#!/usr/bin/env bash
# Root helper for grok-bot-bin GUI auto-update. Invoked via pkexec only.
# Runs pacman -U on a local grok-bot-bin package — not a generic pacman wrapper.
set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "pkexec-pacman-u: usage: pkexec-pacman-u /path/to/grok-bot-bin-*-x86_64.pkg.tar.zst" >&2
  exit 2
fi

pkg=$1
if [[ "$pkg" != /* || "$pkg" == *..* ]]; then
  echo "pkexec-pacman-u: refusing path: $pkg" >&2
  exit 2
fi

base=$(basename -- "$pkg")
if [[ ! "$base" =~ ^grok-bot-bin-.+-x86_64\.pkg\.tar\.zst$ ]]; then
  echo "pkexec-pacman-u: refusing package name: $base" >&2
  exit 2
fi

if [[ ! -f "$pkg" || ! -r "$pkg" ]]; then
  echo "pkexec-pacman-u: package not found or unreadable: $pkg" >&2
  exit 2
fi

# Filename is not enough; require the package metadata name.
info=$(/usr/bin/pacman -Qp -- "$pkg" 2>/dev/null) || {
  echo "pkexec-pacman-u: not a pacman package: $pkg" >&2
  exit 2
}
name=${info%% *}
if [[ "$name" != grok-bot-bin ]]; then
  echo "pkexec-pacman-u: refusing package $name" >&2
  exit 2
fi

exec /usr/bin/pacman -U --noconfirm -- "$pkg"