Split fido2 and fingerprint setups into setup and remove (#5670)

* Split fido2 and fingerprint setups into setup and remove

Don't make one thing do two things

* Extract helpers and clean up

* No need to hide them

* Don't need these

bin/omarchy-setup-security-fido2

@@ -0,0 +1,81 @@
+#!/bin/bash
+
+# omarchy:summary=Set up FIDO2 authentication for sudo and polkit
+# omarchy:requires-sudo=true
+
+set -e
+
+
+check_fido2_hardware() {
+  tokens=$(fido2-token -L 2>/dev/null)
+  if [[ -z $tokens ]]; then
+    omarchy-echo-failure "\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well)."
+    return 1
+  fi
+  return 0
+}
+
+setup_pam_config() {
+  # Configure sudo
+  if ! grep -q pam_u2f.so /etc/pam.d/sudo; then
+    omarchy-echo-info "Configuring sudo for FIDO2 authentication..."
+    sudo sed -i '1i auth    sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo
+  fi
+
+  # Configure polkit
+  if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then
+    omarchy-echo-info "Configuring polkit for FIDO2 authentication..."
+    sudo sed -i '1i auth      sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1
+  elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
+    omarchy-echo-info "Creating polkit configuration with FIDO2 authentication..."
+    sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
+auth      sufficient pam_u2f.so cue authfile=/etc/fido2/fido2
+auth      required pam_unix.so
+
+account   required pam_unix.so
+password  required pam_unix.so
+session   required pam_unix.so
+EOF
+  fi
+}
+
+omarchy-echo-success "Setting up FIDO2 device for authentication.\n"
+
+# Install required packages
+omarchy-echo-info "Installing required packages..."
+omarchy-pkg-add libfido2 pam-u2f
+
+if ! check_fido2_hardware; then
+  exit 1
+fi
+
+# Create the pamu2fcfg file
+if [[ ! -f /etc/fido2/fido2 ]]; then
+  sudo mkdir -p /etc/fido2
+  omarchy-echo-success "\nLet's setup your device by confirming on the device now."
+  omarchy-echo-info "Touch your FIDO2 key when it lights up...\n"
+
+  if pamu2fcfg >/tmp/fido2; then
+    sudo mv /tmp/fido2 /etc/fido2/fido2
+    omarchy-echo-success "FIDO2 device registered successfully!"
+  else
+    omarchy-echo-failure "\nFIDO2 registration failed. Please try again."
+    exit 1
+  fi
+else
+  omarchy-echo-info "FIDO2 device already registered."
+fi
+
+# Configure PAM
+setup_pam_config
+
+# Test with sudo
+omarchy-echo-info "\nTesting FIDO2 authentication with sudo..."
+omarchy-echo-info "Touch your FIDO2 key when prompted.\n"
+
+if sudo echo "FIDO2 authentication test successful"; then
+  omarchy-echo-success "\nPerfect! FIDO2 authentication is now configured."
+  omarchy-echo-info "You can use your FIDO2 key for sudo and polkit authentication."
+else
+  omarchy-echo-failure "\nVerification failed. You may want to check your configuration."
+fi