Utils.ps1

<#
  Script: Utils.ps1
  License: MIT
  Purpose: Shared helper functions for Windows Hardening Suite.
  Usage:   . $PSScriptRoot\Utils.ps1
#>

$ErrorActionPreference = 'Stop'

# --- Configuration ---
$Global:LogRoot = 'C:\Users\Public\Documents\WinHardening_Logs'
if (-not (Test-Path $Global:LogRoot)) { New-Item -ItemType Directory -Force -Path $Global:LogRoot | Out-Null }

function Show-Banner {
    Write-Host "    ___    ___________ ___________ " -ForegroundColor Cyan
    Write-Host "   /   |  / ____/ ___//  _/ ___/ " -ForegroundColor Cyan
    Write-Host "  / /| | / __/  \__ \ / / \__ \  " -ForegroundColor Cyan
    Write-Host " / ___ |/ /___ ___/ // / ___/ /  " -ForegroundColor Cyan
    Write-Host "/_/  |_/_____//____/___//____/   " -ForegroundColor Cyan
    Write-Host "                                 "
    Write-Host "      WINDOWS HARDENING SUITE    " -ForegroundColor DarkGray
    Write-Host "---------------------------------" -ForegroundColor Gray
}

# --- Logging & UI ---
function Write-Step   { param([string]$m) Write-Host ("[*] {0}" -f $m) -ForegroundColor Cyan }
function Write-Ok     { param([string]$m) Write-Host ("  ✔ {0}" -f $m) -ForegroundColor Green }
function Write-Warn   { param([string]$m) Write-Host ("  ⚠ {0}" -f $m) -ForegroundColor Yellow }
function Write-ErrorMsg { param([string]$m) Write-Host ("  ✘ {0}" -f $m) -ForegroundColor Red }
function Write-DryRun { param([string]$m) Write-Host ("  [DRY] {0}" -f $m) -ForegroundColor DarkGray }

function Start-Log {
    param([string]$ScriptName)
    Show-Banner
    $ts = Get-Date -Format 'yyyyMMdd_HHmmss'
    $logPath = Join-Path $Global:LogRoot ("{0}_{1}.log" -f $ScriptName, $ts)
    Start-Transcript -Path $logPath -Force | Out-Null
    Write-Step "Log started: $logPath"
    return $logPath
}

function Stop-Log {
    Stop-Transcript | Out-Null
}

function Test-IsAdmin {
    $currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentIdentity)
    return $principal.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
}

function Assert-Admin {
    if (-not (Test-IsAdmin)) {
        Write-Error "This script requires Administrator privileges. Please run as Administrator." -ErrorAction Stop
    }
}

# --- Registry Helpers ---
function Ensure-RegistryValue {
    param(
        [string]$Path,
        [string]$Name,
        [ValidateSet('String','ExpandString','DWord','QWord','Binary','MultiString')][string]$Type,
        [object]$Value
    )
    if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
    
    $current = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name
    if ($null -eq $current -or $current -ne $Value) {
        if ($null -eq (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue)) {
            New-ItemProperty -Path $Path -Name $Name -PropertyType $Type -Value $Value -Force | Out-Null
        } else {
            Set-ItemProperty -Path $Path -Name $Name -Value $Value | Out-Null
        }
        Write-Ok "Registry: $Name set to $Value"
    }
}

# --- Service Helpers ---
function Set-ServiceState {
    param(
        [string]$Name,
        [ValidateSet('Disabled','Manual','Automatic','AutomaticDelayedStart')][string]$StartupType,
        [switch]$Stop,
        [switch]$DryRun
    )
    
    $svc = Get-Service -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $svc) { return } # Service doesn't exist, skip

    $actionMsg = "$Name -> $StartupType"
    if ($Stop) { $actionMsg += " (Stopped)" }

    if ($DryRun) {
        Write-DryRun $actionMsg
    } else {
        try {
            if ($svc.StartType -ne $StartupType) {
                Set-Service -Name $Name -StartupType $StartupType -ErrorAction Stop
                Write-Ok "Service configured: $Name ($StartupType)"
            }
            if ($Stop -and $svc.Status -eq 'Running') {
                Stop-Service -Name $Name -Force -ErrorAction SilentlyContinue
                Write-Ok "Service stopped: $Name"
            }
        } catch {
            Write-Warn "Failed to configure service $Name : $($_.Exception.Message)"
        }
    }
}

# --- Firewall Helpers ---
function Ensure-FirewallBlock {
    param(
        [string]$Name,
        [ValidateSet('Inbound','Outbound')][string]$Direction,
        [ValidateSet('TCP','UDP')][string]$Protocol,
        [string]$Port,
        [switch]$DryRun
    )
    
    if ($DryRun) {
        Write-DryRun "Firewall Block: $Name ($Direction/$Protocol/$Port)"
        return
    }

    if (-not (Get-NetFirewallRule -DisplayName $Name -ErrorAction SilentlyContinue)) {
        $p = @{ 
            DisplayName=$Name; 
            Direction=$Direction; 
            Protocol=$Protocol; 
            Action='Block'; 
            Profile='Any'; 
            EdgeTraversalPolicy='Block' 
        }
        if ($Direction -eq 'Outbound') { $p.RemotePort=$Port } else { $p.LocalPort=$Port }
        
        try { 
            New-NetFirewallRule @p | Out-Null 
            Write-Ok "Firewall rule added: $Name" 
        } catch {
            Write-Warn "Failed to add firewall rule $Name"
        }
    }
}