#!/bin/bash
set -u

# Installer runs as root. Reset only DualGrade, in the logged-in user's GUI context.
# Never reset a service globally, alter TCC databases, or attempt to grant access.
console_user="$(/usr/bin/stat -f '%Su' /dev/console)"
case "$console_user" in
    ""|root|loginwindow|_mbsetupuser)
        echo "No interactive user; app installed. Accessibility refresh can be run later."
        exit 0
        ;;
esac
console_uid="$(/usr/bin/id -u "$console_user")" || exit 0
app_path="/Applications/DualGrade.app"
bundle_identifier="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$app_path/Contents/Info.plist" 2>/dev/null)"
if [[ "$bundle_identifier" != "local.dualgrade.mapper" ]]; then
    echo "Unexpected app identity; no permissions were changed."
    exit 0
fi

if /bin/launchctl asuser "$console_uid" /usr/bin/sudo -n -H -u "$console_user" \
    /usr/bin/tccutil reset Accessibility "$bundle_identifier"; then
    echo "Refreshed DualGrade Accessibility entry for $console_user. Manual approval is required."
else
    echo "App installed; Accessibility reset failed. Remove and re-add DualGrade manually in System Settings."
fi

# This package component is explicitly selectable in Installer. The app itself never prompts.
/bin/launchctl asuser "$console_uid" /usr/bin/sudo -n -H -u "$console_user" \
    /usr/bin/open -g "$app_path" || true
/bin/launchctl asuser "$console_uid" /usr/bin/sudo -n -H -u "$console_user" \
    /usr/bin/open 'x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility' || true
exit 0
