#!/usr/bin/env bash
# Install the AutoFirmer extension from our own update server, via policy.
#
# The Linux counterpart to install-extension-policy.ps1. Chrome reads managed
# policy from JSON files under /etc, so unlike Windows there is no per-user
# option here — it needs root, and it applies to everyone on the machine.
#
#   sudo scripts/install-extension-policy.sh            # install
#   sudo scripts/install-extension-policy.sh --remove   # take it back off
set -euo pipefail

ID="${EXTENSION_ID:-lkjbblagjjbldlkeaaffhiopdlhniaan}"
UPDATE_URL="${EXTENSION_UPDATE_URL:-https://ext.juicerroom.com/updates.xml}"
FILE=autofirmer.json

REMOVE=0
[ "${1:-}" = "--remove" ] && REMOVE=1

info() { printf '  %s\n' "$1"; }
fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || fail "run this with sudo — Chrome only reads policy from /etc"

# Every Chromium-family browser reads the same policy format from its own
# directory. Only the ones actually installed are touched: creating the
# directory for a browser that is not there would do nothing but confuse
# whoever finds it later.
CANDIDATES="
/etc/opt/chrome/policies/managed
/etc/chromium/policies/managed
/etc/chromium-browser/policies/managed
/etc/opt/edge/policies/managed
/etc/brave/policies/managed
"

touched=0
for dir in $CANDIDATES; do
    parent=$(dirname "$(dirname "$dir")")      # e.g. /etc/opt/chrome
    [ -d "$parent" ] || [ -d "$dir" ] || continue

    if [ "$REMOVE" -eq 1 ]; then
        if [ -f "$dir/$FILE" ]; then
            rm -f "$dir/$FILE"
            info "removed $dir/$FILE"
            touched=$((touched + 1))
        fi
        continue
    fi

    mkdir -p "$dir"
    # Its own file rather than an edit of someone else's: Chrome merges every
    # JSON in this directory, so a separate file cannot corrupt a policy set by
    # something else. Two files setting ExtensionInstallForcelist would collide,
    # which is worth knowing if this machine is centrally managed.
    cat > "$dir/$FILE" <<JSON
{
  "ExtensionInstallForcelist": ["$ID;$UPDATE_URL"]
}
JSON
    chmod 644 "$dir/$FILE"
    info "wrote $dir/$FILE"
    touched=$((touched + 1))
done

if [ "$touched" -eq 0 ]; then
    if [ "$REMOVE" -eq 1 ]; then
        info "nothing to remove"
    else
        fail "found no Chrome, Chromium, Edge or Brave installation to configure"
    fi
    exit 0
fi

echo
if [ "$REMOVE" -eq 1 ]; then
    info "Restart the browser to let the change take effect."
else
    info "Next:"
    info "  1. Remove any unpacked copy from chrome://extensions (same id — both cannot load)."
    info "  2. Restart the browser, or open chrome://policy and press \"Reload policies\"."
    info "  3. The card should read \"Installed by enterprise policy\"."
fi