# shellcheck shell=bash
#
# The few things that need root, and how the menu gets them done.
#
# The menu runs as the user. When it needs root it runs this same program
# again through sudo (or run0, or doas) with --root and one verb, the way
# cachy-auto-update does, so the password is typed into the terminal the user
# is already looking at. The verbs are all there is: there is no way to hand
# the root side a command of one's own.
#
#   --root set <Key> <Value>     one line of /etc/face-unlock/config
#   --root pam-enable <service>  sudo, polkit-1, a lock screen, or lockscreens
#   --root pam-disable <service>  for all lock screens installed; see pam.sh
#   --root socket-enable         start the daemon's socket, and at boot
#   --root socket-disable
#   --root migrate               move over from plasma-face-unlock, see migrate.sh
#   --root polkit-agent-install  install a polkit agent, see fu_polkit_agent_install

FU_SELF="${FU_SELF:-$(readlink -f "${BASH_SOURCE[1]:-$0}")}"

# What each system setting may be set to. Anything else is refused on the root
# side, whatever the menu sent.
declare -A FU_SYS_VALID=(
	[Camera]='^(auto|/dev/video[0-9]+)$'
	[Liveness]='^(off|light|heavy)$'
	[Strictness]='^(relaxed|normal|strict)$'
	[Attention]='^(yes|no)$'
	[ScanSeconds]='^([2-9]|1[0-5])$'
	[Adapt]='^(yes|no)$'
	[SkipLidClosed]='^(yes|no)$'
	[MaxFailures]='^([1-9]|1[0-9]|20)$'
	[LockoutMinutes]='^[1-9][0-9]{0,3}$'
)

# fu_root <verb> [args...]
fu_root() {
	local candidate

	if [[ $EUID -eq 0 ]]; then
		fu_root_verb "$@"
		return
	fi
	for candidate in sudo run0 doas; do
		if fu_have "$candidate"; then
			"$candidate" "$FU_SELF" --root "$@"
			return
		fi
	done
	fu_bad "$(fu_msg "This needs root, and neither sudo, run0 nor doas is installed.")"
	return 1
}

fu_root_verb() {
	local verb="${1:-}"
	[[ $# -gt 0 ]] && shift

	if [[ $EUID -ne 0 ]]; then
		fu_bad "$(fu_msg "This command has to run as root.")"
		return 2
	fi

	case "$verb" in
		set)
			local key="${1:-}" value="${2:-}"
			if [[ -z ${FU_SYS_VALID[$key]+set} || ! $value =~ ${FU_SYS_VALID[$key]} ]]; then
				fu_bad "$(fu_msg "Not a valid setting: %s=%s" "$key" "$value")"
				return 1
			fi
			fu_kv_set "$FU_SYSCONFIG" "$key" "$value" "$FU_PRETTY (system settings)" || return 1
			chmod 0644 "$FU_SYSCONFIG"
			;;
		pam-enable|pam-disable)
			local service="${1:-}" known=0 s rc=0
			local -a services=("$service")
			for s in "${FU_PAM_SERVICES[@]}" "${FU_PAM_LOCKERS[@]}"; do
				[[ $s == "$service" ]] && known=1
			done
			if [[ $service == lockscreens ]]; then
				known=1
				mapfile -t services < <(fu_pam_lockers)
			fi
			(( known )) || { fu_bad "$(fu_msg "Not a service this can be used for: %s" "$service")"; return 1; }
			for s in "${services[@]}"; do
				if [[ $verb == pam-enable ]]; then
					fu_pam_enable "$s" || rc=1
				else
					fu_pam_disable "$s" || rc=1
				fi
			done
			return $rc
			;;
		socket-enable)
			systemctl enable --now "$FU_UNIT_SOCKET" > /dev/null 2>&1
			;;
		socket-disable)
			systemctl disable --now "$FU_UNIT_SOCKET" > /dev/null 2>&1
			;;
		migrate)
			fu_migrate_system
			;;
		polkit-agent-install)
			fu_polkit_agent_install
			;;
		*)
			fu_bad "$(fu_msg "Unknown command: %s" "$verb")"
			return 1
			;;
	esac
}

# ---------------------------------------------------------------------------
# The two services
# ---------------------------------------------------------------------------

fu_socket_enabled() {
	systemctl is-enabled --quiet "$FU_UNIT_SOCKET" 2>/dev/null
}

fu_agent_available() {
	fu_have systemctl && [[ -n ${XDG_RUNTIME_DIR:-} ]]
}

fu_agent_enabled() {
	systemctl --user is-enabled --quiet "$FU_UNIT_AGENT" 2>/dev/null
}

fu_agent_running() {
	systemctl --user is-active --quiet "$FU_UNIT_AGENT" 2>/dev/null
}

fu_agent_enable() {
	systemctl --user daemon-reload > /dev/null 2>&1 || true
	systemctl --user enable --now "$FU_UNIT_AGENT" > /dev/null 2>&1
}

# fu_agent_autostarts
# Whether the agent's service starts with the session. It is wanted by
# graphical-session.target, which Hyprland only reaches when it runs under
# uwsm. Plasma, GNOME and niri-session always do.
fu_agent_autostarts() {
	[[ $FU_DESKTOP != hyprland ]] || systemctl --user is-active --quiet graphical-session.target
}

# fu_agent_hint [unit]
# What to add to Hyprland's config so it starts the lock screen agent, or the
# polkit agent's unit, in the Lua it has since 0.56 or in the older format.
fu_agent_hint() {
	local unit="${1:-$FU_UNIT_AGENT}"
	# shellcheck disable=SC2088  # shown to the user, not a path to open
	local conf="~/.config/hypr/hyprland.conf"
	# shellcheck disable=SC2088
	[[ -f $FU_XDG_CONFIG/hypr/hyprland.lua ]] && conf="~/.config/hypr/hyprland.lua"
	if [[ $unit == "$FU_UNIT_AGENT" ]]; then
		fu_note "$(fu_msg "Hyprland does not start the lock screen agent by itself. Add this to %s:" "$conf")"
	else
		fu_note "$(fu_msg "Hyprland does not start the polkit agent by itself. Add this to %s:" "$conf")"
	fi
	if [[ $conf == *.lua ]]; then
		fu_code "hl.on(\"hyprland.start\", function ()"
		fu_code "  hl.exec_cmd(\"systemctl --user start $unit\")"
		fu_code "end)"
	else
		fu_code "exec-once = systemctl --user start $unit"
	fi
}

# ---------------------------------------------------------------------------
# The polkit agent
# ---------------------------------------------------------------------------
# polkit asks for the password in a window of the session's polkit agent: to
# add a face, and in the admin prompts. Plasma and GNOME bring one, Hyprland
# and Niri do not. Without one no window opens, and polkit just says no.

FU_POLKIT_AGENT_MISSING=''

# fu_polkit_agent_missing
# Whether no polkit agent runs in this session. polkit has no call to ask
# that, so this tries to register an agent of its own: polkit refuses it when
# there is one. When it is let in, busctl ends at once, and polkit drops it
# again. Any other answer counts as not missing, so nobody is warned wrongly.
# Asked once per run.
fu_polkit_agent_missing() {
	local session
	if [[ -z $FU_POLKIT_AGENT_MISSING ]]; then
		FU_POLKIT_AGENT_MISSING=no
		if [[ $FU_DESKTOP != plasma && $FU_DESKTOP != gnome && -n ${WAYLAND_DISPLAY:-} ]] && fu_have busctl; then
			session="${XDG_SESSION_ID:-$(loginctl show-user "$UID" -p Display --value 2> /dev/null)}"
			if [[ -n $session ]] && busctl call --system org.freedesktop.PolicyKit1 \
				/org/freedesktop/PolicyKit1/Authority org.freedesktop.PolicyKit1.Authority \
				RegisterAuthenticationAgent '(sa{sv})ss' unix-session 1 session-id s "$session" \
				C /io/github/loonixtools/FaceUnlock/Probe > /dev/null 2>&1; then
				FU_POLKIT_AGENT_MISSING=yes
			fi
		fi
	fi
	[[ $FU_POLKIT_AGENT_MISSING == yes ]]
}

# fu_polkit_agent_install
# Root side. hyprpolkitagent where the distribution has it, else KDE's agent,
# which runs anywhere and which niri suggests. The package manager shows what
# it installs and asks.
fu_polkit_agent_install() {
	if fu_have pacman; then
		pacman -Si hyprpolkitagent > /dev/null 2>&1 && { pacman -S --needed hyprpolkitagent; return; }
		pacman -S --needed polkit-kde-agent
	elif fu_have dnf; then
		dnf -q info hyprpolkitagent > /dev/null 2>&1 && { dnf install hyprpolkitagent; return; }
		dnf install polkit-kde
	elif fu_have apt-get; then
		apt-cache show hyprpolkitagent > /dev/null 2>&1 && { apt-get install hyprpolkitagent; return; }
		apt-get install polkit-kde-agent-1
	else
		fu_bad "$(fu_msg "No package manager found to install a polkit agent with.")"
		return 1
	fi
}

# _fu_polkit_agent_unit
# The user service of the polkit agent that is installed, if any.
_fu_polkit_agent_unit() {
	local unit
	for unit in hyprpolkitagent.service plasma-polkit-agent.service; do
		if systemctl --user list-unit-files --quiet "$unit" > /dev/null 2>&1; then
			printf '%s\n' "$unit"
			return 0
		fi
	done
	return 1
}

# fu_polkit_agent_fix
# Installs a polkit agent if there is none, and starts it now and with the
# session.
fu_polkit_agent_fix() {
	local unit
	if ! unit="$(_fu_polkit_agent_unit)"; then
		fu_say "  $(fu_msg "Installing a polkit agent. That needs your password.")"
		fu_root polkit-agent-install || { fu_bad "$(fu_msg "Could not install a polkit agent.")"; return 1; }
		systemctl --user daemon-reload > /dev/null 2>&1 || true
		unit="$(_fu_polkit_agent_unit)" || { fu_bad "$(fu_msg "Could not install a polkit agent.")"; return 1; }
	fi

	if [[ $unit == plasma-polkit-agent.service ]]; then
		# KDE's has no [Install] section, and outside Plasma nothing makes it
		# wait for the desktop: it would start before there is one.
		local dropin="$FU_XDG_CONFIG/systemd/user/$unit.d"
		mkdir -p "$dropin" && printf '# Written by %s.\n[Unit]\nAfter=graphical-session.target\n' "$FU_NAME" > "$dropin/$FU_NAME.conf"
		systemctl --user daemon-reload > /dev/null 2>&1 || true
		systemctl --user add-wants graphical-session.target "$unit" > /dev/null 2>&1
		systemctl --user start "$unit" > /dev/null 2>&1
	else
		systemctl --user enable --now "$unit" > /dev/null 2>&1
	fi

	if ! systemctl --user is-active --quiet "$unit"; then
		fu_bad "$(fu_msg "The polkit agent did not start. See: systemctl --user status %s" "$unit")"
		return 1
	fi
	FU_POLKIT_AGENT_MISSING=no
	fu_ok "$(fu_msg "The polkit agent is running. Password windows open now.")"
	fu_agent_autostarts || fu_agent_hint "$unit"
}

# ---------------------------------------------------------------------------
# The bubble's GNOME Shell extension
# ---------------------------------------------------------------------------
# GNOME lets no program draw above its windows; its extensions may. The
# package brings one, and turning face unlock on switches it on.

FU_GNOME_EXTENSION="face-unlock@loonixtools.github.io"

# fu_gnome_extension_enable
# gnome-extensions only knows the extensions GNOME found when the session
# started. One that came with the package later goes straight into the
# setting, and GNOME loads it at the next login: returns 2 then.
fu_gnome_extension_enable() {
	local list new
	fu_have gsettings || return 1
	if gnome-extensions info "$FU_GNOME_EXTENSION" > /dev/null 2>&1; then
		gnome-extensions enable "$FU_GNOME_EXTENSION" > /dev/null 2>&1 && return 0
	fi
	list="$(gsettings get org.gnome.shell enabled-extensions 2>/dev/null)" || return 1
	case "$list" in
		*"'$FU_GNOME_EXTENSION'"*) return 2 ;;
		'@as []'|'[]') new="['$FU_GNOME_EXTENSION']" ;;
		*) new="${list%]}, '$FU_GNOME_EXTENSION']" ;;
	esac
	gsettings set org.gnome.shell enabled-extensions "$new" || return 1
	return 2
}

fu_gnome_extension_disable() {
	local list
	fu_have gsettings || return 0
	gnome-extensions disable "$FU_GNOME_EXTENSION" > /dev/null 2>&1 && return 0
	list="$(gsettings get org.gnome.shell enabled-extensions 2>/dev/null)" || return 0
	list="${list//, \'$FU_GNOME_EXTENSION\'/}"
	list="${list//\'$FU_GNOME_EXTENSION\', /}"
	list="${list//\'$FU_GNOME_EXTENSION\'/}"
	[[ $list == '[]' ]] && list='@as []'
	gsettings set org.gnome.shell enabled-extensions "$list" > /dev/null 2>&1 || true
}

# ---------------------------------------------------------------------------
# The lock screen where it is a program of its own (Hyprland, Niri)
# ---------------------------------------------------------------------------
# Either face-unlock's (`face-unlock lock`, with the bubble), or the user's
# own program. hyprlock then shows what the bubble would as a line of text: a
# label in its config reads a file the agent writes (see
# src/agent/locktext.h). Asked once in a window, and under Settings.

FU_HYPRLOCK_SNIPPET="$FU_XDG_CONFIG/$FU_NAME/hyprlock.conf"
FU_HYPRLOCK_MARK="# $FU_NAME: what face unlock is doing, at the top"

fu_own_lock_here() {
	[[ $FU_DESKTOP != plasma && $FU_DESKTOP != gnome ]]
}

# fu_hyprlock_text_on
# 0 done, 1 could not write, 2 no hyprlock, 3 hyprlock has no config here.
fu_hyprlock_text_on() {
	local conf="$FU_XDG_CONFIG/hypr/hyprlock.conf"
	fu_have hyprlock || return 2
	[[ -f $conf ]] || return 3
	mkdir -p "${FU_HYPRLOCK_SNIPPET%/*}" || return 1
	cat > "$FU_HYPRLOCK_SNIPPET" <<- EOF || return 1
		# Written by $FU_NAME: what face unlock is doing, as a line at the top of
		# hyprlock. Picking $FU_NAME's lock screen in its menu takes it out again.
		label {
		    monitor =
		    text = cmd[update:0:1] cat "\$XDG_RUNTIME_DIR/$FU_NAME/lock-text" 2>/dev/null
		    color = rgba(255, 255, 255, 0.95)
		    font_size = 20
		    shadow_passes = 2
		    shadow_size = 3
		    halign = center
		    valign = top
		    position = 0, -48
		    zindex = 10
		}
	EOF
	grep -qxF "$FU_HYPRLOCK_MARK" "$conf" && return 0
	# With ~ where it can, like a hand-written config. hyprlock expands it.
	local snippet="$FU_HYPRLOCK_SNIPPET"
	# shellcheck disable=SC2088  # for hyprlock, not for the shell
	[[ $snippet == "$HOME"/* ]] && snippet="~/${snippet#"$HOME"/}"
	printf '\n%s\nsource = %s\n' "$FU_HYPRLOCK_MARK" "$snippet" >> "$conf" || return 1
}

# fu_hyprlock_text_off
# The mark, the source line under it, and the empty lines before it. Written
# back in place, so a hyprlock.conf that is a link to a dotfile stays one.
fu_hyprlock_text_off() {
	local conf="$FU_XDG_CONFIG/hypr/hyprlock.conf" content
	rm -f "$FU_HYPRLOCK_SNIPPET"
	[[ -f $conf ]] && grep -qxF "$FU_HYPRLOCK_MARK" "$conf" || return 0
	content="$(awk -v mark="$FU_HYPRLOCK_MARK" '
		$0 == mark { held = ""; skip = 1; next }
		skip && /^[[:space:]]*source[[:space:]]*=/ { skip = 0; next }
		{ skip = 0 }
		/^[[:space:]]*$/ { held = held $0 "\n"; next }
		{ printf "%s", held; held = ""; print }
	' "$conf")" || return 1
	printf '%s\n' "$content" > "$conf"
}

# fu_own_lock_hint
# Where face-unlock's lock screen has to be started from: the user's key and
# idle lock, which are theirs to change.
fu_own_lock_hint() {
	# shellcheck disable=SC2088  # shown to the user, not a path to open
	case "$FU_DESKTOP" in
		hyprland)
			if [[ -f $FU_XDG_CONFIG/hypr/hyprland.lua ]]; then
				fu_note "$(fu_msg "To lock with it, add this to %s, and set %s in %s:" "~/.config/hypr/hyprland.lua" "lock_cmd = $FU_NAME lock" "hypridle.conf")"
				fu_code "hl.bind(\"SUPER + L\", hl.dsp.exec_cmd(\"$FU_NAME lock\"))"
			else
				fu_note "$(fu_msg "To lock with it, add this to %s, and set %s in %s:" "~/.config/hypr/hyprland.conf" "lock_cmd = $FU_NAME lock" "hypridle.conf")"
				fu_code "bind = SUPER, L, exec, $FU_NAME lock"
			fi
			;;
		niri)
			fu_note "$(fu_msg "To lock with it, add this to the binds in %s, and use %s in swayidle:" "~/.config/niri/config.kdl" "$FU_NAME lock")"
			fu_code "Mod+Alt+L { spawn \"$FU_NAME\" \"lock\"; }"
			;;
		*)
			fu_note "$(fu_msg "To lock with it, run %s where your lock screen is started now." "$FU_NAME lock")"
			;;
	esac
}

# fu_lock_style_set <own|yours>
fu_lock_style_set() {
	# shellcheck disable=SC2088  # shown to the user, not a path to open
	local conf="~/.config/hypr/hyprlock.conf"
	case "$1" in
		own)
			fu_config_set LockScreenStyle own || { fu_bad "$(fu_msg "Could not save the setting.")"; return 1; }
			fu_hyprlock_text_off
			fu_ok "$(fu_msg "You lock with face-unlock's lock screen now.")"
			fu_own_lock_hint
			;;
		yours)
			fu_config_set LockScreenStyle yours || { fu_bad "$(fu_msg "Could not save the setting.")"; return 1; }
			fu_hyprlock_text_on
			case $? in
				0) fu_ok "$(fu_msg "hyprlock shows what face unlock is doing at the top, from the next time it locks.")" ;;
				1) fu_bad "$(fu_msg "Could not add the line to %s." "$conf")" ;;
				2) fu_ok "$(fu_msg "Your lock screen stays as it is. Press Enter on the empty password field to scan.")" ;;
				3) fu_note "$(fu_msg "hyprlock has no %s, so it cannot show the text." "$conf")" ;;
			esac
			;;
		*) return 1 ;;
	esac
}

# fu_lock_choose
# Asks in a window which lock screen to use, and carries it out. 1 when the
# window was closed or cannot open.
fu_lock_choose() {
	local choice
	[[ -n ${WAYLAND_DISPLAY:-} ]] || return 1
	choice="$("$FU_AGENT" --choose-lock-screen 2> /dev/null)" || return 1
	fu_lock_style_set "$choice"
}

fu_agent_disable() {
	systemctl --user disable --now "$FU_UNIT_AGENT" > /dev/null 2>&1 || true
}