<#
.SYNOPSIS
    Importiert das Always-Encrypted-Zertifikat in CurrentUser\My.
.NOTES
    PFX-Passwort (nur Dev): ESB-AE-Dev-Only!
    Thumbprint muss mit appsettings AlwaysEncrypted:CertificateThumbprint uebereinstimmen.
#>
$ErrorActionPreference = "Stop"

$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$pfxPath = Join-Path $scriptDir "ESB_ZertifikatManager_AE.pfx"
$thumbPath = Join-Path $scriptDir "thumbprint.txt"

if (-not (Test-Path $pfxPath)) {
    throw "PFX nicht gefunden: $pfxPath"
}

$expectedThumb = (Get-Content -Path $thumbPath -Raw).Trim()
$password = ConvertTo-SecureString -String "ESB-AE-Dev-Only!" -Force -AsPlainText

$imported = Import-PfxCertificate `
    -FilePath $pfxPath `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -Password $password `
    -Exportable

Write-Host "Zertifikat importiert:"
Write-Host "  Subject    : $($imported.Subject)"
Write-Host "  Thumbprint : $($imported.Thumbprint)"
Write-Host "  PrivateKey : $($imported.HasPrivateKey)"

if (-not [string]::Equals(
        $imported.Thumbprint,
        $expectedThumb,
        [System.StringComparison]::OrdinalIgnoreCase)) {
    Write-Warning "Thumbprint weicht von thumbprint.txt ab ($expectedThumb)."
}

Write-Host ""
Write-Host "appsettings.json AlwaysEncrypted:CertificateThumbprint ="
Write-Host $imported.Thumbprint