_add_pipewire_camera() {
    local conf="$1"
    if [ -f "$conf" ] && ! grep -q 'PipeWireCamera' "$conf"; then
        if grep -q 'enable-features=' "$conf"; then
            sed -i 's/--enable-features=\([^ ]*\)/--enable-features=\1,PipeWireCamera/' "$conf"
        else
            echo '--enable-features=PipeWireCamera' >> "$conf"
        fi
    fi
}

_remove_pipewire_camera() {
    local conf="$1"
    [ -f "$conf" ] && sed -i 's/,PipeWireCamera//g' "$conf"
}

_install_sleep_hook() {
    cp /usr/share/intel-ipu7-camera/camera-sleep-hook /usr/lib/systemd/system-sleep/camera-sleep-hook
    chmod 755 /usr/lib/systemd/system-sleep/camera-sleep-hook
}

_apply_runtime_permissions() {
    if ! /usr/bin/systemd-tmpfiles --create /usr/lib/tmpfiles.d/camera.conf; then
        echo ":: WARNING: failed to restrict /run/camera; reboot before using the camera." >&2
    fi

    if [ -S /run/udev/control ]; then
        if ! /usr/bin/udevadm control --reload-rules ||
           ! /usr/bin/udevadm trigger --action=change --sysname-match=ipu7-psys0; then
            echo ":: WARNING: failed to restrict the IPU7 device; reboot before using the camera." >&2
        fi
    fi
}

_warn_if_driver_is_loaded() {
    if [ -d /sys/module/intel_ipu7_psys ]; then
        echo ":: SECURITY: reboot required to activate the updated IPU7 kernel driver." >&2
    fi
}

post_install() {
    _install_sleep_hook
    _apply_runtime_permissions
    systemctl daemon-reload
    systemctl disable camera-init.service v4l2-relayd@ipu7.service 2>/dev/null || true
    systemctl enable intel-ipu7-camera.service

    if [ -n "$SUDO_USER" ]; then
        usermod -aG video "$SUDO_USER" 2>/dev/null || true

        _add_pipewire_camera "/home/$SUDO_USER/.config/chromium-flags.conf"
        _add_pipewire_camera "/home/$SUDO_USER/.config/brave-flags.conf"
        _add_pipewire_camera "/home/$SUDO_USER/.config/chrome-flags.conf"
    fi
}

post_upgrade() {
    _install_sleep_hook
    _apply_runtime_permissions
    _warn_if_driver_is_loaded
    systemctl daemon-reload
    systemctl disable camera-init.service v4l2-relayd@ipu7.service 2>/dev/null || true
    systemctl enable intel-ipu7-camera.service
    # Disable old camera-feed-watch (replaced by v4l2-relayd)
    systemctl --global disable camera-feed-watch.service 2>/dev/null || true

    if [ -n "$SUDO_USER" ]; then
        _add_pipewire_camera "/home/$SUDO_USER/.config/chromium-flags.conf"
        _add_pipewire_camera "/home/$SUDO_USER/.config/brave-flags.conf"
        _add_pipewire_camera "/home/$SUDO_USER/.config/chrome-flags.conf"
    fi
}

pre_remove() {
    systemctl disable v4l2-relayd@ipu7.service 2>/dev/null || true
    systemctl stop v4l2-relayd@ipu7.service 2>/dev/null || true
    systemctl disable intel-ipu7-camera.service 2>/dev/null || true
    systemctl --global disable camera-feed-watch.service 2>/dev/null || true
    systemctl disable camera-init.service 2>/dev/null || true
    systemctl stop camera-init.service 2>/dev/null || true

    if [ -n "$SUDO_USER" ]; then
        _remove_pipewire_camera "/home/$SUDO_USER/.config/chromium-flags.conf"
        _remove_pipewire_camera "/home/$SUDO_USER/.config/brave-flags.conf"
        _remove_pipewire_camera "/home/$SUDO_USER/.config/chrome-flags.conf"
    fi
}

post_remove() {
    rm -f /usr/lib/systemd/system-sleep/camera-sleep-hook
    systemctl daemon-reload
    udevadm control --reload-rules 2>/dev/null || true
}