// Vestibule LibreWolf overrides — relaxes LibreWolf's privacy-hardened
// defaults that break common SSO and telehealth flows in kiosk deployments.
//
// Install at:
//   Linux:   /usr/lib/librewolf/librewolf.overrides.cfg
//            (or ~/.librewolf/vestibule-profile/librewolf.overrides.cfg)
//   Windows: C:\Program Files\LibreWolf\distribution\librewolf.overrides.cfg
//            (or %APPDATA%\LibreWolf\Vestibule\librewolf.overrides.cfg)
//
// Each override documents why it is needed for kiosk use. All use lockPref
// to prevent the user from changing them at runtime.

// Resist Fingerprinting randomizes window dimensions, fonts, and other
// fingerprintable attributes. In a fullscreen kiosk at a fixed resolution,
// this breaks layout on many patient-portal sites and provides no privacy
// benefit (the kiosk is a single-user shared device, not a privacy tool).
lockPref("privacy.resistFingerprinting", false);

// Letterboxing rounds window dimensions to prevent fingerprinting via
// screen size. Unnecessary in fullscreen kiosk mode; can cause rendering
// artifacts on patient-portal sites that expect exact viewport sizes.
lockPref("privacy.window.letterboxing", false);

// Encrypted Media Extensions (EME) — some telehealth portals and medical
// video players require DRM for content protection. Enable for kiosk use.
lockPref("media.eme.enabled", true);

// WebGL — some medical imaging viewers (e.g., OHIF Viewer, Cornerstone.js)
// require WebGL for hardware-accelerated rendering of DICOM images.
lockPref("webgl.disabled", false);

// WebRTC — telehealth portals (e.g., Doxy.me, Zoom for Healthcare) use
// WebRTC for video consultations.
lockPref("media.peerconnection.enabled", true);

// Clipboard — patient intake forms may require copy/paste between fields.
lockPref("dom.event.clipboardevents.enabled", true);

// Tracking protection — kiosks navigate to known, operator-approved URLs.
// Strict tracking protection breaks SSO redirects on some medical portals.
lockPref("privacy.trackingprotection.enabled", false);
lockPref("privacy.trackingprotection.pbmode.enabled", false);

// sessionStore — reopen the kiosk URL automatically after a crash.
lockPref("browser.sessionstore.resume_from_crash", true);
lockPref("browser.startup.page", 1); // reopen the session on startup

// Disable all prompts that could confuse kiosk users.
lockPref("browser.tabs.warnOnClose", false);
lockPref("browser.warnOnQuit", false);
lockPref("app.update.enabled", false); // kiosk updates are operator-managed
lockPref("browser.newtabpage.enabled", false);