#!/bin/sh
# Read-only host config bindings for flatpaks that should pick up our
# chezmoi-managed ~/.config/<app>/ rather than maintaining a separate
# in-sandbox copy. Idempotent; flatpak override merges entries.
#
# script hash: {{ output "sh" "-c" (printf "sha256sum %q/run_onchange_after_deploy-flatpak-overrides.sh.tmpl 2>/dev/null || true" .chezmoi.sourceDir) }}
set -eu

apply() {
	app=$1
	shift
	flatpak info --user "$app" >/dev/null 2>&1 || return 0
	flatpak override --user "$@" "$app"
}

apply org.pwmt.zathura --filesystem=xdg-config/zathura:ro
apply io.mpv.Mpv --filesystem=xdg-config/mpv:ro

# LibreWolf needs raw /dev access for v4l2 webcams. Flatpak has no
# finer-grained device option, so this opens video/dri/snd at once.
apply io.gitlab.librewolf-community --device=all

# Ungoogled Chromium needs /dev/hidraw* for WebHID (e.g. usevia.app
# configuring ZSA keyboards). --device=all is the only knob flatpak
# offers; the host udev rule (etc/udev/rules.d/50-zsa.rules) restricts
# which hidraw nodes the user can actually open.
apply io.github.ungoogled_software.ungoogled_chromium --device=all

# Teams-for-Linux needs read access to our chezmoi-managed hicolor icon
# tree so the per-profile --appIcon= path resolves inside the sandbox
# (used by teams-sii.desktop / teams-xsight.desktop).
apply com.github.IsmaelMartinez.teams_for_linux --filesystem=xdg-data/icons:ro