cmake_minimum_required(VERSION 3.16)
project(BastionGuard LANGUAGES CXX)

include(GNUInstallDirs)
include(cmake/BastionGuardInit.cmake)
bastionguard_detect_init_system(BG_INIT_SYSTEM)

set(BG_SERVICECTL_PATH "/usr/libexec/bastionguard/bastionguard-service")
set(BASTIONGUARD_DINIT_SYSTEM_DIR "/etc/dinit.d" CACHE PATH
    "Dinit system service description directory")
set(BASTIONGUARD_DINIT_USER_DIR "/usr/lib/dinit.d/user" CACHE PATH
    "Dinit user service description directory")
set(BG_DINIT_ENABLE_DIR
    "${BASTIONGUARD_DINIT_SYSTEM_DIR}/bastionguard.d")
configure_file(
    data/init/common/bastionguard-init-config.in
    "${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
    @ONLY
    NEWLINE_STYLE UNIX
)
message(STATUS "BastionGuard init backend: ${BG_INIT_SYSTEM}")
add_compile_definitions(
    BASTIONGUARD_INIT_SYSTEM=\"${BG_INIT_SYSTEM}\"
    BASTIONGUARD_SERVICECTL_PATH=\"${BG_SERVICECTL_PATH}\"
)


# ============================================================
# CEF feature policy
# ============================================================
# IMPORTANT:
# ENABLE_CEF controls only the optional standalone CEF proxy and the
# system-wide CA installer.  It does NOT control the embedded CEF runtime
# used by SecureBrowser, BankPage, BankOpener, BankGUI or Secure Payments.
# Those components are always built and installed.
option(ENABLE_CEF
    "Enable optional standalone CEF proxy/system-CA integration; embedded Secure Browser remains enabled"
    ON)
option(ENABLE_CEF_DAEMON
    "Build and install the standalone bastionguard-cef proxy and user service"
    ON)
option(ENABLE_SYSTEM_CA_INSTALL
    "Install the system CA policy and install-ca-system.sh helper"
    ON)

set(BG_OS_RELEASE_FILE "/etc/os-release" CACHE FILEPATH
    "os-release file used for distro-specific build decisions")
set(BG_OS_ID "")
set(BG_UBUNTU_LINUXMINT FALSE)

# Match the exact distribution ID only.  ID_LIKE is deliberately ignored,
# therefore Debian (ID=debian) is never treated as Ubuntu/Linux Mint.
if(EXISTS "${BG_OS_RELEASE_FILE}")
    file(STRINGS "${BG_OS_RELEASE_FILE}" BG_OS_ID_LINE REGEX "^ID=")
    if(BG_OS_ID_LINE)
        list(GET BG_OS_ID_LINE 0 BG_OS_ID_LINE_FIRST)
        string(REGEX REPLACE "^ID=[\\\"']?([^\\\"']+)[\\\"']?$" "\\1"
            BG_OS_ID "${BG_OS_ID_LINE_FIRST}")
        string(TOLOWER "${BG_OS_ID}" BG_OS_ID)
    endif()
endif()

if(BG_OS_ID STREQUAL "ubuntu" OR BG_OS_ID STREQUAL "linuxmint")
    set(BG_UBUNTU_LINUXMINT TRUE)
    set(ENABLE_CEF OFF CACHE BOOL
        "Disable only standalone CEF proxy/system-CA integration on Ubuntu/Linux Mint"
        FORCE)
endif()

# ENABLE_CEF=OFF must never disable the embedded browser stack.
# It only turns off the standalone proxy daemon and system CA installer.
if(NOT ENABLE_CEF)
    set(ENABLE_CEF_DAEMON OFF CACHE BOOL
        "Build and install the standalone bastionguard-cef proxy and user service"
        FORCE)
    set(ENABLE_SYSTEM_CA_INSTALL OFF CACHE BOOL
        "Install the system CA policy and install-ca-system.sh helper"
        FORCE)
endif()

# Embedded CEF is intentionally unconditional.
add_compile_definitions(
    BASTIONGUARD_HAS_CEF=1
    BASTIONGUARD_HAS_EMBEDDED_CEF=1
)

if(ENABLE_CEF_DAEMON)
    add_compile_definitions(BASTIONGUARD_HAS_CEF_DAEMON=1)
else()
    add_compile_definitions(BASTIONGUARD_HAS_CEF_DAEMON=0)
endif()

if(ENABLE_SYSTEM_CA_INSTALL)
    add_compile_definitions(BASTIONGUARD_ALLOW_SYSTEM_CA_INSTALL=1)
else()
    add_compile_definitions(BASTIONGUARD_ALLOW_SYSTEM_CA_INSTALL=0)
endif()

message(STATUS "BG_OS_ID                       = ${BG_OS_ID}")
message(STATUS "BG_UBUNTU_LINUXMINT            = ${BG_UBUNTU_LINUXMINT}")
message(STATUS "ENABLE_CEF                     = ${ENABLE_CEF} (optional proxy/CA only)")
message(STATUS "ENABLE_CEF_DAEMON              = ${ENABLE_CEF_DAEMON}")
message(STATUS "ENABLE_SYSTEM_CA_INSTALL       = ${ENABLE_SYSTEM_CA_INSTALL}")
message(STATUS "Embedded Secure Browser / Bank = ALWAYS ENABLED")

# ============================================================
# Packaging: disable privileged install-time actions (DEB/RPM/CI)
# ============================================================
option(BG_DEBIAN_NO_INSTALL_CODE
  "Disable bg_install_code( ...) actions (packaging friendly: DEB/RPM/CI)"
  OFF
)

# Optional explicit switch (recommended for spec/rules/CI)
option(BG_PACKAGING
  "Packaging build (RPM/DEB) – disable privileged install-time code"
  OFF
)

# ------------------------------------------------------------
# Auto-detect packaging environments (RPM/DEB) and CI
# NOTE: DESTDIR is usually set only at install time, not configure time
# ------------------------------------------------------------
if(NOT BG_PACKAGING)
  # RPM builders
  if(DEFINED ENV{RPM_BUILD_ROOT} AND NOT "$ENV{RPM_BUILD_ROOT}" STREQUAL "")
    set(BG_PACKAGING ON CACHE BOOL "RPM packaging build (RPM_BUILD_ROOT)" FORCE)
  elseif(DEFINED ENV{RPM_PACKAGE_BUILD_ROOT} AND NOT "$ENV{RPM_PACKAGE_BUILD_ROOT}" STREQUAL "")
    set(BG_PACKAGING ON CACHE BOOL "RPM packaging build (RPM_PACKAGE_BUILD_ROOT)" FORCE)
  # Debian builders (best-effort)
  elseif(DEFINED ENV{DEB_BUILD_OPTIONS} AND NOT "$ENV{DEB_BUILD_OPTIONS}" STREQUAL "")
    set(BG_PACKAGING ON CACHE BOOL "DEB packaging build (DEB_BUILD_OPTIONS)" FORCE)
  endif()
endif()

# Keep original behavior: CI disables privileged install-time code
if(NOT BG_PACKAGING AND NOT BG_DEBIAN_NO_INSTALL_CODE)
  if(DEFINED ENV{CI} AND NOT "$ENV{CI}" STREQUAL "")
    set(BG_DEBIAN_NO_INSTALL_CODE ON CACHE BOOL
      "Disable bg_install_code( ...) actions (CI build)" FORCE)
  endif()
endif()

# If packaging, force-disable privileged install-time code
if(BG_PACKAGING)
  set(BG_DEBIAN_NO_INSTALL_CODE ON CACHE BOOL
    "Disable bg_install_code( ...) actions (packaging build)" FORCE)
endif()

# Debug (useful while stabilizing; you can remove later)
message(STATUS "BG_PACKAGING              = ${BG_PACKAGING}")
message(STATUS "BG_DEBIAN_NO_INSTALL_CODE  = ${BG_DEBIAN_NO_INSTALL_CODE}")
message(STATUS "ENV{DESTDIR}               = '$ENV{DESTDIR}'")
message(STATUS "ENV{RPM_BUILD_ROOT}        = '$ENV{RPM_BUILD_ROOT}'")
message(STATUS "ENV{RPM_PACKAGE_BUILD_ROOT}= '$ENV{RPM_PACKAGE_BUILD_ROOT}'")
message(STATUS "ENV{CI}                    = '$ENV{CI}'")

# ------------------------------------------------------------
# Wrapper: keep same name, but do NOT recurse.
# - If disabled: do not even generate install(CODE ...)
# - Extra safety: even if generated, skip at install-time when DESTDIR is set
# ------------------------------------------------------------
function(bg_install_code code_str)
  # Configure-time guard (packaging / CI / explicit disable)
  if(BG_DEBIAN_NO_INSTALL_CODE OR BG_PACKAGING)
    message(STATUS "[Packaging] Skipping privileged install(CODE ...) block")
    return()
  endif()

  # Install-time guard (DESTDIR staging)
  install(CODE "
    if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
      message(STATUS \"[Packaging] DESTDIR is set → skip privileged install code\")
    else()
      ${code_str}
    endif()
  ")
endfunction()



# ===============================
# 🔒 RPATH GLOBALE BASTIONGUARD
# ===============================
set(BG_RPATH "/usr/share/BastionGuard/lib")

set(CMAKE_SKIP_BUILD_RPATH FALSE)
set(CMAKE_BUILD_WITH_INSTALL_RPATH FALSE)
set(CMAKE_INSTALL_RPATH "${BG_RPATH}")
set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)

set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)


set(CMAKE_AUTOMOC OFF)
set(CMAKE_AUTOUIC OFF)
set(CMAKE_AUTORCC OFF)

find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
# ======================
# libsystemd / sd-bus
# ======================
# sd-bus is used by the StatusNotifierItem implementation, not for service
# management. It remains optional on OpenRC, SysVinit and Dinit systems.
pkg_check_modules(SYSTEMD QUIET libsystemd)

if(SYSTEMD_FOUND)
    message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
    include_directories(${SYSTEMD_INCLUDE_DIRS})
    link_directories(${SYSTEMD_LIBRARY_DIRS})
    add_definitions(${SYSTEMD_CFLAGS_OTHER})
    add_compile_definitions(BASTIONGUARD_HAS_SDBUS=1)
    set(BG_TRAYICON_SOURCE src/TrayIcon.cpp)
else()
    message(WARNING "libsystemd non trovato: tray SNI disabilitata; init ${BG_INIT_SYSTEM} resta supportato")
    add_compile_definitions(BASTIONGUARD_HAS_SDBUS=0)
    set(BG_TRAYICON_SOURCE src/TrayIconStub.cpp)
endif()
# ==============================
# Controllo NGINX
# ==============================
find_program(NGINX_EXECUTABLE nginx)

if (NOT NGINX_EXECUTABLE)
    message(FATAL_ERROR "❌ NGINX non trovato nel sistema. Installa nginx (es: sudo apt install nginx o sudo pacman -S nginx).")
else()
    execute_process(COMMAND ${NGINX_EXECUTABLE} -v
        ERROR_VARIABLE NGINX_VERSION_OUTPUT
        OUTPUT_STRIP_TRAILING_WHITESPACE
        ERROR_STRIP_TRAILING_WHITESPACE
    )
    string(REPLACE "nginx version: " "" NGINX_VERSION "${NGINX_VERSION_OUTPUT}")
    message(STATUS "✔ NGINX trovato: ${NGINX_EXECUTABLE} (${NGINX_VERSION})")
endif()

# ==============================
# Controllo RSYNC (richiesto per SaneSecurity)
# ==============================
find_program(RSYNC_EXECUTABLE rsync)

if (NOT RSYNC_EXECUTABLE)
    message(FATAL_ERROR "❌ rsync non trovato nel sistema. È richiesto per aggiornare le firme SaneSecurity.
Installa rsync (Debian/Ubuntu: sudo apt install rsync | Arch: sudo pacman -S rsync).")
else()
    message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()



# ============================================================
# BastionGuard – RPATH centralizzato (SAFE)
# ============================================================

set(BG_LIBDIR "/usr/share/BastionGuard/lib")
set(BG_CEF_LIBDIR "/usr/share/BastionGuard/cef")

function(bg_set_rpath target)
    if(TARGET ${target})
        set_target_properties(${target} PROPERTIES
            BUILD_RPATH "${BG_LIBDIR};${BG_CEF_LIBDIR}"
            INSTALL_RPATH "${BG_LIBDIR};${BG_CEF_LIBDIR}"
            SKIP_BUILD_RPATH FALSE
        )
    endif()
endfunction()


# Option to control whether init services are enabled / started at install time.
option(ENABLE_INIT_SERVICES "Enable and start BastionGuard init services at install time" OFF)
option(ENABLE_SYSTEMD_SERVICES "Deprecated alias for ENABLE_INIT_SERVICES" OFF)
if(ENABLE_SYSTEMD_SERVICES)
    set(ENABLE_INIT_SERVICES ON)
endif()

# --- Percorso dati installati (es: /usr/share/BastionGuard/data) ---
install(DIRECTORY data/
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
    PATTERN "scripts/install-ca-system.sh" EXCLUDE
    PATTERN "service/BastionGuard-cef.service" EXCLUDE
)


set(INSTALL_DATA_DIR "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/data")
set(INSTALL_LOCALE_DIR "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/locale")


set(PKG_CONFIG_USE_CMAKE_PREFIX_PATH ON)

set(ENV{PKG_CONFIG_PATH}
    "/usr/share/BastionGuard/lib/pkgconfig:/usr/share/BastionGuard/share/pkgconfig"
)

# ======================
# pkg-config
# ======================
pkg_check_modules(GTKMM REQUIRED gtkmm-4.0)
pkg_check_modules(GIOMM REQUIRED giomm-2.68)
pkg_check_modules(SIGC REQUIRED sigc++-3.0)
pkg_check_modules(YARA REQUIRED yara)
pkg_check_modules(SOUP REQUIRED libsoup-3.0)
pkg_check_modules(PANGOMM REQUIRED pangomm-2.48)
# ======================
# libudev (PrivacyPage)
# ======================
pkg_check_modules(UDEV REQUIRED libudev)
include_directories(${UDEV_INCLUDE_DIRS})
link_directories(${UDEV_LIBRARY_DIRS})
if (UDEV_FOUND)
    message(STATUS "✔ libudev trovato: ${UDEV_VERSION}")
else()
    message(FATAL_ERROR "❌ libudev non trovato. Installa libudev-dev (Debian/Ubuntu) o systemd-libs-devel (Fedora).")
endif()

# ======================
# LibSecret (per salvataggio sicuro delle credenziali)
# ======================
pkg_check_modules(LIBSECRET REQUIRED libsecret-1)

if (LIBSECRET_FOUND)
    message(STATUS "✔ LibSecret trovato: ${LIBSECRET_VERSION}")
    include_directories(${LIBSECRET_INCLUDE_DIRS})
    link_directories(${LIBSECRET_LIBRARY_DIRS})
    add_definitions(${LIBSECRET_CFLAGS_OTHER})
else()
    message(FATAL_ERROR "❌ LibSecret non trovato. Installa libsecret-1-dev (Debian/Ubuntu) o libsecret (Arch/Fedora).")
endif()

# ======================
# libidn2 (per IDNA/Punycode nelle URL phishing)
# ======================
pkg_check_modules(IDN2 REQUIRED libidn2)
include_directories(${IDN2_INCLUDE_DIRS})
link_directories(${IDN2_LIBRARY_DIRS})

# ======================
# SQLite3 (per gestione blacklist e database phishing)
# ======================
pkg_check_modules(SQLITE3 REQUIRED sqlite3)
include_directories(${SQLITE3_INCLUDE_DIRS})
link_directories(${SQLITE3_LIBRARY_DIRS})

if(SQLITE3_FOUND)
    message(STATUS "✔ SQLite3 trovato: ${SQLITE3_LIBRARIES}")
else()
    message(FATAL_ERROR "❌ SQLite3 non trovato. Installa libsqlite3-dev (Debian/Ubuntu) o sqlite (Arch/Fedora).")
endif()
# =======================================================
# libsmbclient (Samba Client Library) - ricerca universale
# =======================================================

find_path(SMBCLIENT_INCLUDE_DIR libsmbclient.h
    PATHS
        /usr/include
        /usr/include/samba-4.0
        /usr/local/include
)

find_library(SMBCLIENT_LIBRARY smbclient
    PATHS
        /usr/lib
        /usr/lib64
        /usr/local/lib
        /usr/local/lib64
)

if (NOT SMBCLIENT_INCLUDE_DIR OR NOT SMBCLIENT_LIBRARY)
    message(FATAL_ERROR "❌ libsmbclient non trovato...")
else()
    message(STATUS "✔ libsmbclient trovato: ${SMBCLIENT_LIBRARY}")
    message(STATUS "✔ include: ${SMBCLIENT_INCLUDE_DIR}")
endif()

set(SMBCLIENT_LIBRARIES ${SMBCLIENT_LIBRARY})
set(SMBCLIENT_INCLUDE_DIRS ${SMBCLIENT_INCLUDE_DIR})

include_directories(${SMBCLIENT_INCLUDE_DIRS})



# ======================
# nlohmann-json (header-only, via CMake config)
# ======================
find_package(nlohmann_json 3.2.0 REQUIRED)
# ======================
# CURL (per Google Safe Browsing API)
# ======================
find_package(CURL REQUIRED)
# ==============================
#  OpenSSL
# ==============================
find_package(OpenSSL REQUIRED)
link_directories(/usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64)

if (OpenSSL_FOUND)
    message(STATUS "OpenSSL trovato: ${OPENSSL_VERSION}")
    include_directories(${OPENSSL_INCLUDE_DIR})
else()
    message(FATAL_ERROR "OpenSSL non trovato. Installa libssl-dev")
endif()
# ======================
# systemd (sd-bus) — necessario su Debian/Ubuntu recenti (DSO missing)
# ======================
pkg_check_modules(SYSTEMD QUIET libsystemd)

if (SYSTEMD_FOUND)
    message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
else()
    message(WARNING "⚠ libsystemd non trovato (libsystemd-dev). Alcune feature potrebbero non compilare.")
endif()

function(bg_link_systemd tgt)
    if (SYSTEMD_FOUND AND TARGET ${tgt})
        target_include_directories(${tgt} PRIVATE ${SYSTEMD_INCLUDE_DIRS})
        target_link_directories(${tgt} PRIVATE ${SYSTEMD_LIBRARY_DIRS})
        target_link_libraries(${tgt} PRIVATE ${SYSTEMD_LIBRARIES})
        target_compile_options(${tgt} PRIVATE ${SYSTEMD_CFLAGS_OTHER})
    endif()
endfunction()
# ==============================
# Boost (thread pool, asio, ecc.)
# ==============================
find_package(Boost REQUIRED COMPONENTS thread)
include_directories(${Boost_INCLUDE_DIRS})

# ==============================
# Hyperscan (opzionale, per regex ad alte prestazioni)
# ==============================
find_path(HYPERSCAN_INCLUDE_DIR NAMES hs/hs.h)
find_library(HYPERSCAN_LIBRARY NAMES hs)
find_library(HYPERSCAN_LIBRARY NAMES hs libhs hs.so.5 PATHS /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64)

if (HYPERSCAN_INCLUDE_DIR AND HYPERSCAN_LIBRARY)
    message(STATUS "✔ Hyperscan trovato: ${HYPERSCAN_LIBRARY}")
    include_directories(${HYPERSCAN_INCLUDE_DIR})
    add_compile_definitions(HAVE_HYPERSCAN=1)
else()
    message(WARNING "⚠ Hyperscan non trovato. Verrà usato std::regex fallback (più lento).")
endif()


include_directories(
    ${GTKMM_INCLUDE_DIRS}
    ${GIOMM_INCLUDE_DIRS}
    ${SIGC_INCLUDE_DIRS}
    ${YARA_INCLUDE_DIRS}
    ${SOUP_INCLUDE_DIRS}
    src
    src/filters
)

link_directories(
    ${GTKMM_LIBRARY_DIRS}
    ${GIOMM_LIBRARY_DIRS}
    ${SIGC_LIBRARY_DIRS}
    ${YARA_LIBRARY_DIRS}
    ${SOUP_LIBRARY_DIRS}
)

if(GTKMM_CFLAGS_OTHER)
    add_compile_options(${GTKMM_CFLAGS_OTHER})
endif()
if(GIOMM_CFLAGS_OTHER)
    add_compile_options(${GIOMM_CFLAGS_OTHER})
endif()
if(SIGC_CFLAGS_OTHER)
    add_compile_options(${SIGC_CFLAGS_OTHER})
endif()
if(YARA_CFLAGS_OTHER)
    add_compile_options(${YARA_CFLAGS_OTHER})
endif()
if(SOUP_CFLAGS_OTHER)
    add_compile_options(${SOUP_CFLAGS_OTHER})
endif()

# ======================
# Libreria phishing_common (dnsmasq backend minimal)
# ======================
set(PHISHING_COMMON_SOURCES
    src/phishing/local_warning_server.cpp
    src/phishing/WebProbe.cpp
    src/phishing/network_quality.cpp
    src/phishing/dns_cache.cpp
)

add_library(phishing_common STATIC ${PHISHING_COMMON_SOURCES})

target_include_directories(phishing_common PUBLIC src src/phishing)

target_link_libraries(phishing_common
    PUBLIC
        ${SOUP_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${IDN2_LIBRARIES}
        OpenSSL::SSL
        OpenSSL::Crypto
)

# ======================
# Identity Leak Module
# ======================
set(IDENTITY_LEAK_SOURCES
    src/IdentityLeakPage/ui/IdentityLeakPage.cpp
    src/IdentityLeakPage/worker/LeakCheckWorker.cpp
    src/IdentityLeakPage/monitor/LeakMonitor.cpp
    src/IdentityLeakPage/core/LeakAggregator.cpp
    src/IdentityLeakPage/core/LeakNormalizer.cpp
    src/IdentityLeakPage/providers/HibpProvider.cpp
    src/IdentityLeakPage/providers/LeakCheckProvider.cpp
    src/IdentityLeakPage/providers/HibpPasswordProvider.cpp
    src/IdentityLeakPage/net/HttpClient.cpp
    src/IdentityLeakPage/storage/LeakDatabase.cpp
    src/IdentityLeakPage/utils/HashUtil.cpp
    src/IdentityLeakPage/utils/IdentityLeakConfig.cpp
    src/IdentityLeakPage/utils/TimeUtil.cpp
)

add_library(identity_leak STATIC ${IDENTITY_LEAK_SOURCES})

target_include_directories(identity_leak
    PUBLIC
        src
        src/IdentityLeakPage
)

target_link_libraries(identity_leak
    PUBLIC
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        ${SQLITE3_LIBRARIES}
        nlohmann_json::nlohmann_json
)

# ======================
# Password Manager Module
# ======================
set(PASSWORD_MANAGER_SOURCES
    src/password_manager/PasswordEntry.cpp
    src/password_manager/PasswordVault.cpp
    src/password_manager/PasswordGenerator.cpp
    src/password_manager/PasswordDialogs.cpp
    src/password_manager/PasswordSearchRow.cpp
    src/password_manager/PasswordManagerPage.cpp
    src/password_manager/PasswordImporter.cpp
    src/password_manager/PasswordImportDialog.cpp
    src/password_manager/PasswordVaultView.cpp
)

add_library(password_manager STATIC ${PASSWORD_MANAGER_SOURCES})

target_include_directories(password_manager PUBLIC
    src
    src/password_manager
)

target_link_libraries(password_manager
    PUBLIC
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${LIBSECRET_LIBRARIES}
        nlohmann_json::nlohmann_json
)

# ======================
# RE2 (opzionale, per regex sicure e veloci)
# ======================
find_library(RE2_LIBRARY NAMES re2 libre2 PATHS /usr/lib /usr/lib64 /usr/local/lib)
if (RE2_LIBRARY)
    message(STATUS "✔ RE2 trovato: ${RE2_LIBRARY}")
    target_link_libraries(phishing_common PRIVATE ${RE2_LIBRARY})
else()
    message(WARNING "⚠ RE2 non trovato. Uso std::regex fallback.")
endif()

# === Integrazione Boost per phishing_common ===
target_link_libraries(phishing_common
    PRIVATE
        re2
        Boost::thread
)


target_compile_definitions(phishing_common PUBLIC
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# ============================
# Firewall Management Module
# ============================
set(FIREWALL_SOURCES
    src/firewall/FirewallChoiceDialog.cpp
    src/firewall/FirewallDetector.cpp
    src/firewall/FirewallInstaller.cpp
    src/firewall/FirewallRuleManager.cpp
    src/firewall/BlacklistIpExtractor.cpp
)

add_library(firewall STATIC ${FIREWALL_SOURCES})

target_include_directories(firewall PUBLIC src/firewall)

target_link_libraries(firewall
    PUBLIC
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)


# ----------------------
# GUI principale (BastionGuard)
# ----------------------
set(BastionGuard_SOURCES
    src/main.cpp
    src/MainWindow.cpp
    ${BG_TRAYICON_SOURCE}
    src/Backend.cpp
    src/DashboardPage.cpp
    src/ScanPage.cpp
    src/LogPage.cpp
    src/SettingsPage.cpp
    src/AboutPage.cpp
    src/QuarantinePage.cpp
    src/Quarantine.cpp
    src/ClamdConfig.cpp
    src/UpdatePage.cpp
    src/DonatePage.cpp
    src/StyleProvider.cpp
    src/AntiRansomEngine.cpp
    src/AntiPhishingEngine.cpp
    src/BankPage.cpp
    src/wizard/wizard_window.cpp
    src/wizard/wizard_setup.cpp
    src/SecureBrowser.cpp
    src/PrivacyPage.cpp
    src/AurScan.cpp
    src/SettingsWindow.cpp
    src/AntiRansomwarePage.cpp
    src/SambaPage.cpp
    src/SaneSecurityUpdater.cpp
    src/SettingsStore.cpp
    src/first_run/first-run-services-window.cpp
    src/pac/PacManager.cpp
    src/cloud/MalwareBazaar.cpp
    src/usb/USBScanPage.cpp
    src/usb/ScanPromptWindow.cpp
    src/usb/LiveScanDialog.cpp
    src/phishing_search/PhishingPage.cpp
    src/phishing_search/PhishingCheckCard.cpp
    src/vpn/VpnPage.cpp
    src/vpn/WireguardBackend.cpp
    src/password_manager/PasswordManagerPage.cpp
    src/backup/BackupPage.cpp
    src/Utils.cpp
)

# === Eseguibile principale ===
add_executable(BastionGuard ${BastionGuard_SOURCES})
target_include_directories(BastionGuard
    PRIVATE
        src
        src/firewall
)

target_compile_definitions(BastionGuard PRIVATE
  BASTIONGUARD_VERSION="2.0.3"
  BASTIONGUARD_BUILD=20260803
)

target_link_libraries(BastionGuard
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${YARA_LIBRARIES}
        ${SOUP_LIBRARIES}
        ${LIBSECRET_LIBRARIES}
        ${UDEV_LIBRARIES}
        ${SMBCLIENT_LIBRARIES}
        phishing_common
        firewall
        identity_leak
        password_manager
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        ${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard)
bg_link_systemd(BastionGuard)

# ======================
# BastionGuard RootGuard (native CMake)
# ======================
option(ENABLE_BASTIONGUARD_ROOTGUARD
    "Build BastionGuard RootGuard"
    ON
)

option(ENABLE_BASTIONGUARD_ROOTGUARD_TESTS
    "Build RootGuard tests"
    OFF
)

set(BASTIONGUARD_ROOTGUARD_TARGET
    "BastionGuard"
    CACHE STRING
    "Existing BastionGuard executable target"
)

set(BASTIONGUARD_ROOTGUARD_INIT_SYSTEM
    "auto"
    CACHE STRING
    "RootGuard init integration: auto, systemd, openrc, dinit, sysvinit or none"
)

set(BASTIONGUARD_ROOTGUARD_BTF
    "/sys/kernel/btf/vmlinux"
    CACHE FILEPATH
    "Kernel BTF used to build RootGuard"
)

if(ENABLE_BASTIONGUARD_ROOTGUARD)
    set(BG_ROOTGUARD_SOURCE_DIR
        "${CMAKE_SOURCE_DIR}/src/rootguard"
    )

    set(BG_ROOTGUARD_BINARY_DIR
        "${CMAKE_BINARY_DIR}/bastionguard-rootguard-build"
    )

    if(NOT EXISTS "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt")
        message(FATAL_ERROR
            "[RootGuard] Module not found: "
            "${BG_ROOTGUARD_SOURCE_DIR}/CMakeLists.txt"
        )
    endif()

    if(NOT TARGET ${BASTIONGUARD_ROOTGUARD_TARGET})
        message(FATAL_ERROR
            "[RootGuard] Main target does not exist: "
            "${BASTIONGUARD_ROOTGUARD_TARGET}. "
            "Move this block after add_executable()."
        )
    endif()

    set(ROOTGUARD_BUILD_DAEMON
        ON CACHE BOOL
        "Build RootGuard daemon"
        FORCE
    )

    set(ROOTGUARD_BUILD_GTK_PAGE
        ON CACHE BOOL
        "Build RootGuardPage"
        FORCE
    )

    set(ROOTGUARD_BUILD_GTK_DEMO
        OFF CACHE BOOL
        "Disable standalone GTK demo"
        FORCE
    )

    set(ROOTGUARD_BUILD_TESTS
        ${ENABLE_BASTIONGUARD_ROOTGUARD_TESTS}
        CACHE BOOL
        "Build RootGuard tests"
        FORCE
    )

    set(ROOTGUARD_INIT_SYSTEM
        "${BASTIONGUARD_ROOTGUARD_INIT_SYSTEM}"
        CACHE STRING
        "RootGuard init system"
        FORCE
    )

    set(ROOTGUARD_VMLINUX_BTF
        "${BASTIONGUARD_ROOTGUARD_BTF}"
        CACHE FILEPATH
        "RootGuard kernel BTF"
        FORCE
    )

    message(STATUS "[RootGuard] =====================================")
    message(STATUS "[RootGuard] Source dir : ${BG_ROOTGUARD_SOURCE_DIR}")
    message(STATUS "[RootGuard] Build dir  : ${BG_ROOTGUARD_BINARY_DIR}")
    message(STATUS "[RootGuard] Main target: ${BASTIONGUARD_ROOTGUARD_TARGET}")
    message(STATUS "[RootGuard] Kernel BTF : ${ROOTGUARD_VMLINUX_BTF}")
    message(STATUS "[RootGuard] Init system: ${ROOTGUARD_INIT_SYSTEM}")

    add_subdirectory(
        "${BG_ROOTGUARD_SOURCE_DIR}"
        "${BG_ROOTGUARD_BINARY_DIR}"
    )

    if(NOT TARGET BastionGuard::RootGuardUI)
        message(FATAL_ERROR
            "[RootGuard] RootGuard UI target was not created"
        )
    endif()

    target_link_libraries(
        ${BASTIONGUARD_ROOTGUARD_TARGET}
        PRIVATE
        BastionGuard::RootGuardUI
    )

    if(TARGET bastionguard-rootguard)
        add_dependencies(
            ${BASTIONGUARD_ROOTGUARD_TARGET}
            bastionguard-rootguard
        )
    endif()

    if(TARGET bastionguard-rootguard-action)
        add_dependencies(
            ${BASTIONGUARD_ROOTGUARD_TARGET}
            bastionguard-rootguard-action
        )
    endif()

    message(STATUS "[RootGuard] Native module enabled")
    message(STATUS "[RootGuard] =====================================")
endif()
# ============================================================
# Blink / CEF Integration (SecureBrowser)
# ============================================================
set(CEF_ROOT "${CMAKE_SOURCE_DIR}/thirdparty/cef")
set(CEF_RELEASE_DIR "${CEF_ROOT}/Release")
set(CEF_LIB "${CEF_RELEASE_DIR}/libcef.so")

# Tentativi di percorso possibili per il wrapper
set(CEF_WRAPPER_A "${CEF_ROOT}/build/libcef_dll_wrapper.a")
set(CEF_WRAPPER_B "${CEF_ROOT}/build/libcef_dll_wrapper/libcef_dll_wrapper.a")

# ============================================================
# 🔹 Download automatico CEF se mancante
# ============================================================
set(CEF_URL "https://cef-builds.spotifycdn.com/cef_binary_141.0.7%2Bga5714cc%2Bchromium-141.0.7390.108_linux64_minimal.tar.bz2")
set(CEF_ARCHIVE "${CMAKE_SOURCE_DIR}/thirdparty/cef_download.tar.bz2")

if (NOT EXISTS ${CEF_LIB})
    message(WARNING "⚠️  libcef.so non trovato in ${CEF_RELEASE_DIR}")
    message(STATUS "⬇️  Download automatico CEF da: ${CEF_URL}")

    # Crea cartella thirdparty/cef
    file(MAKE_DIRECTORY ${CEF_ROOT})

    # Scarica il pacchetto
    file(DOWNLOAD
        ${CEF_URL}
        ${CEF_ARCHIVE}
        SHOW_PROGRESS
        STATUS cef_status
    )

    list(GET cef_status 0 cef_status_code)
    if (NOT cef_status_code EQUAL 0)
        message(FATAL_ERROR "❌ Errore nel download di CEF (${CEF_URL})")
    endif()

    # Estrai archivio
    message(STATUS "📦 Estrazione archivio CEF...")
    execute_process(
        COMMAND ${CMAKE_COMMAND} -E tar xjf ${CEF_ARCHIVE}
        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/thirdparty
        RESULT_VARIABLE cef_extract_result
    )

    if (NOT cef_extract_result EQUAL 0)
        message(FATAL_ERROR "❌ Errore durante l'estrazione del pacchetto CEF")
    endif()

    # Rinomina la cartella estratta (contiene spesso un nome lungo)
    file(GLOB cef_subdirs "${CMAKE_SOURCE_DIR}/thirdparty/cef_binary_*")
    list(LENGTH cef_subdirs cef_count)
    if (cef_count GREATER 0)
        list(GET cef_subdirs 0 cef_extracted_dir)
        message(STATUS "📂 CEF estratto in: ${cef_extracted_dir}")
        file(RENAME "${cef_extracted_dir}" "${CEF_ROOT}")
    endif()

    # Verifica dopo estrazione
    if (NOT EXISTS ${CEF_LIB})
        message(FATAL_ERROR "❌ libcef.so ancora non trovato dopo estrazione in ${CEF_RELEASE_DIR}")
    endif()

    message(STATUS "✔ CEF scaricato e preparato con successo in ${CEF_ROOT}")
else()
    message(STATUS "✔ CEF trovato: ${CEF_LIB}")
endif()

# ============================================================
# Build automatica del wrapper se necessario
# ============================================================
if (NOT (EXISTS ${CEF_WRAPPER_A} OR EXISTS ${CEF_WRAPPER_B}))
    message(STATUS "🧩 Compilo automaticamente libcef_dll_wrapper.a (wrapper CEF)...")
    execute_process(
        COMMAND cmake -B build -S .
        WORKING_DIRECTORY ${CEF_ROOT}
        RESULT_VARIABLE CEF_CONFIGURE_RESULT
    )
    if (NOT CEF_CONFIGURE_RESULT EQUAL 0)
        message(FATAL_ERROR "❌ Errore durante la configurazione CMake di libcef_dll_wrapper")
    endif()

    execute_process(
        COMMAND cmake --build build --config Release
        WORKING_DIRECTORY ${CEF_ROOT}
        RESULT_VARIABLE CEF_BUILD_RESULT
    )
    if (NOT CEF_BUILD_RESULT EQUAL 0)
        message(FATAL_ERROR "❌ Errore durante la compilazione di libcef_dll_wrapper.a")
    endif()
endif()

# ============================================================
# Conferma finale e selezione wrapper corretto
# ============================================================
if (EXISTS ${CEF_WRAPPER_A})
    set(CEF_WRAPPER ${CEF_WRAPPER_A})
elseif (EXISTS ${CEF_WRAPPER_B})
    set(CEF_WRAPPER ${CEF_WRAPPER_B})
else()
    message(FATAL_ERROR "❌ libcef_dll_wrapper.a non trovato dopo la build.")
endif()

message(STATUS "✔ Wrapper statico CEF trovato: ${CEF_WRAPPER}")

# ------------------------------------------------------------
# SecureBrowser is already part of BastionGuard_SOURCES above and remains
# unconditional even when ENABLE_CEF=OFF.
# ------------------------------------------------------------
include_directories(${CEF_ROOT} ${CEF_ROOT}/include)

target_link_libraries(BastionGuard
    PRIVATE
        ${CEF_LIB}
        ${CEF_WRAPPER}
        pthread
        dl
)


# Su alcune distro serve anche pthread e dl
find_package(Threads REQUIRED)
target_link_libraries(BastionGuard PRIVATE pthread dl)

# ============================================================
# ✅ INSTALLAZIONE COMPLETA DEL RUNTIME CEF (compatibile con build senza cef_helper)
# ============================================================

set(CEF_INSTALL_DIR "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/cef")

# Installa librerie principali
install(FILES
    ${CEF_RELEASE_DIR}/libcef.so
    ${CEF_RELEASE_DIR}/libEGL.so
    ${CEF_RELEASE_DIR}/libGLESv2.so
    ${CEF_RELEASE_DIR}/libvk_swiftshader.so
    ${CEF_RELEASE_DIR}/libvulkan.so.1
    DESTINATION ${CEF_INSTALL_DIR}
)

# Installa sandbox (chrome-sandbox)
install(FILES
    ${CEF_RELEASE_DIR}/chrome-sandbox
    DESTINATION ${CEF_INSTALL_DIR}
    PERMISSIONS OWNER_EXECUTE OWNER_WRITE OWNER_READ GROUP_EXECUTE GROUP_READ WORLD_EXECUTE WORLD_READ
)

# Installa tutte le risorse necessarie (pak, dat, bin, locales)
install(DIRECTORY
    ${CEF_ROOT}/Resources/
    DESTINATION ${CEF_INSTALL_DIR}
    FILES_MATCHING
        PATTERN "*.pak"
        PATTERN "*.bin"
        PATTERN "*.dat"
        PATTERN "locales"
)

# Installa eventuali snapshot e config
install(FILES
    ${CEF_RELEASE_DIR}/v8_context_snapshot.bin
    ${CEF_RELEASE_DIR}/vk_swiftshader_icd.json
    DESTINATION ${CEF_INSTALL_DIR}
    OPTIONAL
)



# Post-install: imposta permessi sandbox
bg_install_code( "
    message(STATUS \"[CEF] Imposto permessi per chrome-sandbox...\")
    execute_process(COMMAND chmod 4755 ${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/cef/chrome-sandbox)
")

# ============================================================
# Optional Polkit integration
# ============================================================
find_package(PkgConfig REQUIRED)
pkg_check_modules(POLKIT_GOBJECT QUIET polkit-gobject-1)

if (POLKIT_GOBJECT_FOUND)
    message(STATUS "✔ Found Polkit: ${POLKIT_GOBJECT_VERSION}")
    include_directories(${POLKIT_GOBJECT_INCLUDE_DIRS})
    target_link_libraries(BastionGuard PRIVATE ${POLKIT_GOBJECT_LIBRARIES})
    target_compile_definitions(BastionGuard PRIVATE HAVE_POLKIT=1)
else()
    message(WARNING "⚠ Polkit not found, using pkexec fallback only")
    target_compile_definitions(BastionGuard PRIVATE HAVE_POLKIT=0)
endif()

target_compile_definitions(BastionGuard PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ===============================
# Eseguibile per gli alert ransomware
# ===============================
set(RANSW_ALERT_SOURCES
    src/alert/BastionGuard-ransomware-alert.cpp
    src/Backend.cpp
    src/AntiRansomEngine.cpp
    src/AntiPhishingEngine.cpp
    src/Quarantine.cpp
    src/Utils.cpp
)

add_executable(BastionGuard-ransomware-alert ${RANSW_ALERT_SOURCES})
target_include_directories(BastionGuard-ransomware-alert PRIVATE src)
target_link_libraries(BastionGuard-ransomware-alert PRIVATE
    ${GTKMM_LIBRARIES}
    ${GIOMM_LIBRARIES}
    ${SIGC_LIBRARIES}
    ${YARA_LIBRARIES}
    ${SOUP_LIBRARIES}
    ${SMBCLIENT_LIBRARIES}
    CURL::libcurl
    OpenSSL::SSL
    OpenSSL::Crypto
    phishing_common
    firewall
)
bg_set_rpath(BastionGuard-ransomware-alert)
target_compile_definitions(BastionGuard-ransomware-alert PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-ransomware-alert RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ================================
#  Alert realtime (SOCKET UNIX)
#  BastionGuard-ransomware-realtime-alert
# ================================

set(RANSW_REALTIME_ALERT_SOURCES
    src/alert/BastionGuard-ransomware-realtime-alert.cpp
    src/alert/AlertWindowRealtime.cpp
    src/Backend.cpp
    src/AntiRansomEngine.cpp
    src/AntiPhishingEngine.cpp
    src/Quarantine.cpp
    src/Utils.cpp
)

add_executable(BastionGuard-ransomware-realtime-alert ${RANSW_REALTIME_ALERT_SOURCES})

target_include_directories(BastionGuard-ransomware-realtime-alert PRIVATE src)

target_link_libraries(BastionGuard-ransomware-realtime-alert
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        ${YARA_LIBRARIES}
        ${SMBCLIENT_LIBRARIES}
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        phishing_common
        pthread
        firewall
)
bg_set_rpath(BastionGuard-ransomware-realtime-alert)
target_compile_definitions(BastionGuard-ransomware-realtime-alert PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# Installazione binario
install(TARGETS BastionGuard-ransomware-realtime-alert
        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})



# ======================
# Demone Anti-Phishing
# ======================
# ======================
# BastionGuard DNS Daemon (dnsmasq backend)
# ======================
set(BastionGuard_DAEMON_SOURCES
    src/phishing/BastionGuard-daemon.cpp
    src/phishing/local_warning_server.cpp
    src/phishing/dns_cache.cpp
)

add_executable(BastionGuard-daemon ${BastionGuard_DAEMON_SOURCES})

target_include_directories(BastionGuard-daemon PRIVATE src src/phishing)

target_link_libraries(BastionGuard-daemon
    PRIVATE
        ${SOUP_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GTKMM_LIBRARIES}
        Threads::Threads
        dl
)
bg_set_rpath(BastionGuard-daemon)
target_compile_definitions(BastionGuard-daemon PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

install(TARGETS BastionGuard-daemon RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Archive inspection support
# ======================

set(BG_ARCHIVE_CORE_SOURCES
    src/security/archive/ArchiveSandbox.cpp
    src/security/archive/ArchiveInspector.cpp
)

set(BG_ARCHIVE_HELPER_SOURCES
    src/helpers/archive_worker.cpp
)

add_executable(archive_worker
    ${BG_ARCHIVE_HELPER_SOURCES}
)

target_include_directories(archive_worker
    PRIVATE
        src
)

target_compile_definitions(archive_worker PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# opzionale ma utile
bg_set_rpath(archive_worker)

install(TARGETS archive_worker
    RUNTIME DESTINATION /usr/libexec/bastionguard
)

# ======================
# Demone Anti-Ransomware
# ======================
add_executable(BastionGuard-ransomware-scanner
    src/scanner-ransomware/BastionGuard-ransomware-scanner.cpp
    ${BG_ARCHIVE_CORE_SOURCES}
)
target_link_libraries(BastionGuard-ransomware-scanner
    PRIVATE
        ${YARA_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${GTKMM_LIBRARIES}
        phishing_common
        OpenSSL::SSL
        OpenSSL::Crypto
        Threads::Threads
        nlohmann_json::nlohmann_json
)
bg_set_rpath(BastionGuard-ransomware-scanner)
target_compile_definitions(BastionGuard-ransomware-scanner PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-ransomware-scanner RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Demone Anti-Ransomware Realtime (fanotify)
# ======================
add_executable(BastionGuard-ransomware-realtime
    src/scanner-ransomware/BastionGuard-ransomware-realtime.cpp
    ${BG_ARCHIVE_CORE_SOURCES}
)

target_include_directories(BastionGuard-ransomware-realtime PRIVATE src)

target_link_libraries(BastionGuard-ransomware-realtime
    PRIVATE
        ${YARA_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${GTKMM_LIBRARIES}
        OpenSSL::SSL
        OpenSSL::Crypto
        phishing_common
        pthread
)
bg_set_rpath(BastionGuard-ransomware-realtime)
target_compile_definitions(BastionGuard-ransomware-realtime PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

install(TARGETS BastionGuard-ransomware-realtime
        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ======================
# Native Messaging Host
# ======================
add_executable(BastionGuard-native-host
    src/native_host/native_host.cpp
    src/wizard/wizard_setup.cpp
)
target_include_directories(BastionGuard-native-host PRIVATE src)
target_link_libraries(BastionGuard-native-host
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${YARA_LIBRARIES}
        ${SOUP_LIBRARIES}
        nlohmann_json::nlohmann_json
)
bg_set_rpath(BastionGuard-native-host)
target_compile_definitions(BastionGuard-native-host PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-native-host RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Setup Wizard
# ======================
set(WIZARD_SOURCES
    src/wizard/wizard_window.cpp
    src/wizard/wizard_setup.cpp
    src/wizard/main.cpp
    src/wizard/StyleProvider.cpp
    src/Utils.cpp
)

add_executable(BastionGuard-wizard ${WIZARD_SOURCES})
target_include_directories(BastionGuard-wizard PRIVATE src)
target_link_libraries(BastionGuard-wizard
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        phishing_common
)
bg_set_rpath(BastionGuard-wizard)
target_compile_definitions(BastionGuard-wizard PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-wizard RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ==============================
# First Run Services standalone
# ==============================
add_executable(BastionGuard-first-run
    src/first_run/first-run-main.cpp
    src/first_run/first-run-services-window.cpp
    src/StyleProvider.cpp
)

target_compile_definitions(BastionGuard-first-run PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-first-run
    PRIVATE
        src
        src/first_run
)

target_link_libraries(BastionGuard-first-run
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}

)

bg_set_rpath(BastionGuard-first-run)


install(TARGETS BastionGuard-first-run RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Helper privilegiato — bastionguard-privhelper
# ======================

set(PRIVHELPER_SOURCES
    src/privhelper/bastionguard_privhelper.cpp
)



add_executable(bastionguard-privhelper ${PRIVHELPER_SOURCES})
target_link_libraries(bastionguard-privhelper PRIVATE ${UDEV_LIBRARIES} pthread)

install(TARGETS bastionguard-privhelper
    RUNTIME DESTINATION /usr/bin
    PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
                GROUP_READ GROUP_EXECUTE
                WORLD_READ WORLD_EXECUTE)


# ======================
# Helper privilegiato — bastionguard-firewall
# ======================

set(FIREWALL_HELPER_SOURCES
    src/privhelper/bastionguard-firewall.cpp
)



add_executable(bastionguard-firewall ${FIREWALL_HELPER_SOURCES})

# Nessuna dipendenza GTK / Backend
target_link_libraries(bastionguard-firewall PRIVATE pthread)

install(TARGETS bastionguard-firewall
    RUNTIME DESTINATION /usr/bin
    PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
                GROUP_READ GROUP_EXECUTE
                WORLD_READ WORLD_EXECUTE
)



# ======================
# Demone Privacy (Webcam + Microfono)
# ======================
set(PRIVACYD_SOURCES
    src/BastionGuard-privacyd.cpp
)

add_executable(BastionGuard-privacyd ${PRIVACYD_SOURCES})
target_include_directories(BastionGuard-privacyd PRIVATE src)
target_link_libraries(BastionGuard-privacyd
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)
bg_set_rpath(BastionGuard-privacyd)
target_compile_definitions(BastionGuard-privacyd PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# === Installa l’eseguibile ===
install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Demone USB (BastionGuard-usbd)
# ======================

if(SYSTEMD_FOUND)
    set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd.cpp)
else()
    set(BG_USBD_BUS_SOURCE src/usb/BastionGuard-usbd-gdbus.cpp)
endif()

set(USBD_SOURCES
    ${BG_USBD_BUS_SOURCE}
    src/usb/LiveScanDialog.cpp
)

add_executable(BastionGuard-usbd ${USBD_SOURCES})

target_include_directories(BastionGuard-usbd PRIVATE
    src
    src/usb
    ${SYSTEMD_INCLUDE_DIRS}
)

target_link_libraries(BastionGuard-usbd
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${UDEV_LIBRARIES}
        ${SYSTEMD_LIBRARIES}
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

install(TARGETS BastionGuard-usbd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})



# ======================
# BankOpener (wrapper sandbox sicuro)
# ======================
add_executable(BastionGuard-bankopener
    src/xdg-open.cpp
    src/xdg-main.cpp
    src/SecureBrowser.cpp
    src/SettingsStore.cpp
    src/phishing/local_warning_server.cpp
)

target_include_directories(BastionGuard-bankopener PRIVATE src)

target_link_libraries(BastionGuard-bankopener
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        nlohmann_json::nlohmann_json
        ${CEF_LIB}
        ${CEF_WRAPPER}
        pthread
        dl
)
bg_set_rpath(BastionGuard-bankopener)
# Imposta il percorso runtime per libcef.so
set_target_properties(BastionGuard-bankopener PROPERTIES
    BUILD_RPATH "${CMAKE_SOURCE_DIR}/thirdparty/cef/Release"
    INSTALL_RPATH "/usr/share/BastionGuard/cef"
)

install(TARGETS BastionGuard-bankopener RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Bank gui desktop
# ======================

add_executable(BastionGuard-bankgui
    src/bankgui-main.cpp
    src/StyleProvider.cpp
)

target_compile_definitions(BastionGuard-bankgui PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-bankgui PRIVATE src)
target_link_libraries(BastionGuard-bankgui
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)
bg_set_rpath(BastionGuard-bankgui)
install(TARGETS BastionGuard-bankgui RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ======================
# Pagamenti sicuri
# ======================
find_package(Boost REQUIRED)
add_executable(bastionguard-pacd
    src/pac/BastionGuard-pac.cpp
)

target_link_libraries(bastionguard-pacd PRIVATE Boost::boost)
target_compile_features(bastionguard-pacd PRIVATE cxx_std_17)

install(TARGETS bastionguard-pacd RUNTIME DESTINATION bin)


if(ENABLE_CEF_DAEMON)
# ======================
# BastionGuard CEF Proxy (bastionguard-cef)
# ======================

find_package(Threads REQUIRED)
find_package(Boost REQUIRED)

# Boost headers target portability (1.89+)
if(TARGET Boost::headers)
  set(BG_BOOST_HEADERS Boost::headers)
elseif(TARGET Boost::boost)
  set(BG_BOOST_HEADERS Boost::boost)
else()
  message(FATAL_ERROR "Boost headers target not found (Boost::headers/Boost::boost).")
endif()



# libsoup + glib/gobject/gio for local_warning_server.cpp symbols
pkg_check_modules(GLIB REQUIRED glib-2.0 gobject-2.0 gio-2.0)

add_executable(bastionguard-cef
  src/cef/bastionguard_cef.cpp
  src/SecureBrowser.cpp
  src/SettingsStore.cpp
  src/phishing/local_warning_server.cpp
)

target_include_directories(bastionguard-cef
  PRIVATE
    src
    ${CEF_ROOT}
    ${CEF_ROOT}/include
    ${GLIB_INCLUDE_DIRS}
    ${SOUP_INCLUDE_DIRS}
    ${GTKMM_INCLUDE_DIRS}
    ${GIOMM_INCLUDE_DIRS}
    ${SIGC_INCLUDE_DIRS}
)

target_compile_options(bastionguard-cef
  PRIVATE
    ${GLIB_CFLAGS_OTHER}
    ${SOUP_CFLAGS_OTHER}
)

# Asio without boost_system (Boost 1.89+)
target_compile_definitions(bastionguard-cef PRIVATE
  BOOST_ASIO_DISABLE_BOOST_SYSTEM
  BOOST_ASIO_USE_STD_SYSTEM_ERROR
)

target_link_libraries(bastionguard-cef
  PRIVATE
    ${BG_BOOST_HEADERS}
    Threads::Threads
    OpenSSL::SSL
    OpenSSL::Crypto
    ${GTKMM_LIBRARIES}
    ${GIOMM_LIBRARIES}
    ${SIGC_LIBRARIES}
    ${SOUP_LIBRARIES}
    ${GLIB_LIBRARIES}
    ${CEF_LIB}
    ${CEF_WRAPPER}

    dl
    pthread
)

bg_set_rpath(bastionguard-cef)

install(TARGETS bastionguard-cef RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

endif()

# ======================
# BastionGuard Secure Payments
#  - BastionGuard-secure      (CLI opener)
#  - BastionGuard-secure-gui  (GUI selector)
# src/payment_secure/*
# ======================

# ---- CLI opener ----
add_executable(BastionGuard-secure
    src/payment_secure/BastionGuard-secure-cli.cpp
    src/payment_secure/BastionGuard-secure.cpp
    src/payment_secure/dns_secure.cpp
    src/SecureBrowser.cpp
    src/SettingsStore.cpp
    src/phishing/local_warning_server.cpp
)

target_compile_definitions(BastionGuard-secure PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-secure
    PRIVATE
        src
        src/payment_secure
        ${CEF_ROOT}
        ${CEF_ROOT}/include
        ${GLIBMM_INCLUDE_DIRS}
        ${GLIB_INCLUDE_DIRS}
        ${SOUP_INCLUDE_DIRS}
        ${GTKMM_INCLUDE_DIRS}
        ${GIOMM_INCLUDE_DIRS}
        ${SIGC_INCLUDE_DIRS}
)

target_compile_options(BastionGuard-secure
    PRIVATE
        ${GLIBMM_CFLAGS_OTHER}
        ${GLIB_CFLAGS_OTHER}
        ${SOUP_CFLAGS_OTHER}
)

target_link_libraries(BastionGuard-secure
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        ${GLIBMM_LIBRARIES}
        ${GLIB_LIBRARIES}

        nlohmann_json::nlohmann_json

        ${CEF_LIB}
        ${CEF_WRAPPER}

        OpenSSL::SSL
        OpenSSL::Crypto

        Threads::Threads
        dl
        pthread
)

bg_set_rpath(BastionGuard-secure)

set_target_properties(BastionGuard-secure PROPERTIES
    INSTALL_RPATH "/usr/share/BastionGuard/lib;/usr/share/BastionGuard/cef"
    BUILD_RPATH   "/usr/share/BastionGuard/lib;/usr/share/BastionGuard/cef"
)

install(TARGETS BastionGuard-secure RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ---- GUI selector ----
add_executable(BastionGuard-secure-gui
    src/payment_secure/BastionGuard-secure-main.cpp
    src/payment_secure/dns_secure.cpp
    src/StyleProvider.cpp
)

target_compile_definitions(BastionGuard-secure-gui PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-secure-gui
    PRIVATE
        src
        src/payment_secure
        ${GTKMM_INCLUDE_DIRS}
        ${GIOMM_INCLUDE_DIRS}
        ${SIGC_INCLUDE_DIRS}
)

target_link_libraries(BastionGuard-secure-gui
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)

bg_set_rpath(BastionGuard-secure-gui)

set_target_properties(BastionGuard-secure-gui PROPERTIES
    INSTALL_RPATH "/usr/share/BastionGuard/lib"
    BUILD_RPATH   "/usr/share/BastionGuard/lib"
)

install(TARGETS BastionGuard-secure-gui RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ======================
# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# ======================

add_executable(BastionGuard-mailproxy
    src/mail/BastionGuard-mailproxy.cpp
)

target_include_directories(BastionGuard-mailproxy PRIVATE src)

target_link_libraries(BastionGuard-mailproxy
    PRIVATE
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        nlohmann_json::nlohmann_json
        pthread
)

target_compile_definitions(BastionGuard-mailproxy PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

bg_set_rpath(BastionGuard-mailproxy)

install(TARGETS BastionGuard-mailproxy
    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
    PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
                GROUP_READ GROUP_EXECUTE
                WORLD_READ WORLD_EXECUTE
)

# Il service file viene installato nella sezione init-system centralizzata.


# ============================================================
# BastionGuard WebUI
# ============================================================

set(BG_WEBUI_SOURCE_DIR "${CMAKE_SOURCE_DIR}/webui")
set(BG_WEBUI_BUILD_DIR  "${CMAKE_BINARY_DIR}/webui")
set(BG_WEBUI_STAMP      "${BG_WEBUI_BUILD_DIR}/.webui-staged")

if(EXISTS "${BG_WEBUI_SOURCE_DIR}/index.php")

    add_custom_command(
        OUTPUT "${BG_WEBUI_STAMP}"
        COMMAND ${CMAKE_COMMAND} -E rm -rf "${BG_WEBUI_BUILD_DIR}"
        COMMAND ${CMAKE_COMMAND} -E make_directory "${BG_WEBUI_BUILD_DIR}"
        COMMAND ${CMAKE_COMMAND} -E copy_directory
                "${BG_WEBUI_SOURCE_DIR}"
                "${BG_WEBUI_BUILD_DIR}"
        COMMAND ${CMAKE_COMMAND} -E touch "${BG_WEBUI_STAMP}"
        DEPENDS "${BG_WEBUI_SOURCE_DIR}/index.php"
        COMMENT "Staging BastionGuard WebUI into the build directory"
        VERBATIM
    )

    add_custom_target(BastionGuard-webui ALL
        DEPENDS "${BG_WEBUI_STAMP}"
    )

    install(DIRECTORY "${BG_WEBUI_BUILD_DIR}/"
        DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/webui"
        USE_SOURCE_PERMISSIONS
        COMPONENT webui
        PATTERN ".git" EXCLUDE
        PATTERN "*.bak" EXCLUDE
        PATTERN "*.tmp" EXCLUDE
        PATTERN ".webui-staged" EXCLUDE
    )

    install(DIRECTORY "${CMAKE_SOURCE_DIR}/data/vhosts/webui/"
        DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/vhosts/webui"
        USE_SOURCE_PERMISSIONS
        COMPONENT webui
        OPTIONAL
    )

    install(CODE "
        message(STATUS \"[WebUI] Installed in: ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/webui\")
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/cache)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/quarantine)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/sessions)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/tmp)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/log/bastionguard-webui)
    ")

else()
    message(WARNING "BastionGuard WebUI source not found at ${BG_WEBUI_SOURCE_DIR}; WebUI will not be installed.")
endif()

# ======================
# BastionGuard Backup (fork di Timeshift, build via Meson)
# ======================
option(ENABLE_BASTIONGUARD_BACKUP "Build bastionguard-backup (Timeshift fork)" ON)

if(ENABLE_BASTIONGUARD_BACKUP)
    include(ExternalProject)

    find_program(MESON_EXECUTABLE meson REQUIRED)
    find_program(NINJA_EXECUTABLE ninja REQUIRED)
    find_program(VALAC_EXECUTABLE valac REQUIRED)
    find_program(PKG_CONFIG_EXECUTABLE pkg-config REQUIRED)

    # Dipendenze runtime/build del fork
    pkg_check_modules(BG_BACKUP_GTK3 REQUIRED gtk+-3.0)
    pkg_check_modules(BG_BACKUP_GIO REQUIRED gio-2.0 gio-unix-2.0)
    pkg_check_modules(BG_BACKUP_JSON REQUIRED json-glib-1.0)
    pkg_check_modules(BG_BACKUP_VTE REQUIRED vte-2.91)
    pkg_check_modules(BG_BACKUP_GEE REQUIRED gee-0.8)

    set(BG_BACKUP_SOURCE_DIR "${CMAKE_SOURCE_DIR}/thirdparty/bastionguard-backup")
    set(BG_BACKUP_BINARY_DIR "${CMAKE_BINARY_DIR}/bastionguard-backup-build")
    set(BG_BACKUP_INSTALL_DIR "${CMAKE_BINARY_DIR}/bastionguard-backup-install")

    message(STATUS "[BG-Backup] Source dir  : ${BG_BACKUP_SOURCE_DIR}")
    message(STATUS "[BG-Backup] Build dir   : ${BG_BACKUP_BINARY_DIR}")
    message(STATUS "[BG-Backup] Stage dir   : ${BG_BACKUP_INSTALL_DIR}")
    message(STATUS "[BG-Backup] Final prefix: ${CMAKE_INSTALL_PREFIX}")

    ExternalProject_Add(bastionguard_backup_ext
        SOURCE_DIR "${BG_BACKUP_SOURCE_DIR}"
        BINARY_DIR "${BG_BACKUP_BINARY_DIR}"

        CONFIGURE_COMMAND
            ${MESON_EXECUTABLE} setup "${BG_BACKUP_BINARY_DIR}" "${BG_BACKUP_SOURCE_DIR}"
            --prefix=/usr
            --buildtype=release
            --reconfigure

        BUILD_COMMAND
            ${MESON_EXECUTABLE} compile -C "${BG_BACKUP_BINARY_DIR}"

        INSTALL_COMMAND
            ${MESON_EXECUTABLE} install -C "${BG_BACKUP_BINARY_DIR}" --destdir "${BG_BACKUP_INSTALL_DIR}"

        BUILD_ALWAYS 1

        USES_TERMINAL_CONFIGURE 1
        USES_TERMINAL_BUILD 1
        USES_TERMINAL_INSTALL 1

        LOG_CONFIGURE OFF
        LOG_BUILD OFF
        LOG_INSTALL OFF
    )

    add_custom_target(BastionGuard-backup ALL
        DEPENDS bastionguard_backup_ext
    )

install(CODE "
        set(BG_BACKUP_DESTDIR \"\$ENV{DESTDIR}\")
        message(STATUS \"[BG-Backup] =====================================\")
        message(STATUS \"[BG-Backup] Installazione bastionguard-backup\")
        message(STATUS \"[BG-Backup] Stage dir Meson : ${BG_BACKUP_INSTALL_DIR}\")
        message(STATUS \"[BG-Backup] Prefix finale   : ${CMAKE_INSTALL_PREFIX}\")
        message(STATUS \"[BG-Backup] DESTDIR         : \${BG_BACKUP_DESTDIR}\")
        message(STATUS \"[BG-Backup]\")
        set(BG_BACKUP_STAGE_BIN   \"${BG_BACKUP_INSTALL_DIR}/usr/bin\")
        set(BG_BACKUP_STAGE_SHARE \"${BG_BACKUP_INSTALL_DIR}/usr/share\")
        set(BG_BACKUP_STAGE_ETC   \"${BG_BACKUP_INSTALL_DIR}/etc\")
        set(BG_BACKUP_DEST_BIN   \"\${BG_BACKUP_DESTDIR}${CMAKE_INSTALL_PREFIX}/bin\")
        set(BG_BACKUP_DEST_SHARE \"\${BG_BACKUP_DESTDIR}${CMAKE_INSTALL_PREFIX}/share\")
        set(BG_BACKUP_DEST_ETC   \"\${BG_BACKUP_DESTDIR}/etc\")
        message(STATUS \"[BG-Backup] Copia binari : \${BG_BACKUP_STAGE_BIN} -> \${BG_BACKUP_DEST_BIN}\")
        if(EXISTS \"\${BG_BACKUP_STAGE_BIN}\")
            file(MAKE_DIRECTORY \"\${BG_BACKUP_DEST_BIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_BACKUP_STAGE_BIN}\"
                        \"\${BG_BACKUP_DEST_BIN}\"
                RESULT_VARIABLE BG_BACKUP_BIN_RES
            )
            if(NOT BG_BACKUP_BIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-Backup] Errore copiando i binari in \${BG_BACKUP_DEST_BIN}\")
            endif()
        else()
            message(WARNING \"[BG-Backup] Directory bin non trovata: \${BG_BACKUP_STAGE_BIN}\")
        endif()
        message(STATUS \"[BG-Backup] Copia share  : \${BG_BACKUP_STAGE_SHARE} -> \${BG_BACKUP_DEST_SHARE}\")
        if(EXISTS \"\${BG_BACKUP_STAGE_SHARE}\")
            file(MAKE_DIRECTORY \"\${BG_BACKUP_DEST_SHARE}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_BACKUP_STAGE_SHARE}\"
                        \"\${BG_BACKUP_DEST_SHARE}\"
                RESULT_VARIABLE BG_BACKUP_SHARE_RES
            )
            if(NOT BG_BACKUP_SHARE_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-Backup] Errore copiando share in \${BG_BACKUP_DEST_SHARE}\")
            endif()
        else()
            message(WARNING \"[BG-Backup] Directory share non trovata: \${BG_BACKUP_STAGE_SHARE}\")
        endif()
        message(STATUS \"[BG-Backup] Copia etc    : \${BG_BACKUP_STAGE_ETC} -> \${BG_BACKUP_DEST_ETC}\")
        if(EXISTS \"\${BG_BACKUP_STAGE_ETC}\")
            file(MAKE_DIRECTORY \"\${BG_BACKUP_DEST_ETC}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_BACKUP_STAGE_ETC}\"
                        \"\${BG_BACKUP_DEST_ETC}\"
                RESULT_VARIABLE BG_BACKUP_ETC_RES
            )
            if(NOT BG_BACKUP_ETC_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-Backup] Errore copiando etc in \${BG_BACKUP_DEST_ETC}\")
            endif()
        else()
            message(STATUS \"[BG-Backup] Nessuna directory etc da installare\")
        endif()
        message(STATUS \"[BG-Backup] ✔ installazione completata\")
        message(STATUS \"[BG-Backup] =====================================\")
    ")
endif()


# ======================
# BastionGuard Secure Connection (Meson + Go)
# ======================
option(ENABLE_BASTIONGUARD_SECURE_CONNECTION "Build bastionguard-secure-connection" ON)

if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
    include(ExternalProject)

    find_program(MESON_EXECUTABLE meson REQUIRED)
    find_program(NINJA_EXECUTABLE ninja REQUIRED)
    find_program(GO_EXECUTABLE go REQUIRED)
    find_program(PROTOC_EXECUTABLE protoc REQUIRED)
    find_program(GRPC_CPP_PLUGIN_EXECUTABLE grpc_cpp_plugin REQUIRED)
    find_program(PKG_CONFIG_EXECUTABLE pkg-config REQUIRED)

    set(BG_SC_SOURCE_DIR "${CMAKE_SOURCE_DIR}/thirdparty/bastionguard-secure-connection")
    set(BG_SC_BINARY_DIR "${CMAKE_BINARY_DIR}/bastionguard-secure-connection-build")
    set(BG_SC_INSTALL_DIR "${CMAKE_BINARY_DIR}/bastionguard-secure-connection-install")

    message(STATUS "[BG-SC] Source dir  : ${BG_SC_SOURCE_DIR}")
    message(STATUS "[BG-SC] Build dir   : ${BG_SC_BINARY_DIR}")
    message(STATUS "[BG-SC] Stage dir   : ${BG_SC_INSTALL_DIR}")
    message(STATUS "[BG-SC] Final prefix: ${CMAKE_INSTALL_PREFIX}")

    ExternalProject_Add(bastionguard_secure_connection_ext
        SOURCE_DIR "${BG_SC_SOURCE_DIR}"
        BINARY_DIR "${BG_SC_BINARY_DIR}"

        CONFIGURE_COMMAND
            ${MESON_EXECUTABLE} setup "${BG_SC_BINARY_DIR}" "${BG_SC_SOURCE_DIR}"
            --prefix=/usr
            --sysconfdir=/etc
            --localedir=share/locale
            --buildtype=release
            -Dinstall_systemd_service=false
            --reconfigure

        BUILD_COMMAND
            ${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"

        INSTALL_COMMAND
            ${CMAKE_COMMAND} -E rm -rf "${BG_SC_INSTALL_DIR}"
            COMMAND ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"

        BUILD_ALWAYS 1

        USES_TERMINAL_CONFIGURE 1
        USES_TERMINAL_BUILD 1
        USES_TERMINAL_INSTALL 1

        LOG_CONFIGURE OFF
        LOG_BUILD OFF
        LOG_INSTALL OFF
    )

    add_custom_target(BastionGuard-secure-connection ALL
        DEPENDS bastionguard_secure_connection_ext
    )

    install(CODE "
        set(BG_SC_DESTDIR \"\$ENV{DESTDIR}\")
        message(STATUS \"[BG-SC] =====================================\")
        message(STATUS \"[BG-SC] Installazione bastionguard-secure-connection\")
        message(STATUS \"[BG-SC] Stage dir Meson : ${BG_SC_INSTALL_DIR}\")
        message(STATUS \"[BG-SC] Prefix finale   : ${CMAKE_INSTALL_PREFIX}\")
        message(STATUS \"[BG-SC] DESTDIR         : \${BG_SC_DESTDIR}\")

        set(BG_SC_STAGE_BIN   \"${BG_SC_INSTALL_DIR}/usr/bin\")
        set(BG_SC_STAGE_SHARE \"${BG_SC_INSTALL_DIR}/usr/share\")
        set(BG_SC_STAGE_ETC   \"${BG_SC_INSTALL_DIR}/etc\")
        set(BG_SC_STAGE_LIB   \"${BG_SC_INSTALL_DIR}/usr/lib\")

        set(BG_SC_DEST_BIN   \"\${BG_SC_DESTDIR}${CMAKE_INSTALL_PREFIX}/bin\")
        set(BG_SC_DEST_SHARE \"\${BG_SC_DESTDIR}${CMAKE_INSTALL_PREFIX}/share\")
        set(BG_SC_DEST_ETC   \"\${BG_SC_DESTDIR}/etc\")
        set(BG_SC_DEST_LIB   \"\${BG_SC_DESTDIR}${CMAKE_INSTALL_PREFIX}/lib\")

        if(EXISTS \"\${BG_SC_STAGE_BIN}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_BIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_BIN}\"
                        \"\${BG_SC_DEST_BIN}\"
                RESULT_VARIABLE BG_SC_BIN_RES
            )
            if(NOT BG_SC_BIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando i binari\")
            endif()
        endif()

        if(EXISTS \"\${BG_SC_STAGE_SHARE}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_SHARE}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_SHARE}\"
                        \"\${BG_SC_DEST_SHARE}\"
                RESULT_VARIABLE BG_SC_SHARE_RES
            )
            if(NOT BG_SC_SHARE_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando share\")
            endif()
        endif()

        if(EXISTS \"\${BG_SC_STAGE_ETC}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_ETC}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_ETC}\"
                        \"\${BG_SC_DEST_ETC}\"
                RESULT_VARIABLE BG_SC_ETC_RES
            )
            if(NOT BG_SC_ETC_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando etc\")
            endif()
        endif()

        # ── Copia esplicita config daemon in /etc/bastionguard-secure-connectiond ──
        # Meson installa i JSON con sysconfdir=/etc (assoluto), quindi nella stage
        # finiscono sempre in <INSTALL_DIR>/etc/bastionguard-secure-connectiond/.
        # Con DESTDIR finiscono dentro il pkgdir, senza DESTDIR in /etc di sistema.
        set(BG_SC_CONF_SRC \"${BG_SC_INSTALL_DIR}/etc/bastionguard-secure-connectiond\")
        set(BG_SC_CONF_DST \"\${BG_SC_DESTDIR}/etc/bastionguard-secure-connectiond\")

        if(EXISTS \"\${BG_SC_CONF_SRC}\")
            file(MAKE_DIRECTORY \"\${BG_SC_CONF_DST}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_CONF_SRC}\"
                        \"\${BG_SC_CONF_DST}\"
                RESULT_VARIABLE BG_SC_CONF_RES
            )
            if(NOT BG_SC_CONF_RES EQUAL 0)
                message(WARNING \"[BG-SC] Impossibile copiare la config (permessi?): \${BG_SC_CONF_DST}\")
            else()
                message(STATUS \"[BG-SC] ✔ Config daemon installata: \${BG_SC_CONF_DST}\")
            endif()
        else()
            message(WARNING \"[BG-SC] Directory config non trovata nella stage: \${BG_SC_CONF_SRC}\")
        endif()

        # ── Copia esplicita autostart in /etc/xdg/autostart ──────────────────
        set(BG_SC_AUTOSTART_SRC
            \"${BG_SC_INSTALL_DIR}/etc/xdg/autostart/bastionguard-sc-autostart.desktop\")
        set(BG_SC_AUTOSTART_DST \"\${BG_SC_DESTDIR}/etc/xdg/autostart/bastionguard-sc-autostart.desktop\")

        if(EXISTS \"\${BG_SC_AUTOSTART_SRC}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DESTDIR}/etc/xdg/autostart\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy
                        \"\${BG_SC_AUTOSTART_SRC}\"
                        \"\${BG_SC_AUTOSTART_DST}\"
                RESULT_VARIABLE BG_SC_AUTOSTART_RES
            )
            if(NOT BG_SC_AUTOSTART_RES EQUAL 0)
                message(WARNING \"[BG-SC] Impossibile copiare l'autostart (permessi?): \${BG_SC_AUTOSTART_DST}\")
            else()
                message(STATUS \"[BG-SC] ✔ Autostart installato: \${BG_SC_AUTOSTART_DST}\")
            endif()
        else()
            message(WARNING \"[BG-SC] File autostart non trovato nella stage: \${BG_SC_AUTOSTART_SRC}\")
        endif()

        if(EXISTS \"\${BG_SC_STAGE_LIB}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_LIB}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_LIB}\"
                        \"\${BG_SC_DEST_LIB}\"
                RESULT_VARIABLE BG_SC_LIB_RES
            )
            if(NOT BG_SC_LIB_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando lib\")
            endif()
        endif()

        message(STATUS \"[BG-SC] ✔ installazione completata\")
        message(STATUS \"[BG-SC] =====================================\")
    ")
endif()

# ======================
# BastionGuard Recovery Data (CMake)
# ======================
option(ENABLE_BASTIONGUARD_RECOVERY_DATA "Build bastionguard-recovery-data" ON)

if(ENABLE_BASTIONGUARD_RECOVERY_DATA)
    include(ExternalProject)

    set(BG_RD_SOURCE_DIR  "${CMAKE_SOURCE_DIR}/thirdparty/bastionguard-recovery-data")
    set(BG_RD_BINARY_DIR  "${CMAKE_BINARY_DIR}/bastionguard-recovery-data-build")
    set(BG_RD_INSTALL_DIR "${CMAKE_BINARY_DIR}/bastionguard-recovery-data-install")

    message(STATUS "[BG-RD] Source dir  : ${BG_RD_SOURCE_DIR}")
    message(STATUS "[BG-RD] Build dir   : ${BG_RD_BINARY_DIR}")
    message(STATUS "[BG-RD] Stage dir   : ${BG_RD_INSTALL_DIR}")
    message(STATUS "[BG-RD] Final prefix: ${CMAKE_INSTALL_PREFIX}")

    ExternalProject_Add(bastionguard_recovery_data_ext
        SOURCE_DIR "${BG_RD_SOURCE_DIR}"
        BINARY_DIR "${BG_RD_BINARY_DIR}"

        CONFIGURE_COMMAND
            "${CMAKE_COMMAND}" -S "${BG_RD_SOURCE_DIR}" -B "${BG_RD_BINARY_DIR}"
            -DCMAKE_INSTALL_PREFIX=/usr
            -DCMAKE_BUILD_TYPE=Release

        BUILD_COMMAND
            "${CMAKE_COMMAND}" --build "${BG_RD_BINARY_DIR}" --parallel

        INSTALL_COMMAND
            "${CMAKE_COMMAND}" -E env DESTDIR=${BG_RD_INSTALL_DIR}
            "${CMAKE_COMMAND}" --install "${BG_RD_BINARY_DIR}"

        BUILD_ALWAYS 1

        USES_TERMINAL_CONFIGURE 1
        USES_TERMINAL_BUILD 1
        USES_TERMINAL_INSTALL 1

        LOG_CONFIGURE OFF
        LOG_BUILD OFF
        LOG_INSTALL OFF
    )

    add_custom_target(BastionGuard-recovery-data ALL
        DEPENDS bastionguard_recovery_data_ext
    )

    install(CODE "
        set(BG_RD_DESTDIR \"\$ENV{DESTDIR}\")
        message(STATUS \"[BG-RD] =====================================\")
        message(STATUS \"[BG-RD] Installazione bastionguard-recovery-data\")
        message(STATUS \"[BG-RD] Stage dir CMake : ${BG_RD_INSTALL_DIR}\")
        message(STATUS \"[BG-RD] Prefix finale   : ${CMAKE_INSTALL_PREFIX}\")
        message(STATUS \"[BG-RD] DESTDIR         : \${BG_RD_DESTDIR}\")

        set(BG_RD_STAGE_BIN   \"${BG_RD_INSTALL_DIR}/usr/bin\")
        set(BG_RD_STAGE_SHARE \"${BG_RD_INSTALL_DIR}/usr/share\")
        set(BG_RD_STAGE_ETC   \"${BG_RD_INSTALL_DIR}/etc\")
        set(BG_RD_STAGE_LIB   \"${BG_RD_INSTALL_DIR}/usr/lib\")

        set(BG_RD_DEST_BIN   \"\${BG_RD_DESTDIR}${CMAKE_INSTALL_PREFIX}/bin\")
        set(BG_RD_DEST_SHARE \"\${BG_RD_DESTDIR}${CMAKE_INSTALL_PREFIX}/share\")
        set(BG_RD_DEST_ETC   \"\${BG_RD_DESTDIR}/etc\")
        set(BG_RD_DEST_LIB   \"\${BG_RD_DESTDIR}${CMAKE_INSTALL_PREFIX}/lib\")

        if(EXISTS \"\${BG_RD_STAGE_BIN}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_BIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_BIN}\"
                        \"\${BG_RD_DEST_BIN}\"
                RESULT_VARIABLE BG_RD_BIN_RES
            )
            if(NOT BG_RD_BIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando i binari\")
            endif()
        else()
            message(WARNING \"[BG-RD] Directory bin non trovata: \${BG_RD_STAGE_BIN}\")
        endif()

        if(EXISTS \"\${BG_RD_STAGE_SHARE}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_SHARE}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_SHARE}\"
                        \"\${BG_RD_DEST_SHARE}\"
                RESULT_VARIABLE BG_RD_SHARE_RES
            )
            if(NOT BG_RD_SHARE_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando share\")
            endif()
        else()
            message(WARNING \"[BG-RD] Directory share non trovata: \${BG_RD_STAGE_SHARE}\")
        endif()

        if(EXISTS \"\${BG_RD_STAGE_ETC}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_ETC}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_ETC}\"
                        \"\${BG_RD_DEST_ETC}\"
                RESULT_VARIABLE BG_RD_ETC_RES
            )
            if(NOT BG_RD_ETC_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando etc\")
            endif()
        else()
            message(STATUS \"[BG-RD] Nessuna directory etc da installare\")
        endif()

        if(EXISTS \"\${BG_RD_STAGE_LIB}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_LIB}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_LIB}\"
                        \"\${BG_RD_DEST_LIB}\"
                RESULT_VARIABLE BG_RD_LIB_RES
            )
            if(NOT BG_RD_LIB_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando lib\")
            endif()
        endif()

        message(STATUS \"[BG-RD] ✔ installazione completata\")
        message(STATUS \"[BG-RD] =====================================\")
    ")
endif()


# ======================
# Traduzioni con gettext
# ======================
set(PO_DIR ${CMAKE_SOURCE_DIR}/locale)
set(POT_FILE ${PO_DIR}/BastionGuard.pot)

file(GLOB PO_FILES RELATIVE ${PO_DIR} ${PO_DIR}/*.po)

add_custom_target(update-po
    COMMAND ${GETTEXT_XGETTEXT_EXECUTABLE} --keyword=_ --language=C++ --from-code=UTF-8
            -o ${POT_FILE} ${CMAKE_SOURCE_DIR}/src/*.cpp ${CMAKE_SOURCE_DIR}/src/*.hpp
    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
    COMMENT "Rigenerazione BastionGuard.pot"
)

if(NOT DEFINED GETTEXT_MSGUNIQ_EXECUTABLE)
    find_program(GETTEXT_MSGUNIQ_EXECUTABLE msguniq)
endif()

if(NOT GETTEXT_MSGUNIQ_EXECUTABLE)
    message(WARNING "msguniq non trovato. I duplicati nelle .po non verranno filtrati automaticamente.")
endif()

set(MO_TARGETS "")

foreach(PO_REL ${PO_FILES})
    set(PO_FILE ${PO_DIR}/${PO_REL})
    get_filename_component(LANG ${PO_FILE} NAME_WE)

    set(BUILD_LOCALE_DIR ${CMAKE_CURRENT_BINARY_DIR}/locale/${LANG}/LC_MESSAGES)
    set(SANITIZED_PO ${CMAKE_CURRENT_BINARY_DIR}/locale/${LANG}/BastionGuard_${LANG}.po)
    set(MO_FILE ${BUILD_LOCALE_DIR}/BastionGuard.mo)

    if(GETTEXT_MSGUNIQ_EXECUTABLE)
        add_custom_command(
            OUTPUT ${MO_FILE}
            COMMAND ${CMAKE_COMMAND} -E make_directory ${BUILD_LOCALE_DIR}
            COMMAND ${GETTEXT_MSGUNIQ_EXECUTABLE} ${PO_FILE} -o ${SANITIZED_PO}
            COMMAND ${GETTEXT_MSGFMT_EXECUTABLE} -o ${MO_FILE} ${SANITIZED_PO}
            DEPENDS ${PO_FILE}
            COMMENT "Sanitizzo ${PO_FILE} (msguniq) e compilo ${MO_FILE}"
        )
    else()
        add_custom_command(
            OUTPUT ${MO_FILE}
            COMMAND ${CMAKE_COMMAND} -E make_directory ${BUILD_LOCALE_DIR}
            COMMAND ${GETTEXT_MSGFMT_EXECUTABLE} -o ${MO_FILE} ${PO_FILE}
            DEPENDS ${PO_FILE}
            COMMENT "Compilo ${PO_FILE} → ${MO_FILE}"
        )
    endif()

    add_custom_target(${LANG}.mo ALL DEPENDS ${MO_FILE})
    list(APPEND MO_TARGETS ${LANG}.mo)

    install(FILES ${MO_FILE}
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/locale/${LANG}/LC_MESSAGES
    )
endforeach()

add_custom_target(translations DEPENDS ${MO_TARGETS})

# ======================
# Installazioni generali
# ======================
install(FILES desktop/BastionGuard.desktop
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications)

install(FILES desktop/BastionGuard-bankgui.desktop
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications)

install(FILES desktop/BastionGuard-secure.desktop
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications)

install(FILES desktop/bastionguard-bankopener.desktop
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications)

install(FILES  desktop/BastionGuard-autostart.desktop
        DESTINATION ${CMAKE_INSTALL_SYSCONFDIR}/xdg/autostart)


if (EXISTS "${CMAKE_SOURCE_DIR}/data/rules")
  install(DIRECTORY "${CMAKE_SOURCE_DIR}/data/rules/"
          DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/rules")
else()
  message(WARNING "data/rules not found; skipping install")
endif()

if (EXISTS "${CMAKE_SOURCE_DIR}/data/vhosts")
  install(DIRECTORY "${CMAKE_SOURCE_DIR}/data/vhosts/"
          DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/vhosts")
else()
  message(WARNING "data/vhosts not found; skipping install")
endif()


# ==============================
# Installazione automatica dei file NGINX (universale)
# ==============================
if (INSTALL_NGINX_DEFAULTS)
    message(STATUS "🧩 Installazione automatica dei file di configurazione NGINX abilitata")

    bg_install_code( "
        message(STATUS \"📦 Creazione directory standard NGINX...\")
        file(MAKE_DIRECTORY /etc/nginx/conf.d)
        file(MAKE_DIRECTORY /etc/nginx/sites-available)
        file(MAKE_DIRECTORY /etc/nginx/sites-enabled)

        # ============================================================
        # 1️⃣ Copia BastionGuard Virtual Host (nginx.conf → BastionGuard.conf)
        # ============================================================
        if(EXISTS \"/usr/share/BastionGuard/data/vhosts/nginx.conf\")
            message(STATUS \"[NGINX] Installo BastionGuard.conf in /etc/nginx/sites-available/\")
            execute_process(COMMAND cp -f /usr/share/BastionGuard/data/vhosts/nginx.conf /etc/nginx/sites-available/BastionGuard.conf)

            if(NOT EXISTS /etc/nginx/sites-enabled/BastionGuard.conf)
                execute_process(COMMAND ln -s ../sites-available/BastionGuard.conf /etc/nginx/sites-enabled/BastionGuard.conf)
                message(STATUS \"[NGINX] Abilitato site BastionGuard in sites-enabled/\")
            else()
                message(STATUS \"[NGINX] sites-enabled/BastionGuard.conf già presente\")
            endif()
        else()
            message(WARNING \"[NGINX] nginx.conf non trovato in /usr/share/BastionGuard/data/vhosts/\")
        endif()

        # ============================================================
        # 2️⃣ Installa il default site per Arch / altre distro
        # ============================================================
        if(EXISTS /etc/os-release)
            file(READ /etc/os-release OSINFO)
            string(FIND \"\${OSINFO}\" \"arch\" _archpos)
            if(NOT _archpos EQUAL -1)
                message(STATUS \"[NGINX] Rilevata Arch Linux → uso nginx-default-arch.conf come default\")
                if(EXISTS \"/usr/share/BastionGuard/data/vhosts/nginx-default-arch.conf\")
                    execute_process(COMMAND cp -f /usr/share/BastionGuard/data/vhosts/nginx-default-arch.conf /etc/nginx/sites-available/default)
                endif()
            else()
                message(STATUS \"[NGINX] Uso configurazione standard nginx-default.conf come default\")
                if(EXISTS \"/usr/share/BastionGuard/data/vhosts/nginx-default.conf\")
                    execute_process(COMMAND cp -f /usr/share/BastionGuard/data/vhosts/nginx-default.conf /etc/nginx/sites-available/default)
                endif()
            endif()
        endif()

        # Link simbolico per default
        if(NOT EXISTS /etc/nginx/sites-enabled/default)
            execute_process(COMMAND ln -s ../sites-available/default /etc/nginx/sites-enabled/default)
            message(STATUS \"[NGINX] Abilitato default site in sites-enabled/\")
        endif()

        # ============================================================
        # 3️⃣ Pagina di test HTTP
        # ============================================================
        if(NOT EXISTS /srv/http/index.html)
            file(MAKE_DIRECTORY /srv/http)
            file(WRITE /srv/http/index.html \"<html><body><h2>✅ Nginx configurato correttamente per BastionGuard</h2></body></html>\")
            message(STATUS \"[NGINX] Creata pagina di test /srv/http/index.html\")
        endif()

        # ============================================================
        # 4️⃣ Test configurazione e riavvio
        # ============================================================
        message(STATUS \"[NGINX] Testo configurazione...\")
        execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
        if(nginx_test EQUAL 0)
            execute_process(
                COMMAND ${BG_SERVICECTL_PATH} --system restart nginx.service
            )
            message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
        else()
            message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
        endif()
    ")
else()
    message(STATUS "Installazione automatica dei file NGINX disabilitata (usa -DINSTALL_NGINX_DEFAULTS=ON per abilitarla)")
endif()


install(FILES data/service/org.BastionGuard.RansomwareAlert.service
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/dbus-1/services)

install(FILES
        actions/policy/org.BastionGuard.policy
        actions/policy/org.BastionGuard.ransomware.policy
        actions/policy/org.BastionGuard.USBD.policy
        DESTINATION /usr/share/polkit-1/actions
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

if(ENABLE_SYSTEM_CA_INSTALL)
    install(FILES actions/policy/eu.bastionguard.install-ca.policy
        DESTINATION /usr/share/polkit-1/actions
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
    )
endif()

install(FILES actions/dbus/org.BastionGuard.USBD.conf
        DESTINATION /usr/share/dbus-1/system.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

# Install DBus system service
install(
    FILES actions/dbus/org.BastionGuard.USBD.service
    DESTINATION /usr/share/dbus-1/system-services
    PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
)

# ======================
# Polkit Policy – Privacy Webcam
# ======================
install(FILES actions/policy/it.BastionGuard.camera.policy
        DESTINATION /usr/share/polkit-1/actions
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

# ======================
# Permission Policy – Privacy Webcam
# ======================
install(FILES data/sudoers/bastionguard-helper
        DESTINATION /etc/sudoers.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

# ======================
# Permission Policy – Bank helper
# ======================
install(FILES data/sudoers/bastionguard-helper
        DESTINATION /etc/sudoers.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

# ======================
# Permission Policy – Helper anti-phishing-update
# ======================
install(FILES data/sudoers/bastionguard-phishing
        DESTINATION /etc/sudoers.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

install(PROGRAMS
    data/scripts/bank-helper
    DESTINATION /usr/bin/
)

# ======================
# Services
# ======================

# opzione per abilitare automaticamente i servizi utente durante install
option(ENABLE_USER_AGENT_AUTO "Attempt to enable user services for logged-in users at install time" OFF)

# Dispatcher e supervisori comuni a tutti i backend.
install(PROGRAMS
    data/init/common/bastionguard-service
    data/init/common/bastionguard-supervise
    data/init/common/bastionguard-periodic
    data/init/common/bastionguard-sanesecurity-update
    DESTINATION /usr/libexec/bastionguard
)
install(FILES
    "${CMAKE_CURRENT_BINARY_DIR}/bastionguard-init-config"
    DESTINATION /usr/libexec/bastionguard
)

if(BG_INIT_SYSTEM STREQUAL "SYSTEMD")
    install(FILES
        data/service/BastionGuard-phishing-scanner.service
        data/service/BastionGuard-phishing-updater.service
        data/service/BastionGuard-phishing-updater.timer
        data/service/BastionGuard-ransomware-realtime.service
        data/service/bastionguard-sanesecurity.service
        data/service/bastionguard-sanesecurity.timer
        data/service/BastionGuard-usbd.service
        DESTINATION /usr/lib/systemd/system
    )

    if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
        install(FILES
            thirdparty/bastionguard-secure-connection/dist/bsc-daemon.service
            DESTINATION /usr/lib/systemd/system
        )
    endif()

    install(FILES
        data/service/BastionGuard-useragent.service
        data/service/BastionGuard-privacyd.service
        data/service/BastionGuard-ransomware-alert.service
        data/service/BastionGuard-ransomware-realtime-alert.service
        data/service/BastionGuard-ransomware-scanner.service
        data/service/BastionGuard-pacd.service
        data/service/BastionGuard-mailproxy.service
        data/service/BastionGuard-user-session-watch.service
        DESTINATION /usr/lib/systemd/user
    )

    if(ENABLE_CEF_DAEMON)
        install(FILES data/service/BastionGuard-cef.service
            DESTINATION /usr/lib/systemd/user
        )
    endif()
elseif(BG_INIT_SYSTEM STREQUAL "OPENRC")
    function(bg_install_openrc_service service_name)
        install(PROGRAMS data/init/openrc/bastionguard-openrc-service
            DESTINATION /etc/init.d
            RENAME "${service_name}")
    endfunction()

    bg_install_openrc_service(BastionGuard-phishing-scanner)
    bg_install_openrc_service(BastionGuard-phishing-updater)
    bg_install_openrc_service(BastionGuard-phishing-updater-timer)
    bg_install_openrc_service(BastionGuard-ransomware-realtime)
    bg_install_openrc_service(bastionguard-sanesecurity)
    bg_install_openrc_service(bastionguard-sanesecurity-timer)
    bg_install_openrc_service(BastionGuard-usbd)
    bg_install_openrc_service(clamav-clamonacc)
    if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
        bg_install_openrc_service(bsc-daemon)
    endif()

    install(FILES data/init/common/bastionguard-user-services.desktop
        DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "SYSVINIT")
    function(bg_install_sysv_service service_name)
        set(BG_SYSV_SERVICE_NAME "${service_name}")
        set(_generated_service
            "${CMAKE_CURRENT_BINARY_DIR}/init/sysvinit/${service_name}")
        configure_file(
            data/init/sysvinit/bastionguard-sysv-service.in
            "${_generated_service}"
            @ONLY
            NEWLINE_STYLE UNIX
        )
        install(PROGRAMS "${_generated_service}"
            DESTINATION /etc/init.d)
    endfunction()

    bg_install_sysv_service(BastionGuard-phishing-scanner)
    bg_install_sysv_service(BastionGuard-phishing-updater)
    bg_install_sysv_service(BastionGuard-phishing-updater-timer)
    bg_install_sysv_service(BastionGuard-ransomware-realtime)
    bg_install_sysv_service(bastionguard-sanesecurity)
    bg_install_sysv_service(bastionguard-sanesecurity-timer)
    bg_install_sysv_service(BastionGuard-usbd)
    bg_install_sysv_service(clamav-clamonacc)
    if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
        bg_install_sysv_service(bsc-daemon)
    endif()

    install(FILES data/init/common/bastionguard-user-services.desktop
        DESTINATION /etc/xdg/autostart)
elseif(BG_INIT_SYSTEM STREQUAL "DINIT")
    install(PROGRAMS
        data/init/dinit/bastionguard-dinit-run
        data/init/dinit/bastionguard-dinit-user-run
        DESTINATION /usr/libexec/bastionguard
    )

    set(_generated_dinit_root
        "${CMAKE_CURRENT_BINARY_DIR}/init/dinit/bastionguard")
    configure_file(
        data/init/dinit/bastionguard-dinit-root.in
        "${_generated_dinit_root}"
        @ONLY
        NEWLINE_STYLE UNIX
    )
    install(FILES "${_generated_dinit_root}"
        DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
    install(DIRECTORY DESTINATION "${BG_DINIT_ENABLE_DIR}")

    function(bg_install_dinit_service service_name service_type restart_policy)
        set(BG_DINIT_SERVICE_NAME "${service_name}")
        set(BG_DINIT_SERVICE_TYPE "${service_type}")
        set(BG_DINIT_SERVICE_RESTART "${restart_policy}")
        if(service_type STREQUAL "process")
            set(BG_DINIT_SERVICE_RESTART_OPTIONS
                "restart-delay = 5\nrestart-limit-count = 0")
        else()
            set(BG_DINIT_SERVICE_RESTART_OPTIONS "")
        endif()
        set(_generated_service
            "${CMAKE_CURRENT_BINARY_DIR}/init/dinit/system/${service_name}")
        configure_file(
            data/init/dinit/bastionguard-dinit-service.in
            "${_generated_service}"
            @ONLY
            NEWLINE_STYLE UNIX
        )
        install(FILES "${_generated_service}"
            DESTINATION "${BASTIONGUARD_DINIT_SYSTEM_DIR}")
    endfunction()

    bg_install_dinit_service(BastionGuard-phishing-scanner process on-failure)
    bg_install_dinit_service(BastionGuard-phishing-updater process false)
    bg_install_dinit_service(BastionGuard-phishing-updater-timer process on-failure)
    bg_install_dinit_service(BastionGuard-ransomware-realtime process on-failure)
    bg_install_dinit_service(bastionguard-sanesecurity process false)
    bg_install_dinit_service(bastionguard-sanesecurity-timer process on-failure)
    bg_install_dinit_service(BastionGuard-usbd process on-failure)
    bg_install_dinit_service(clamav-clamonacc process on-failure)
    if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
        bg_install_dinit_service(bsc-daemon process on-failure)
    endif()

    function(bg_install_dinit_user_service service_name restart_policy restart_delay)
        set(BG_DINIT_USER_SERVICE_NAME "${service_name}")
        set(BG_DINIT_USER_SERVICE_RESTART "${restart_policy}")
        set(BG_DINIT_USER_RESTART_DELAY "${restart_delay}")
        set(_generated_service
            "${CMAKE_CURRENT_BINARY_DIR}/init/dinit/user/${service_name}")
        configure_file(
            data/init/dinit/bastionguard-dinit-user-service.in
            "${_generated_service}"
            @ONLY
            NEWLINE_STYLE UNIX
        )
        install(FILES "${_generated_service}"
            DESTINATION "${BASTIONGUARD_DINIT_USER_DIR}")
    endfunction()

    bg_install_dinit_user_service(BastionGuard-useragent true 3)
    bg_install_dinit_user_service(BastionGuard-privacyd true 3)
    bg_install_dinit_user_service(BastionGuard-ransomware-alert on-failure 3)
    bg_install_dinit_user_service(BastionGuard-ransomware-realtime-alert true 3)
    bg_install_dinit_user_service(BastionGuard-ransomware-scanner true 3)
    bg_install_dinit_user_service(BastionGuard-pacd true 3)
    bg_install_dinit_user_service(BastionGuard-mailproxy true 3)
    bg_install_dinit_user_service(BastionGuard-user-session-watch true 3)
    if(ENABLE_CEF_DAEMON)
        bg_install_dinit_user_service(BastionGuard-cef true 3)
    endif()

    install(FILES data/init/common/bastionguard-user-services.desktop
        DESTINATION /etc/xdg/autostart)
endif()

# Mantiene la copia dati dell'unità CEF prevista da questo CMake.
if(ENABLE_CEF_DAEMON)
    install(FILES data/service/BastionGuard-cef.service
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/service
    )
endif()

# helper script to enable user agents for logged-in users
install(PROGRAMS
    data/scripts/enable-user-agents.sh
    data/scripts/BastionGuard-phishing-updater.sh
    data/scripts/BastionGuard-net-setup.sh
    data/scripts/BastionGuard-export-env.sh
    data/scripts/BastionGuard-locale.sh
    data/scripts/BastionGuard-setup-clamav-daemon.sh
    data/scripts/BastionGuard-restart-user-services.sh
    data/scripts/BastionGuard-user-session-watch.sh
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)

if(ENABLE_SYSTEM_CA_INSTALL)
    install(PROGRAMS data/scripts/install-ca-system.sh
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
    )
endif()

install(PROGRAMS
    data/extension/bastionguard-tb-extension/install-tb-extension.sh
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/extension/bastionguard-tb-extension
)

install(FILES
    data/config/nftables.conf
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/config
)

# ============================================================
# 🔧 Forza RPATH su TUTTI i binari BastionGuard
# ============================================================
set(BG_ALL_BINARIES
    BastionGuard
    BastionGuard-ransomware-alert
    BastionGuard-ransomware-realtime-alert
    BastionGuard-daemon
    BastionGuard-privacyd
    BastionGuard-usbd
    BastionGuard-wizard
    BastionGuard-bankopener
    BastionGuard-bankgui
    BastionGuard-native-host
    BastionGuard-ransomware-scanner
    BastionGuard-ransomware-realtime
    BastionGuard-mailproxy
    archive_worker
)

foreach(tgt IN LISTS BG_ALL_BINARIES)
    if(TARGET ${tgt})
       set_target_properties(${tgt} PROPERTIES
    INSTALL_RPATH "/usr/share/BastionGuard/lib;/usr/share/BastionGuard/cef"
    BUILD_RPATH   "/usr/share/BastionGuard/lib;/usr/share/BastionGuard/cef"
)
    endif()
endforeach()


# ============================================================
# 📌 Installazione automatica delle firme custom in /var/lib/clamav
# ============================================================

bg_install_code( "
    message(STATUS \"[ClamAV] Copio tutte le firme custom da data/signature in /var/lib/clamav ...\")
    set(SRC_DIR \"${CMAKE_SOURCE_DIR}/data/signature\")
    set(DEST_DIR \"/var/lib/clamav\")

    # Crea la directory se non esiste
    file(MAKE_DIRECTORY \${DEST_DIR})

    # Cerca solo i file con estensioni valide per ClamAV
    file(GLOB SIGNATURE_FILES
        \"\${SRC_DIR}/*.ndb\"
        \"\${SRC_DIR}/*.hdb\"
        \"\${SRC_DIR}/*.ldb\"
        \"\${SRC_DIR}/*.fp\"
        \"\${SRC_DIR}/*.ign\"
        \"\${SRC_DIR}/*.ign2\"
    )

    list(LENGTH SIGNATURE_FILES NUM_FILES)

    if(NUM_FILES EQUAL 0)
        message(WARNING \"[ClamAV] Nessun file di signature (.ndb/.hdb/.ldb/.fp/etc) trovato in \${SRC_DIR}\")
    else()
        foreach(f IN LISTS SIGNATURE_FILES)
            get_filename_component(FILENAME \${f} NAME)
            file(INSTALL
                DESTINATION \${DEST_DIR}
                TYPE FILE
                FILES \"\${f}\"
                PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
            )
            message(STATUS \"[ClamAV] Installato: \${FILENAME} → \${DEST_DIR}\")
        endforeach()
        message(STATUS \"[ClamAV] Completato: \${NUM_FILES} firme custom copiate con successo\")
    endif()
")

# ============================================================
# ⚙️  Installazione ottimizzazioni DNS (sysctl)
# ============================================================
set(SYSCTL_SOURCE_PATH "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/data/config/99-dns-fast.conf")
set(SYSCTL_DEST_PATH "/etc/sysctl.d/99-dns-fast.conf")

bg_install_code( "
    message(STATUS \"[Sysctl] Installazione ottimizzazioni DNS...\")
    if(EXISTS \"${SYSCTL_SOURCE_PATH}\")
        file(INSTALL DESTINATION /etc/sysctl.d
             TYPE FILE
             FILES \"${SYSCTL_SOURCE_PATH}\"
             PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
        message(STATUS \"[Sysctl] Copiato: ${SYSCTL_SOURCE_PATH} → ${SYSCTL_DEST_PATH}\")

        # Applica immediatamente le modifiche
        execute_process(COMMAND sysctl --system
                        RESULT_VARIABLE sysctl_result
                        OUTPUT_VARIABLE sysctl_output
                        ERROR_VARIABLE sysctl_error)
        if(sysctl_result EQUAL 0)
            message(STATUS \"[Sysctl] ✅ Configurazioni DNS applicate correttamente.\")
        else()
            message(WARNING \"[Sysctl] ⚠ Errore applicando sysctl: \${sysctl_error}\")
        endif()
    else()
        message(WARNING \"[Sysctl] ⚠ File non trovato: ${SYSCTL_SOURCE_PATH}\")
    endif()
")





if(ENABLE_INIT_SERVICES)
    bg_install_code( "
        if(DEFINED ENV{DESTDIR} AND NOT \"\$ENV{DESTDIR}\" STREQUAL \"\")
            message(STATUS \"[Init] DESTDIR attivo: salto enable/start dei servizi\")
        else()
            message(STATUS \"[Init] Backend: ${BG_INIT_SYSTEM}\")
            execute_process(COMMAND ${BG_SERVICECTL_PATH} --system daemon-reload)

            message(STATUS \"[Init] Abilito e avvio BastionGuard-phishing-scanner...\")
            execute_process(
                COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-phishing-scanner.service
            )

            message(STATUS \"[Init] Abilito e avvio BastionGuard-ransomware-realtime...\")
            execute_process(
                COMMAND ${BG_SERVICECTL_PATH} --system enable --now BastionGuard-ransomware-realtime.service
            )

            if(${ENABLE_BASTIONGUARD_SECURE_CONNECTION})
                message(STATUS \"[Init] Abilito e avvio bsc-daemon...\")
                execute_process(
                    COMMAND ${BG_SERVICECTL_PATH} --system enable --now bsc-daemon.service
                )
            endif()

            execute_process(
                COMMAND ${BG_SERVICECTL_PATH} --system start polkit.service
            )
        endif()
    ")
else()
    message(STATUS "Init service install-time actions are disabled. Use -DENABLE_INIT_SERVICES=ON to enable them")
endif()

# ============================================================
#  Installazione automatica regola udev per BastionGuard USB
# ============================================================
set(UDEV_RULE_SOURCE "${CMAKE_SOURCE_DIR}/data/udev/99-BastionGuard-usb.rules")
set(UDEV_RULE_DEST   "/etc/udev/rules.d/99-BastionGuard-usb.rules")

if(EXISTS ${UDEV_RULE_SOURCE})
    message(STATUS "✔ Regola UDEV trovata: ${UDEV_RULE_SOURCE}")

    bg_install_code( "
        message(STATUS \"[UDEV] Installazione regola USB...\")

        # Determina l'utente reale
        set(INSTALL_USER \"$ENV{SUDO_USER}\")
        if(NOT INSTALL_USER OR INSTALL_USER STREQUAL \"\")
            set(INSTALL_USER \"$ENV{USER}\")
        endif()
        message(STATUS \"[UDEV] Utente reale: \${INSTALL_USER}\")

        # 1️⃣ Copia regola udev UNA SOLA VOLTA
        execute_process(
            COMMAND cp -f \"${UDEV_RULE_SOURCE}\" \"${UDEV_RULE_DEST}\"
        )
        message(STATUS \"[UDEV] Copiata: ${UDEV_RULE_SOURCE} → ${UDEV_RULE_DEST}\")

        # 2️⃣ Gruppo plugdev
        execute_process(
            COMMAND getent group plugdev
            RESULT_VARIABLE PLUGDEV_EXISTS
            OUTPUT_QUIET ERROR_QUIET
        )
        if(PLUGDEV_EXISTS EQUAL 0)
            message(STATUS \"[UDEV] Gruppo plugdev già esistente.\")
        else()
            message(STATUS \"[UDEV] Creo gruppo plugdev...\")
            execute_process(COMMAND groupadd plugdev)
        endif()

        # 3️⃣ Aggiunta utente
        execute_process(
            COMMAND id -nG \${INSTALL_USER}
            OUTPUT_VARIABLE USER_GROUPS
            OUTPUT_STRIP_TRAILING_WHITESPACE
        )
        string(FIND \"\${USER_GROUPS}\" \"plugdev\" FOUND_PLUGDEV)
        if(NOT FOUND_PLUGDEV EQUAL -1)
            message(STATUS \"[UDEV] Utente \${INSTALL_USER} già nel gruppo plugdev.\")
        else()
            message(STATUS \"[UDEV] Aggiungo \${INSTALL_USER} al gruppo plugdev...\")
            execute_process(COMMAND usermod -aG plugdev \${INSTALL_USER})
        endif()

        # 4️⃣ Reload
        message(STATUS \"[UDEV] Ricarico regole udev...\")
        execute_process(COMMAND udevadm control --reload-rules)

        # 5️⃣ Trigger
        message(STATUS \"[UDEV] Eseguo udevadm trigger...\")
        execute_process(COMMAND udevadm trigger)

        message(STATUS \"[UDEV] ✔ Installazione UDEV completata.\")
    ")

else()
    message(WARNING "⚠ File UDEV non trovato: ${UDEV_RULE_SOURCE}")
endif()


# ======================
# Helper uninstall target (CMake uninstall support)
# ======================
if(NOT TARGET uninstall)
    configure_file(
        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/cmake_uninstall.cmake.in"
        "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake"
        IMMEDIATE @ONLY
    )

    add_custom_target(uninstall
        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake
        COMMENT "Rimozione completa di tutti i file installati da BastionGuard"
    )
endif()
