# roles/thin-client/apps/chromium.nix
#
# Chromium enterprise policy.
# Q12 decisions: ManagedBookmarks, SyncDisabled, uBlock Origin + Allowlist,
# PasswordManagerEnabled=false, Bitwarden Extension force-install.
#
# Policy file path on NixOS: /etc/chromium/policies/managed/*.json
{config, lib, pkgs, ...}: let
  inherit (lib) mkIf mkOption types;
  cfg = config.az.tc;
in {
  options.az.tc.chromium = {
    homepage = mkOption {
      type = types.str;
      default = "https://www.office.com"; # TODO: real homepage
      description = "Chromium startup URL.";
    };

    bookmarks = mkOption {
      type = types.listOf (types.submodule {
        options = {
          name = mkOption {type = types.str;};
          url = mkOption {type = types.str;};
        };
      });
      default = [
        {name = "Outlook Web"; url = "https://outlook.office.com";}
        {name = "Teams Web"; url = "https://teams.microsoft.com";}
        {name = "SharePoint"; url = "https://azgroup.sharepoint.com";}
        {name = "Office Home"; url = "https://www.office.com";}
        # TODO: Intranet, Helpdesk, ERP, HR — fill real URLs
      ];
      description = "Managed bookmarks (cannot be deleted by user).";
    };

    bitwardenServerUrl = mkOption {
      type = types.str;
      default = "https://vault.bitwarden.com"; # cloud default; override for self-hosted
      description = ''
        Bitwarden server URL (cloud or self-hosted). Pushed via Chromium
        extension settings.
      '';
    };
  };

  config = mkIf cfg.enable {
    programs.chromium = {
      enable = true;
      extraOpts = {
        # Bookmarks
        ManagedBookmarks = [
          {cn = "AZ Corporate Bookmarks"; children = config.az.tc.chromium.bookmarks;}
        ];

        # Homepage
        HomepageLocation = config.az.tc.chromium.homepage;
        RestoreOnStartup = 4; # always restore homepage
        StartupUrls = [config.az.tc.chromium.homepage];

        # Sync disabled (Q12)
        SyncDisabled = true;
        BrowserSignin = 0; # no Google account sign-in
        RestrictSigninToPattern = ".*@az-group\\.local";

        # Password manager disabled (Q12)
        PasswordManagerEnabled = false;

        # Autofill
        AutofillAddressEnabled = true;
        AutofillCreditCardEnabled = false;

        # Background mode (Chromium keeps running in background)
        BackgroundModeEnabled = false;

        # Extensions: force-install uBlock Origin + Bitwarden
        ExtensionInstallForcelist = [
          # uBlock Origin
          "cjpalhdlnbpafiamejdnhcphjbkeiagm"
          # Bitwarden Password Manager
          "nngceckbapebfimnlniiiahkandclblb"
        ];
        ExtensionInstallAllowlist = [
          "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
          "nngceckbapebfimnlniiiahkandclblb" # Bitwarden
        ];
        ExtensionInstallBlocklist = ["*"]; # block everything not in allowlist

        # Bitwarden configuration via extension policy
        "3rdparty" = {
          "extensions" = {
            "nngceckbapebfimnlniiiahkandclblb" = {
              environment = {
                base = config.az.tc.chromium.bitwardenServerUrl;
              };
            };
          };
        };

        # Disable telemetry
        UrlKeyedAnonymizedDataCollectionEnabled = false;
        SafeBrowsingEnabled = true;

        # Default browser check
        DefaultBrowserSettingEnabled = true;

        # PDF / plugins / popups
        AlwaysOpenPdfExternally = false;
        BlockThirdPartyCookies = true;

        # Pinch-to-zoom, etc.
        TouchEnabled = false;
      };
    };

    environment.systemPackages = with pkgs; [
      chromium
    ];
  };
}