#!/bin/sh
# The web browser chosen in the first-run setup, installed for everyone on the
# machine: downloaded from its publisher (never shipped in the image) and run
# silently as SYSTEM in the machine's Windows system. With winget installed
# (the user's own), winget does it; otherwise the publisher's download link,
# fetched by sg-fetch (HTTPS only; the image has no curl).
# Run as root by sg-oobe-browser.service -- started by sg-oobed, and at each
# boot while the request is still there (offline: it tries again).
#
# SPDX-License-Identifier: AGPL-3.0-or-later
set -u
SG_LIB="${SG_LIB:-/usr/lib/stained-glass}"
# shellcheck source=lib/sg-common.sh
. "$SG_LIB/sg-common.sh"
REQ="${SG_OOBE_BROWSER_REQ:-/var/lib/stained-glass/oobe-browser}"
[ -r "$REQ" ] || exit 0
id=$(head -1 "$REQ")
# A Linux build: apt, with its maker's source -- sg-admind's own install
# (SG Store's Linux apps go the same way), as root here.
case "$id" in
    linux:firefox|linux:google-chrome-stable|linux:microsoft-edge-stable)
        pkg=${id#linux:}
        admind="${SG_ADMIND:-/usr/libexec/stained-glass/sg-admind}"
        [ -r "$admind" ] || { sg_log "oobe-browser: no sg-admind (sg-shell) for $pkg; trying again at the next boot"; exit 1; }
        sg_log "oobe-browser: installing $pkg (Linux)"
        if python3 -c 'import runpy, sys
g = runpy.run_path(sys.argv[1], run_name="sg_oobe_browser")
print("\n".join(g["op_apt_install"]([sys.argv[2]])))' "$admind" "$pkg" 2>&1 | sed 's/^/oobe-browser: /' >&2 \
           && dpkg-query -W -f '${db:Status-Status}' "$pkg" 2>/dev/null | grep -qx installed; then
            sg_log "oobe-browser: $pkg is installed"; rm -f "$REQ"; exit 0
        fi
        sg_log "oobe-browser: $pkg was not installed; trying again at the next boot"
        exit 1 ;;
esac
case "$id" in
    Mozilla.Firefox)     url='https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US'; exe='Mozilla Firefox/firefox.exe' ;;
    Mozilla.Firefox.ESR) url='https://download.mozilla.org/?product=firefox-esr-latest-ssl&os=win64&lang=en-US'; exe='Mozilla Firefox/firefox.exe' ;;
    Google.Chrome|Microsoft.Edge) url=''; exe='' ;;
    *) sg_log "oobe-browser: '$id' is not offered; nothing to do"; rm -f "$REQ"; exit 0 ;;
esac
sg_log "oobe-browser: installing $id"
# SYSTEM's temporary folder: installers unpack there first (Firefox's did,
# and failed without it). sg-services-start makes it too; this may run first.
runuser -u "$SG_SYSTEM_USER" -- mkdir -p "$SG_PREFIX/drive_c/users/$SG_SYSTEM_USER/AppData/Local/Temp" 2>/dev/null
# Get a web browser (sg-shell) installs what it offers -- from the
# publisher's download in winget's manifests, checked against its SHA-256 --
# with no window: /install ID. As SYSTEM, which needs no elevation
# (SG_IN_BROKER: never the consent prompt).
browser="${SG_SHELL_DIR:-/usr/libexec/stained-glass/shell}/sg-browser64.exe"
if [ -f "$browser" ] && [ "$id" != Mozilla.Firefox.ESR ]; then
    # shellcheck disable=SC2016  # expanded by the inner shell, as SYSTEM
    runuser -u "$SG_SYSTEM_USER" -- env -u DISPLAY -u WAYLAND_DISPLAY SG_IN_BROKER=1 \
        SG_WINSTATION='__wineservice_winstation\Default' SG_LIB="$SG_LIB" ID="$id" BROWSER="$browser" sh -c '
        . "$SG_LIB/sg-common.sh"; sg_wine_env
        exec wine "$BROWSER" /install "$ID"' 2>&1 | sed 's/^/oobe-browser: /' >&2
fi
if [ -z "$exe" ]; then
    # sg-browser's install shows in Program Files
    for p in "Google/Chrome/Application/chrome.exe" "Microsoft/Edge/Application/msedge.exe"; do
        for pf in "Program Files" "Program Files (x86)"; do
            if [ -f "$SG_PREFIX/drive_c/$pf/$p" ]; then
                sg_log "oobe-browser: $id is installed"; rm -f "$REQ"; exit 0
            fi
        done
    done
    sg_log "oobe-browser: $id was not installed; trying again at the next boot"
    exit 1
fi
if [ -f "$SG_PREFIX/drive_c/Program Files/$exe" ]; then
    sg_log "oobe-browser: $id is installed"
    rm -f "$REQ"
    exit 0
fi
# shellcheck disable=SC2016  # expanded by the inner shell, as SYSTEM
runuser -u "$SG_SYSTEM_USER" -- env -u DISPLAY -u WAYLAND_DISPLAY \
    SG_WINSTATION='__wineservice_winstation\Default' SG_LIB="$SG_LIB" ID="$id" URL="$url" sh -c '
    . "$SG_LIB/sg-common.sh"; sg_wine_env
    if wine cmd /c "where winget" >/dev/null 2>&1; then
        exec wine winget install -e --id "$ID" --scope machine --silent \
            --accept-package-agreements --accept-source-agreements
    fi
    d=$(mktemp -d /var/tmp/sg-oobe-browser.XXXXXX) || exit 1
    trap "rm -rf \"$d\"" EXIT
    "$SG_LIB/sg-fetch" "$URL" "$d/setup.exe" || exit 1
    wine "$d/setup.exe" /S' 2>&1 | sed 's/^/oobe-browser: /' >&2
if [ -f "$SG_PREFIX/drive_c/Program Files/$exe" ]; then
    sg_log "oobe-browser: $id is installed"
    rm -f "$REQ"
    exit 0
fi
sg_log "oobe-browser: $id was not installed; trying again at the next boot"
exit 1
