[CmdletBinding()]
param(
    [string]$Version = '18.4-1',
    [string]$Destination = (Join-Path $PSScriptRoot 'prerequisites\postgresql-18-windows-x64.exe')
)

$ErrorActionPreference = 'Stop'
$destinationDirectory = Split-Path -Parent $Destination
New-Item -ItemType Directory -Path $destinationDirectory -Force | Out-Null

$url = "https://get.enterprisedb.com/postgresql/postgresql-$Version-windows-x64.exe"
$temporaryFile = "$Destination.download"

Write-Host "Downloading PostgreSQL $Version from $url"
Invoke-WebRequest -Uri $url -OutFile $temporaryFile -UseBasicParsing

$signature = Get-AuthenticodeSignature -FilePath $temporaryFile
if ($signature.Status -ne 'Valid') {
    Remove-Item -LiteralPath $temporaryFile -Force -ErrorAction SilentlyContinue
    throw "PostgreSQL installer signature is not valid: $($signature.Status)"
}

if ($signature.SignerCertificate.Subject -notmatch 'EnterpriseDB|EDB') {
    Remove-Item -LiteralPath $temporaryFile -Force -ErrorAction SilentlyContinue
    throw "Unexpected PostgreSQL installer signer: $($signature.SignerCertificate.Subject)"
}

Move-Item -LiteralPath $temporaryFile -Destination $Destination -Force
$hash = Get-FileHash -LiteralPath $Destination -Algorithm SHA256
Write-Host "Saved: $Destination"
Write-Host "SHA256: $($hash.Hash)"