#!/bin/sh

set -eu

deny_in_webkiosk_mode_path='/etc/polkit-1/localauthority/50-local.d/90.org.freedesktop.networkmanager.deny_in_webkiosk_mode.pkla'

if [ "$(puavo-conf puavo.xsessions.default)" = 'puavo-webkiosk' ]; then
  cat <<'EOF' > "${deny_in_webkiosk_mode_path}.tmp"
[Normal User Permissions]
Identity=unix-user:*
Action=org.freedesktop.NetworkManager.*
ResultAny=no
ResultInactive=no
ResultActive=no
EOF
  mv "${deny_in_webkiosk_mode_path}.tmp" "$deny_in_webkiosk_mode_path"
else
  rm -f "$deny_in_webkiosk_mode_path"
fi

allow_modify_by_special_user_path='/etc/polkit-1/localauthority/50-local.d/10.org.freedesktop.networkmanager.allow_modify_by_special_user.pkla'

primary_user=''
user_for_system_network_permissions=''
if [ "$(puavo-conf puavo.xsessions.user_registration.enabled)" = 'true' ]; then
  user_for_system_network_permissions='guest'
else
  primary_user=$(puavo-conf puavo.admin.primary_user)
  if [ -n "$primary_user" ]; then
    user_for_system_network_permissions="$primary_user"
  fi
fi

if [ -n "$user_for_system_network_permissions" ]; then
  cat <<EOF > "${allow_modify_by_special_user_path}.tmp"
[Primary user permissions]
Identity=unix-user:${user_for_system_network_permissions}
Action=org.freedesktop.NetworkManager.settings.modify.system
ResultAny=no
ResultInactive=no
ResultActive=yes
EOF
  mv "${allow_modify_by_special_user_path}.tmp" \
     "$allow_modify_by_special_user_path"
else
  rm -f "$allow_modify_by_special_user_path"
fi

polkit_primary_user_path='/etc/polkit-1/localauthority.conf.d/52-puavo-primary-user.conf'
if [ -n "$primary_user" ]; then
  cat <<EOF > "${polkit_primary_user_path}.tmp"
[Configuration]
AdminIdentities=unix-user:${primary_user};unix-group:puavo-role-admin
EOF
else
  cat <<EOF > "${polkit_primary_user_path}.tmp"
[Configuration]
AdminIdentities=unix-group:puavo-role-admin
EOF
fi
mv "${polkit_primary_user_path}.tmp" \
   "$polkit_primary_user_path"
