#!/bin/bash
# retired: Whonix is the safer place for wallets (Feather and Electrum come in its Workstation, behind Tor): wrenctl install whonix.
# What is left of this extra is its --remove, for whoever still has it set up: update.sh offers it,
# and so does wrenctl remove wallet-sandbox. It can't be installed any more; the rest of it was deleted.
# Usage: bash wallet-sandbox.sh --remove
# summary: Wallets as their own users, on Tor only
# security: most
# category: money
# status: file:/usr/local/bin/wallet
. "$(dirname -- "${BASH_SOURCE[0]}")/../lib.sh"
. "$WREN_DIR/lib/appimage.sh"
if [ "${1:-}" = --manual ]; then echo "Retired: only --remove is left (bash extras/wallet-sandbox.sh --remove)."; exit; fi
need_user

MARK=/etc/tor/.wren-wallet-sandbox
WALLETS=(feather sparrow electrum)
CMD=/usr/local/bin/wallet
SESSION=/usr/local/libexec/wallet-session
NETCHECK=/usr/local/libexec/wallet-net-check
CAMERA=/usr/local/libexec/wallet-camera
HOMES=/var/lib/wren-wallet
LIB=/usr/local/lib/wren-wallet
CONF=${WREN_WALLET_CONF:-/etc/wren/wallets}
SUDOERS=/etc/sudoers.d/wren-wallet
LIMITS=/etc/security/limits.d/50-wren-wallet.conf
FIREWALL=/etc/wren/wallet.nft
UNIT=/etc/systemd/system/wren-wallet-firewall.service
OWNER=$(id -un)

hw_rule() { echo "/etc/udev/rules.d/71-wren-wallet-$1.rules"; }
conf_says() { grep -qsx "$2=yes" "$CONF/$1.conf"; }

if [ "${1:-}" = --remove ]; then
    sudo systemctl disable --now wren-wallet-firewall.service >/dev/null 2>&1 || true
    sudo nft delete table inet wren_wallet 2>/dev/null || true
    remove_snippet wallet-sandbox
    sudo rm -f "$SUDOERS" "$LIMITS" "$CMD" "$SESSION" "$NETCHECK" "$CAMERA" "$FIREWALL" "$UNIT"
    for w in "${WALLETS[@]}"; do
        sudo rm -f "$(hw_rule "$w")" "$CONF/$w.conf"
    done
    sudo udevadm control --reload-rules 2>/dev/null || true
    sudo rm -rf "$LIB"
    sudo systemctl daemon-reload >/dev/null 2>&1 || true
    sudo rmdir "$CONF" 2>/dev/null || true
    for w in "${WALLETS[@]}"; do
        if id "wallet-$w" >/dev/null 2>&1; then
            sudo pkill -KILL -u "wallet-$w" 2>/dev/null || true
            sudo userdel "wallet-$w"
            note "Removed the user wallet-$w."
        fi
    done
    sudo rm -f "$MARK"
    system_tor_wanted .wren-wallet-sandbox || tor_service_off
    if [ -L "$HOME/Wallets" ]; then rm -f "$HOME/Wallets"; fi
    remove_wayland_restrict
    remove_no_abstract
    apt_purge
    # Never deleted here: these can hold the only copy of a wallet
    warn "Your wallets are kept in $HOMES (only root can read them now). Back them up before deleting anything."
    exit
fi

die "Retired: Whonix is the safer place for wallets (wrenctl install whonix). Only --remove is left."