{ config, pkgs, ... }:

{
  programs.thunderbird.enable = true;
}

# TODO: use thunderbird seeding config

# Thunderbird with all mail accounts declared. Thunderbird can't read passwords
# from a command, so its credential store (logins.json + key4.db) is kept in
# sops and copied into a fresh profile once. The Microsoft 365 account still
# needs its OAuth consent once per machine.

# let
#   realName = "Djai Hougee";
#   profile = "/home/djai/.thunderbird/main";
#
#   # without this thunderbird picks OAuth2 for gmail.com accounts, but these need app passwords
#   passwordAuth = id: {
#     "mail.server.server_${id}.authMethod" = 3;
#     "mail.smtpserver.smtp_${id}.authMethod" = 3;
#   };
#
#   oauthAuth = id: {
#     "mail.server.server_${id}.authMethod" = 10;
#     "mail.smtpserver.smtp_${id}.authMethod" = 10;
#   };
#
#   account = flavor: address: auth: {
#     inherit flavor address realName;
#     userName = address;
#     thunderbird = {
#       enable = true;
#       settings = auth;
#     };
#   };
# in
# {
#   # Only seeds a profile that has no logins.json yet, so the live store (with
#   # Thunderbird's own token refreshes) is never overwritten.
#   systemd.services.thunderbird-seed-creds = {
#     description = "Seed Thunderbird credential store from sops (first run only)";
#     wantedBy = [ "multi-user.target" ];
#     after = [
#       "sops-install-secrets.service"
#       "home-manager-djai.service"
#     ];
#     serviceConfig = {
#       Type = "oneshot";
#       User = "djai";
#       RemainAfterExit = true;
#     };
#     script = ''
#       set -eu
#       secret="${config.sops.secrets."thunderbird-creds".path}"
#       if [ ! -d "${profile}" ]; then
#         echo "profile ${profile} not present yet; skipping seed"
#         exit 0
#       fi
#       if [ -e "${profile}/logins.json" ]; then
#         echo "logins.json already present; leaving live store untouched"
#         exit 0
#       fi
#       if [ ! -r "$secret" ]; then
#         echo "secret $secret not readable; skipping"
#         exit 0
#       fi
#       ${pkgs.gnutar}/bin/tar -C "${profile}" -xf "$secret"
#       echo "seeded Thunderbird credential store into ${profile}"
#     '';
#   };
#
#   home-manager.users.djai = {
#     programs.thunderbird = {
#       enable = true;
#       profiles.main.isDefault = true;
#     };
#
#     accounts.email.accounts = {
#       djai = account "kolabnow.com" "ljxjah@mykolab.com" passwordAuth // {
#         primary = true;
#       };
#       uni = account "gmail.com" "d.hougee@student.rug.nl" oauthAuth;
#     };
#   };
# }