#!/bin/bash
# dde-lock wrapper for deepin-security-loader
# Launches dde-lock through security loader to get authorization
# for calling protected system services without polkit popup.

TAG="dde-lock-loader-wrapper"

logger -t "$TAG" "Starting, args: $*"

REAL_BINARY="/usr/libexec/deepin/dde-lock"
LOADER="/usr/bin/deepin-security-loader"
LOADER_EXEC="/usr/bin/deepin-security-loader-exec"

if [ -x "$LOADER" ] && [ -x "$LOADER_EXEC" ]; then
    if getcap "$LOADER_EXEC" 2>/dev/null | grep -q cap_setgid; then
        logger -t "$TAG" "Launching via security loader"
        exec "$LOADER" --group deepin-daemon -- "$REAL_BINARY" "$@"
    else
        logger -t "$TAG" "cap_setgid missing, falling back"
    fi
fi

logger -t "$TAG" "Launching $REAL_BINARY directly"
exec "$REAL_BINARY" "$@"
