#!/bin/bash

# omarchy:summary=Configure Quickshell lock screen authentication
# omarchy:requires-sudo=true
# omarchy:hidden=true

set -e

# Install and upgrade callers can start this helper as root. Ignore their PATH
# so optional commands never fall through to a user-writable directory.
if (( EUID == 0 )); then
  export PATH=/usr/share/omarchy/bin:/usr/local/bin:/usr/bin:/bin
fi

target_user=${OMARCHY_INSTALL_USER:-${SUDO_USER:-}}
if [[ -z $target_user && -n ${PKEXEC_UID:-} ]]; then
  target_user=$(getent passwd "$PKEXEC_UID" | cut -d: -f1)
fi
target_user=${target_user:-$USER}

as_root() {
  if (( EUID == 0 )); then
    "$@"
  else
    sudo "$@"
  fi
}

echo "Configuring lock screen password authentication..."

as_root tee /etc/pam.d/omarchy-lock-password >/dev/null <<'EOF'
#%PAM-1.0
auth       required                    pam_faillock.so preauth silent deny=10 unlock_time=120
-auth      [success=2 default=ignore]  pam_systemd_home.so
auth       [success=1 default=bad]     pam_unix.so try_first_pass nullok
auth       [default=die]               pam_faillock.so authfail deny=10 unlock_time=120
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so authsucc
account    include                     system-local-login
EOF

# Install resume recovery alongside fingerprint PAM, so setup and upgrades
# cannot leave one configured without the other.
resume_hook_src="$OMARCHY_PATH/default/systemd/system-sleep/fprintd-resume"
resume_hook_dst=/usr/lib/systemd/system-sleep/fprintd-resume
stop_timeout_src="$OMARCHY_PATH/default/systemd/system/fprintd.service.d/10-stop-timeout.conf"
stop_timeout_dst=/etc/systemd/system/fprintd.service.d/10-stop-timeout.conf

# Keep the privileged probe pinned to /usr/bin; failure is not empty enrollment.
if [[ -x /usr/bin/fprintd-list ]]; then
  fingerprint_status=$(/usr/bin/fprintd-list "$target_user" 2>&1 || true)
else
  fingerprint_status="no"
fi

if grep -qE '^[[:space:]]*-[[:space:]]*#[0-9]+:' <<< "$fingerprint_status"; then
  echo "Configuring lock screen fingerprint authentication..."
  as_root install -Dm755 -o root -g root "$resume_hook_src" "$resume_hook_dst"
  as_root install -Dm644 -o root -g root "$stop_timeout_src" "$stop_timeout_dst"
  as_root systemctl daemon-reload
  as_root tee /etc/pam.d/omarchy-lock-fingerprint >/dev/null <<'EOF'
#%PAM-1.0
auth       required                    pam_fprintd.so
account    include                     system-local-login
EOF
elif [[ $fingerprint_status == "no" ]] || grep -qi 'has no fingers enrolled' <<< "$fingerprint_status"; then
  as_root rm -f /etc/pam.d/omarchy-lock-fingerprint "$resume_hook_dst"
  # Only reload when something was there: this branch also runs in the
  # install chroot, where there is no systemd to reload.
  if [[ -e $stop_timeout_dst ]]; then
    as_root rm -f "$stop_timeout_dst"
    as_root rmdir --ignore-fail-on-non-empty "$(dirname "$stop_timeout_dst")"
    as_root systemctl daemon-reload
  fi
else
  echo "Could not check fingerprint enrollment; keeping the existing configuration." >&2
fi

# omarchy-shell can't reach a running shell during chroot install. The echo
# is just confirmation, so swallow the failure rather than letting it become
# the script's exit code.
if omarchy-shell lock status >/dev/null 2>&1; then
  echo "Lock screen authentication configured."
fi