; Grant standard (non-admin) users read/execute on the install tree.
; Elevated installs into Program Files often create admin-only ACLs, which
; breaks launcher.exe and deeplink handling for normal users.
!macro grantUsersInstallAccess
  Push $0
  Push $1
  DetailPrint "Granting standard users read and execute access to $INSTDIR"
  StrCpy $1 "$INSTDIR"
  InitPluginsDir
  FileOpen $0 "$PLUGINSDIR\grant-access.ps1" w
  FileWrite $0 '$$path = "'
  FileWrite $0 $1
  FileWrite $0 '"$\r$\n'
  FileWrite $0 '$$icacls = Join-Path $$env:SystemRoot "System32\icacls.exe"$\r$\n'
  FileWrite $0 'function Invoke-Icacls {$\r$\n'
  FileWrite $0 '  param([string[]]$$Arguments)$\r$\n'
  FileWrite $0 '  $$proc = Start-Process -FilePath $$icacls -ArgumentList $$Arguments -Wait -PassThru -NoNewWindow$\r$\n'
  FileWrite $0 '  Write-Host ("icacls " + ($$Arguments -join " ") + " -> " + $$proc.ExitCode)$\r$\n'
  FileWrite $0 '}$\r$\n'
  FileWrite $0 'Invoke-Icacls @($$path, "/reset", "/T", "/C")$\r$\n'
  FileWrite $0 'Invoke-Icacls @($$path, "/inheritance:e", "/T", "/C")$\r$\n'
  FileWrite $0 'Invoke-Icacls @($$path, "/grant", "BUILTIN\Users:(OI)(CI)RX", "/T", "/C")$\r$\n'
  FileWrite $0 'Invoke-Icacls @($$path, "/grant", "NT AUTHORITY\Authenticated Users:(OI)(CI)RX", "/T", "/C")$\r$\n'
  FileWrite $0 'Invoke-Icacls @($$path, "/grant", "ALL APPLICATION PACKAGES:(OI)(CI)RX", "/T", "/C")$\r$\n'
  FileClose $0
  ExecWait '"$SYSDIR\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "$PLUGINSDIR\grant-access.ps1"' $0
  DetailPrint "Granted Users read/execute (exit code: $0)"
  Delete "$PLUGINSDIR\grant-access.ps1"
  Pop $1
  Pop $0
!macroend