#!/usr/bin/env bash
# Installs Kadence's privileged helper and its polkit action.
#
# The desktop app itself never runs as root; this one small script is the entire
# privileged surface, and you can read all of it in a minute.
#
#   sudo ./install.sh                     # prompt once per session (recommended)
#   sudo ./install.sh --passwordless      # no prompt for the invoking user
#   sudo ./install.sh --uninstall
set -euo pipefail

HELPER_SRC="$(dirname "$(readlink -f "$0")")/kadence-helper"
POLICY_SRC="$(dirname "$(readlink -f "$0")")/org.kadence.helper.policy"
HELPER_DEST="/usr/local/bin/kadence-helper"
POLICY_DEST="/usr/share/polkit-1/actions/org.kadence.helper.policy"
RULE_DEST="/etc/polkit-1/rules.d/49-kadence.rules"

TARGET_USER="${SUDO_USER:-${USER:-root}}"
PASSWORDLESS=0
UNINSTALL=0

while [[ $# -gt 0 ]]; do
  case "$1" in
    --passwordless) PASSWORDLESS=1 ;;
    --uninstall) UNINSTALL=1 ;;
    --user) TARGET_USER="$2"; shift ;;
    -h|--help) sed -n '2,12p' "$0"; exit 0 ;;
    *) echo "unknown option: $1" >&2; exit 2 ;;
  esac
  shift
done

if [[ $EUID -ne 0 ]]; then
  echo "Run me with sudo." >&2
  exit 1
fi

if [[ $UNINSTALL -eq 1 ]]; then
  # Unblock first — leaving a block behind after uninstalling would be rude.
  [[ -x "$HELPER_DEST" ]] && "$HELPER_DEST" clear || true
  rm -f "$HELPER_DEST" "$POLICY_DEST" "$RULE_DEST"
  echo "Removed the helper, its polkit action and any passwordless rule."
  exit 0
fi

install -m 0755 -o root -g root "$HELPER_SRC" "$HELPER_DEST"
install -m 0644 -o root -g root "$POLICY_SRC" "$POLICY_DEST"
echo "Installed $HELPER_DEST and its polkit action."

if [[ $PASSWORDLESS -eq 1 ]]; then
  mkdir -p "$(dirname "$RULE_DEST")"
  cat > "$RULE_DEST" <<RULE
// Lets $TARGET_USER manage the Kadence block list without a password prompt.
// Scope: this one action, this one user, this one helper binary.
polkit.addRule(function (action, subject) {
    if (action.id == "org.kadence.helper.manage-hosts" &&
        subject.user == "$TARGET_USER" && subject.local && subject.active) {
        return polkit.Result.YES;
    }
});
RULE
  chmod 0644 "$RULE_DEST"
  echo "Passwordless blocking enabled for '$TARGET_USER' ($RULE_DEST)."
  echo "Remove that file to go back to prompting."
fi

echo
echo "Check it works:  $HELPER_DEST status"