#!/usr/bin/env bash
set -euo pipefail

# Launch the BigLinux installer as root with only the desktop session values
# required for rendering and accessibility. Do not preserve the full user
# environment across the privilege boundary.

software_render=0
if [[ ${1:-} == --software-render ]]; then
	software_render=1
	shift
fi

live_user=${USER:-}
[[ $live_user =~ ^[a-z_][a-z0-9_-]*[$]?$ ]] || {
	printf '%s\n' 'calamares-biglinux: cannot determine the live-session user' >&2
	exit 1
}
live_user_id=$(id -u -- "$live_user") || exit 1
((live_user_id > 0)) || {
	printf '%s\n' 'calamares-biglinux: refusing a root desktop session' >&2
	exit 1
}

color_scheme=$(gsettings get org.gnome.desktop.interface color-scheme 2>/dev/null | tr -d "'" || true)
case "$color_scheme" in
prefer-dark | prefer-light) ;;
*) color_scheme=default ;;
esac

declare -a installer_environment=(
	"HOME=/root"
	"PATH=/usr/bin:/bin"
	"BIGLINUX_LIVE_USER=$live_user"
	"ADW_DEBUG_COLOR_SCHEME=$color_scheme"
)

append_safe_environment() {
	local name=$1 value=$2 pattern=$3
	[[ -n $value && ${#value} -le 4096 && ! $value =~ [[:cntrl:]] && $value =~ $pattern ]] || return 0
	installer_environment+=("$name=$value")
}

# Running as root, GTK reads /root/.config, where the window buttons may sit on
# the other side than the ones the user sees on every other window.
decoration_layout=$(
	awk -F= '$1 == "gtk-decoration-layout" { print $2; exit }' \
		"${XDG_CONFIG_HOME:-${HOME:-}/.config}/gtk-4.0/settings.ini" 2>/dev/null || true
)
append_safe_environment BIGLINUX_DECORATION_LAYOUT "$decoration_layout" '^[a-z]+[a-z,:]*$'

append_safe_environment DISPLAY "${DISPLAY:-}" '^([A-Za-z0-9._-]+)?:[0-9]+([.][0-9]+)?$'
append_safe_environment WAYLAND_DISPLAY "${WAYLAND_DISPLAY:-}" '^wayland-[A-Za-z0-9._-]+$'
if [[ ${XDG_RUNTIME_DIR:-} =~ ^/run/user/[0-9]+$ && -d ${XDG_RUNTIME_DIR:-} ]]; then
	installer_environment+=("XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR")
fi
append_safe_environment XAUTHORITY "${XAUTHORITY:-}" '^/[^[:cntrl:]]+$'
append_safe_environment DBUS_SESSION_BUS_ADDRESS "${DBUS_SESSION_BUS_ADDRESS:-}" '^[^[:space:][:cntrl:]]+$'
append_safe_environment LANG "${LANG:-}" '^[A-Za-z0-9_.@-]+$'
append_safe_environment LANGUAGE "${LANGUAGE:-}" '^[A-Za-z0-9_.@:-]+$'
append_safe_environment LC_MESSAGES "${LC_MESSAGES:-}" '^[A-Za-z0-9_.@-]+$'
append_safe_environment LC_ALL "${LC_ALL:-}" '^[A-Za-z0-9_.@-]+$'
append_safe_environment DESKTOP_STARTUP_ID "${DESKTOP_STARTUP_ID:-}" '^[^[:space:][:cntrl:]]+$'
append_safe_environment XDG_ACTIVATION_TOKEN "${XDG_ACTIVATION_TOKEN:-}" '^[^[:space:][:cntrl:]]+$'

at_spi_bus_address=$(dbus-send --session --dest=org.a11y.Bus --print-reply \
	/org/a11y/bus org.a11y.Bus.GetAddress 2>/dev/null |
	sed -n 's/.*string "\([^"]*\)".*/\1/p' | head -n 1 || true)
append_safe_environment AT_SPI_BUS_ADDRESS "$at_spi_bus_address" \
	'^unix:(path|abstract)=[A-Za-z0-9_./@=-]+(,guid=[0-9a-fA-F]{32})?$'

((software_render == 0)) || installer_environment+=("QT_QUICK_BACKEND=software")

exec sudo -- /usr/bin/env -i "${installer_environment[@]}" \
	/usr/bin/calamares-biglinux "$@"
