#!/usr/bin/env bash
# Enrol this machine's Chrome in Chrome Enterprise Core.
#
# The Linux counterpart to enroll-chrome-management.ps1. Chrome reads the token
# from a file under /etc at startup, so this needs root, and it applies to every
# user on the machine.
#
#   sudo scripts/enroll-chrome-management.sh <token>
#   sudo scripts/enroll-chrome-management.sh --remove
#
# Chrome only — Chromium builds have no cloud-management support, so a Chromium
# install cannot be enrolled and stays subject to the off-store restriction.
set -euo pipefail

DIR=/etc/opt/chrome/policies/enrollment
TOKEN_FILE="$DIR/CloudManagementEnrollmentToken"

info() { printf '  %s\n' "$1"; }
fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || fail "run this with sudo — the token lives under /etc"
[ $# -ge 1 ] || fail "usage: $0 <enrollment-token> | --remove"

if [ "$1" = "--remove" ]; then
    rm -f "$TOKEN_FILE" "$DIR/CloudManagementEnrollmentOptions"
    info "removed $TOKEN_FILE"
    info "Restart Chrome. This stops it asking for policy, but does not undo the"
    info "enrolment on Google's side — delete the browser from Devices > Chrome >"
    info "Managed browsers too."
    exit 0
fi

[ -d /etc/opt/chrome ] || fail "no /etc/opt/chrome — this is for Google Chrome, not Chromium"

mkdir -p "$DIR"
# The file must contain the token and nothing else: no quotes, no newline noise,
# no filename extension. Chrome reads it verbatim.
printf '%s' "$1" > "$TOKEN_FILE"
chmod 644 "$TOKEN_FILE"
info "wrote $TOKEN_FILE"

echo
info "Next:"
info "  1. Restart Chrome completely."
info "  2. chrome://policy should name the Admin console as a policy source, and"
info "     chrome://management should say the browser is managed."
info "  3. Then: sudo scripts/install-extension-policy.sh"