signer certificate: $VerifyPath"
  }
  if ($signature.SignerCertificate.Thumbprint -ne $certificate.Thumbprint) {
    throw "Signed artifact certificate does not match the exported developer certificate: $VerifyPath"
  }
  exit 0
}

$parent = Split-Path -Parent $PfxPath
if ($parent) {
  New-Item -ItemType Directory -Force -Path $parent | Out-Null
}

$securePassword = ConvertTo-SecureString -String $Password -AsPlainText -Force
if (Test-Path -LiteralPath $PfxPath) {
  $certificate = [Security.Cryptography.X509Certificates.X509Certificate2]::new($PfxPath, $securePassword)
  $cerMatches = $false
  if (Test-Path -LiteralPath $CerPath) {
    $existingCer = [Security.Cryptography.X509Certificates.X509Certificate2]::new($CerPath)
    $cerMatches = $existingCer.Thumbprint -eq $certificate.Thumbprint
  }
  if (-not $cerMatches) {
    Export-Certificate -Cert $certificate -FilePath $CerPath -Force | Out-Null
  }
} else {
  $certificate = New-SelfSignedCertificate `
    -Type CodeSigningCert `
    -Subject $Subject `
    -CertStoreLocation 'Cert:\CurrentUser\My' `
    -KeyExportPolicy Exportable `
    -KeyUsage DigitalSignature `
    -FriendlyName 'YMhut Box WinUI local signing'

  Export-PfxCertificate -Cert $certificate -FilePath $PfxPath -Password $securePassword | Out-Null
  Export-Certificate -Cert $certificate -FilePath $CerPath -Force | Out-Null
}

foreach ($store in @('Cert:\CurrentUser\Root', 'Cert:\CurrentUser\TrustedPeople')) {
  $present = Get-ChildItem -Path $store | Where-Object Thumbprint -eq $certificate.Thumbprint
  if (-not $present) {
    Import-Certificate -FilePath $CerPath -CertStoreLocation $store | Out-Null
  }
}