#!/bin/bash
# incognito [--no-audio] [--signin] [URL]: written by Wren Linux parts/incognito.sh
# Opens Firefox as a different, locked-down user (incognito), inside its own
# small window system, so it shares no clipboard and no folder with you.
# Everything it stores is kept in memory and deleted when you close it.
# It gets a restricted Wayland socket (bin/wayland-restrict), not your real
# one: it can show a window, but sway doesn't offer it the screen-reading,
# typing or session-lock protocols.
# Sound: incognito runs its own audio server with no sound card; all it can
# do is write sound into one pipe, which a player of yours reads and plays.
# It never gets to your audio server, so it can't hear your microphone or
# your other programs.
# --signin: the Wi-Fi sign-in window (bin/wifi-signin): it uses the network's
# own DNS, not Firefox's encrypted DNS, so a sign-in page can load. It runs as
# another user, wifi-signin, whose firewall rule lets it reach the local
# network, where sign-in pages often are; it has no sound, and it can be open
# next to an incognito window.
# shellcheck disable=SC2154  # rt, share, sock, audio_arg: set by the wren-sandbox functions
set -euo pipefail

die() { printf 'incognito: %s\n' "$*" >&2; exit 1; }

audio=true kind=normal
if [ "${1:-}" = --no-audio ]; then audio=false; shift; fi
if [ "${1:-}" = --signin ]; then kind=signin; shift; fi
# Who it runs as: each kind its own user, with its own firewall rule
user=incognito
if [ "$kind" = signin ]; then user=wifi-signin audio=false; fi

WS=${WREN_SANDBOX_LIB:-/usr/local/libexec/wren-sandbox}
# shellcheck source=wren-sandbox
. "$WS" || die "$WS is missing. Run: wrenctl part incognito"
ws_session
ws_tools "wrenctl part incognito"
# The one command your user may run as incognito or wifi-signin (see /etc/sudoers.d)
ws_allowed /usr/local/libexec/incognito-session "wrenctl part incognito"
# One of each kind at a time: the second would take back the access the first one needs
ws_lock "$rt/$user.lock" || die "it is already open."
ws_share "$user"
# incognito may only reach the restricted Wayland socket (and the sound pipe), and only while it runs.
ws_traps
ws_wayland "$user-wayland" "$user"
# The sound pipe: incognito writes, a player of yours reads and plays it. Opening the pipe waits
# until incognito's sound server opens its end. It is a normal stream in your volume control.
ws_audio "$audio" incognito-audio.fifo

rc=0
# the theme (bin/theme): just the word light or dark
theme=$(head -c 16 "${XDG_CONFIG_HOME:-$HOME/.config}/wren/theme" 2>/dev/null || true)
case $theme in light | dark) ;; *) theme=dark ;; esac
sudo -n -u "$user" /usr/local/libexec/incognito-session "$share" "${sock##*/}" "$audio_arg" "$theme" "$kind" "$@" || rc=$?
exit "$rc"