cmake_minimum_required(VERSION 3.16)
project(BastionGuard LANGUAGES CXX)


# ============================================================
# Optional CEF support and Fedora/RHEL-family hard disable
# ============================================================
option(ENABLE_CEF "Build and install CEF-based secure browser components" ON)

set(BG_OS_RELEASE_FILE "/etc/os-release" CACHE FILEPATH "os-release file used for distro-specific build decisions")
set(BG_FEDORA_RHEL_FAMILY FALSE)
if(EXISTS "${BG_OS_RELEASE_FILE}")
    file(STRINGS "${BG_OS_RELEASE_FILE}" BG_OS_RELEASE_LINES REGEX "^ID=")
    foreach(BG_OS_LINE IN LISTS BG_OS_RELEASE_LINES)
        string(REPLACE "\"" "" BG_OS_LINE "${BG_OS_LINE}")
        string(TOLOWER "${BG_OS_LINE}" BG_OS_LINE_LOWER)
        if(BG_OS_LINE_LOWER MATCHES "^id=(fedora|rhel|almalinux|alma|rocky|rockylinux)$")
            set(BG_FEDORA_RHEL_FAMILY TRUE)
        endif()
    endforeach()
endif()

if(BG_FEDORA_RHEL_FAMILY)
    set(ENABLE_CEF OFF CACHE BOOL "Build and install CEF-based secure browser components" FORCE)
    message(STATUS "CEF disabilitato: Fedora/RHEL/AlmaLinux/Rocky Linux non supportati")
endif()

if(ENABLE_CEF)
    add_compile_definitions(BASTIONGUARD_HAS_CEF=1)
else()
    add_compile_definitions(BASTIONGUARD_HAS_CEF=0)
endif()

# ===============================
# 🔒 RPATH GLOBALE BASTIONGUARD
# ===============================
set(BG_RPATH "/usr/share/BastionGuard/lib")

set(CMAKE_SKIP_BUILD_RPATH FALSE)
set(CMAKE_BUILD_WITH_INSTALL_RPATH FALSE)
set(CMAKE_INSTALL_RPATH "${BG_RPATH}")
set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)

set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)


set(CMAKE_AUTOMOC ON)
set(CMAKE_AUTOUIC ON)
set(CMAKE_AUTORCC ON)

find_package(PkgConfig REQUIRED)
find_package(Gettext REQUIRED)
# ======================
# libsystemd / sd-bus
# ======================
pkg_check_modules(SYSTEMD REQUIRED libsystemd)

if (SYSTEMD_FOUND)
    message(STATUS "✔ libsystemd trovato: ${SYSTEMD_VERSION}")
    include_directories(${SYSTEMD_INCLUDE_DIRS})
    link_directories(${SYSTEMD_LIBRARY_DIRS})
    add_definitions(${SYSTEMD_CFLAGS_OTHER})
else()
    message(FATAL_ERROR "❌ libsystemd non trovato. Installa libsystemd-dev")
endif()
# ==============================
# Controllo NGINX
# ==============================
find_program(NGINX_EXECUTABLE nginx)

if (NOT NGINX_EXECUTABLE)
    message(FATAL_ERROR "❌ NGINX non trovato nel sistema. Installa nginx (es: sudo apt install nginx o sudo pacman -S nginx).")
else()
    execute_process(COMMAND ${NGINX_EXECUTABLE} -v
        ERROR_VARIABLE NGINX_VERSION_OUTPUT
        OUTPUT_STRIP_TRAILING_WHITESPACE
        ERROR_STRIP_TRAILING_WHITESPACE
    )
    string(REPLACE "nginx version: " "" NGINX_VERSION "${NGINX_VERSION_OUTPUT}")
    message(STATUS "✔ NGINX trovato: ${NGINX_EXECUTABLE} (${NGINX_VERSION})")
endif()

# ==============================
# Controllo RSYNC (richiesto per SaneSecurity)
# ==============================
find_program(RSYNC_EXECUTABLE rsync)

if (NOT RSYNC_EXECUTABLE)
    message(FATAL_ERROR "❌ rsync non trovato nel sistema. È richiesto per aggiornare le firme SaneSecurity.
Installa rsync (Debian/Ubuntu: sudo apt install rsync | Arch: sudo pacman -S rsync).")
else()
    message(STATUS "✔ rsync trovato: ${RSYNC_EXECUTABLE}")
endif()



include(GNUInstallDirs)

# ============================================================
# BastionGuard – RPATH centralizzato (SAFE)
# ============================================================

set(BG_LIBDIR "/usr/share/BastionGuard/lib")
set(BG_CEF_LIBDIR "/usr/share/BastionGuard/cef")
if(ENABLE_CEF)
    set(BG_RUNTIME_RPATH "${BG_LIBDIR};${BG_CEF_LIBDIR}")
else()
    set(BG_RUNTIME_RPATH "${BG_LIBDIR}")
endif()

function(bg_set_rpath target)
    if(TARGET ${target})
        set_target_properties(${target} PROPERTIES
            BUILD_RPATH "${BG_RUNTIME_RPATH}"
            INSTALL_RPATH "${BG_RUNTIME_RPATH}"
            SKIP_BUILD_RPATH FALSE
        )
    endif()
endfunction()


# Option to control whether systemd services are enabled / started at install time.
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)

# --- Percorso dati installati (es: /usr/share/BastionGuard/data) ---
install(DIRECTORY data/
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
    PATTERN "scripts/install-ca-system.sh" EXCLUDE
)



set(INSTALL_DATA_DIR "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/data")
set(INSTALL_LOCALE_DIR "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/locale")


set(PKG_CONFIG_USE_CMAKE_PREFIX_PATH ON)

set(ENV{PKG_CONFIG_PATH}
    "/usr/share/BastionGuard/lib/pkgconfig:/usr/share/BastionGuard/share/pkgconfig"
)

# ======================
# pkg-config
# ======================
pkg_check_modules(GTKMM REQUIRED gtkmm-4.0)
pkg_check_modules(GIOMM REQUIRED giomm-2.68)
pkg_check_modules(SIGC REQUIRED sigc++-3.0)
pkg_check_modules(YARA REQUIRED yara)
pkg_check_modules(SOUP REQUIRED libsoup-3.0)
pkg_check_modules(PANGOMM REQUIRED pangomm-2.48)
# ======================
# libudev (PrivacyPage)
# ======================
pkg_check_modules(UDEV REQUIRED libudev)
include_directories(${UDEV_INCLUDE_DIRS})
link_directories(${UDEV_LIBRARY_DIRS})
if (UDEV_FOUND)
    message(STATUS "✔ libudev trovato: ${UDEV_VERSION}")
else()
    message(FATAL_ERROR "❌ libudev non trovato. Installa libudev-dev (Debian/Ubuntu) o systemd-libs-devel (Fedora).")
endif()

# ======================
# LibSecret (per salvataggio sicuro delle credenziali)
# ======================
pkg_check_modules(LIBSECRET REQUIRED libsecret-1)

if (LIBSECRET_FOUND)
    message(STATUS "✔ LibSecret trovato: ${LIBSECRET_VERSION}")
    include_directories(${LIBSECRET_INCLUDE_DIRS})
    link_directories(${LIBSECRET_LIBRARY_DIRS})
    add_definitions(${LIBSECRET_CFLAGS_OTHER})
else()
    message(FATAL_ERROR "❌ LibSecret non trovato. Installa libsecret-1-dev (Debian/Ubuntu) o libsecret (Arch/Fedora).")
endif()

# ======================
# libidn2 (per IDNA/Punycode nelle URL phishing)
# ======================
pkg_check_modules(IDN2 REQUIRED libidn2)
include_directories(${IDN2_INCLUDE_DIRS})
link_directories(${IDN2_LIBRARY_DIRS})

# ======================
# SQLite3 (per gestione blacklist e database phishing)
# ======================
pkg_check_modules(SQLITE3 REQUIRED sqlite3)
include_directories(${SQLITE3_INCLUDE_DIRS})
link_directories(${SQLITE3_LIBRARY_DIRS})

if(SQLITE3_FOUND)
    message(STATUS "✔ SQLite3 trovato: ${SQLITE3_LIBRARIES}")
else()
    message(FATAL_ERROR "❌ SQLite3 non trovato. Installa libsqlite3-dev (Debian/Ubuntu) o sqlite (Arch/Fedora).")
endif()
# =======================================================
# libsmbclient (Samba Client Library) - ricerca universale
# =======================================================

find_path(SMBCLIENT_INCLUDE_DIR libsmbclient.h
    PATHS
        /usr/include
        /usr/include/samba-4.0
        /usr/local/include
)

find_library(SMBCLIENT_LIBRARY smbclient
    PATHS
        /usr/lib
        /usr/lib64
        /usr/local/lib
        /usr/local/lib64
)

if (NOT SMBCLIENT_INCLUDE_DIR OR NOT SMBCLIENT_LIBRARY)
    message(FATAL_ERROR "❌ libsmbclient non trovato...")
else()
    message(STATUS "✔ libsmbclient trovato: ${SMBCLIENT_LIBRARY}")
    message(STATUS "✔ include: ${SMBCLIENT_INCLUDE_DIR}")
endif()

set(SMBCLIENT_LIBRARIES ${SMBCLIENT_LIBRARY})
set(SMBCLIENT_INCLUDE_DIRS ${SMBCLIENT_INCLUDE_DIR})

include_directories(${SMBCLIENT_INCLUDE_DIRS})



# ======================
# nlohmann-json (header-only, via CMake config)
# ======================
find_package(nlohmann_json 3.2.0 REQUIRED)
# ======================
# CURL (per Google Safe Browsing API)
# ======================
find_package(CURL REQUIRED)
# ==============================
#  OpenSSL
# ==============================
find_package(OpenSSL REQUIRED)
link_directories(/usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64)

if (OpenSSL_FOUND)
    message(STATUS "OpenSSL trovato: ${OPENSSL_VERSION}")
    include_directories(${OPENSSL_INCLUDE_DIR})
else()
    message(FATAL_ERROR "OpenSSL non trovato. Installa libssl-dev")
endif()

# ==============================
# Boost (thread pool, asio, ecc.)
# ==============================
find_package(Boost REQUIRED COMPONENTS thread)
find_package(Threads REQUIRED)
include_directories(${Boost_INCLUDE_DIRS})

# ==============================
# Hyperscan (opzionale, per regex ad alte prestazioni)
# ==============================
find_path(HYPERSCAN_INCLUDE_DIR NAMES hs/hs.h)
find_library(HYPERSCAN_LIBRARY NAMES hs)
find_library(HYPERSCAN_LIBRARY NAMES hs libhs hs.so.5 PATHS /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64)

if (HYPERSCAN_INCLUDE_DIR AND HYPERSCAN_LIBRARY)
    message(STATUS "✔ Hyperscan trovato: ${HYPERSCAN_LIBRARY}")
    include_directories(${HYPERSCAN_INCLUDE_DIR})
    add_compile_definitions(HAVE_HYPERSCAN=1)
else()
    message(WARNING "⚠ Hyperscan non trovato. Verrà usato std::regex fallback (più lento).")
endif()


include_directories(
    ${GTKMM_INCLUDE_DIRS}
    ${GIOMM_INCLUDE_DIRS}
    ${SIGC_INCLUDE_DIRS}
    ${YARA_INCLUDE_DIRS}
    ${SOUP_INCLUDE_DIRS}
    src
    src/filters
)

link_directories(
    ${GTKMM_LIBRARY_DIRS}
    ${GIOMM_LIBRARY_DIRS}
    ${SIGC_LIBRARY_DIRS}
    ${YARA_LIBRARY_DIRS}
    ${SOUP_LIBRARY_DIRS}
)

if(GTKMM_CFLAGS_OTHER)
    add_compile_options(${GTKMM_CFLAGS_OTHER})
endif()
if(GIOMM_CFLAGS_OTHER)
    add_compile_options(${GIOMM_CFLAGS_OTHER})
endif()
if(SIGC_CFLAGS_OTHER)
    add_compile_options(${SIGC_CFLAGS_OTHER})
endif()
if(YARA_CFLAGS_OTHER)
    add_compile_options(${YARA_CFLAGS_OTHER})
endif()
if(SOUP_CFLAGS_OTHER)
    add_compile_options(${SOUP_CFLAGS_OTHER})
endif()

# ======================
# Libreria phishing_common (dnsmasq backend minimal)
# ======================
set(PHISHING_COMMON_SOURCES
    src/phishing/local_warning_server.cpp
    src/phishing/WebProbe.cpp
    src/phishing/network_quality.cpp
    src/phishing/dns_cache.cpp
)

add_library(phishing_common STATIC ${PHISHING_COMMON_SOURCES})

target_include_directories(phishing_common PUBLIC src src/phishing)

target_link_libraries(phishing_common
    PUBLIC
        ${SOUP_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${IDN2_LIBRARIES}
        OpenSSL::SSL
        OpenSSL::Crypto
)

# ======================
# Identity Leak Module
# ======================
set(IDENTITY_LEAK_SOURCES
    src/IdentityLeakPage/ui/IdentityLeakPage.cpp
    src/IdentityLeakPage/worker/LeakCheckWorker.cpp
    src/IdentityLeakPage/monitor/LeakMonitor.cpp
    src/IdentityLeakPage/core/LeakAggregator.cpp
    src/IdentityLeakPage/core/LeakNormalizer.cpp
    src/IdentityLeakPage/providers/HibpProvider.cpp
    src/IdentityLeakPage/providers/LeakCheckProvider.cpp
    src/IdentityLeakPage/providers/HibpPasswordProvider.cpp
    src/IdentityLeakPage/net/HttpClient.cpp
    src/IdentityLeakPage/storage/LeakDatabase.cpp
    src/IdentityLeakPage/utils/HashUtil.cpp
    src/IdentityLeakPage/utils/IdentityLeakConfig.cpp
    src/IdentityLeakPage/utils/TimeUtil.cpp
)

add_library(identity_leak STATIC ${IDENTITY_LEAK_SOURCES})

target_include_directories(identity_leak
    PUBLIC
        src
        src/IdentityLeakPage
)

target_link_libraries(identity_leak
    PUBLIC
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        ${SQLITE3_LIBRARIES}
        nlohmann_json::nlohmann_json
)


# ======================
# RE2 (opzionale, per regex sicure e veloci)
# ======================
find_library(RE2_LIBRARY NAMES re2 libre2 PATHS /usr/lib /usr/lib64 /usr/local/lib)
if (RE2_LIBRARY)
    message(STATUS "✔ RE2 trovato: ${RE2_LIBRARY}")
    target_link_libraries(phishing_common PRIVATE ${RE2_LIBRARY})
else()
    message(WARNING "⚠ RE2 non trovato. Uso std::regex fallback.")
endif()

# === Integrazione Boost per phishing_common ===
target_link_libraries(phishing_common
    PRIVATE
        re2
        Boost::thread
)


target_compile_definitions(phishing_common PUBLIC
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# ============================
# Firewall Management Module
# ============================
set(FIREWALL_SOURCES
    src/firewall/FirewallChoiceDialog.cpp
    src/firewall/FirewallDetector.cpp
    src/firewall/FirewallInstaller.cpp
    src/firewall/FirewallRuleManager.cpp
    src/firewall/BlacklistIpExtractor.cpp
)

add_library(firewall STATIC ${FIREWALL_SOURCES})

target_include_directories(firewall PUBLIC src/firewall)

target_link_libraries(firewall
    PUBLIC
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)

# ======================
# Password Manager Module
# ======================
set(PASSWORD_MANAGER_SOURCES
    src/password_manager/PasswordEntry.cpp
    src/password_manager/PasswordVault.cpp
    src/password_manager/PasswordGenerator.cpp
    src/password_manager/PasswordDialogs.cpp
    src/password_manager/PasswordSearchRow.cpp
    src/password_manager/PasswordManagerPage.cpp
    src/password_manager/PasswordImporter.cpp
    src/password_manager/PasswordImportDialog.cpp
    src/password_manager/PasswordVaultView.cpp
)

add_library(password_manager STATIC ${PASSWORD_MANAGER_SOURCES})

target_include_directories(password_manager PUBLIC
    src
    src/password_manager
)

target_link_libraries(password_manager
    PUBLIC
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${LIBSECRET_LIBRARIES}
        nlohmann_json::nlohmann_json
)

# ----------------------
# GUI principale (BastionGuard)
# ----------------------
set(BastionGuard_SOURCES
    src/main.cpp
    src/MainWindow.cpp
    src/TrayIcon.cpp
    src/Backend.cpp
    src/DashboardPage.cpp
    src/ScanPage.cpp
    src/LogPage.cpp
    src/SettingsPage.cpp
    src/AboutPage.cpp
    src/QuarantinePage.cpp
    src/Quarantine.cpp
    src/ClamdConfig.cpp
    src/UpdatePage.cpp
    src/DonatePage.cpp
    src/StyleProvider.cpp
    src/AntiRansomEngine.cpp
    src/AntiPhishingEngine.cpp
    src/wizard/wizard_window.cpp
    src/wizard/wizard_setup.cpp
    src/PrivacyPage.cpp
    src/AurScan.cpp
    src/SettingsWindow.cpp
    src/AntiRansomwarePage.cpp
    src/SambaPage.cpp
    src/SaneSecurityUpdater.cpp
    src/SettingsStore.cpp
    src/first_run/first-run-services-window.cpp
    src/pac/PacManager.cpp
    src/cloud/MalwareBazaar.cpp
    src/usb/USBScanPage.cpp
    src/usb/ScanPromptWindow.cpp
    src/usb/LiveScanDialog.cpp
    src/phishing_search/PhishingPage.cpp
    src/phishing_search/PhishingCheckCard.cpp
    src/vpn/VpnPage.cpp
    src/vpn/WireguardBackend.cpp
    src/password_manager/PasswordManagerPage.cpp
    src/backup/BackupPage.cpp
    src/Utils.cpp
)

if(ENABLE_CEF)
    list(APPEND BastionGuard_SOURCES
        src/BankPage.cpp
        src/SecureBrowser.cpp
    )
endif()

# === Eseguibile principale ===
add_executable(BastionGuard ${BastionGuard_SOURCES})
target_include_directories(BastionGuard
    PRIVATE
        src
        src/firewall
)

target_compile_definitions(BastionGuard PRIVATE
  BASTIONGUARD_VERSION="2.0"
  BASTIONGUARD_BUILD=20260411
)

target_link_libraries(BastionGuard
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${YARA_LIBRARIES}
        ${SOUP_LIBRARIES}
        ${LIBSECRET_LIBRARIES}
        ${UDEV_LIBRARIES}
        ${SMBCLIENT_LIBRARIES}
        ${SYSTEMD_LIBRARIES}
        phishing_common
        firewall
        identity_leak
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        password_manager
)

target_link_options(BastionGuard PRIVATE -lsystemd)
bg_set_rpath(BastionGuard)

if(ENABLE_CEF)
# ============================================================
# Blink / CEF Integration (SecureBrowser)
# ============================================================
set(CEF_ROOT "${CMAKE_SOURCE_DIR}/thirdparty/cef")
set(CEF_RELEASE_DIR "${CEF_ROOT}/Release")
set(CEF_LIB "${CEF_RELEASE_DIR}/libcef.so")

# Tentativi di percorso possibili per il wrapper
set(CEF_WRAPPER_A "${CEF_ROOT}/build/libcef_dll_wrapper.a")
set(CEF_WRAPPER_B "${CEF_ROOT}/build/libcef_dll_wrapper/libcef_dll_wrapper.a")

# ============================================================
# 🔹 Download automatico CEF se mancante
# ============================================================
set(CEF_URL "https://cef-builds.spotifycdn.com/cef_binary_141.0.7%2Bga5714cc%2Bchromium-141.0.7390.108_linux64_minimal.tar.bz2")
set(CEF_ARCHIVE "${CMAKE_SOURCE_DIR}/thirdparty/cef_download.tar.bz2")

if (NOT EXISTS ${CEF_LIB})
    message(WARNING "⚠️  libcef.so non trovato in ${CEF_RELEASE_DIR}")
    message(STATUS "⬇️  Download automatico CEF da: ${CEF_URL}")

    # Crea cartella thirdparty/cef
    file(MAKE_DIRECTORY ${CEF_ROOT})

    # Scarica il pacchetto
    file(DOWNLOAD
        ${CEF_URL}
        ${CEF_ARCHIVE}
        SHOW_PROGRESS
        STATUS cef_status
    )

    list(GET cef_status 0 cef_status_code)
    if (NOT cef_status_code EQUAL 0)
        message(FATAL_ERROR "❌ Errore nel download di CEF (${CEF_URL})")
    endif()

    # Estrai archivio
    message(STATUS "📦 Estrazione archivio CEF...")
    execute_process(
        COMMAND ${CMAKE_COMMAND} -E tar xjf ${CEF_ARCHIVE}
        WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/thirdparty
        RESULT_VARIABLE cef_extract_result
    )

    if (NOT cef_extract_result EQUAL 0)
        message(FATAL_ERROR "❌ Errore durante l'estrazione del pacchetto CEF")
    endif()

    # Rinomina la cartella estratta (contiene spesso un nome lungo)
    file(GLOB cef_subdirs "${CMAKE_SOURCE_DIR}/thirdparty/cef_binary_*")
    list(LENGTH cef_subdirs cef_count)
    if (cef_count GREATER 0)
        list(GET cef_subdirs 0 cef_extracted_dir)
        message(STATUS "📂 CEF estratto in: ${cef_extracted_dir}")
        file(RENAME "${cef_extracted_dir}" "${CEF_ROOT}")
    endif()

    # Verifica dopo estrazione
    if (NOT EXISTS ${CEF_LIB})
        message(FATAL_ERROR "❌ libcef.so ancora non trovato dopo estrazione in ${CEF_RELEASE_DIR}")
    endif()

    message(STATUS "✔ CEF scaricato e preparato con successo in ${CEF_ROOT}")
else()
    message(STATUS "✔ CEF trovato: ${CEF_LIB}")
endif()

# ============================================================
# Build automatica del wrapper se necessario
# ============================================================
if (NOT (EXISTS ${CEF_WRAPPER_A} OR EXISTS ${CEF_WRAPPER_B}))
    message(STATUS "🧩 Compilo automaticamente libcef_dll_wrapper.a (wrapper CEF)...")
    execute_process(
        COMMAND cmake -B build -S .
        WORKING_DIRECTORY ${CEF_ROOT}
        RESULT_VARIABLE CEF_CONFIGURE_RESULT
    )
    if (NOT CEF_CONFIGURE_RESULT EQUAL 0)
        message(FATAL_ERROR "❌ Errore durante la configurazione CMake di libcef_dll_wrapper")
    endif()

    execute_process(
        COMMAND cmake --build build --config Release
        WORKING_DIRECTORY ${CEF_ROOT}
        RESULT_VARIABLE CEF_BUILD_RESULT
    )
    if (NOT CEF_BUILD_RESULT EQUAL 0)
        message(FATAL_ERROR "❌ Errore durante la compilazione di libcef_dll_wrapper.a")
    endif()
endif()

# ============================================================
# Conferma finale e selezione wrapper corretto
# ============================================================
if (EXISTS ${CEF_WRAPPER_A})
    set(CEF_WRAPPER ${CEF_WRAPPER_A})
elseif (EXISTS ${CEF_WRAPPER_B})
    set(CEF_WRAPPER ${CEF_WRAPPER_B})
else()
    message(FATAL_ERROR "❌ libcef_dll_wrapper.a non trovato dopo la build.")
endif()

message(STATUS "✔ Wrapper statico CEF trovato: ${CEF_WRAPPER}")

# ------------------------------------------------------------
# Aggiungi SecureBrowser
# ------------------------------------------------------------
include_directories(${CEF_ROOT} ${CEF_ROOT}/include)

target_link_libraries(BastionGuard
    PRIVATE
        ${CEF_LIB}
        ${CEF_WRAPPER}
        pthread
        dl
)


# Su alcune distro serve anche pthread e dl
find_package(Threads REQUIRED)
target_link_libraries(BastionGuard PRIVATE pthread dl)

# ============================================================
# ✅ INSTALLAZIONE COMPLETA DEL RUNTIME CEF (compatibile con build senza cef_helper)
# ============================================================

set(CEF_INSTALL_DIR "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/cef")

# Installa librerie principali
install(FILES
    ${CEF_RELEASE_DIR}/libcef.so
    ${CEF_RELEASE_DIR}/libEGL.so
    ${CEF_RELEASE_DIR}/libGLESv2.so
    ${CEF_RELEASE_DIR}/libvk_swiftshader.so
    ${CEF_RELEASE_DIR}/libvulkan.so.1
    DESTINATION ${CEF_INSTALL_DIR}
)

# Installa sandbox (chrome-sandbox)
install(FILES
    ${CEF_RELEASE_DIR}/chrome-sandbox
    DESTINATION ${CEF_INSTALL_DIR}
    PERMISSIONS OWNER_EXECUTE OWNER_WRITE OWNER_READ GROUP_EXECUTE GROUP_READ WORLD_EXECUTE WORLD_READ
)

# Installa tutte le risorse necessarie (pak, dat, bin, locales)
install(DIRECTORY
    ${CEF_ROOT}/Resources/
    DESTINATION ${CEF_INSTALL_DIR}
    FILES_MATCHING
        PATTERN "*.pak"
        PATTERN "*.bin"
        PATTERN "*.dat"
        PATTERN "locales"
)

# Installa eventuali snapshot e config
install(FILES
    ${CEF_RELEASE_DIR}/v8_context_snapshot.bin
    ${CEF_RELEASE_DIR}/vk_swiftshader_icd.json
    DESTINATION ${CEF_INSTALL_DIR}
    OPTIONAL
)



# Post-install: imposta permessi sandbox
install(CODE "
    message(STATUS \"[CEF] Imposto permessi per chrome-sandbox...\")
    execute_process(COMMAND chmod 4755 ${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/cef/chrome-sandbox)
")

endif()

# ============================================================
# Optional Polkit integration
# ============================================================
find_package(PkgConfig REQUIRED)
pkg_check_modules(POLKIT_GOBJECT QUIET polkit-gobject-1)

if (POLKIT_GOBJECT_FOUND)
    message(STATUS "✔ Found Polkit: ${POLKIT_GOBJECT_VERSION}")
    include_directories(${POLKIT_GOBJECT_INCLUDE_DIRS})
    target_link_libraries(BastionGuard PRIVATE ${POLKIT_GOBJECT_LIBRARIES})
    target_compile_definitions(BastionGuard PRIVATE HAVE_POLKIT=1)
else()
    message(WARNING "⚠ Polkit not found, using pkexec fallback only")
    target_compile_definitions(BastionGuard PRIVATE HAVE_POLKIT=0)
endif()

target_compile_definitions(BastionGuard PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ===============================
# Eseguibile per gli alert ransomware
# ===============================
set(RANSW_ALERT_SOURCES
    src/alert/BastionGuard-ransomware-alert.cpp
    src/Backend.cpp
    src/AntiRansomEngine.cpp
    src/AntiPhishingEngine.cpp
    src/Quarantine.cpp
    src/Utils.cpp
)

add_executable(BastionGuard-ransomware-alert ${RANSW_ALERT_SOURCES})
target_include_directories(BastionGuard-ransomware-alert PRIVATE src)
target_link_libraries(BastionGuard-ransomware-alert PRIVATE
    ${GTKMM_LIBRARIES}
    ${GIOMM_LIBRARIES}
    ${SIGC_LIBRARIES}
    ${YARA_LIBRARIES}
    ${SOUP_LIBRARIES}
    ${SMBCLIENT_LIBRARIES}
    CURL::libcurl
    OpenSSL::SSL
    OpenSSL::Crypto
    phishing_common
    firewall
)
bg_set_rpath(BastionGuard-ransomware-alert)
target_compile_definitions(BastionGuard-ransomware-alert PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-ransomware-alert RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ================================
#  Alert realtime (SOCKET UNIX)
#  BastionGuard-ransomware-realtime-alert
# ================================

set(RANSW_REALTIME_ALERT_SOURCES
    src/alert/BastionGuard-ransomware-realtime-alert.cpp
    src/alert/AlertWindowRealtime.cpp
    src/Backend.cpp
    src/AntiRansomEngine.cpp
    src/AntiPhishingEngine.cpp
    src/Quarantine.cpp
    src/Utils.cpp
)

add_executable(BastionGuard-ransomware-realtime-alert ${RANSW_REALTIME_ALERT_SOURCES})

target_include_directories(BastionGuard-ransomware-realtime-alert PRIVATE src)

target_link_libraries(BastionGuard-ransomware-realtime-alert
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        ${YARA_LIBRARIES}
        ${SMBCLIENT_LIBRARIES}
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        phishing_common
        pthread
        firewall
)
bg_set_rpath(BastionGuard-ransomware-realtime-alert)
target_compile_definitions(BastionGuard-ransomware-realtime-alert PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# Installazione binario
install(TARGETS BastionGuard-ransomware-realtime-alert
        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})



# ======================
# Demone Anti-Phishing
# ======================
# ======================
# BastionGuard DNS Daemon (dnsmasq backend)
# ======================
set(BastionGuard_DAEMON_SOURCES
    src/phishing/BastionGuard-daemon.cpp
    src/phishing/local_warning_server.cpp
    src/phishing/dns_cache.cpp
)

add_executable(BastionGuard-daemon ${BastionGuard_DAEMON_SOURCES})

target_include_directories(BastionGuard-daemon PRIVATE src src/phishing)

target_link_libraries(BastionGuard-daemon
    PRIVATE
        ${SOUP_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GTKMM_LIBRARIES}
        Threads::Threads
        dl
)
bg_set_rpath(BastionGuard-daemon)
target_compile_definitions(BastionGuard-daemon PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

install(TARGETS BastionGuard-daemon RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Demone Anti-Ransomware
# ======================
add_executable(BastionGuard-ransomware-scanner
    src/scanner-ransomware/BastionGuard-ransomware-scanner.cpp
)
target_link_libraries(BastionGuard-ransomware-scanner
    PRIVATE
        ${YARA_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${GTKMM_LIBRARIES}
        phishing_common
        OpenSSL::SSL
        OpenSSL::Crypto
)
bg_set_rpath(BastionGuard-ransomware-scanner)
target_compile_definitions(BastionGuard-ransomware-scanner PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-ransomware-scanner RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ======================
# Archive inspection support
# ======================

set(BG_ARCHIVE_CORE_SOURCES
    src/security/archive/ArchiveSandbox.cpp
    src/security/archive/ArchiveInspector.cpp
)

set(BG_ARCHIVE_HELPER_SOURCES
    src/helpers/archive_worker.cpp
)

add_executable(archive_worker
    ${BG_ARCHIVE_HELPER_SOURCES}
)

target_include_directories(archive_worker
    PRIVATE
        src
)

target_compile_definitions(archive_worker PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# opzionale ma utile
bg_set_rpath(archive_worker)

install(TARGETS archive_worker
    RUNTIME DESTINATION /usr/libexec/bastionguard
)

# ======================
# Demone Anti-Ransomware Realtime (fanotify)
# ======================
add_executable(BastionGuard-ransomware-realtime
    src/scanner-ransomware/BastionGuard-ransomware-realtime.cpp
    ${BG_ARCHIVE_CORE_SOURCES}
)

target_include_directories(BastionGuard-ransomware-realtime PRIVATE src)

target_link_libraries(BastionGuard-ransomware-realtime
    PRIVATE
        ${YARA_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${GTKMM_LIBRARIES}
        OpenSSL::SSL
        OpenSSL::Crypto
        phishing_common
        pthread
        Threads::Threads
        nlohmann_json::nlohmann_json
)

bg_set_rpath(BastionGuard-ransomware-realtime)
target_compile_definitions(BastionGuard-ransomware-realtime PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

install(TARGETS BastionGuard-ransomware-realtime
        RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ======================
# Native Messaging Host
# ======================
add_executable(BastionGuard-native-host
    src/native_host/native_host.cpp
    src/wizard/wizard_setup.cpp
)
target_include_directories(BastionGuard-native-host PRIVATE src)
target_link_libraries(BastionGuard-native-host
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${YARA_LIBRARIES}
        ${SOUP_LIBRARIES}
        nlohmann_json::nlohmann_json
)
bg_set_rpath(BastionGuard-native-host)
target_compile_definitions(BastionGuard-native-host PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-native-host RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Setup Wizard
# ======================
set(WIZARD_SOURCES
    src/wizard/wizard_window.cpp
    src/wizard/wizard_setup.cpp
    src/wizard/main.cpp
    src/wizard/StyleProvider.cpp
    src/Utils.cpp
)

add_executable(BastionGuard-wizard ${WIZARD_SOURCES})
target_include_directories(BastionGuard-wizard PRIVATE src)
target_link_libraries(BastionGuard-wizard
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        phishing_common
)
bg_set_rpath(BastionGuard-wizard)
target_compile_definitions(BastionGuard-wizard PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)
install(TARGETS BastionGuard-wizard RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ==============================
# First Run Services standalone
# ==============================
add_executable(BastionGuard-first-run
    src/first_run/first-run-main.cpp
    src/first_run/first-run-services-window.cpp
    src/StyleProvider.cpp
)

target_compile_definitions(BastionGuard-first-run PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-first-run
    PRIVATE
        src
        src/first_run
)

target_link_libraries(BastionGuard-first-run
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}

)

bg_set_rpath(BastionGuard-first-run)


install(TARGETS BastionGuard-first-run RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# BastionGuard-mailproxy — proxy SMTP utente
# Gira come systemctl --user, senza privilegi root
# ======================

add_executable(BastionGuard-mailproxy
    src/mail/BastionGuard-mailproxy.cpp
)

target_include_directories(BastionGuard-mailproxy PRIVATE src)

target_link_libraries(BastionGuard-mailproxy
    PRIVATE
        CURL::libcurl
        OpenSSL::SSL
        OpenSSL::Crypto
        nlohmann_json::nlohmann_json
        pthread
)

target_compile_definitions(BastionGuard-mailproxy PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

bg_set_rpath(BastionGuard-mailproxy)

install(TARGETS BastionGuard-mailproxy
    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
    PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
                GROUP_READ GROUP_EXECUTE
                WORLD_READ WORLD_EXECUTE
)

# Installa il service file systemd --user
install(FILES
    data/service/BastionGuard-mailproxy.service
    DESTINATION /usr/lib/systemd/user
)

# ======================
# Helper privilegiato — bastionguard-privhelper
# ======================

set(PRIVHELPER_SOURCES
    src/privhelper/bastionguard_privhelper.cpp
)



add_executable(bastionguard-privhelper ${PRIVHELPER_SOURCES})
target_link_libraries(bastionguard-privhelper PRIVATE ${UDEV_LIBRARIES} pthread)

install(TARGETS bastionguard-privhelper
    RUNTIME DESTINATION /usr/bin
    PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
                GROUP_READ GROUP_EXECUTE
                WORLD_READ WORLD_EXECUTE)

install(CODE "
    message(STATUS \"[privhelper] Imposto owner root e setuid su bastionguard-privhelper\")

    execute_process(
        COMMAND chown root:root /usr/bin/bastionguard-privhelper
        RESULT_VARIABLE CHOWN_RES
    )

    if(NOT CHOWN_RES EQUAL 0)
        message(FATAL_ERROR \"[privhelper] chown root fallito\")
    endif()

    execute_process(
        COMMAND chmod 4755 /usr/bin/bastionguard-privhelper
        RESULT_VARIABLE CHMOD_RES
    )

    if(NOT CHMOD_RES EQUAL 0)
        message(FATAL_ERROR \"[privhelper] chmod 4755 fallito\")
    endif()

    message(STATUS \"[privhelper] ✔ bastionguard-privhelper installato come setuid root\")
")

# ======================
# Helper privilegiato — bastionguard-firewall
# ======================

set(FIREWALL_HELPER_SOURCES
    src/privhelper/bastionguard-firewall.cpp
)



add_executable(bastionguard-firewall ${FIREWALL_HELPER_SOURCES})

# Nessuna dipendenza GTK / Backend
target_link_libraries(bastionguard-firewall PRIVATE pthread)

install(TARGETS bastionguard-firewall
    RUNTIME DESTINATION /usr/bin
    PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
                GROUP_READ GROUP_EXECUTE
                WORLD_READ WORLD_EXECUTE
)

install(CODE "
    message(STATUS \"[firewall-helper] Imposto owner root e setuid su bastionguard-firewall\")

    execute_process(
        COMMAND chown root:root /usr/bin/bastionguard-firewall
        RESULT_VARIABLE CHOWN_RES
    )

    if(NOT CHOWN_RES EQUAL 0)
        message(FATAL_ERROR \"[firewall-helper] chown root fallito\")
    endif()

    execute_process(
        COMMAND chmod 4755 /usr/bin/bastionguard-firewall
        RESULT_VARIABLE CHMOD_RES
    )

    if(NOT CHMOD_RES EQUAL 0)
        message(FATAL_ERROR \"[firewall-helper] chmod 4755 fallito\")
    endif()

    message(STATUS \"[firewall-helper] ✔ bastionguard-firewall installato come setuid root\")
")



# ======================
# Demone Privacy (Webcam + Microfono)
# ======================
set(PRIVACYD_SOURCES
    src/BastionGuard-privacyd.cpp
)

add_executable(BastionGuard-privacyd ${PRIVACYD_SOURCES})
target_include_directories(BastionGuard-privacyd PRIVATE src)
target_link_libraries(BastionGuard-privacyd
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)
bg_set_rpath(BastionGuard-privacyd)
target_compile_definitions(BastionGuard-privacyd PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

# === Installa l’eseguibile ===
install(TARGETS BastionGuard-privacyd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Demone USB (BastionGuard-usbd)
# ======================

# Trova libsystemd
find_package(PkgConfig REQUIRED)
pkg_check_modules(SYSTEMD REQUIRED libsystemd)

set(USBD_SOURCES
    src/usb/BastionGuard-usbd.cpp
    src/usb/LiveScanDialog.cpp

)

add_executable(BastionGuard-usbd ${USBD_SOURCES})

target_include_directories(BastionGuard-usbd PRIVATE
    src
    src/usb
    ${SYSTEMD_INCLUDE_DIRS}
)

target_link_libraries(BastionGuard-usbd
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${UDEV_LIBRARIES}
        ${SYSTEMD_LIBRARIES}     # <── FIX CRITICO
)
bg_set_rpath(BastionGuard-usbd)
target_compile_definitions(BastionGuard-usbd PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

install(TARGETS BastionGuard-usbd RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})



if(ENABLE_CEF)
# ======================
# BankOpener (wrapper sandbox sicuro)
# ======================
add_executable(BastionGuard-bankopener
    src/xdg-open.cpp
    src/xdg-main.cpp
    src/SecureBrowser.cpp
    src/SettingsStore.cpp
    src/phishing/local_warning_server.cpp
)

target_include_directories(BastionGuard-bankopener PRIVATE src)

target_link_libraries(BastionGuard-bankopener
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        nlohmann_json::nlohmann_json
        ${CEF_LIB}
        ${CEF_WRAPPER}
        pthread
        dl
)
bg_set_rpath(BastionGuard-bankopener)
# Imposta il percorso runtime per libcef.so
set_target_properties(BastionGuard-bankopener PROPERTIES
    BUILD_RPATH "${CMAKE_SOURCE_DIR}/thirdparty/cef/Release"
    INSTALL_RPATH "/usr/share/BastionGuard/cef"
)

install(TARGETS BastionGuard-bankopener RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# Bank gui desktop
# ======================

add_executable(BastionGuard-bankgui
    src/bankgui-main.cpp
    src/StyleProvider.cpp
)

target_compile_definitions(BastionGuard-bankgui PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-bankgui PRIVATE src)
target_link_libraries(BastionGuard-bankgui
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
)
bg_set_rpath(BastionGuard-bankgui)
install(TARGETS BastionGuard-bankgui RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


endif()

# ======================
# Pagamenti sicuri
# ======================
find_package(Boost REQUIRED)
add_executable(bastionguard-pacd
    src/pac/BastionGuard-pac.cpp
)

target_link_libraries(bastionguard-pacd PRIVATE Boost::boost)
target_compile_features(bastionguard-pacd PRIVATE cxx_std_17)

install(TARGETS bastionguard-pacd RUNTIME DESTINATION bin)


if(ENABLE_CEF)
# ======================
# BastionGuard CEF Proxy (bastionguard-cef)
# ======================

find_package(Threads REQUIRED)
find_package(Boost REQUIRED)

# Boost headers target portability (1.89+)
if(TARGET Boost::headers)
  set(BG_BOOST_HEADERS Boost::headers)
elseif(TARGET Boost::boost)
  set(BG_BOOST_HEADERS Boost::boost)
else()
  message(FATAL_ERROR "Boost headers target not found (Boost::headers/Boost::boost).")
endif()


# libsoup + glib/gobject/gio for local_warning_server.cpp symbols
pkg_check_modules(GLIB REQUIRED glib-2.0 gobject-2.0 gio-2.0)

add_executable(bastionguard-cef
  src/cef/bastionguard_cef.cpp
  src/SecureBrowser.cpp
  src/SettingsStore.cpp
  src/phishing/local_warning_server.cpp
)

target_include_directories(bastionguard-cef
  PRIVATE
    src
    ${CEF_ROOT}
    ${CEF_ROOT}/include
    ${GLIB_INCLUDE_DIRS}
    ${SOUP_INCLUDE_DIRS}
    ${GTKMM_INCLUDE_DIRS}
    ${GIOMM_INCLUDE_DIRS}
    ${SIGC_INCLUDE_DIRS}
)

target_compile_options(bastionguard-cef
  PRIVATE
    ${GLIB_CFLAGS_OTHER}
    ${SOUP_CFLAGS_OTHER}
)

# Asio without boost_system (Boost 1.89+)
target_compile_definitions(bastionguard-cef PRIVATE
  BOOST_ASIO_DISABLE_BOOST_SYSTEM
  BOOST_ASIO_USE_STD_SYSTEM_ERROR
)

target_link_libraries(bastionguard-cef
  PRIVATE
    ${BG_BOOST_HEADERS}
    Threads::Threads
    OpenSSL::SSL
    OpenSSL::Crypto
    ${GTKMM_LIBRARIES}
    ${GIOMM_LIBRARIES}
    ${SIGC_LIBRARIES}
    ${SOUP_LIBRARIES}
    ${GLIB_LIBRARIES}
    ${CEF_LIB}
    ${CEF_WRAPPER}

    dl
    pthread
)

bg_set_rpath(bastionguard-cef)

install(TARGETS bastionguard-cef RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

# ======================
# BastionGuard Secure Payments
#  - BastionGuard-secure      (CLI opener)
#  - BastionGuard-secure-gui  (GUI selector)
# src/payment_secure/*
# ======================

# ---- CLI opener ----
add_executable(BastionGuard-secure
    src/payment_secure/BastionGuard-secure-cli.cpp
    src/payment_secure/BastionGuard-secure.cpp
    src/payment_secure/dns_secure.cpp
    src/SecureBrowser.cpp
    src/SettingsStore.cpp
    src/phishing/local_warning_server.cpp
)

target_compile_definitions(BastionGuard-secure PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-secure
    PRIVATE
        src
        src/payment_secure
        ${CEF_ROOT}
        ${CEF_ROOT}/include
        ${GLIBMM_INCLUDE_DIRS}
        ${GLIB_INCLUDE_DIRS}
        ${SOUP_INCLUDE_DIRS}
        ${GTKMM_INCLUDE_DIRS}
        ${GIOMM_INCLUDE_DIRS}
        ${SIGC_INCLUDE_DIRS}
)

target_compile_options(BastionGuard-secure
    PRIVATE
        ${GLIBMM_CFLAGS_OTHER}
        ${GLIB_CFLAGS_OTHER}
        ${SOUP_CFLAGS_OTHER}
)

target_link_libraries(BastionGuard-secure
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${SOUP_LIBRARIES}
        ${GLIBMM_LIBRARIES}
        ${GLIB_LIBRARIES}

        nlohmann_json::nlohmann_json

        ${CEF_LIB}
        ${CEF_WRAPPER}

        OpenSSL::SSL
        OpenSSL::Crypto

        Threads::Threads
        dl
        pthread
)

bg_set_rpath(BastionGuard-secure)

set_target_properties(BastionGuard-secure PROPERTIES
    INSTALL_RPATH "${BG_RUNTIME_RPATH}"
    BUILD_RPATH   "${BG_RUNTIME_RPATH}"
)

install(TARGETS BastionGuard-secure RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


# ---- GUI selector ----
add_executable(BastionGuard-secure-gui
    src/payment_secure/BastionGuard-secure-main.cpp
    src/payment_secure/dns_secure.cpp
    src/StyleProvider.cpp
)

target_compile_definitions(BastionGuard-secure-gui PRIVATE
    "DATA_DIR=\"${INSTALL_DATA_DIR}\""
    "LOCALEDIR=\"${INSTALL_LOCALE_DIR}\""
)

target_include_directories(BastionGuard-secure-gui
    PRIVATE
        src
        src/payment_secure
        ${GTKMM_INCLUDE_DIRS}
        ${GIOMM_INCLUDE_DIRS}
        ${SIGC_INCLUDE_DIRS}
)

target_link_libraries(BastionGuard-secure-gui
    PRIVATE
        ${GTKMM_LIBRARIES}
        ${GIOMM_LIBRARIES}
        ${SIGC_LIBRARIES}
        ${GLIBMM_LIBRARIES}
        ${GLIB_LIBRARIES}
)

bg_set_rpath(BastionGuard-secure-gui)

set_target_properties(BastionGuard-secure-gui PROPERTIES
    INSTALL_RPATH "/usr/share/BastionGuard/lib"
    BUILD_RPATH   "/usr/share/BastionGuard/lib"
)

install(TARGETS BastionGuard-secure-gui RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})


endif()

# ============================================================
# BastionGuard WebUI
# ============================================================

set(BG_WEBUI_SOURCE_DIR "${CMAKE_SOURCE_DIR}/webui")
set(BG_WEBUI_BUILD_DIR  "${CMAKE_BINARY_DIR}/webui")
set(BG_WEBUI_STAMP      "${BG_WEBUI_BUILD_DIR}/.webui-staged")

if(EXISTS "${BG_WEBUI_SOURCE_DIR}/index.php")

    add_custom_command(
        OUTPUT "${BG_WEBUI_STAMP}"
        COMMAND ${CMAKE_COMMAND} -E rm -rf "${BG_WEBUI_BUILD_DIR}"
        COMMAND ${CMAKE_COMMAND} -E make_directory "${BG_WEBUI_BUILD_DIR}"
        COMMAND ${CMAKE_COMMAND} -E copy_directory
                "${BG_WEBUI_SOURCE_DIR}"
                "${BG_WEBUI_BUILD_DIR}"
        COMMAND ${CMAKE_COMMAND} -E touch "${BG_WEBUI_STAMP}"
        DEPENDS "${BG_WEBUI_SOURCE_DIR}/index.php"
        COMMENT "Staging BastionGuard WebUI into the build directory"
        VERBATIM
    )

    add_custom_target(BastionGuard-webui ALL
        DEPENDS "${BG_WEBUI_STAMP}"
    )

    install(DIRECTORY "${BG_WEBUI_BUILD_DIR}/"
        DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/webui"
        USE_SOURCE_PERMISSIONS
        COMPONENT webui
        PATTERN ".git" EXCLUDE
        PATTERN "*.bak" EXCLUDE
        PATTERN "*.tmp" EXCLUDE
        PATTERN ".webui-staged" EXCLUDE
    )

    install(DIRECTORY "${CMAKE_SOURCE_DIR}/data/vhosts/webui/"
        DESTINATION "${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/vhosts/webui"
        USE_SOURCE_PERMISSIONS
        COMPONENT webui
        OPTIONAL
    )

    install(CODE "
        message(STATUS \"[WebUI] Installed in: ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/webui\")
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/cache)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/quarantine)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/sessions)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/lib/bastionguard-webui/tmp)
        file(MAKE_DIRECTORY \$ENV{DESTDIR}/var/log/bastionguard-webui)
    ")

else()
    message(WARNING "BastionGuard WebUI source not found at ${BG_WEBUI_SOURCE_DIR}; WebUI will not be installed.")
endif()



# ======================
# BastionGuard Backup (fork di Timeshift, build via Meson)
# ======================
option(ENABLE_BASTIONGUARD_BACKUP "Build bastionguard-backup (Timeshift fork)" ON)

if(ENABLE_BASTIONGUARD_BACKUP)
    include(ExternalProject)

    find_program(MESON_EXECUTABLE meson REQUIRED)
    find_program(NINJA_EXECUTABLE ninja REQUIRED)
    find_program(VALAC_EXECUTABLE valac REQUIRED)
    find_program(PKG_CONFIG_EXECUTABLE pkg-config REQUIRED)

    # Dipendenze runtime/build del fork
    pkg_check_modules(BG_BACKUP_GTK3 REQUIRED gtk+-3.0)
    pkg_check_modules(BG_BACKUP_GIO REQUIRED gio-2.0 gio-unix-2.0)
    pkg_check_modules(BG_BACKUP_JSON REQUIRED json-glib-1.0)
    pkg_check_modules(BG_BACKUP_VTE REQUIRED vte-2.91)
    pkg_check_modules(BG_BACKUP_GEE REQUIRED gee-0.8)

    set(BG_BACKUP_SOURCE_DIR "${CMAKE_SOURCE_DIR}/thirdparty/bastionguard-backup")
    set(BG_BACKUP_BINARY_DIR "${CMAKE_BINARY_DIR}/bastionguard-backup-build")
    set(BG_BACKUP_INSTALL_DIR "${CMAKE_BINARY_DIR}/bastionguard-backup-install")

    message(STATUS "[BG-Backup] Source dir  : ${BG_BACKUP_SOURCE_DIR}")
    message(STATUS "[BG-Backup] Build dir   : ${BG_BACKUP_BINARY_DIR}")
    message(STATUS "[BG-Backup] Stage dir   : ${BG_BACKUP_INSTALL_DIR}")
    message(STATUS "[BG-Backup] Final prefix: ${CMAKE_INSTALL_PREFIX}")

    ExternalProject_Add(bastionguard_backup_ext
        SOURCE_DIR "${BG_BACKUP_SOURCE_DIR}"
        BINARY_DIR "${BG_BACKUP_BINARY_DIR}"

        CONFIGURE_COMMAND
            ${MESON_EXECUTABLE} setup "${BG_BACKUP_BINARY_DIR}" "${BG_BACKUP_SOURCE_DIR}"
            --prefix=/usr
            --buildtype=release
            --reconfigure

        BUILD_COMMAND
            ${MESON_EXECUTABLE} compile -C "${BG_BACKUP_BINARY_DIR}"

        INSTALL_COMMAND
            ${MESON_EXECUTABLE} install -C "${BG_BACKUP_BINARY_DIR}" --destdir "${BG_BACKUP_INSTALL_DIR}"

        BUILD_ALWAYS 1

        USES_TERMINAL_CONFIGURE 1
        USES_TERMINAL_BUILD 1
        USES_TERMINAL_INSTALL 1

        LOG_CONFIGURE OFF
        LOG_BUILD OFF
        LOG_INSTALL OFF
    )

    add_custom_target(BastionGuard-backup ALL
        DEPENDS bastionguard_backup_ext
    )

    install(CODE "
        message(STATUS \"[BG-Backup] =====================================\")
        message(STATUS \"[BG-Backup] Installazione bastionguard-backup\")
        message(STATUS \"[BG-Backup] Stage dir Meson : ${BG_BACKUP_INSTALL_DIR}\")
        message(STATUS \"[BG-Backup] Prefix finale   : ${CMAKE_INSTALL_PREFIX}\")
        message(STATUS \"[BG-Backup]\")

        set(BG_BACKUP_STAGE_BIN   \"${BG_BACKUP_INSTALL_DIR}/usr/bin\")
        set(BG_BACKUP_STAGE_SHARE \"${BG_BACKUP_INSTALL_DIR}/usr/share\")
        set(BG_BACKUP_STAGE_ETC   \"${BG_BACKUP_INSTALL_DIR}/etc\")

        set(BG_BACKUP_DEST_BIN   \"${CMAKE_INSTALL_PREFIX}/bin\")
        set(BG_BACKUP_DEST_SHARE \"${CMAKE_INSTALL_PREFIX}/share\")
        set(BG_BACKUP_DEST_ETC   \"${CMAKE_INSTALL_PREFIX}/etc\")

        message(STATUS \"[BG-Backup] Copia binari : \${BG_BACKUP_STAGE_BIN} -> \${BG_BACKUP_DEST_BIN}\")
        if(EXISTS \"\${BG_BACKUP_STAGE_BIN}\")
            file(MAKE_DIRECTORY \"\${BG_BACKUP_DEST_BIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_BACKUP_STAGE_BIN}\"
                        \"\${BG_BACKUP_DEST_BIN}\"
                RESULT_VARIABLE BG_BACKUP_BIN_RES
            )
            if(NOT BG_BACKUP_BIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-Backup] Errore copiando i binari in \${BG_BACKUP_DEST_BIN}\")
            endif()
        else()
            message(WARNING \"[BG-Backup] Directory bin non trovata: \${BG_BACKUP_STAGE_BIN}\")
        endif()

        message(STATUS \"[BG-Backup] Copia share  : \${BG_BACKUP_STAGE_SHARE} -> \${BG_BACKUP_DEST_SHARE}\")
        if(EXISTS \"\${BG_BACKUP_STAGE_SHARE}\")
            file(MAKE_DIRECTORY \"\${BG_BACKUP_DEST_SHARE}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_BACKUP_STAGE_SHARE}\"
                        \"\${BG_BACKUP_DEST_SHARE}\"
                RESULT_VARIABLE BG_BACKUP_SHARE_RES
            )
            if(NOT BG_BACKUP_SHARE_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-Backup] Errore copiando share in \${BG_BACKUP_DEST_SHARE}\")
            endif()
        else()
            message(WARNING \"[BG-Backup] Directory share non trovata: \${BG_BACKUP_STAGE_SHARE}\")
        endif()

        message(STATUS \"[BG-Backup] Copia etc    : \${BG_BACKUP_STAGE_ETC} -> \${BG_BACKUP_DEST_ETC}\")
        if(EXISTS \"\${BG_BACKUP_STAGE_ETC}\")
            file(MAKE_DIRECTORY \"\${BG_BACKUP_DEST_ETC}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_BACKUP_STAGE_ETC}\"
                        \"\${BG_BACKUP_DEST_ETC}\"
                RESULT_VARIABLE BG_BACKUP_ETC_RES
            )
            if(NOT BG_BACKUP_ETC_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-Backup] Errore copiando etc in \${BG_BACKUP_DEST_ETC}\")
            endif()
        else()
            message(STATUS \"[BG-Backup] Nessuna directory etc da installare\")
        endif()

        message(STATUS \"[BG-Backup] ✔ installazione completata\")
        message(STATUS \"[BG-Backup] =====================================\")
    ")
endif()


# ======================
# BastionGuard Secure Connection (Meson)
# ======================
option(ENABLE_BASTIONGUARD_SECURE_CONNECTION "Build bastionguard-secure-connection" ON)

if(ENABLE_BASTIONGUARD_SECURE_CONNECTION)
    include(ExternalProject)
    include(FindPkgConfig)

    find_program(MESON_EXECUTABLE meson REQUIRED)
    find_program(NINJA_EXECUTABLE ninja REQUIRED)
    find_program(PKG_CONFIG_EXECUTABLE pkg-config REQUIRED)

    # Toolchain per eBPF / libbpf
    find_program(CLANG_EXECUTABLE clang REQUIRED)
    find_program(LLVM_STRIP_EXECUTABLE llvm-strip)
    find_program(BPFTool_EXECUTABLE bpftool)

    if(NOT LLVM_STRIP_EXECUTABLE)
        message(WARNING "[BG-SC] llvm-strip non trovato: potrebbe essere richiesto dalla build eBPF")
    endif()

    if(NOT BPFTool_EXECUTABLE)
        message(WARNING "[BG-SC] bpftool non trovato: potrebbe essere richiesto per skeleton/header eBPF")
    endif()

    # Verifica dipendenze pkg-config usate da Meson
    pkg_check_modules(BGSC_OPENSSL REQUIRED openssl)
    pkg_check_modules(BGSC_NLOHMANN_JSON REQUIRED nlohmann_json)
    pkg_check_modules(BGSC_GTKMM REQUIRED gtkmm-4.0)
    pkg_check_modules(BGSC_GLIBMM REQUIRED glibmm-2.68)
    pkg_check_modules(BGSC_GIOMM REQUIRED giomm-2.68)
    pkg_check_modules(BGSC_SYSTEMD REQUIRED libsystemd)
    pkg_check_modules(BGSC_SHUMATE REQUIRED shumate-1.0)
    pkg_check_modules(BGSC_LIBBPF REQUIRED libbpf)

    # Opzionale
    pkg_check_modules(BGSC_NFQ libnetfilter_queue)

    find_package(Threads REQUIRED)

    set(BG_SC_SOURCE_DIR "${CMAKE_SOURCE_DIR}/thirdparty/bastionguard-secure-connection")
    set(BG_SC_BINARY_DIR "${CMAKE_BINARY_DIR}/bastionguard-secure-connection-build")
    set(BG_SC_INSTALL_DIR "${CMAKE_BINARY_DIR}/bastionguard-secure-connection-install")

    message(STATUS "[BG-SC] Source dir  : ${BG_SC_SOURCE_DIR}")
    message(STATUS "[BG-SC] Build dir   : ${BG_SC_BINARY_DIR}")
    message(STATUS "[BG-SC] Stage dir   : ${BG_SC_INSTALL_DIR}")
    message(STATUS "[BG-SC] Final prefix: ${CMAKE_INSTALL_PREFIX}")

    message(STATUS "[BG-SC] openssl            : ${BGSC_OPENSSL_FOUND}")
    message(STATUS "[BG-SC] nlohmann_json      : ${BGSC_NLOHMANN_JSON_FOUND}")
    message(STATUS "[BG-SC] gtkmm-4.0          : ${BGSC_GTKMM_FOUND}")
    message(STATUS "[BG-SC] glibmm-2.68        : ${BGSC_GLIBMM_FOUND}")
    message(STATUS "[BG-SC] giomm-2.68         : ${BGSC_GIOMM_FOUND}")
    message(STATUS "[BG-SC] libsystemd         : ${BGSC_SYSTEMD_FOUND}")
    message(STATUS "[BG-SC] shumate-1.0        : ${BGSC_SHUMATE_FOUND}")
    message(STATUS "[BG-SC] libbpf             : ${BGSC_LIBBPF_FOUND}")
    message(STATUS "[BG-SC] libnetfilter_queue : ${BGSC_NFQ_FOUND} (optional)")
    message(STATUS "[BG-SC] Threads            : ${Threads_FOUND}")

    ExternalProject_Add(bastionguard_secure_connection_ext
        SOURCE_DIR "${BG_SC_SOURCE_DIR}"
        BINARY_DIR "${BG_SC_BINARY_DIR}"

        CONFIGURE_COMMAND
            ${MESON_EXECUTABLE} setup "${BG_SC_BINARY_DIR}" "${BG_SC_SOURCE_DIR}"
            --prefix=/usr
            --sysconfdir=/etc
            --localedir=share/locale
            --buildtype=release
            --reconfigure

        BUILD_COMMAND
            ${MESON_EXECUTABLE} compile -C "${BG_SC_BINARY_DIR}"

        INSTALL_COMMAND
            ${MESON_EXECUTABLE} install -C "${BG_SC_BINARY_DIR}" --destdir "${BG_SC_INSTALL_DIR}"

        BUILD_ALWAYS 1

        USES_TERMINAL_CONFIGURE 1
        USES_TERMINAL_BUILD 1
        USES_TERMINAL_INSTALL 1

        LOG_CONFIGURE OFF
        LOG_BUILD OFF
        LOG_INSTALL OFF
    )

    add_custom_target(BastionGuard-secure-connection ALL
        DEPENDS bastionguard_secure_connection_ext
    )

    install(CODE "
        message(STATUS \"[BG-SC] =====================================\")
        message(STATUS \"[BG-SC] Installazione bastionguard-secure-connection\")
        message(STATUS \"[BG-SC] Stage dir Meson : ${BG_SC_INSTALL_DIR}\")
        message(STATUS \"[BG-SC] Prefix finale   : ${CMAKE_INSTALL_PREFIX}\")

        set(BG_SC_STAGE_BIN   \"${BG_SC_INSTALL_DIR}/usr/bin\")
        set(BG_SC_STAGE_SBIN  \"${BG_SC_INSTALL_DIR}/usr/sbin\")
        set(BG_SC_STAGE_SHARE \"${BG_SC_INSTALL_DIR}/usr/share\")
        set(BG_SC_STAGE_ETC   \"${BG_SC_INSTALL_DIR}/etc\")
        set(BG_SC_STAGE_LIB   \"${BG_SC_INSTALL_DIR}/usr/lib\")

        set(BG_SC_DEST_BIN   \"${CMAKE_INSTALL_PREFIX}/bin\")
        set(BG_SC_DEST_SBIN  \"${CMAKE_INSTALL_PREFIX}/sbin\")
        set(BG_SC_DEST_SHARE \"${CMAKE_INSTALL_PREFIX}/share\")
        set(BG_SC_DEST_ETC   \"${CMAKE_INSTALL_PREFIX}/etc\")
        set(BG_SC_DEST_LIB   \"${CMAKE_INSTALL_PREFIX}/lib\")

        if(EXISTS \"\${BG_SC_STAGE_BIN}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_BIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_BIN}\"
                        \"\${BG_SC_DEST_BIN}\"
                RESULT_VARIABLE BG_SC_BIN_RES
            )
            if(NOT BG_SC_BIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando i binari\")
            endif()
        endif()

        if(EXISTS \"\${BG_SC_STAGE_SBIN}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_SBIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_SBIN}\"
                        \"\${BG_SC_DEST_SBIN}\"
                RESULT_VARIABLE BG_SC_SBIN_RES
            )
            if(NOT BG_SC_SBIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando sbin\")
            endif()
        endif()

        if(EXISTS \"\${BG_SC_STAGE_SHARE}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_SHARE}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_SHARE}\"
                        \"\${BG_SC_DEST_SHARE}\"
                RESULT_VARIABLE BG_SC_SHARE_RES
            )
            if(NOT BG_SC_SHARE_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando share\")
            endif()
        endif()

        if(EXISTS \"\${BG_SC_STAGE_ETC}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_ETC}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_ETC}\"
                        \"\${BG_SC_DEST_ETC}\"
                RESULT_VARIABLE BG_SC_ETC_RES
            )
            if(NOT BG_SC_ETC_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando etc\")
            endif()
        endif()

        set(BG_SC_CONF_SRC \"${BG_SC_INSTALL_DIR}/etc/bastionguard-secure-connectiond\")
        set(BG_SC_CONF_DST \"/etc/bastionguard-secure-connectiond\")

        if(EXISTS \"\${BG_SC_CONF_SRC}\")
            file(MAKE_DIRECTORY \"\${BG_SC_CONF_DST}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_CONF_SRC}\"
                        \"\${BG_SC_CONF_DST}\"
                RESULT_VARIABLE BG_SC_CONF_RES
            )
            if(NOT BG_SC_CONF_RES EQUAL 0)
                message(WARNING \"[BG-SC] Impossibile copiare la config (permessi?): \${BG_SC_CONF_DST}\")
            else()
                message(STATUS \"[BG-SC] ✔ Config daemon installata: \${BG_SC_CONF_DST}\")
            endif()
        else()
            message(WARNING \"[BG-SC] Directory config non trovata nella stage: \${BG_SC_CONF_SRC}\")
        endif()

        set(BG_SC_AUTOSTART_SRC
            \"${BG_SC_INSTALL_DIR}/etc/xdg/autostart/bastionguard-sc-autostart.desktop\")
        set(BG_SC_AUTOSTART_DST \"/etc/xdg/autostart/bastionguard-sc-autostart.desktop\")

        if(EXISTS \"\${BG_SC_AUTOSTART_SRC}\")
            file(MAKE_DIRECTORY \"/etc/xdg/autostart\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy
                        \"\${BG_SC_AUTOSTART_SRC}\"
                        \"\${BG_SC_AUTOSTART_DST}\"
                RESULT_VARIABLE BG_SC_AUTOSTART_RES
            )
            if(NOT BG_SC_AUTOSTART_RES EQUAL 0)
                message(WARNING \"[BG-SC] Impossibile copiare l'autostart (permessi?): \${BG_SC_AUTOSTART_DST}\")
            else()
                message(STATUS \"[BG-SC] ✔ Autostart installato: \${BG_SC_AUTOSTART_DST}\")
            endif()
        else()
            message(WARNING \"[BG-SC] File autostart non trovato nella stage: \${BG_SC_AUTOSTART_SRC}\")
        endif()

        if(EXISTS \"\${BG_SC_STAGE_LIB}\")
            file(MAKE_DIRECTORY \"\${BG_SC_DEST_LIB}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_SC_STAGE_LIB}\"
                        \"\${BG_SC_DEST_LIB}\"
                RESULT_VARIABLE BG_SC_LIB_RES
            )
            if(NOT BG_SC_LIB_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-SC] Errore copiando lib\")
            endif()
        endif()

        message(STATUS \"[BG-SC] ✔ installazione completata\")
        message(STATUS \"[BG-SC] =====================================\")
    ")
endif()

# ======================
# BastionGuard Recovery Data (CMake)
# ======================
option(ENABLE_BASTIONGUARD_RECOVERY_DATA "Build bastionguard-recovery-data" ON)

if(ENABLE_BASTIONGUARD_RECOVERY_DATA)
    include(ExternalProject)

    set(BG_RD_SOURCE_DIR  "${CMAKE_SOURCE_DIR}/thirdparty/bastionguard-recovery-data")
    set(BG_RD_BINARY_DIR  "${CMAKE_BINARY_DIR}/bastionguard-recovery-data-build")
    set(BG_RD_INSTALL_DIR "${CMAKE_BINARY_DIR}/bastionguard-recovery-data-install")

    message(STATUS "[BG-RD] Source dir  : ${BG_RD_SOURCE_DIR}")
    message(STATUS "[BG-RD] Build dir   : ${BG_RD_BINARY_DIR}")
    message(STATUS "[BG-RD] Stage dir   : ${BG_RD_INSTALL_DIR}")
    message(STATUS "[BG-RD] Final prefix: ${CMAKE_INSTALL_PREFIX}")

    ExternalProject_Add(bastionguard_recovery_data_ext
        SOURCE_DIR "${BG_RD_SOURCE_DIR}"
        BINARY_DIR "${BG_RD_BINARY_DIR}"

        CONFIGURE_COMMAND
            "${CMAKE_COMMAND}" -S "${BG_RD_SOURCE_DIR}" -B "${BG_RD_BINARY_DIR}"
            -DCMAKE_INSTALL_PREFIX=/usr
            -DCMAKE_BUILD_TYPE=Release

        BUILD_COMMAND
            "${CMAKE_COMMAND}" --build "${BG_RD_BINARY_DIR}" --parallel

        INSTALL_COMMAND
            "${CMAKE_COMMAND}" -E env DESTDIR=${BG_RD_INSTALL_DIR}
            "${CMAKE_COMMAND}" --install "${BG_RD_BINARY_DIR}"

        BUILD_ALWAYS 1

        USES_TERMINAL_CONFIGURE 1
        USES_TERMINAL_BUILD 1
        USES_TERMINAL_INSTALL 1

        LOG_CONFIGURE OFF
        LOG_BUILD OFF
        LOG_INSTALL OFF
    )

    add_custom_target(BastionGuard-recovery-data ALL
        DEPENDS bastionguard_recovery_data_ext
    )

    install(CODE "
        set(BG_RD_DESTDIR \"\$ENV{DESTDIR}\")
        message(STATUS \"[BG-RD] =====================================\")
        message(STATUS \"[BG-RD] Installazione bastionguard-recovery-data\")
        message(STATUS \"[BG-RD] Stage dir CMake : ${BG_RD_INSTALL_DIR}\")
        message(STATUS \"[BG-RD] Prefix finale   : ${CMAKE_INSTALL_PREFIX}\")
        message(STATUS \"[BG-RD] DESTDIR         : \${BG_RD_DESTDIR}\")

        set(BG_RD_STAGE_BIN   \"${BG_RD_INSTALL_DIR}/usr/bin\")
        set(BG_RD_STAGE_SHARE \"${BG_RD_INSTALL_DIR}/usr/share\")
        set(BG_RD_STAGE_ETC   \"${BG_RD_INSTALL_DIR}/etc\")
        set(BG_RD_STAGE_LIB   \"${BG_RD_INSTALL_DIR}/usr/lib\")

        set(BG_RD_DEST_BIN   \"\${BG_RD_DESTDIR}${CMAKE_INSTALL_PREFIX}/bin\")
        set(BG_RD_DEST_SHARE \"\${BG_RD_DESTDIR}${CMAKE_INSTALL_PREFIX}/share\")
        set(BG_RD_DEST_ETC   \"\${BG_RD_DESTDIR}/etc\")
        set(BG_RD_DEST_LIB   \"\${BG_RD_DESTDIR}${CMAKE_INSTALL_PREFIX}/lib\")

        if(EXISTS \"\${BG_RD_STAGE_BIN}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_BIN}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_BIN}\"
                        \"\${BG_RD_DEST_BIN}\"
                RESULT_VARIABLE BG_RD_BIN_RES
            )
            if(NOT BG_RD_BIN_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando i binari\")
            endif()
        else()
            message(WARNING \"[BG-RD] Directory bin non trovata: \${BG_RD_STAGE_BIN}\")
        endif()

        if(EXISTS \"\${BG_RD_STAGE_SHARE}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_SHARE}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_SHARE}\"
                        \"\${BG_RD_DEST_SHARE}\"
                RESULT_VARIABLE BG_RD_SHARE_RES
            )
            if(NOT BG_RD_SHARE_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando share\")
            endif()
        else()
            message(WARNING \"[BG-RD] Directory share non trovata: \${BG_RD_STAGE_SHARE}\")
        endif()

        if(EXISTS \"\${BG_RD_STAGE_ETC}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_ETC}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_ETC}\"
                        \"\${BG_RD_DEST_ETC}\"
                RESULT_VARIABLE BG_RD_ETC_RES
            )
            if(NOT BG_RD_ETC_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando etc\")
            endif()
        else()
            message(STATUS \"[BG-RD] Nessuna directory etc da installare\")
        endif()

        if(EXISTS \"\${BG_RD_STAGE_LIB}\")
            file(MAKE_DIRECTORY \"\${BG_RD_DEST_LIB}\")
            execute_process(
                COMMAND \"${CMAKE_COMMAND}\" -E copy_directory
                        \"\${BG_RD_STAGE_LIB}\"
                        \"\${BG_RD_DEST_LIB}\"
                RESULT_VARIABLE BG_RD_LIB_RES
            )
            if(NOT BG_RD_LIB_RES EQUAL 0)
                message(FATAL_ERROR \"[BG-RD] Errore copiando lib\")
            endif()
        endif()

        message(STATUS \"[BG-RD] ✔ installazione completata\")
        message(STATUS \"[BG-RD] =====================================\")
    ")
endif()

# ======================
# Traduzioni con gettext
# ======================

set(PO_DIR ${CMAKE_SOURCE_DIR}/locale)
set(POT_FILE ${PO_DIR}/BastionGuard.pot)

file(GLOB PO_FILES RELATIVE ${PO_DIR} ${PO_DIR}/*.po)

# Cerca ricorsivamente tutti i sorgenti traducibili
file(GLOB_RECURSE I18N_SOURCES
    ${CMAKE_SOURCE_DIR}/src/*.cpp
    ${CMAKE_SOURCE_DIR}/src/*.hpp
    ${CMAKE_SOURCE_DIR}/src/*.h
)

add_custom_target(update-po
    COMMAND ${GETTEXT_XGETTEXT_EXECUTABLE}
            --keyword=_
            --language=C++
            --from-code=UTF-8
            --sort-output
            --no-wrap
            -o ${POT_FILE}
            ${I18N_SOURCES}
    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
    COMMENT "Rigenerazione BastionGuard.pot"
    VERBATIM
)

# ============================================================
# Sanitizer PO:
# - il file Python sta nella root del progetto
# - CMake lo copia nella directory di build
# - NON fa merge dei duplicati
# - se trova più msgid uguali, tiene SOLO l'ultimo
# - se trova un msgstr già sporco con #-#-#-#-#, tiene SOLO l'ultima traduzione
# ============================================================

set(BG_PO_SANITIZER_SRC "${CMAKE_SOURCE_DIR}/sanitize_po_keep_last.py")
set(BG_PO_SANITIZER "${CMAKE_CURRENT_BINARY_DIR}/sanitize_po_keep_last.py")

add_custom_command(
    OUTPUT ${BG_PO_SANITIZER}
    COMMAND ${CMAKE_COMMAND} -E copy_if_different
            ${BG_PO_SANITIZER_SRC}
            ${BG_PO_SANITIZER}
    DEPENDS ${BG_PO_SANITIZER_SRC}
    COMMENT "Copio sanitize_po_keep_last.py nella directory di build"
    VERBATIM
)

set(MO_TARGETS "")

foreach(PO_REL ${PO_FILES})
    set(PO_FILE ${PO_DIR}/${PO_REL})
    get_filename_component(LANG ${PO_FILE} NAME_WE)

    set(BUILD_LOCALE_DIR ${CMAKE_CURRENT_BINARY_DIR}/locale/${LANG}/LC_MESSAGES)
    set(SANITIZED_PO ${CMAKE_CURRENT_BINARY_DIR}/locale/${LANG}/BastionGuard_${LANG}.po)
    set(MO_FILE ${BUILD_LOCALE_DIR}/BastionGuard.mo)

    add_custom_command(
        OUTPUT ${MO_FILE}
        COMMAND ${CMAKE_COMMAND} -E make_directory ${BUILD_LOCALE_DIR}
        COMMAND python3 ${BG_PO_SANITIZER} ${PO_FILE} ${SANITIZED_PO}
        COMMAND ${GETTEXT_MSGFMT_EXECUTABLE}
                --check
                --verbose
                -o ${MO_FILE}
                ${SANITIZED_PO}
        DEPENDS ${PO_FILE} ${BG_PO_SANITIZER}
        COMMENT "Sanitizzo ${PO_FILE}: duplicati msgid -> tengo l'ultimo, nessun merge; compilo ${MO_FILE}"
        VERBATIM
    )

    add_custom_target(${LANG}.mo ALL DEPENDS ${MO_FILE})
    list(APPEND MO_TARGETS ${LANG}.mo)

    install(FILES ${MO_FILE}
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/locale/${LANG}/LC_MESSAGES
    )
endforeach()

add_custom_target(translations DEPENDS ${MO_TARGETS})

# ======================
# Installazioni generali
# ======================
install(FILES desktop/BastionGuard.desktop
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications)

if(ENABLE_CEF)
    install(FILES
        desktop/BastionGuard-bankgui.desktop
        desktop/BastionGuard-secure.desktop
        desktop/bastionguard-bankopener.desktop
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications
    )
endif()

install(FILES  desktop/BastionGuard-autostart.desktop
        DESTINATION ${CMAKE_INSTALL_SYSCONFDIR}/xdg/autostart)


install(DIRECTORY data/rules DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard)

install(DIRECTORY data/vhosts
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data)

# ==============================
# Installazione automatica dei file NGINX (universale)
# ==============================
if (INSTALL_NGINX_DEFAULTS)
    message(STATUS "🧩 Installazione automatica dei file di configurazione NGINX abilitata")

    install(CODE "
        message(STATUS \"📦 Creazione directory standard NGINX...\")
        file(MAKE_DIRECTORY /etc/nginx/conf.d)
        file(MAKE_DIRECTORY /etc/nginx/sites-available)
        file(MAKE_DIRECTORY /etc/nginx/sites-enabled)

        # ============================================================
        # 1️⃣ Copia BastionGuard Virtual Host (nginx.conf → BastionGuard.conf)
        # ============================================================
        if(EXISTS \"/usr/share/BastionGuard/data/vhosts/nginx.conf\")
            message(STATUS \"[NGINX] Installo BastionGuard.conf in /etc/nginx/sites-available/\")
            execute_process(COMMAND cp -f /usr/share/BastionGuard/data/vhosts/nginx.conf /etc/nginx/sites-available/BastionGuard.conf)

            if(NOT EXISTS /etc/nginx/sites-enabled/BastionGuard.conf)
                execute_process(COMMAND ln -s ../sites-available/BastionGuard.conf /etc/nginx/sites-enabled/BastionGuard.conf)
                message(STATUS \"[NGINX] Abilitato site BastionGuard in sites-enabled/\")
            else()
                message(STATUS \"[NGINX] sites-enabled/BastionGuard.conf già presente\")
            endif()
        else()
            message(WARNING \"[NGINX] nginx.conf non trovato in /usr/share/BastionGuard/data/vhosts/\")
        endif()

        # ============================================================
        # 2️⃣ Installa il default site per Arch / altre distro
        # ============================================================
        if(EXISTS /etc/os-release)
            file(READ /etc/os-release OSINFO)
            string(FIND \"\${OSINFO}\" \"arch\" _archpos)
            if(NOT _archpos EQUAL -1)
                message(STATUS \"[NGINX] Rilevata Arch Linux → uso nginx-default-arch.conf come default\")
                if(EXISTS \"/usr/share/BastionGuard/data/vhosts/nginx-default-arch.conf\")
                    execute_process(COMMAND cp -f /usr/share/BastionGuard/data/vhosts/nginx-default-arch.conf /etc/nginx/sites-available/default)
                endif()
            else()
                message(STATUS \"[NGINX] Uso configurazione standard nginx-default.conf come default\")
                if(EXISTS \"/usr/share/BastionGuard/data/vhosts/nginx-default.conf\")
                    execute_process(COMMAND cp -f /usr/share/BastionGuard/data/vhosts/nginx-default.conf /etc/nginx/sites-available/default)
                endif()
            endif()
        endif()

        # Link simbolico per default
        if(NOT EXISTS /etc/nginx/sites-enabled/default)
            execute_process(COMMAND ln -s ../sites-available/default /etc/nginx/sites-enabled/default)
            message(STATUS \"[NGINX] Abilitato default site in sites-enabled/\")
        endif()

        # ============================================================
        # 3️⃣ Pagina di test HTTP
        # ============================================================
        if(NOT EXISTS /srv/http/index.html)
            file(MAKE_DIRECTORY /srv/http)
            file(WRITE /srv/http/index.html \"<html><body><h2>✅ Nginx configurato correttamente per BastionGuard</h2></body></html>\")
            message(STATUS \"[NGINX] Creata pagina di test /srv/http/index.html\")
        endif()

        # ============================================================
        # 4️⃣ Test configurazione e riavvio
        # ============================================================
        message(STATUS \"[NGINX] Testo configurazione...\")
        execute_process(COMMAND nginx -t RESULT_VARIABLE nginx_test)
        if(nginx_test EQUAL 0)
            execute_process(COMMAND systemctl restart nginx)
            message(STATUS \"[NGINX] ✅ Configurazione valida, Nginx riavviato.\")
        else()
            message(WARNING \"[NGINX] ⚠ Test configurazione fallito. Controlla con: sudo nginx -t\")
        endif()
    ")
else()
    message(STATUS "Installazione automatica dei file NGINX disabilitata (usa -DINSTALL_NGINX_DEFAULTS=ON per abilitarla)")
endif()


install(FILES data/service/org.BastionGuard.RansomwareAlert.service
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/dbus-1/services)

install(FILES actions/policy/org.BastionGuard.policy
        FILES actions/policy/org.BastionGuard.ransomware.policy
        FILES actions/policy/org.BastionGuard.USBD.policy
        DESTINATION /usr/share/polkit-1/actions
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

if(ENABLE_CEF)
    install(FILES actions/policy/eu.bastionguard.install-ca.policy
        DESTINATION /usr/share/polkit-1/actions
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
    )
endif()

install(FILES actions/dbus/org.BastionGuard.USBD.conf
        DESTINATION /usr/share/dbus-1/system.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

# Install DBus activation service (system bus)
install(
    FILES actions/dbus/org.BastionGuard.USBD.service
    DESTINATION /usr/share/dbus-1/system-services
    PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
)

# ======================
# Permission Policy – Privacy Webcam
# ======================
install(FILES data/sudoers/bastionguard-helper
        DESTINATION /etc/sudoers.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)

# ======================
# Permission Policy – Bank
# ======================
if(ENABLE_CEF)
install(FILES data/sudoers/bastionguard-bank
        DESTINATION /etc/sudoers.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
endif()

# ======================
# Permission Policy – Helper anti-phishing-update
# ======================
install(FILES data/sudoers/bastionguard-phishing
        DESTINATION /etc/sudoers.d
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)



# ======================
# Polkit Policy – Privacy Webcam
# ======================

install(FILES actions/policy/it.BastionGuard.camera.policy
        DESTINATION /usr/share/polkit-1/actions
        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)


# ======================
# Services
# ======================

# opzione per abilitare auto attivazione user units durante 'cmake --install' (default OFF)
option(ENABLE_USER_AGENT_AUTO "Attempt to enable systemd --user unit for logged-in users at install time" OFF)

# install system units (system-wide)
install(FILES
    data/service/BastionGuard-phishing-scanner.service
    data/service/BastionGuard-phishing-updater.service
    data/service/BastionGuard-phishing-updater.timer
    data/service/BastionGuard-ransomware-realtime.service
    data/service/bastionguard-sanesecurity.service
    data/service/bastionguard-sanesecurity.timer
    data/service/BastionGuard-usbd.service
    DESTINATION /usr/lib/systemd/system
)

# install user units (systemd --user services)
install(FILES
    data/service/BastionGuard-useragent.service
    data/service/BastionGuard-privacyd.service
    data/service/BastionGuard-ransomware-alert.service
    data/service/BastionGuard-ransomware-realtime-alert.service
    data/service/BastionGuard-ransomware-scanner.service
    data/service/BastionGuard-pacd.service
    data/service/BastionGuard-mailproxy.service
    data/service/BastionGuard-user-session-watch.service
    DESTINATION /usr/lib/systemd/user
)

if(ENABLE_CEF)
    install(FILES data/service/BastionGuard-cef.service
        DESTINATION /usr/lib/systemd/user
    )
endif()



# helper script to enable user agents for logged-in users
install(PROGRAMS
    data/scripts/enable-user-agents.sh
    data/scripts/BastionGuard-phishing-updater.sh
    data/scripts/BastionGuard-net-setup.sh
    data/scripts/BastionGuard-export-env.sh
    data/scripts/BastionGuard-locale.sh
    data/scripts/BastionGuard-setup-clamav-daemon.sh
    data/scripts/BastionGuard-restart-user-services.sh
    data/scripts/BastionGuard-user-session-watch.sh
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)

if(ENABLE_CEF)
    install(PROGRAMS data/scripts/install-ca-system.sh
        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
    )
endif()

if(ENABLE_CEF)
install(PROGRAMS
    data/scripts/bank-helper
    DESTINATION /usr/bin/
)
endif()

install(FILES
    data/config/nftables.conf
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/config
)

install(PROGRAMS
    data/extension/bastionguard-tb-extension/install-tb-extension.sh
    DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/extension/bastionguard-tb-extension
)

# ============================================================
# 🔧 Forza RPATH su TUTTI i binari BastionGuard
# ============================================================
set(BG_ALL_BINARIES
    BastionGuard
    BastionGuard-ransomware-alert
    BastionGuard-ransomware-realtime-alert
    BastionGuard-daemon
    BastionGuard-privacyd
    BastionGuard-usbd
    BastionGuard-wizard
    BastionGuard-bankopener
    BastionGuard-bankgui
    BastionGuard-native-host
    BastionGuard-ransomware-scanner
    BastionGuard-ransomware-realtime
    BastionGuard-mailproxy
    archive_worker
)

foreach(tgt IN LISTS BG_ALL_BINARIES)
    if(TARGET ${tgt})
       set_target_properties(${tgt} PROPERTIES
    INSTALL_RPATH "${BG_RUNTIME_RPATH}"
    BUILD_RPATH   "${BG_RUNTIME_RPATH}"
)
    endif()
endforeach()


# ============================================================
# 📌 Installazione automatica delle firme custom in /var/lib/clamav
# ============================================================

install(CODE "
    message(STATUS \"[ClamAV] Copio tutte le firme custom da data/signature in /var/lib/clamav ...\")
    set(SRC_DIR \"${CMAKE_SOURCE_DIR}/data/signature\")
    set(DEST_DIR \"/var/lib/clamav\")

    # Crea la directory se non esiste
    file(MAKE_DIRECTORY \${DEST_DIR})

    # Cerca solo i file con estensioni valide per ClamAV
    file(GLOB SIGNATURE_FILES
        \"\${SRC_DIR}/*.ndb\"
        \"\${SRC_DIR}/*.hdb\"
        \"\${SRC_DIR}/*.ldb\"
        \"\${SRC_DIR}/*.fp\"
        \"\${SRC_DIR}/*.ign\"
        \"\${SRC_DIR}/*.ign2\"
    )

    list(LENGTH SIGNATURE_FILES NUM_FILES)

    if(NUM_FILES EQUAL 0)
        message(WARNING \"[ClamAV] Nessun file di signature (.ndb/.hdb/.ldb/.fp/etc) trovato in \${SRC_DIR}\")
    else()
        foreach(f IN LISTS SIGNATURE_FILES)
            get_filename_component(FILENAME \${f} NAME)
            file(INSTALL
                DESTINATION \${DEST_DIR}
                TYPE FILE
                FILES \"\${f}\"
                PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
            )
            message(STATUS \"[ClamAV] Installato: \${FILENAME} → \${DEST_DIR}\")
        endforeach()
        message(STATUS \"[ClamAV] Completato: \${NUM_FILES} firme custom copiate con successo\")
    endif()
")

# ============================================================
# ⚙️  Installazione ottimizzazioni DNS (sysctl)
# ============================================================
set(SYSCTL_SOURCE_PATH "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/data/config/99-dns-fast.conf")
set(SYSCTL_DEST_PATH "/etc/sysctl.d/99-dns-fast.conf")

install(CODE "
    message(STATUS \"[Sysctl] Installazione ottimizzazioni DNS...\")
    if(EXISTS \"${SYSCTL_SOURCE_PATH}\")
        file(INSTALL DESTINATION /etc/sysctl.d
             TYPE FILE
             FILES \"${SYSCTL_SOURCE_PATH}\"
             PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
        message(STATUS \"[Sysctl] Copiato: ${SYSCTL_SOURCE_PATH} → ${SYSCTL_DEST_PATH}\")

        # Applica immediatamente le modifiche
        execute_process(COMMAND sysctl --system
                        RESULT_VARIABLE sysctl_result
                        OUTPUT_VARIABLE sysctl_output
                        ERROR_VARIABLE sysctl_error)
        if(sysctl_result EQUAL 0)
            message(STATUS \"[Sysctl] ✅ Configurazioni DNS applicate correttamente.\")
        else()
            message(WARNING \"[Sysctl] ⚠ Errore applicando sysctl: \${sysctl_error}\")
        endif()
    else()
        message(WARNING \"[Sysctl] ⚠ File non trovato: ${SYSCTL_SOURCE_PATH}\")
    endif()
")





if(ENABLE_SYSTEMD_SERVICES)
    install(CODE "
        message(STATUS \"[Systemd] Ricarico configurazione systemd...\")
        execute_process(COMMAND systemctl daemon-reload)

        message(STATUS \"[Systemd] Abilito BastionGuard-phishing-scanner...\")
        execute_process(COMMAND systemctl enable BastionGuard-phishing-scanner.service)

        message(STATUS \"[Systemd] Avvio BastionGuard-phishing-scanner...\")
        execute_process(COMMAND systemctl start BastionGuard-phishing-scanner.service)

        message(STATUS \"[Systemd] Riavvio BastionGuard-phishing-scanner...\")
        execute_process(COMMAND systemctl restart BastionGuard-phishing-scanner.service)

        message(STATUS \"[Systemd] Abilito BastionGuard-ransomware-realtime...\")
        execute_process(COMMAND systemctl enable BastionGuard-ransomware-realtime.service)

        message(STATUS \"[Systemd] Avvio BastionGuard-ransomware-realtime...\")
        execute_process(COMMAND systemctl start BastionGuard-ransomware-realtime.service)

        message(STATUS \"[Systemd] Riavvio BastionGuard-ransomware-realtime...\")
        execute_process(COMMAND systemctl restart BastionGuard-ransomware-realtime.service)

        message(STATUS \"[Systemd] Riavvio polkit ...\")
        execute_process(COMMAND systemctl start polkit.service)
    ")
else()
    message(STATUS "Systemd service install-time actions are disabled. To enable, run CMake with -DENABLE_SYSTEMD_SERVICES=ON")
endif()

# ============================================================
#  Installazione automatica regola udev per BastionGuard USB
# ============================================================
set(UDEV_RULE_SOURCE "${CMAKE_SOURCE_DIR}/data/udev/99-BastionGuard-usb.rules")
set(UDEV_RULE_DEST   "/etc/udev/rules.d/99-BastionGuard-usb.rules")

if(EXISTS ${UDEV_RULE_SOURCE})
    message(STATUS "✔ Regola UDEV trovata: ${UDEV_RULE_SOURCE}")

    install(CODE "
        message(STATUS \"[UDEV] Installazione regola USB...\")

        # Determina l'utente reale
        set(INSTALL_USER \"$ENV{SUDO_USER}\")
        if(NOT INSTALL_USER OR INSTALL_USER STREQUAL \"\")
            set(INSTALL_USER \"$ENV{USER}\")
        endif()
        message(STATUS \"[UDEV] Utente reale: \${INSTALL_USER}\")

        # 1️⃣ Copia regola udev UNA SOLA VOLTA
        execute_process(
            COMMAND cp -f \"${UDEV_RULE_SOURCE}\" \"${UDEV_RULE_DEST}\"
        )
        message(STATUS \"[UDEV] Copiata: ${UDEV_RULE_SOURCE} → ${UDEV_RULE_DEST}\")

        # 2️⃣ Gruppo plugdev
        execute_process(
            COMMAND getent group plugdev
            RESULT_VARIABLE PLUGDEV_EXISTS
            OUTPUT_QUIET ERROR_QUIET
        )
        if(PLUGDEV_EXISTS EQUAL 0)
            message(STATUS \"[UDEV] Gruppo plugdev già esistente.\")
        else()
            message(STATUS \"[UDEV] Creo gruppo plugdev...\")
            execute_process(COMMAND groupadd plugdev)
        endif()

        # 3️⃣ Aggiunta utente
        execute_process(
            COMMAND id -nG \${INSTALL_USER}
            OUTPUT_VARIABLE USER_GROUPS
            OUTPUT_STRIP_TRAILING_WHITESPACE
        )
        string(FIND \"\${USER_GROUPS}\" \"plugdev\" FOUND_PLUGDEV)
        if(NOT FOUND_PLUGDEV EQUAL -1)
            message(STATUS \"[UDEV] Utente \${INSTALL_USER} già nel gruppo plugdev.\")
        else()
            message(STATUS \"[UDEV] Aggiungo \${INSTALL_USER} al gruppo plugdev...\")
            execute_process(COMMAND usermod -aG plugdev \${INSTALL_USER})
        endif()

        # 4️⃣ Reload
        message(STATUS \"[UDEV] Ricarico regole udev...\")
        execute_process(COMMAND udevadm control --reload-rules)

        # 5️⃣ Trigger
        message(STATUS \"[UDEV] Eseguo udevadm trigger...\")
        execute_process(COMMAND udevadm trigger)

        message(STATUS \"[UDEV] ✔ Installazione UDEV completata.\")
    ")

else()
    message(WARNING "⚠ File UDEV non trovato: ${UDEV_RULE_SOURCE}")
endif()




# ======================
# Helper uninstall target (CMake uninstall support)
# ======================
if(NOT TARGET uninstall)
    configure_file(
        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/cmake_uninstall.cmake.in"
        "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake"
        IMMEDIATE @ONLY
    )

    add_custom_target(uninstall
        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake
        COMMENT "Rimozione completa di tutti i file installati da BastionGuard"
    )
endif()