#!/bin/bash
# enable-fingerprint.sh — wire pam_fprintd.so into sudo + hyprlock auth stacks.
# Idempotent: re-runs are no-ops once the line is present. Run with sudo.
# Prerequisite: fprintd installed and at least one finger enrolled
# (run `fprintd-enroll` as your user first).

set -euo pipefail

if [ "$EUID" -ne 0 ]; then
    echo "Run as root: sudo bash $0" >&2
    exit 1
fi

if ! command -v fprintd-enroll >/dev/null 2>&1; then
    echo "ERROR: fprintd is not installed. Run install.sh first." >&2
    exit 1
fi

PAM_LINE="auth      sufficient    pam_fprintd.so"
TARGETS=(/etc/pam.d/sudo /etc/pam.d/hyprlock)

for f in "${TARGETS[@]}"; do
    if [ ! -f "$f" ]; then
        echo "ERROR: $f does not exist. Is the corresponding package installed?" >&2
        exit 1
    fi

    if grep -q "pam_fprintd" "$f"; then
        echo "$f: pam_fprintd already present — skipping"
        continue
    fi

    backup="$f.bak.$(date +%s)"
    cp -a "$f" "$backup"
    echo "$f: backed up to $backup"

    # Insert PAM_LINE on a new line directly before the first `auth ` directive.
    awk -v line="$PAM_LINE" '
        !inserted && /^auth[[:space:]]/ { print line; inserted = 1 }
        { print }
    ' "$f" > "$f.new"

    if ! grep -q "pam_fprintd" "$f.new"; then
        echo "ERROR: failed to insert PAM line into $f (no auth directive found?). Restoring backup." >&2
        rm -f "$f.new"
        exit 1
    fi

    mv "$f.new" "$f"
    chmod --reference="$backup" "$f"
    echo "$f: inserted '$PAM_LINE'"
done

echo
echo "Done. Test with: sudo true   (should prompt for fingerprint)"
echo "Or lock the screen (Mod+Shift+E) and touch the reader."
echo
echo "To revert: restore the .bak.<ts> files in /etc/pam.d/, or:"
echo "  sudo sed -i '/pam_fprintd/d' ${TARGETS[*]}"