#!/bin/sh
# Launcher for the MeduzaVPN GUI, installed as /usr/bin/meduzavpn-desktop.
#
# The Flutter bundle is a directory, not a single file: the executable expects
# `data/` and `lib/` next to it. That is why it lives in /usr/lib/meduzavpn
# rather than /usr/bin, and why this wrapper exists at all -- a `.desktop` entry
# and a shell `$PATH` both want one plain command name.
set -eu

BUNDLE_DIR=/usr/lib/meduzavpn
BIN="$BUNDLE_DIR/meduzavpn-desktop"

if [ ! -x "$BIN" ]; then
	echo "meduzavpn-desktop: $BIN is missing or not executable." >&2
	echo "Reinstall the meduzavpn-desktop package." >&2
	exit 127
fi

# The bundle's ELF already carries an RPATH of $ORIGIN/lib, so this is a
# belt-and-braces line for the case where a distribution's hardening flags
# stripped it. Prepending rather than replacing keeps any value the user set.
LD_LIBRARY_PATH="$BUNDLE_DIR/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
export LD_LIBRARY_PATH

# One friendly word before the GUI has to say it in a dialog. The socket is the
# permission boundary (cli/internal/ipc/proto.go), so a user who is not in the
# group will get a connect error from every action they try, and the fix is not
# something they can guess.
if [ -S /run/meduzavpn/control.sock ] && [ ! -w /run/meduzavpn/control.sock ]; then
	echo "meduzavpn-desktop: you are not a member of the 'meduzavpn' group, so this" >&2
	echo "meduzavpn-desktop: session cannot control the tunnel. An administrator can run:" >&2
	echo "meduzavpn-desktop:   sudo usermod -aG meduzavpn ${USER:-<username>}" >&2
	echo "meduzavpn-desktop: then log out and back in." >&2
fi

exec "$BIN" "$@"
