# pacman scripts for mcp-server-diwall-browser; the bodies are shared with the RPM package.

post_install() {
    PYTHON=/usr/bin/python3
# Post-install body shared by the .deb (postinst, configure), the RPM (%post) and
# pacman (post_install, post_upgrade) packages. PYTHON is set by the caller to the
# interpreter of the distribution.
set -e

DEST="/usr/lib/mcp-server-diwall-browser"
NAME="mcp-server-diwall-browser"

# A distribution upgrade that changes the Python minor version leaves the virtual
# environment pointing at the new interpreter with its modules installed for the
# old one: nothing imports any more. Rebuild it then.
if [ -x "$DEST/venv/bin/python3" ] && ! "$DEST/venv/bin/python3" -c "import mcp, mcp_server_diwall_browser" 2>/dev/null; then
    echo "$NAME: the Python interpreter changed, rebuilding the virtual environment..."
    rm -rf "$DEST/venv"
fi
if [ ! -x "$DEST/venv/bin/python3" ]; then
    echo "$NAME: creating the Python virtual environment..."
    "$PYTHON" -m venv "$DEST/venv"
fi

# Run on every install and upgrade, so that a version pinned in requirements.txt
# reaches an existing installation; pip does not touch the network when every pin is
# already satisfied. No cache: the package manager runs this as root, and a cache
# has no use for an installation done once per version.
echo "$NAME: installing the dependencies with pip (network required)..."
if ! "$DEST/venv/bin/pip" install --quiet --disable-pip-version-check --no-cache-dir -r "$DEST/requirements.txt"; then
    echo "$NAME: pip could not install the dependencies. Check the network connection, then install the package again." >&2
    exit 1
fi

# The program itself: a wheel built from the release tag, installed without dependencies (they
# are the pins above). It is reinstalled every time, so that a rebuilt package of the same version
# replaces the files; its version is then readable from the metadata of the environment.
if ! "$DEST/venv/bin/pip" install --quiet --disable-pip-version-check --no-cache-dir --no-deps --force-reinstall "$DEST"/mcp_server_diwall_browser-*.whl; then
    echo "$NAME: pip could not install the program. Install the package again." >&2
    exit 1
fi

cat <<NOTICE
$NAME installed.
The server does not work without an encrypted directory: the browser profile keeps your signed-in
sessions, and they must never sit on the disk in clear.
First command, in a terminal of yours:  mcp-server-diwall-browser-setup
It reports what your machine allows, then offers a trial on a temporary encrypted volume in memory
(lost when you close it, when the machine stops or when your session ends: the signed-in sessions of
the sites, the audit journal and the evidence) or a durable volume.
After adding the server to your MCP client, restart the client.
You type the password yourself and you sign in to your sites yourself, in the browser it opens.
See /usr/share/doc/$NAME/OPERATOR_GUIDE.md, "First launch", and man $NAME-setup.
NOTICE
}

post_upgrade() {
    post_install
}

post_remove() {
# Post-removal body shared by the .deb (postrm, remove and purge), the RPM (%postun,
# full removal only) and pacman (post_remove).
#
# Nothing the operator produced lives under /usr/lib/mcp-server-diwall-browser: it holds
# the program, a virtual environment and Python bytecode, which a reinstall rebuilds.
# The operator profile (~/.config/mcp-server-diwall-browser) and the encrypted
# directory are in the operator's home and are never touched.
#
# No set -e: cleanup must never make a removal fail.

DEST="/usr/lib/mcp-server-diwall-browser"

rm -rf "$DEST/venv"
if [ -d "$DEST" ]; then
    find "$DEST" -depth -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
    find "$DEST" -depth -type d -empty -delete 2>/dev/null || true
fi
echo "mcp-server-diwall-browser removed. Your operator profile and your encrypted directory were not touched."
true
}
