wizard_setup.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
 
#include "wizard_setup.hpp"
#include "shell_quote.hpp"
#include "../SafeProcess.hpp"
#include "resource.hpp"
#include "../DistroUtils.hpp"
#include <glibmm/i18n.h>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <sstream>
#include <array>
#include <cstdio>
#include <cstdlib>
#include <sys/stat.h>
#include <unistd.h>
#include <vector>
#include <algorithm>
#include <pwd.h>
#include <sys/types.h>
#include <sys/wait.h>
 
#include <gtkmm/messagedialog.h>
 
 
 
namespace fs = std::filesystem;
 
namespace {
 
 
static bool run_cmd_capture(const std::string& cmd, std::string* out = nullptr, int* exit_code = nullptr) {
    // The legacy setup command plans contain fixed firewall shell operators.
    // Do not add an extra /bin/sh layer or interpolate unquoted user data.
    const auto result = bg_process::run({"/bin/sh", "-c", cmd}, true);
    if (out) *out = result.output;
    if (exit_code) *exit_code = result.exit_code;
    return result.ok();
}
 
static std::string elev_cmd(const std::string& inner,
                            const std::string& action_id = "org.BastionGuard.maintenance") {
    std::ostringstream cmd;
 
    bool has_action_id = run_cmd_capture("pkexec --help | grep -q action-id");
 
    if (fs::exists("/usr/bin/pkexec")) {
        if (has_action_id) {
            cmd << "pkexec --disable-internal-agent --action-id " << action_id
                << " /bin/bash -c " << BastionGuard::wizard::shell_quote(inner);
        } else {
 
            cmd << "pkexec /bin/bash -c " << BastionGuard::wizard::shell_quote(inner);
        }
    } else {
        cmd << "sudo /bin/bash -c " << BastionGuard::wizard::shell_quote(inner);
    }
 
    return cmd.str();
}
 
 
 
 
 
static std::string user_data_dir() {
    const char* xdg = getenv("XDG_DATA_HOME");
    if (xdg && *xdg) return std::string(xdg) + "/BastionGuard";
    const char* home = getenv("HOME");
    if (!home) home = "";
    return std::string(home) + "/.local/share/BastionGuard";
}
 
static bool write_temp_script_and_elevate(const std::string& script_contents, std::string* out_log = nullptr) {
    char tmpl[] = "/tmp/BastionGuard_tmp_XXXXXX";
    int fd = mkstemp(tmpl);
    if (fd < 0) {
        if (out_log) *out_log = _("Impossibile creare file temporaneo");
        return false;
    }
 
    std::string tmpname = tmpl;
    FILE* f = fdopen(fd, "w");
    if (!f) {
        close(fd);
        if (out_log) *out_log = _("fdopen fallita");
        return false;
    }
 
    fputs(script_contents.c_str(), f);
    fclose(f);
    chmod(tmpname.c_str(), 0755);
 
    bool has_action_id = run_cmd_capture("pkexec --help | grep -q action-id");
 
    std::ostringstream elev;
    if (fs::exists("/usr/bin/pkexec")) {
        if (has_action_id) {
            elev << "pkexec --disable-internal-agent --action-id org.BastionGuard.maintenance " << tmpname;
        } else {
            elev << "pkexec " << tmpname;
        }
    } else {
        elev << "sudo " << tmpname;
    }
 
    std::string out;
    int rc = 0;
    bool ok = run_cmd_capture(elev.str(), &out, &rc);
    std::cerr << _("\n===== [BastionGuard DEBUG: write_temp_script_and_elevate] =====\n");
    std::cerr << _("Comando elevato eseguito:\n") << elev.str() << "\n";
    std::cerr << "Exit code: " << rc << (ok ? " (OK)" : " (FAIL)") << "\n";
    if (!out.empty())
        std::cerr << "Output:\n" << out << "\n";
    else
        std::cerr << _("(nessun output catturato)\n");
    std::cerr << "===========================================================\n";
 
    std::error_code ec;
    fs::remove(tmpname, ec);
 
    if (out_log) *out_log = out;
    return ok && rc == 0;
}
 
 
 
 
 
 
static bool file_exists(const std::string& path) {
    struct stat st;
    return (stat(path.c_str(), &st) == 0);
}
 
static std::string run_capture(const std::string& cmd) {
    const auto capture = bg_process::run({"/bin/sh", "-c", cmd});
    if (!capture.ok()) return {};
    std::string out = capture.output;
    while (!out.empty() && (out.back() == '\n' || out.back() == '\r')) out.pop_back();
    return out;
}
 
static bool detect_resolvectl() {
    if (run_cmd_capture("command -v resolvectl >/dev/null 2>&1")) return true;
    return false;
}
 
static bool detect_nmcli() {
    return run_cmd_capture("command -v nmcli >/dev/null 2>&1");
}
 
static std::string find_active_interface_nmcli() {
    std::string cmd = "nmcli -t -f DEVICE,STATE device status 2>/dev/null | awk -F: '$2==\"connected\"{print $1; exit}'";
    return run_capture(cmd);
}
 
static std::string find_active_link_resolvectl() {
    std::string out = run_capture("ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++){ if($i==\"dev\") {print $(i+1); exit}}}'");
    if (!out.empty()) return out;
    if (detect_nmcli()) {
        return find_active_interface_nmcli();
    }
    return {};
}
 
} // anonymous
 
namespace BastionGuard::wizard {
bool run_all_elevated_steps(const std::vector<std::string>& commands, std::string* out_log) {
    if (commands.empty()) {
        if (out_log) *out_log = "No commands";
        return true;
    }
 
    char tmpl[] = "/tmp/BastionGuard_all_XXXXXX";
    int fd = mkstemp(tmpl);
    if (fd < 0) {
        if (out_log) *out_log = _("Impossibile creare file temporaneo");
        return false;
    }
    std::string tmpname = tmpl;
 
    FILE* f = fdopen(fd, "w");
    if (!f) {
        close(fd);
        if (out_log) *out_log = _("fdopen fallita");
        return false;
    }
 
    fputs("#!/bin/bash\nset -euo pipefail\n\n", f);
    fputs("echo \"[BastionGuard] start elevated script\" >&2\n", f);
    for (const auto &c : commands) {
        fputs(c.c_str(), f);
        fputc('\n', f);
    }
 
    fputs("echo \"[BastionGuard] end elevated script\" >&2\n", f);
    fclose(f);
    chmod(tmpname.c_str(), 0750);
 
    bool use_pkexec = fs::exists("/usr/bin/pkexec");
    bool has_action_id = run_cmd_capture("pkexec --help | grep -q action-id");
    std::ostringstream elev;
    if (use_pkexec) {
        if (has_action_id) {
            elev << "pkexec --disable-internal-agent --action-id org.BastionGuard.maintenance " << tmpname;
        } else {
            elev << "pkexec " << tmpname;
        }
    } else {
        elev << "sudo " << tmpname;
    }
 
    std::string out;
    int rc = 0;
    bool ok = run_cmd_capture(elev.str(), &out, &rc);
 
    // Pulizia
    std::error_code ec;
    fs::remove(tmpname, ec);
 
    if (out_log) *out_log = out;
    return ok && rc == 0;
}
 
 
 
void gen_cert_commands(std::vector<std::string>& out) {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[wizard] Certificati e CA disabilitati su Fedora/RHEL/Alma/Rocky.\n");
        return;
    }
    out.push_back(_("echo '[BastionGuard] Generazione certificati...' >&2"));
    out.push_back("mkdir -p /etc/BastionGuard/certs && chmod 755 /etc/BastionGuard/certs");
    out.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/BastionGuard-ca.key.pem 4096");
    out.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.crt.pem ] || openssl req -x509 -new -nodes -key /etc/BastionGuard/certs/BastionGuard-ca.key.pem -sha256 -days 3650 -subj '/CN=BastionGuard Local CA' -out /etc/BastionGuard/certs/BastionGuard-ca.crt.pem");
    out.push_back("[ -f /etc/BastionGuard/certs/local-warning.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/local-warning.key.pem 2048");
    out.push_back("openssl req -new -key /etc/BastionGuard/certs/local-warning.key.pem -subj '/CN=localhost' -out /etc/BastionGuard/certs/local-warning.csr.pem");
    out.push_back("echo 'subjectAltName = DNS:localhost,IP:127.0.0.2' > /etc/BastionGuard/certs/v3ext.cnf");
    out.push_back("openssl x509 -req -in /etc/BastionGuard/certs/local-warning.csr.pem -CA /etc/BastionGuard/certs/BastionGuard-ca.crt.pem -CAkey /etc/BastionGuard/certs/BastionGuard-ca.key.pem -CAcreateserial -out /etc/BastionGuard/certs/local-warning.crt.pem -days 825 -sha256 -extfile /etc/BastionGuard/certs/v3ext.cnf");
    out.push_back("rm -f /etc/BastionGuard/certs/local-warning.csr.pem /etc/BastionGuard/certs/BastionGuard-ca.srl /etc/BastionGuard/certs/v3ext.cnf || true");
    out.push_back("chmod 600 /etc/BastionGuard/certs/*key.pem || true");
    out.push_back("chmod 644 /etc/BastionGuard/certs/*.crt.pem || true");
    out.push_back("if command -v update-ca-certificates >/dev/null 2>&1; then install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /usr/local/share/ca-certificates/BastionGuard-ca.crt && update-ca-certificates; "
                  "elif command -v trust >/dev/null 2>&1; then trust anchor --store /etc/BastionGuard/certs/BastionGuard-ca.crt.pem; "
                  "elif command -v update-ca-trust >/dev/null 2>&1; then install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt && update-ca-trust extract; fi");
}
 
void gen_web_commands(std::vector<std::string>& out, int http_port, int https_port) {
    out.push_back(_("echo '[BastionGuard] Configuro webserver (nginx) porte...' >&2"));
    out.push_back("mkdir -p /etc/BastionGuard");
    out.push_back("echo \"" + std::to_string(http_port) + " " + std::to_string(https_port) + "\" > /etc/BastionGuard/webports.conf");
    out.push_back("sed -i 's/listen [0-9]\\+/listen " + std::to_string(http_port) + "/g' /etc/nginx/conf.d/*.conf 2>/dev/null || true");
    out.push_back("sed -i 's/listen [0-9]\\+ ssl/listen " + std::to_string(https_port) + " ssl/g' /etc/nginx/conf.d/*.conf 2>/dev/null || true");
    out.push_back("nginx -t && /usr/libexec/bastionguard/bastionguard-service --system restart nginx.service || true");
}
 
void gen_blacklist_commands(std::vector<std::string>& out, const std::string& packaged_blacklist) {
    if (fs::exists(packaged_blacklist)) {
        std::string dst = (fs::path(user_data_dir()) / "phishing/blacklist.txt").string();
        out.push_back("mkdir -p " + (fs::path(user_data_dir()) / "phishing").string());
        out.push_back("install -m 0644 " + packaged_blacklist + " " + dst + " || true");
    }
}
 
 
 
bool setup_firewall_ports() {
    bool group_modified = false;
 
    try {
        std::cout << "[wizard] " << _("Apro le porte firewall necessarie (53/udp, 81/tcp, 444/tcp, 4443/tcp)...") << std::endl;
 
        auto detect_distro_family = []() -> std::string {
            std::ifstream f("/etc/os-release");
            if (!f.is_open()) return "unknown";
            std::string line, content;
            while (std::getline(f, line)) content += line + "\n";
            f.close();
 
            if (content.find("ID=fedora") != std::string::npos ||
                content.find("ID_LIKE=fedora") != std::string::npos ||
                content.find("ID_LIKE=rhel") != std::string::npos)
                return "fedora";
            if (content.find("ID=arch") != std::string::npos ||
                content.find("ID_LIKE=arch") != std::string::npos)
                return "arch";
            if (content.find("ID=opensuse") != std::string::npos)
                return "suse";
            if (content.find("ID=debian") != std::string::npos ||
                content.find("ID_LIKE=debian") != std::string::npos ||
                content.find("ID=ubuntu") != std::string::npos)
                return "debian";
            return "generic";
        };
 
        std::string distro = detect_distro_family();
        std::cout << "[wizard] " << _("Rilevata distribuzione: ") << distro << std::endl;
 
        auto try_firewalld = [&]() -> bool {
            if (!fs::exists("/usr/bin/firewall-cmd")) return false;
            std::string cmd = elev_cmd(
                "firewall-cmd --permanent --add-port=53/udp && "
                "firewall-cmd --permanent --add-port=81/tcp && "
                "firewall-cmd --permanent --add-port=444/tcp && "
                "firewall-cmd --permanent --add-port=4443/tcp && "
                "firewall-cmd --reload"
            );
            std::string out; int rc = 0;
            bool ok = run_cmd_capture(cmd, &out, &rc);
            if (ok && rc == 0)
                std::cout << "[wizard] ✅ " << _("Porte aperte tramite firewalld.") << std::endl;
            return ok;
        };
 
        auto try_ufw = [&]() -> bool {
            if (!fs::exists("/usr/sbin/ufw") && !fs::exists("/usr/bin/ufw")) return false;
            std::ostringstream cmd;
            cmd << "ufw allow 53/udp && ufw allow 81/tcp && ufw allow 444/tcp && ufw allow 4443/tcp";
            std::string out; int rc = 0;
            bool ok = run_cmd_capture(elev_cmd(cmd.str(), "org.BastionGuard.nftables"), &out, &rc);
 
            if (ok && rc == 0)
                std::cout << "[wizard] ✅ " << _("Porte aperte tramite ufw.") << std::endl;
            return ok;
        };
 
        auto try_nft = [&]() -> bool {
            if (!fs::exists("/usr/sbin/nft") && !fs::exists("/usr/bin/nft")) return false;
 
            run_cmd_capture(elev_cmd("modprobe nf_nat 2>/dev/null || true"), nullptr, nullptr);
            run_cmd_capture(elev_cmd("sh -c 'echo nf_nat > /etc/modules-load.d/BastionGuard.conf 2>/dev/null || true'"), nullptr, nullptr);
 
            std::string cmd = elev_cmd(
                "nft add table inet BastionGuard_filter 2>/dev/null || true; "
                "nft add chain inet BastionGuard_filter input { type filter hook input priority 0; policy accept; } 2>/dev/null || true; "
                "nft add rule inet BastionGuard_filter input udp dport 53 accept || true; "
                "nft add rule inet BastionGuard_filter input tcp dport 81 accept || true; "
                "nft add rule inet BastionGuard_filter input tcp dport 444 accept || true; "
                "nft add rule inet BastionGuard_filter input tcp dport 4443 accept || true"
            );
            std::string out; int rc = 0;
            run_cmd_capture(cmd, &out, &rc);
            std::cout << "[wizard] ✅ " << _("Regole nftables applicate (best-effort).") << std::endl;
            return true;
        };
 
        auto try_iptables = [&]() -> bool {
            if (!fs::exists("/sbin/iptables") && !fs::exists("/usr/sbin/iptables")) return false;
            std::string cmd = elev_cmd(
                "iptables -I INPUT -p udp --dport 53 -j ACCEPT || true; "
                "iptables -I INPUT -p tcp --dport 81 -j ACCEPT || true; "
                "iptables -I INPUT -p tcp --dport 444 -j ACCEPT || true; "
                "iptables -I INPUT -p tcp --dport 4443 -j ACCEPT || true"
            );
            std::string out; int rc = 0;
            run_cmd_capture(cmd, &out, &rc);
            std::cout << "[wizard] ✅ " << _("Regole iptables applicate (best-effort).") << std::endl;
            return true;
        };
 
        bool ok = false;
        if (try_firewalld()) ok = true;
        else if (try_ufw()) ok = true;
        else if (try_nft()) ok = true;
        else if (try_iptables()) ok = true;
        else
            std::cerr << "[wizard] ⚠ " << _("Nessuno strumento firewall rilevato; apri manualmente le porte se necessario.") << std::endl;
 
        const char* user = getenv("SUDO_USER");
        if (!user || !*user) {
            const char* pk_uid = getenv("PKEXEC_UID");
            if (pk_uid && *pk_uid) {
                struct passwd* pwuid_entry = getpwuid(static_cast<uid_t>(std::stoi(pk_uid)));
                if (pwuid_entry)
                    user = pwuid_entry->pw_name;
            }
        }
        if (!user || !*user)
            user = getenv("USER");
 
        if (user && *user) {
            std::cout << "[wizard] " << _("Utente effettivo: ") << user << std::endl;
 
            const auto groups = bg_process::run({"id", "-nG", user});
            std::istringstream words(groups.output);
            std::string group;
            bool member = false;
            while (words >> group) {
                if (group == "adm" || group == "systemd-journal") { member = true; break; }
            }
            const int rc_check = groups.ok() && member ? 0 : 1;
 
            if (rc_check != 0) {
                std::ostringstream cmd;
                cmd << "gpasswd -a " << BastionGuard::wizard::shell_quote(user) << " adm; "
                    << "if getent group systemd-journal >/dev/null 2>&1; then "
                    << "gpasswd -a " << BastionGuard::wizard::shell_quote(user) << " systemd-journal; fi";
                std::string out;
                int rc = 0;
                std::cout << "[wizard] " << _("Aggiungo l'utente ai gruppi di log disponibili...") << std::endl;
                bool okgrp = run_cmd_capture(elev_cmd(cmd.str()), &out, &rc);
                if (okgrp && rc == 0) {
                    std::cout << "[wizard] ✅ " << _("Utente aggiunto ai gruppi richiesti.") << std::endl;
                    group_modified = true;
                } else {
                    std::cerr << "[wizard] ⚠ " << _("Errore aggiungendo l'utente ai gruppi: ") << out << std::endl;
                }
            } else {
                std::cout << "[wizard] " << _("Utente già presente in un gruppo di accesso ai log.") << std::endl;
            }
        } else {
            std::cerr << "[wizard] ⚠ " << _("Impossibile determinare l'utente effettivo; salto l'aggiunta ai gruppi.") << std::endl;
        }
 
        if (group_modified) {
            auto* dlg = new Gtk::MessageDialog(
                _("Per completare la configurazione,\ntermina e riavvia la sessione utente."),
                false,
                Gtk::MessageType::INFO,
                Gtk::ButtonsType::OK,
                true
            );
            dlg->set_title(_("BastionGuard - Permessi aggiornati"));
            dlg->set_secondary_text(
                _("I nuovi permessi di accesso ai log diventeranno attivi dopo il logout.\n"
                  "Chiudi e riapri la sessione per visualizzare correttamente l'avvio dell'applicazione BastionGuard.")
            );
            dlg->signal_response().connect([dlg](int) { dlg->hide(); delete dlg; });
            dlg->present();
        }
 
        if (ok) {
        std::cout << "[wizard] " << _("Riavvio del servizio BastionGuard-phishing-scanner...") << std::endl;
 
        {
            std::string out; int rc = 0;
            run_cmd_capture("test -x /usr/libexec/bastionguard/bastionguard-service", &out, &rc);
            if (rc != 0) {
                std::cout << "[wizard] " << _("Gestore servizi non presente: salto il riavvio del servizio.") << std::endl;
            } else {
 
                run_cmd_capture(elev_cmd("/usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1"), &out, &rc);
                if (rc == 0) {
                    run_cmd_capture(elev_cmd("/usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service >/dev/null 2>&1 || true", "org.BastionGuard.service.manage"), &out, &rc);
 
                    if (rc == 0) {
                        std::cout << "[wizard] ✅ " << _("Servizio BastionGuard-phishing-scanner riavviato.") << std::endl;
                    } else {
                        std::cerr << "[wizard] ⚠ " << _("Tentativo di riavvio eseguito (codice ") << rc << _("). Verifica lo stato del servizio.") << std::endl;
                    }
                } else {
                    std::cout << "[wizard] " << _("Servizio BastionGuard-phishing-scanner non trovato: salto il riavvio.") << std::endl;
                }
            }
        }
    }
        return ok;
 
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] ⚠ " << _("Eccezione in setup_firewall_ports: ") << ex.what() << std::endl;
        return false;
    }
}
 
bool install_nftables_conf() {
    try {
        std::cout << _("[wizard] 🔧 Configurazione rete e nftables (modalità agent)...\n");
 
        const std::string src_conf = "/usr/share/BastionGuard/data/config/nftables.conf";
        const std::string dst_conf = "/etc/nftables.conf";
        const std::string net_script = "/usr/share/BastionGuard/data/scripts/BastionGuard-net-setup.sh";
 
        if (!fs::exists(src_conf)) {
            std::cerr << _("[wizard] ⚠ File di configurazione nftables non trovato: ") << src_conf << "\n";
            return false;
        }
 
        std::ostringstream script;
        script << "#!/bin/bash\n";
        script << "set -euo pipefail\n";
        script << "export PATH=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"\n";
        script << "export XDG_RUNTIME_DIR=\"/run/user/0\"\n";
        script << "export DBUS_SESSION_BUS_ADDRESS=\"unix:path=/run/dbus/system_bus_socket\"\n";
        script << "export DISPLAY=${DISPLAY:-:0}\n";
        script << _("echo '[BastionGuard] ▶ Configurazione nftables e rete...'\n");
 
        script << "install -m 0644 \"" << src_conf << "\" \"" << dst_conf << "\"\n";
        script << "nft -f \"" << dst_conf << "\" || true\n";
        script << "if ! /usr/libexec/bastionguard/bastionguard-service --system is-active ufw.service 2>/dev/null && "
                  "! /usr/libexec/bastionguard/bastionguard-service --system is-active firewalld.service 2>/dev/null; then\n";
        script << _("  echo '[BastionGuard] Abilito e avvio nftables.service...'\n");
        script << "  /usr/libexec/bastionguard/bastionguard-service --system enable --now nftables.service || true\n";
        script << "else\n";
        script << _("  echo '[BastionGuard] UFW o Firewalld rilevati: mantengo configurazione esistente.'\n");
        script << "fi\n";
 
        if (fs::exists(net_script)) {
            script << _("echo '[BastionGuard] ▶ Eseguo BastionGuard-net-setup.sh (modalità agent)...'\n");
            script << "/usr/bin/env bash \"" << net_script << "\" || true\n";
        } else {
            script << _("echo '[BastionGuard] Nessuno script di rete trovato.'\n");
        }
 
        script << _("echo '[BastionGuard] ✅ Configurazione nftables + rete completata.'\n");
 
        std::string out;
        bool ok = write_temp_script_and_elevate(script.str(), &out);
 
        // 🔍 Diagnostica
        std::cerr << _("[wizard][DEBUG] Output BastionGuard-net-setup.sh:\n") << out << "\n";
 
        if (ok) {
            std::cout << _("[wizard] ✅ nftables e rete configurati con successo (agent mode)\n");
        } else {
            std::cerr << _("[wizard] ⚠ Errore configurando nftables o rete:\n") << out << "\n";
        }
 
        return ok;
    } catch (const std::exception& ex) {
        std::cerr << _("[wizard] ⚠ Eccezione in install_nftables_conf: ") << ex.what() << "\n";
        return false;
    }
}
 
 
 
bool install_system_ca(const std::string& ca_crt_path) {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[wizard] Installazione CA di sistema bloccata su Fedora/RHEL/Alma/Rocky.\n");
        return false;
    }
    try {
        if (!fs::exists(ca_crt_path)) {
            std::cerr << "[wizard] " << _("File CA non trovato:") << " " << ca_crt_path << std::endl;
            return false;
        }
 
        std::ostringstream script;
        script << "#!/bin/sh\nset -e\n\n";
        script << "CA=\"" << ca_crt_path << "\"\n";
        script << "OK=0\n\n";
 
        script << "if command -v update-ca-certificates >/dev/null 2>&1; then\n";
        script << "  install -m 644 \"$CA\" /usr/local/share/ca-certificates/BastionGuard-ca.crt && update-ca-certificates && OK=1 || true\n";
        script << "fi\n\n";
 
 
        script << "if command -v trust >/dev/null 2>&1; then\n";
        script << "  trust anchor --store \"$CA\" && OK=1 || true\n";
        script << "fi\n\n";
 
        script << "if command -v update-ca-trust >/dev/null 2>&1; then\n";
        script << "  install -m 644 \"$CA\" /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt && update-ca-trust extract && OK=1 || true\n";
        script << "fi\n\n";
 
        script << "if [ -d /etc/ca-certificates/trust-source/anchors ]; then\n";
        script << "  install -m 644 \"$CA\" /etc/ca-certificates/trust-source/anchors/BastionGuard-ca.crt && \\\n";
        script << "  ( (command -v trust >/dev/null 2>&1 && trust extract-compat) || (trust anchor --store \"$CA\") ) && OK=1 || true\n";
        script << "fi\n\n";
        script << "install -m 644 \"$CA\" /usr/local/share/ca-certificates/BastionGuard-ca.crt || true\n";
        script << "install -m 644 \"$CA\" /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt || true\n";
        script << "if command -v update-ca-certificates >/dev/null 2>&1; then update-ca-certificates || true; fi\n";
        script << "if command -v update-ca-trust >/dev/null 2>&1; then update-ca-trust extract || true; fi\n";
        script << "if command -v trust >/dev/null 2>&1; then trust anchor --store \"$CA\" || true; fi\n\n";
 
        script << "if [ \"$OK\" -eq 1 ]; then\n";
        script << "  echo \"OK: CA installed into system trust\"\n";
        script << "  exit 0\n";
        script << "else\n";
        script << "  echo \"WARN: none of the system trust installers succeeded; CA copied to common paths\"\n";
        script << "  exit 2\n";
        script << "fi\n";
 
        std::string out;
        bool ok = write_temp_script_and_elevate(script.str(), &out);
 
        if (!ok) {
            std::cerr << "[wizard] " << _("Installazione CA: script restituisce warning o errore") << "\n" << out << std::endl;
            if (out.find("OK: CA installed") != std::string::npos) {
                std::cout << "[wizard] " << _("CA installata nel trust store di sistema") << std::endl;
                return true;
            }
            if (out.find("WARN:") != std::string::npos) {
                std::cout << "[wizard] " << _("CA copiata in directory comuni, ma potresti doverla abilitare manualmente") << std::endl;
                return true;
            }
            return false;
        }
 
        std::cout << "[wizard] " << _("CA installata nel trust store di sistema") << std::endl;
        return true;
 
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] " << _("Eccezione in install_system_ca:") << " " << ex.what() << std::endl;
        return false;
    }
}
 
 
bool setup_certificates() {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[wizard] Generazione/installazione certificati disabilitata su Fedora/RHEL/Alma/Rocky.\n");
        return true;
    }
    try {
        std::cout << "[wizard] " << _("Generazione CA locale e certificato per il warning server...") << std::endl;
 
        std::ostringstream script;
        script << "#!/bin/sh\nset -e\n";
        script << "OUT=/etc/BastionGuard/certs\n";
        script << "mkdir -p \"$OUT\"\n";
        script << "chmod 755 \"$OUT\"\n\n";
 
        script << "if [ ! -f \"$OUT/BastionGuard-ca.key.pem\" ] || [ ! -f \"$OUT/BastionGuard-ca.crt.pem\" ]; then\n";
        script << "  openssl genrsa -out \"$OUT/BastionGuard-ca.key.pem\" 4096\n";
        script << "  openssl req -x509 -new -nodes -key \"$OUT/BastionGuard-ca.key.pem\" "
                  "-sha256 -days 3650 -subj \"/CN=BastionGuard Local CA\" -out \"$OUT/BastionGuard-ca.crt.pem\"\n";
        script << "fi\n\n";
 
        script << "if [ ! -f \"$OUT/local-warning.key.pem\" ] || [ ! -f \"$OUT/local-warning.crt.pem\" ]; then\n";
        script << "  openssl genrsa -out \"$OUT/local-warning.key.pem\" 2048\n";
        script << "  openssl req -new -key \"$OUT/local-warning.key.pem\" -subj \"/CN=localhost\" -out \"$OUT/local-warning.csr.pem\"\n";
        script << "  echo \"subjectAltName = DNS:localhost,IP:127.0.0.2\" > \"$OUT/v3ext.cnf\"\n";
        script << "  openssl x509 -req -in \"$OUT/local-warning.csr.pem\" "
                  "-CA \"$OUT/BastionGuard-ca.crt.pem\" -CAkey \"$OUT/BastionGuard-ca.key.pem\" -CAcreateserial "
                  "-out \"$OUT/local-warning.crt.pem\" -days 825 -sha256 -extfile \"$OUT/v3ext.cnf\"\n";
        script << "  rm -f \"$OUT/local-warning.csr.pem\" \"$OUT/BastionGuard-ca.srl\" \"$OUT/v3ext.cnf\"\n";
        script << "  chmod 600 \"$OUT/BastionGuard-ca.key.pem\" \"$OUT/local-warning.key.pem\"\n";
        script << "  chmod 644 \"$OUT/BastionGuard-ca.crt.pem\" \"$OUT/local-warning.crt.pem\"\n";
        script << "fi\n";
 
        std::string out;
        if (!write_temp_script_and_elevate(script.str(), &out)) {
            std::cerr << _("[wizard] Certificati: errore nello script\n") << out << std::endl;
            return false;
        }
 
        if (!install_system_ca("/etc/BastionGuard/certs/BastionGuard-ca.crt.pem")) {
            std::cerr << _("[wizard] ⚠️ Attenzione: installazione CA di sistema non riuscita.") << std::endl;
            std::cerr << _("[wizard] L'utente può installare manualmente il file: /etc/BastionGuard/certs/BastionGuard-ca.crt.pem") << std::endl;
            return false;
        }
 
        std::cout << _("[wizard] ✅ Certificati generati in /etc/BastionGuard/certs e CA installata nel sistema") << std::endl;
        return true;
 
    } catch (const std::exception& ex) {
        std::cerr << _("[wizard] Eccezione in setup_certificates: ") << ex.what() << std::endl;
        return false;
    }
}
 
 
 
 
bool install_phishing_blacklist(const std::string& src, const std::string& dst) {
    try {
        fs::create_directories(fs::path(dst).parent_path());
        fs::copy_file(src, dst, fs::copy_options::overwrite_existing);
        std::cout << "[wizard] " << _("Blacklist phishing copiata in:") << " " << dst << std::endl;
        return true;
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] " << _("Errore copiando blacklist:") << " " << ex.what() << std::endl;
        return false;
    }
}
 
 
bool install_native_host(const std::string& /*src_host*/, const std::string& extension_id) {
    try {
        namespace fs = std::filesystem;
 
        std::cout << "[wizard] " << _("Installazione native messaging host...") << std::endl;
        std::string bin_path = "/usr/bin/BastionGuard-native-host";
 
        if (fs::exists(bin_path)) {
            std::error_code ec;
            auto perms = fs::status(bin_path, ec).permissions();
            if (!ec && ((perms & fs::perms::owner_exec) == fs::perms::none)) {
                fs::permissions(
                    bin_path,
                    fs::perms::owner_exec | fs::perms::group_exec | fs::perms::others_exec,
                    fs::perm_options::add,
                    ec
                );
                if (ec) {
                    std::cerr << "[wizard] " << _("Impossibile impostare i permessi eseguibili: ")
                              << ec.message() << std::endl;
                }
            }
        } else {
            std::cerr << "[wizard] " << _("Avviso: binario native host non trovato: ") << bin_path << std::endl;
        }
 
        auto json_escape = [](const std::string& s) {
            std::string out;
            for (char c : s) {
                if (c == '\\') out += "\\\\";
                else if (c == '"') out += "\\\"";
                else out += c;
            }
            return out;
        };
 
        auto make_chrome_manifest = [&](const std::string& ext_id) {
            std::ostringstream o;
            o << "{\n"
              << "  \"name\": \"com.BastionGuard.native_host\",\n"
              << "  \"description\": \"BastionGuard native messaging host\",\n"
              << "  \"path\": \"" << json_escape(bin_path) << "\",\n"
              << "  \"type\": \"stdio\",\n"
              << "  \"allowed_origins\": [\n";
            if (!ext_id.empty())
                o << "    \"chrome-extension://" << ext_id << "/\"\n";
            o << "  ]\n"
              << "}\n";
            return o.str();
        };
 
        auto make_firefox_manifest = [&](const std::string& ext_id) {
            std::ostringstream o;
            o << "{\n"
              << "  \"name\": \"com.BastionGuard.native_host\",\n"
              << "  \"description\": \"BastionGuard native messaging host\",\n"
              << "  \"path\": \"" << json_escape(bin_path) << "\",\n"
              << "  \"type\": \"stdio\",\n"
              << "  \"allowed_extensions\": [\n";
            if (!ext_id.empty())
                o << "    \"" << ext_id << "\"\n";
            o << "  ]\n"
              << "}\n";
            return o.str();
        };
 
        const char* xdg = getenv("XDG_CONFIG_HOME");
        std::string config_base = (xdg && *xdg)
            ? std::string(xdg)
            : (std::string(getenv("HOME")) + "/.config");
 
        std::vector<std::pair<std::string,std::string>> manifest_targets;
 
        manifest_targets.emplace_back(config_base + "/google-chrome/NativeMessagingHosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back(config_base + "/chromium/NativeMessagingHosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back(config_base + "/BraveSoftware/Brave-Browser/NativeMessagingHosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back(config_base + "/microsoft-edge/NativeMessagingHosts", make_chrome_manifest(extension_id));
 
        manifest_targets.emplace_back(std::string(getenv("HOME")) + "/.mozilla/native-messaging-hosts", make_firefox_manifest("BastionGuard@local"));
        manifest_targets.emplace_back(std::string(getenv("HOME")) + "/.librewolf/native-messaging-hosts", make_firefox_manifest("BastionGuard@local"));
 
        manifest_targets.emplace_back("/etc/opt/chrome/native-messaging-hosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back("/etc/chromium/native-messaging-hosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back("/usr/lib/mozilla/native-messaging-hosts", make_firefox_manifest("BastionGuard@local"));
 
        bool any_written = false;
        for (auto& t : manifest_targets) {
            const std::string& dir = t.first;
            const std::string& content = t.second;
            std::error_code ec;
            fs::create_directories(dir, ec);
            if (ec) {
                std::cerr << "[wizard] " << _("Impossibile creare la directory: ")
                          << dir << " (" << ec.message() << ")" << std::endl;
                continue;
            }
            std::string manifest_name = dir + "/com.BastionGuard.native_host.json";
 
            if (fs::exists(manifest_name)) {
                std::cout << "[wizard] " << _("Manifest già presente, salto: ") << manifest_name << std::endl;
                continue;
            }
 
            std::ofstream man(manifest_name, std::ios::trunc);
            if (man.is_open()) {
                man << content;
                man.close();
                std::cout << "[wizard] " << _("Manifest scritto in: ") << manifest_name << std::endl;
                any_written = true;
            } else {
                std::cerr << "[wizard] " << _("Impossibile scrivere manifest in: ") << manifest_name << std::endl;
            }
        }
 
        if (any_written) {
            std::cout << "[wizard] " << _("Native host configurato, manifest creati") << std::endl;
            return true;
        }
 
        std::cerr << "[wizard] " << _("Nessun manifest creato (tutti già presenti?)") << std::endl;
        return false;
 
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] " << _("Eccezione in install_native_host: ") << ex.what() << std::endl;
        return false;
    }
}
 
 
bool run_wizard_setup(const std::vector<std::string>& options) {
    bool run_all = options.empty();
    bool ok = true;
 
    auto has_opt = [&](const std::string& key) {
        return run_all || std::find(options.begin(), options.end(), key) != options.end();
    };
 
    std::vector<std::string> cmds;
 
    std::cout << _("[wizard] 🔁 Esecuzione privilegiata combinata (una sola autenticazione)...\n");
 
 
 
 
    if (has_opt("certs") && !BastionGuard::Platform::is_fedora_rhel_family()) {
        cmds.push_back(_("echo '[BastionGuard] Genero certificati locali...' >&2"));
        cmds.push_back("mkdir -p /etc/BastionGuard/certs && chmod 755 /etc/BastionGuard/certs");
        cmds.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/BastionGuard-ca.key.pem 4096");
        cmds.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.crt.pem ] || openssl req -x509 -new -nodes "
                       "-key /etc/BastionGuard/certs/BastionGuard-ca.key.pem -sha256 -days 3650 "
                       "-subj '/CN=BastionGuard Local CA' -out /etc/BastionGuard/certs/BastionGuard-ca.crt.pem");
        cmds.push_back("[ -f /etc/BastionGuard/certs/local-warning.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/local-warning.key.pem 2048");
        cmds.push_back("openssl req -new -key /etc/BastionGuard/certs/local-warning.key.pem "
                       "-subj '/CN=localhost' -out /etc/BastionGuard/certs/local-warning.csr.pem");
        cmds.push_back("echo 'subjectAltName = DNS:localhost,IP:127.0.0.2' > /etc/BastionGuard/certs/v3ext.cnf");
        cmds.push_back("openssl x509 -req -in /etc/BastionGuard/certs/local-warning.csr.pem "
                       "-CA /etc/BastionGuard/certs/BastionGuard-ca.crt.pem -CAkey /etc/BastionGuard/certs/BastionGuard-ca.key.pem "
                       "-CAcreateserial -out /etc/BastionGuard/certs/local-warning.crt.pem -days 825 "
                       "-sha256 -extfile /etc/BastionGuard/certs/v3ext.cnf");
        cmds.push_back("rm -f /etc/BastionGuard/certs/local-warning.csr.pem /etc/BastionGuard/certs/BastionGuard-ca.srl /etc/BastionGuard/certs/v3ext.cnf");
        cmds.push_back("chmod 600 /etc/BastionGuard/certs/*key.pem || true");
        cmds.push_back("chmod 644 /etc/BastionGuard/certs/*.crt.pem || true");
 
        cmds.push_back("if command -v update-ca-certificates >/dev/null 2>&1; then "
                       "install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /usr/local/share/ca-certificates/BastionGuard-ca.crt && "
                       "update-ca-certificates; "
                       "elif command -v trust >/dev/null 2>&1; then "
                       "trust anchor --store /etc/BastionGuard/certs/BastionGuard-ca.crt.pem; "
                       "elif command -v update-ca-trust >/dev/null 2>&1; then "
                       "install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt && "
                       "update-ca-trust extract; fi");
    }
 
    if (has_opt("blacklist")) {
        std::string dst = user_data_dir() + "/blacklist/phishing-blacklist.txt";
        cmds.push_back(_("echo '[BastionGuard] Copio blacklist phishing...' >&2"));
        cmds.push_back("mkdir -p " + user_data_dir() + "/blacklist || true");
        cmds.push_back("install -m 0644 phishing-blacklist.txt " + dst + " || true");
    }
 
    cmds.push_back(_("echo '[BastionGuard] Riavvio BastionGuard-phishing-scanner...' >&2"));
    cmds.push_back("if [ -x /usr/libexec/bastionguard/bastionguard-service ] && "
                   "/usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1; then "
                   "/usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service || true; "
                   "else echo '[BastionGuard] Nessun servizio BastionGuard-phishing-scanner trovato.' >&2; fi");
 
    if (!cmds.empty()) {
        std::string log;
        bool ok_elev = run_all_elevated_steps(cmds, &log);
        if (!ok_elev) {
            std::cerr << _("[wizard] ⚠ Errore nello script privilegiato:\n") << log << std::endl;
            return false;
        }
        std::cout << _("[wizard] ✅ Tutte le operazioni privilegiate completate.") << std::endl;
    }
 
    if (has_opt("native-host")) {
        std::string ext_id;
        ok &= install_native_host("/usr/bin/BastionGuard-native-host", ext_id);
    }
 
    return ok;
}
 
 
 
} // namespace BastionGuard::wizard