//go:build windows

package runtimeassets

import (
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"syscall"

	"golang.org/x/sys/windows"
)

// Windows 10's Fixed Version WebView2 renderer requires read/execute access
// for its two AppContainer groups. Limit the grant to our private runtime.
// https://learn.microsoft.com/microsoft-edge/webview2/concepts/distribution
func PrepareWebview(path string) error {
	if path == "" || windows.RtlGetVersion().BuildNumber >= 22000 {
		return nil
	}
	for _, group := range []string{"*S-1-15-2-2:(OI)(CI)(RX)", "*S-1-15-2-1:(OI)(CI)(RX)"} {
		cmd := exec.Command(filepath.Join(os.Getenv("SystemRoot"), "System32", "icacls.exe"), path, "/grant", group)
		cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: 0x08000000}
		if out, err := cmd.CombinedOutput(); err != nil {
			return fmt.Errorf("WebView2 directory permissions: %w: %s", err, out)
		}
	}
	return nil
}