#!/bin/sh
# Reads the debconf answer and writes /etc/authforge/policy.d/00-debconf.conf
# exactly once, on first install. Subsequent upgrades/reconfigures don't
# touch the file — admin edits via authforgectl/GUI win.
set -e

# shellcheck source=/dev/null
. /usr/share/debconf/confmodule

POLICY_DIR=/etc/authforge/policy.d
SEED_FILE=$POLICY_DIR/00-debconf.conf

case "$1" in
    configure)
        # Only seed on first install: $2 is empty when no previous version
        # was configured. Skip if the seed file already exists (admin may
        # have written one manually before apt configured the metapackage).
        if [ -z "$2" ] && [ ! -e "$SEED_FILE" ]; then
            db_get authforge/initial-policy || true
            mkdir -p "$POLICY_DIR"
            case "$RET" in
                "None")
                    : # no seed — leave dir empty
                    ;;
                "Optional everywhere")
                    cat > "$SEED_FILE" <<'EOF'
# /etc/authforge/policy.d/00-debconf.conf
# Seeded by debconf on first install. Edit via `authforgectl policy set`
# or the AuthForge GUI; admin edits override on next daemon reload.
[stacks.gdm-password]
mode = "optional"
methods = ["fido2"]

[stacks.sudo]
mode = "optional"
methods = ["fido2", "totp"]

[stacks.sshd]
mode = "optional"
methods = ["fido2"]
EOF
                    ;;
                "Required for sudo")
                    cat > "$SEED_FILE" <<'EOF'
# /etc/authforge/policy.d/00-debconf.conf
# Seeded by debconf on first install. Edit via `authforgectl policy set`
# or the AuthForge GUI; admin edits override on next daemon reload.
[stacks.sudo]
mode = "required"
methods = ["fido2", "totp"]
EOF
                    ;;
            esac
        fi
        ;;
    abort-upgrade|abort-remove|abort-deconfigure)
        ;;
    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
        ;;
esac

#DEBHELPER#

exit 0