#!/bin/bash
set -euo pipefail

GDM_PAM=/etc/pam.d/gdm-password
SUBSTACK=/etc/pam.d/pinpam-gdm-auth
BACKUP=/etc/pam.d/gdm-password.before-pinpam
ENABLE_MASTER_KEY=0

die() {
    echo "Error: $*" >&2
    exit 1
}

usage() {
    cat <<USAGE
Usage:
  pinpam-configure-gdm [--master-key]
  pinpam-configure-gdm --undo

Options:
  --master-key  Also enable libpinpam_master_key.so before pam_gnome_keyring.so
  --undo        Restore the original gdm-password backup and remove the substack
USAGE
}

[[ $EUID -eq 0 ]] || die "must be run as root"

case "${1:-}" in
    "")
        ;;
    --master-key)
        ENABLE_MASTER_KEY=1
        ;;
    --undo)
        [[ -f "$BACKUP" ]] || die "backup not found: $BACKUP"
        cp -a "$BACKUP" "$GDM_PAM"
        rm -f "$SUBSTACK"
        echo "GDM configuration restored from:"
        echo "  $BACKUP"
        exit 0
        ;;
    -h|--help)
        usage
        exit 0
        ;;
    *)
        usage >&2
        exit 2
        ;;
esac

[[ -f "$GDM_PAM" ]] || die "$GDM_PAM not found"
[[ -f /etc/pam.d/password-auth ]] || die "/etc/pam.d/password-auth not found"
[[ -e /usr/lib64/security/libpinpam.so ]] || die "libpinpam.so not installed"

if [[ ! -f "$BACKUP" ]]; then
    cp -a "$GDM_PAM" "$BACKUP"
fi

cat > "$SUBSTACK" <<'PAM'
# PIN-or-password authentication decision for GDM.
# Managed by pinpam-configure-gdm.
auth        sufficient    libpinpam.so
auth        substack      password-auth
PAM

# Remove an older direct pinpam rule, if present.
sed -i \
    '/^[[:space:]]*auth[[:space:]]\+sufficient[[:space:]]\+libpinpam\.so\([[:space:]].*\)\?$/d' \
    "$GDM_PAM"

if grep -qE '^[[:space:]]*auth[[:space:]]+substack[[:space:]]+password-auth([[:space:]]|$)' "$GDM_PAM"; then
    sed -i \
        's/^[[:space:]]*auth[[:space:]]\+substack[[:space:]]\+password-auth.*$/auth        substack      pinpam-gdm-auth/' \
        "$GDM_PAM"
elif ! grep -qE '^[[:space:]]*auth[[:space:]]+substack[[:space:]]+pinpam-gdm-auth([[:space:]]|$)' "$GDM_PAM"; then
    die "expected GDM authentication rule not found"
fi

if [[ $ENABLE_MASTER_KEY -eq 1 ]]; then
    [[ -e /usr/lib64/security/libpinpam_master_key.so ]] ||
        die "libpinpam_master_key.so not installed"

    if ! grep -qE '^[[:space:]]*auth[[:space:]]+optional[[:space:]]+libpinpam_master_key\.so' "$GDM_PAM"; then
        sed -i \
            '/^[[:space:]]*auth[[:space:]]\+optional[[:space:]]\+pam_gnome_keyring\.so/i auth        optional      libpinpam_master_key.so' \
            "$GDM_PAM"
    fi
else
    sed -i \
        '/^[[:space:]]*auth[[:space:]]\+optional[[:space:]]\+libpinpam_master_key\.so$/d' \
        "$GDM_PAM"
fi

echo "GDM pinpam configuration installed."
echo "Backup: $BACKUP"

if [[ $ENABLE_MASTER_KEY -eq 1 ]]; then
    echo "Master-key integration: enabled"
else
    echo "Master-key integration: disabled"
fi
