#!/bin/sh
set -eu

if [ "$(id -u)" -ne 0 ]; then
    echo "pam-fixture: SKIP (root is required to install a temporary PAM policy)"
    exit 0
fi

service="latchd-fixture-$$"
session_service="latchd-session-fixture-$$"
policy="/etc/pam.d/$service"
session_policy="/etc/pam.d/$session_service"
checker="/tmp/latchd-pam-session-check-$$"
module_source="/tmp/latchd-pam-session-env-$$.c"
module="/tmp/latchd-pam-session-env-$$.so"
cleanup() {
    rm -f "$policy" "$session_policy" "$checker" "$module_source" "$module"
}
trap cleanup EXIT HUP INT TERM

umask 077
cat >"$policy" <<'PAM'
auth      required pam_deny.so
account   required pam_permit.so
password  required pam_deny.so
session   required pam_permit.so
PAM

cat >"$checker" <<'SH'
#!/bin/sh
set -eu

[ "${PAM_TTY:-}" = "tty2" ]
[ "${XDG_SESSION_CLASS:-}" = "user" ]
[ "${XDG_SESSION_TYPE:-}" = "wayland" ]
[ "${XDG_SESSION_DESKTOP:-}" = "niri" ]
[ "${XDG_SEAT:-}" = "seat0" ]
[ "${XDG_VTNR:-}" = "2" ]
SH
chmod 700 "$checker"

cat >"$module_source" <<'C'
#include <security/pam_appl.h>
#include <security/pam_modules.h>

PAM_EXTERN int pam_sm_open_session(
    pam_handle_t *pamh,
    int flags,
    int argc,
    const char **argv
) {
    int result;
    (void)flags;
    (void)argc;
    (void)argv;

    result = pam_putenv(pamh, "XDG_SESSION_ID=fixture-session");
    if (result != PAM_SUCCESS) return result;
    result = pam_putenv(pamh, "XDG_RUNTIME_DIR=/tmp/latchd-runtime-fixture");
    if (result != PAM_SUCCESS) return result;
    return pam_putenv(
        pamh,
        "DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/latchd-runtime-fixture/bus"
    );
}

PAM_EXTERN int pam_sm_close_session(
    pam_handle_t *pamh,
    int flags,
    int argc,
    const char **argv
) {
    (void)pamh;
    (void)flags;
    (void)argc;
    (void)argv;
    return PAM_SUCCESS;
}
C
${CC:-cc} -shared -fPIC "$module_source" -o "$module" -lpam
chmod 700 "$module"

cat >"$session_policy" <<PAM
auth      required pam_permit.so
account   required pam_permit.so
password  required pam_deny.so
session   required $module
session   required pam_exec.so $checker
PAM

LATCHD_PAM_FIXTURE_SERVICE="$service" \
LATCHD_PAM_SESSION_FIXTURE_SERVICE="$session_service" \
    cargo test --locked -p latchd-auth --test pam_fixture -- --ignored