#!/bin/sh
set -e

# Debian maintainer script: postinst
# Purpose:
# - Apply statoverrides for setuid helpers (policy-compliant)
# - Ensure CEF chrome-sandbox has correct mode (if shipped)
# - Reload udev rules (best-effort)
# - Reload systemd units (best-effort, debhelper-friendly)

case "$1" in
  configure|abort-upgrade|abort-deconfigure|abort-remove)

    # ------------------------------------------------------------
    # 1) setuid helpers via dpkg-statoverride (preferred)
    # ------------------------------------------------------------
    if command -v dpkg-statoverride >/dev/null 2>&1; then
      if [ -e /usr/bin/bastionguard-privhelper ]; then
        dpkg-statoverride --list /usr/bin/bastionguard-privhelper >/dev/null 2>&1 \
          || dpkg-statoverride --add root root 4755 /usr/bin/bastionguard-privhelper || true
      fi

      if [ -e /usr/bin/bastionguard-firewall ]; then
        dpkg-statoverride --list /usr/bin/bastionguard-firewall >/dev/null 2>&1 \
          || dpkg-statoverride --add root root 4755 /usr/bin/bastionguard-firewall || true
      fi
    fi

    # ------------------------------------------------------------
    # 2) CEF sandbox permissions (if installed)
    # Notes:
    # - chrome-sandbox typically requires setuid root (4755).
    # - There's no Debian-wide statoverride convention for this file,
    #   so we apply chmod best-effort.
    # ------------------------------------------------------------
    if [ -e /usr/share/BastionGuard/cef/chrome-sandbox ]; then
      chmod 4755 /usr/share/BastionGuard/cef/chrome-sandbox || true
      chown root:root /usr/share/BastionGuard/cef/chrome-sandbox || true
    fi

    # ------------------------------------------------------------
    # 3) udev reload (best-effort)
    # ------------------------------------------------------------
    if command -v udevadm >/dev/null 2>&1; then
      udevadm control --reload-rules >/dev/null 2>&1 || true
      udevadm trigger >/dev/null 2>&1 || true
    fi

    # ------------------------------------------------------------
    # 4) systemd unit reload (debhelper-friendly)
    # Prefer deb-systemd-helper / deb-systemd-invoke when available.
    # ------------------------------------------------------------
    if [ -d /run/systemd/system ]; then
      if command -v deb-systemd-helper >/dev/null 2>&1; then
        # This is safe even if units are not enabled here.
        deb-systemd-helper daemon-reload >/dev/null 2>&1 || true
      elif command -v systemctl >/dev/null 2>&1; then
        systemctl daemon-reload >/dev/null 2>&1 || true
      fi
    fi
  ;;
esac

exit 0