pragma Singleton

// Read-only device security facts: Secure Boot, TPM, disk encryption, SELinux,
// firewall.
//
// Nothing here is a preference. These are set in firmware, at install time, or
// by system policy, and a settings app that offered to change them from a
// switch would either fail or do something far-reaching from a control that
// looks like every other control. What this answers is "is this machine set up
// the way I think it is", which otherwise takes five commands and root.
//
// Read on demand. None of these can change while the desktop is running,
// short of a reboot.

import Quickshell
import Quickshell.Io
import QtQuick

Singleton {
    id: root

    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-security"

    // [{ label, value, ok, detail }]
    property var facts: []
    property bool scanned: false

    // The facts that are not in their reassuring state. The page leads with the
    // count so a machine that is entirely fine says so in one line instead of
    // making the user read five rows to find out.
    readonly property int attentionCount: root.facts.filter(fact => !fact.ok).length

    function refresh(): void {
        if (!query.running)
            query.running = true;
    }

    Process {
        id: query
        command: [root.helperPath]
        stdout: StdioCollector {
            onStreamFinished: {
                try {
                    const parsed = JSON.parse(this.text);
                    root.facts = Array.isArray(parsed) ? parsed : [];
                } catch (error) {
                    root.facts = [];
                    console.warn("DeviceSecurity: could not parse helper output:", error);
                }
                root.scanned = true;
            }
        }
    }
}