#!/bin/bash

# omarchy:summary=Remove fingerprint authentication from sudo, polkit, and lock screen
# omarchy:requires-sudo=true

set -e

# Resolve the invoking account before changing authentication or packages.
if (( EUID == 0 )) && [[ -v SUDO_UID ]]; then
  if [[ ! $SUDO_UID =~ ^[0-9]+$ ]]; then
    echo "Cannot identify the invoking fingerprint user" >&2
    exit 1
  fi
  fingerprint_user=$(/usr/bin/id -nu "+$SUDO_UID") || exit 1
else
  fingerprint_user=$(/usr/bin/id -un) || exit 1
fi

if [[ -z $fingerprint_user || $fingerprint_user == "." || $fingerprint_user == ".." || $fingerprint_user == */* ]]; then
  echo "Unsafe fingerprint user name" >&2
  exit 1
fi


remove_pam_config() {
  # Remove from sudo (both the fingerprint module and its clamshell gate)
  if grep -Eq 'pam_fprintd\.so|omarchy-hw-laptop-closed' /etc/pam.d/sudo; then
    echo "Removing fingerprint authentication from sudo..."
    sudo sed -i -e '/pam_fprintd\.so/d' -e '/omarchy-hw-laptop-closed/d' /etc/pam.d/sudo
  fi

  # Remove from polkit (both the fingerprint module and its clamshell gate)
  if [[ -f /etc/pam.d/polkit-1 ]] && grep -Eq 'pam_fprintd\.so|omarchy-hw-laptop-closed' /etc/pam.d/polkit-1; then
    echo "Removing fingerprint authentication from polkit..."
    sudo sed -i -e '/pam_fprintd\.so/d' -e '/omarchy-hw-laptop-closed/d' /etc/pam.d/polkit-1
  fi
}

remove_lock_fingerprint_pam() {
  if [[ -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
    echo "Removing lock screen fingerprint authentication..."
    sudo rm -f /etc/pam.d/omarchy-lock-fingerprint
  fi
}

remove_resume_hook() {
  if [[ -f /usr/lib/systemd/system-sleep/fprintd-resume ]]; then
    echo "Removing fingerprint resume hook..."
    sudo rm -f /usr/lib/systemd/system-sleep/fprintd-resume
  fi
  if [[ -f /etc/systemd/system/fprintd.service.d/10-stop-timeout.conf ]]; then
    echo "Removing fprintd stop timeout bound..."
    sudo rm -f /etc/systemd/system/fprintd.service.d/10-stop-timeout.conf
    sudo rmdir --ignore-fail-on-non-empty /etc/systemd/system/fprintd.service.d
    sudo systemctl daemon-reload
  fi
}


echo -e "\e[32mRemoving fingerprint scanner from authentication.\n\e[0m"

# A match-on-chip reader (Touch ID among them) keeps the prints in the device as
# well, so fprintd deletes them there first, while it still runs. A reader with
# no prints, or no fprintd, leaves nothing to delete. Authenticating first keeps
# sudo's own prompt in view, since the delete's output is not.
if ! sudo -n true 2>/dev/null && ! sudo -v; then
  echo -e "\e[31mRemoving fingerprint authentication needs administrator rights.\e[0m"
  exit 1
fi
# fprintd finds no reader when it is off or unplugged: then nothing could be
# deleted from it, which is said plainly rather than as a failure.
if omarchy-cmd-present fprintd-delete && ! delete_output=$(sudo fprintd-delete "$fingerprint_user" 2>&1); then
  if [[ $delete_output == *"No devices available"* ]]; then
    echo -e "\e[33mNo fingerprint reader is available now, so any fingerprints stored on the reader itself stay there.\e[0m"
  else
    echo -e "\e[33mThe reader's own copy of $fingerprint_user's fingerprints may not have been deleted: $(tail -n 1 <<<"$delete_output")\e[0m"
  fi
fi

remove_pam_config
remove_lock_fingerprint_pam
remove_resume_hook

sudo rm -rf -- "/var/lib/fprint/$fingerprint_user"

# A platform that turned its reader on for setup turns it off again. Failing to
# doesn't stop the removal, but the owner is told the reader may stay on.
if ! disable_hook=$(omarchy-lifecycle-dispatch --resolve disable-fingerprint) ||
  { [[ -n $disable_hook ]] && ! sudo omarchy-lifecycle-dispatch disable-fingerprint; }; then
  echo -e "\e[33mThe fingerprint reader may still be turned on at the next boot.\e[0m"
fi

echo "Removing fingerprint packages..."
omarchy-pkg-drop fprintd libfprint libfprint-git

echo -e "\e[32mFingerprint authentication and $fingerprint_user's local saved fingerprints have been removed.\e[0m"
