#!/usr/bin/env bash
# Enrol this machine's Chrome in Chrome Enterprise Core.
#
# The Linux counterpart to enroll-chrome-management.ps1. Chrome reads the token
# from a file under /etc at startup, so this needs root, and it applies to every
# user on the machine.
#
#   sudo scripts/enroll-chrome-management.sh            # the built-in token
#   sudo scripts/enroll-chrome-management.sh <token>    # a different one
#   sudo scripts/enroll-chrome-management.sh --remove
#
# Chrome only — Chromium builds have no cloud-management support, so a Chromium
# install cannot be enrolled and stays subject to the off-store restriction.
set -euo pipefail

# Defaulted so setup is hands-off. A token is reusable and enrols any number of
# browsers, which is what makes a baked-in default work. It is a modest secret:
# anyone holding it can enrol *their* browser into the org — our policies and a
# row in the console — and nothing more. Rotate it in Devices > Chrome > Managed
# browsers and change it here.
DEFAULT_TOKEN=ce4fa6cd-e940-45f6-9086-85075d6cff34

DIR=/etc/opt/chrome/policies/enrollment
TOKEN_FILE="$DIR/CloudManagementEnrollmentToken"

info() { printf '  %s\n' "$1"; }
fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || fail "run this with sudo — the token lives under /etc"

if [ "$1" = "--remove" ]; then
    rm -f "$TOKEN_FILE" "$DIR/CloudManagementEnrollmentOptions"
    info "removed $TOKEN_FILE"
    info "Restart Chrome. This stops it asking for policy, but does not undo the"
    info "enrolment on Google's side — delete the browser from Devices > Chrome >"
    info "Managed browsers too."
    exit 0
fi

TOKEN="${1:-$DEFAULT_TOKEN}"

# Enrolling a browser that is not installed would write a token nothing reads.
# Chromium is not a substitute: it has no cloud-management support, so it can
# never be enrolled, and Google publishes Chrome for x86_64 only — on a Pi there
# is no version of this that works, and saying so beats installing something
# that cannot do the job.
if ! command -v google-chrome >/dev/null 2>&1 && [ ! -x /opt/google/chrome/chrome ]; then
    ARCH=$(uname -m)
    [ "$ARCH" = "x86_64" ] || fail "Google Chrome is not published for $ARCH. Chromium cannot be enrolled — this machine cannot run the extension."
    command -v apt-get >/dev/null || fail "Chrome is missing and this is not an apt system — install Google Chrome, then re-run"

    info "Google Chrome is not installed — fetching it from Google (about 110 MB)"
    DEB=$(mktemp --suffix=.deb)
    curl -fsSL -o "$DEB" https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb \
        || fail "could not download Chrome"
    # apt rather than dpkg: it pulls the dependencies a bare dpkg -i would leave
    # half-configured.
    DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB" >/dev/null || fail "Chrome install failed"
    rm -f "$DEB"
    info "Chrome installed"
fi

mkdir -p "$DIR"
# The file must contain the token and nothing else: no quotes, no newline noise,
# no filename extension. Chrome reads it verbatim.
printf '%s' "$TOKEN" > "$TOKEN_FILE"
chmod 644 "$TOKEN_FILE"
info "wrote $TOKEN_FILE"

echo
info "Next:"
info "  1. Restart Chrome completely."
info "  2. chrome://policy should name the Admin console as a policy source, and"
info "     chrome://management should say the browser is managed."
info "  3. Then: sudo scripts/install-extension-policy.sh"