## Written by Wren Linux extras/whonix.sh, into the Workstation at
## /usr/local/etc/torbrowser.d/50_wren.conf.
##
## Whonix's browser starter (tb-starter's /usr/bin/torbrowser) sources every
## /usr/local/etc/torbrowser.d/*.conf before it prepares Tor Browser, so this
## file replaces its tb_custom_user_js_file (which copies user.js into the
## profile at every start) with one that also puts Wren Linux's policy file
## into the browser itself. The policy locks the Safest level with the
## browser's own policy engine: the slider and the prefs behind it can't be
## moved, and about:config is blocked. user.js still turns JavaScript off
## (javascript.* can't be locked by policy).
##
## A browser update deletes the whole browser folder (~/.tb/tor-browser);
## both files come back at the next start, from the root-owned copies here.

tb_custom_user_js_file() {
   local policies="${WREN_POLICIES:-/usr/local/etc/torbrowser.d/policies.json}"
   if test -f "${tb_user_js_source_file}" ; then
      cp "${tb_user_js_source_file}" "${tb_user_js_target_file}"
   fi
   if test -f "${policies}" ; then
      mkdir -p "${tb_browser_folder}/Browser/distribution"
      cp "${policies}" "${tb_browser_folder}/Browser/distribution/policies.json"
   fi
}