#! /bin/sh

set -e
set -u
set -o pipefail

echo "Ensuring filesystem permissions are correct"

# Despite our attempt to set these permissions correctly in auto/config,
# sometimes /tmp ends up with incorrect permissions in the chroot,
# which breaks some APT operations in later stages of the build.
chmod 1777 /tmp

chown root:root \
    /usr/local/lib/elizaos \
    /usr/local/bin/elizaos \
    /usr/local/lib/elizaos/capability-runner \
    /usr/local/lib/elizaos/create-persistent-storage-session \
    /usr/local/lib/elizaos/elizaos-webkit-shell \
    /usr/local/lib/elizaos/elizaos-keeper \
    /usr/local/lib/elizaos/persistence-maintenance \
    /usr/local/lib/elizaos/renderer-server.mjs \
    /usr/local/lib/elizaos/runtime-env \
    /usr/local/lib/elizaos/start-elizaos-agent-user \
    /usr/local/lib/elizaos/start-elizaos-browser-user \
    /usr/local/lib/elizaos/start-elizaos-pill-user \
    /usr/local/lib/elizaos/start-elizaos-renderer-user \
    /usr/local/lib/elizaos/start-elizaos-user \
    /usr/local/lib/elizaos/update-health-check \
    /usr/local/lib/elizaos/update-manager
chmod 0755 \
    /usr/local/lib/elizaos \
    /usr/local/bin/elizaos \
    /usr/local/lib/elizaos/capability-runner \
    /usr/local/lib/elizaos/create-persistent-storage-session \
    /usr/local/lib/elizaos/elizaos-webkit-shell \
    /usr/local/lib/elizaos/elizaos-keeper \
    /usr/local/lib/elizaos/persistence-maintenance \
    /usr/local/lib/elizaos/renderer-server.mjs \
    /usr/local/lib/elizaos/runtime-env \
    /usr/local/lib/elizaos/start-elizaos-agent-user \
    /usr/local/lib/elizaos/start-elizaos-browser-user \
    /usr/local/lib/elizaos/start-elizaos-pill-user \
    /usr/local/lib/elizaos/start-elizaos-renderer-user \
    /usr/local/lib/elizaos/start-elizaos-user \
    /usr/local/lib/elizaos/update-health-check \
    /usr/local/lib/elizaos/update-manager

chown root:root \
    /etc/systemd/system/elizaos-update-health-check.service \
    /etc/systemd/system/elizaos-update-verify.service \
    /etc/systemd/system/elizaos.path \
    /etc/systemd/system/elizaos.service \
    /etc/systemd/user/elizaos-agent.service \
    /etc/systemd/user/elizaos-renderer.service \
    /etc/systemd/user/elizaos-pill.service \
    /etc/systemd/user/elizaos.service \
    /usr/share/applications/elizaos.desktop
chmod 0644 \
    /etc/systemd/system/elizaos-update-health-check.service \
    /etc/systemd/system/elizaos-update-verify.service \
    /etc/systemd/system/elizaos.path \
    /etc/systemd/system/elizaos.service \
    /etc/systemd/user/elizaos-agent.service \
    /etc/systemd/user/elizaos-renderer.service \
    /etc/systemd/user/elizaos-pill.service \
    /etc/systemd/user/elizaos.service \
    /usr/share/applications/elizaos.desktop

if [ -e /etc/generate-sudoers.d/elizaos-capability-runner.toml ]; then
    chown root:root /etc/generate-sudoers.d/elizaos-capability-runner.toml
    chmod 0644 /etc/generate-sudoers.d/elizaos-capability-runner.toml
fi
if [ -e /etc/generate-sudoers.d/elizaos-persistence-maintenance.toml ]; then
    chown root:root /etc/generate-sudoers.d/elizaos-persistence-maintenance.toml
    chmod 0644 /etc/generate-sudoers.d/elizaos-persistence-maintenance.toml
fi

for python_pkg in \
    /usr/lib/python3/dist-packages/tps \
    /usr/lib/python3/dist-packages/tps_frontend
do
    [ -d "${python_pkg}" ] || continue
    chown -R root:root "${python_pkg}"
    find "${python_pkg}" -type d -exec chmod 0755 {} +
    find "${python_pkg}" -type f -exec chmod go-w {} +
done
