# pacman scripts for Diwall; the bodies are shared with the RPM package.

post_install() {
    PYTHON=/usr/bin/python3
# Post-install body shared by the RPM (%post) and pacman (post_install,
# post_upgrade) packages. PYTHON is set by the caller to the distribution's
# interpreter. It mirrors debian/postinst (configure), with these differences:
# - the account is created with groupadd/useradd (adduser is Debian-only);
# - diwall-sample.conf is a packaged file, not written here;
# - the virtual environment is rebuilt when it can no longer import
#   playwright, as happens after a distribution update changes the Python
#   version;
# - pip runs on every install or upgrade, so a version pinned in
#   requirements.txt reaches an existing installation (pip does not touch the
#   network when every pin is already satisfied).
set -e

DEST="/opt/diwall"
GROUPE="diwall"

if ! getent group "$GROUPE" >/dev/null; then
    groupadd -r "$GROUPE"
fi
if ! getent passwd "$GROUPE" >/dev/null; then
    useradd -r -g "$GROUPE" -d /nonexistent -M -s /bin/false "$GROUPE"
fi

chown root:"$GROUPE" "$DEST"
chmod 755 "$DEST"
chown -R root:"$GROUPE" "$DEST/lib"
chmod -R 755 "$DEST/lib"
# scenarios/ and skills/ hold instance data: files readable by the diwall
# group only, as on the .deb and git-clone channels.
chown -R root:"$GROUPE" "$DEST/scenarios" "$DEST/skills"
find "$DEST/scenarios" "$DEST/skills" -type d -exec chmod 755 {} +
find "$DEST/scenarios" "$DEST/skills" -type f -exec chmod 640 {} +
chown root:"$GROUPE" "$DEST/scripts"
chmod 755 "$DEST/scripts"
chmod 755 "$DEST/scripts"/*.sh
# watch.py runs shot.py directly (shebang and execute bit).
chmod 755 "$DEST/shot.py" "$DEST/watch.py" "$DEST/rpa.py" "$DEST/journal.py"

if [ -x "$DEST/venv/bin/python3" ] && ! "$DEST/venv/bin/python3" -c "import playwright" 2>/dev/null; then
    echo "Diwall: the Python interpreter changed, rebuilding the virtual environment..."
    rm -rf "$DEST/venv"
fi
if [ ! -x "$DEST/venv/bin/python3" ]; then
    echo "Diwall: creating Python virtual environment..."
    "$PYTHON" -m venv "$DEST/venv"
fi
"$DEST/venv/bin/pip" install --quiet --disable-pip-version-check --no-cache-dir -r "$DEST/requirements.txt"

# Fixed path, independent of HOME: the package manager runs this as root, and
# shot.py looks for Chromium in the same place by default.
export PLAYWRIGHT_BROWSERS_PATH="$DEST/.cache/ms-playwright"
if ! "$DEST/venv/bin/python3" -c \
    "from playwright.sync_api import sync_playwright; p = sync_playwright().start(); c = p.chromium.executable_path; p.stop(); import os,sys; sys.exit(0 if os.path.isfile(c) else 1)" \
    2>/dev/null; then
    echo "Diwall: installing Chromium via Playwright..."
    # Never --with-deps: it calls apt-get. Chromium's libraries are declared
    # dependencies of the package.
    "$DEST/venv/bin/playwright" install chromium
fi
chown -R root:"$GROUPE" "$PLAYWRIGHT_BROWSERS_PATH"
find "$PLAYWRIGHT_BROWSERS_PATH" -type d -exec chmod 755 {} +
find "$PLAYWRIGHT_BROWSERS_PATH" -type f -exec chmod go+r {} +

mkdir -p /var/log/diwall/preuves
chown root:"$GROUPE" /var/log/diwall /var/log/diwall/preuves
chmod 2770 /var/log/diwall /var/log/diwall/preuves

mkdir -p "$DEST/references"
chown root:"$GROUPE" "$DEST/references"
chmod 770 "$DEST/references"

chown root:"$GROUPE" /etc/diwall /etc/diwall/diwall-sample.conf
chmod 755 /etc/diwall
chmod 644 /etc/diwall/diwall-sample.conf
if [ ! -f /etc/diwall/diwall.conf ]; then
    echo ""
    echo "=========================================================="
    echo " Diwall installed. No configuration active yet."
    echo " Create /etc/diwall/diwall.conf from the template:"
    echo "   sudo cp /etc/diwall/diwall-sample.conf /etc/diwall/diwall.conf"
    echo " Then add your operator account to the diwall group:"
    echo "   sudo usermod -aG diwall \$USER"
    echo "=========================================================="
    echo ""
fi

echo "Diwall installed. Check version: diwall-shot --version"
}

post_upgrade() {
    post_install
}

post_remove() {
# Post-removal body shared by the RPM (%postun, full removal only) and pacman
# (post_remove) packages.
#
# RPM and pacman have a single removal command where Debian has two (remove,
# purge). This one deletes everything that can be rebuilt (virtual
# environment, downloaded Chromium, run-time Python bytecode) and every
# directory left empty. It keeps what the operator produced and could not get
# back by reinstalling: /etc/diwall/diwall.conf, the files under
# /var/log/diwall (journal, evidence), the captures under
# /opt/diwall/references. While it keeps any of them, it keeps the diwall
# user and group that protect them: deleting the group would leave those
# files to an orphan group number, inherited with their rights by the next
# group created on the machine. It then prints the exact command that erases
# them. When nothing was kept, the account goes too.
#
# Destroying data on a command that, on these systems, usually keeps it could
# not be undone; data left behind is removed with one command.
#
# No set -e: cleanup must never make a removal fail.

DEST="/opt/diwall"
GROUPE="diwall"

rm -rf "$DEST/venv" "$DEST/.cache"
if [ -d "$DEST" ]; then
    find "$DEST" -depth -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
    find "$DEST" -depth -type d -empty -delete 2>/dev/null || true
fi
for d in /etc/diwall /var/log/diwall; do
    [ -d "$d" ] && find "$d" -depth -type d -empty -delete 2>/dev/null || true
done

CONSERVES=""
for d in /etc/diwall /var/log/diwall "$DEST/references"; do
    [ -d "$d" ] && CONSERVES="$CONSERVES $d"
done

if [ -z "$CONSERVES" ]; then
    rmdir "$DEST" 2>/dev/null || true
    getent passwd "$GROUPE" >/dev/null && userdel "$GROUPE" 2>/dev/null
    getent group "$GROUPE" >/dev/null && groupdel "$GROUPE" 2>/dev/null
else
    echo ""
    echo "Diwall removed. Kept, because they hold your data:$CONSERVES"
    echo "The diwall user and group are kept with them."
    echo "To erase them as well:"
    echo "  sudo rm -rf$CONSERVES"
    echo "  sudo userdel diwall; sudo groupdel diwall"
    echo ""
fi
true
}
