#!/bin/bash
# Log to systemd journal with tag "dde-session"
log_to_journal() {
    logger -t dde-session -p user.info -- "$1"
}

set -u
PATH=/usr/sbin:/usr/bin:/sbin:/bin
export PATH

REAL_BINARY="/usr/lib/deepin/dde-session"
LOADER="/usr/bin/deepin-security-loader"
LOADER_EXEC="/usr/bin/deepin-security-loader-exec"

systemd_service=false
for argument in "$@"; do
    if [ "$argument" = "--systemd-service" ]; then
        systemd_service=true
        break
    fi
done
log_to_journal "dde-session launched with args: $*"

if [ -x "$LOADER" ] && [ -x "$LOADER_EXEC" ] && \
    getcap "$LOADER_EXEC" 2>/dev/null | grep -q 'cap_setgid'; then
    log_to_journal "Using deepin-security-loader with authorization groups"
    exec "$LOADER" --group deepin-daemon -- "$REAL_BINARY" "$@"
fi

# Fallback: direct launch without loader (no polkit-free authorization)
log_to_journal "Fallback: launching directly without security loader"
exec "$REAL_BINARY" "$@"
