#!/bin/bash
# wifi-signin: written by Wren Linux parts/incognito.sh
# For Wi-Fi with a sign-in page (cafés, hotels, trains). Opens a throwaway
# window (incognito --signin: Firefox as the incognito user, in memory, gone
# when it closes) that alone uses the network's own DNS, so the sign-in page
# can load; every other Firefox keeps its encrypted DNS. If secure DNS is on,
# it is switched off while the window is open and on again when you close it.
# The Wren menu's Wi-Fi > Sign-in page runs this.
set -euo pipefail

# Mozilla's page for exactly this: plain http, so the network can put its
# sign-in page in its place
START=http://detectportal.firefox.com/canonical.html
INCOGNITO=/usr/local/bin/incognito
SECURE_DNS=$HOME/.local/bin/secure-dns
# While this has secure DNS off: the next login says so if it is still off
# (bin/secure-dns login-check); switching on removes it
LEFT_OFF=${XDG_STATE_HOME:-$HOME/.local/state}/wren/secure-dns-left-off

# say: in the terminal, or as a notification when started from the menu
say() {
    printf 'wifi-signin: %s\n' "$*" >&2
    if [ ! -t 2 ] && command -v notify-send >/dev/null; then notify-send -a wren "Wi-Fi sign-in" "$*" 2>/dev/null || true; fi
}

[ -x "$INCOGNITO" ] || { say "the incognito window isn't set up: wrenctl part incognito"; exit 1; }

# You chose that switching secure DNS off asks for your password (parts/secure-dns.sh):
# from the menu there is no terminal to ask in (sudo asks on /dev/tty, so that is
# what counts, not stdin), so it opens a window for that
if [ -e "$HOME/.config/wren/secure-dns-strict" ] && ! { : </dev/tty; } 2>/dev/null && [ -z "${WREN_SIGNIN_WINDOW:-}" ] &&
    [ -n "${WAYLAND_DISPLAY:-}" ] && command -v foot >/dev/null &&
    [ -x "$SECURE_DNS" ] && [ "$("$SECURE_DNS" status)" = on ]; then
    exec foot --app-id=wren-run --title="Wi-Fi sign-in" env WREN_SIGNIN_WINDOW=1 "$(readlink -f -- "$0")"
fi

was_on=false
if [ -x "$SECURE_DNS" ] && [ "$("$SECURE_DNS" status)" = on ]; then
    was_on=true
    mkdir -p "${LEFT_OFF%/*}"
    : >"$LEFT_OFF"
    "$SECURE_DNS" off >/dev/null || { say "couldn't switch secure DNS off for the sign-in."; exit 1; }
fi
# shellcheck disable=SC2317,SC2329  # runs from the EXIT trap
back_on() {
    $was_on || return 0
    if "$SECURE_DNS" on >/dev/null 2>&1; then
        say "signed in? Secure DNS is on again."
    else
        say "secure DNS couldn't switch on again (not signed in yet?): the Wren menu's Secure DNS line, or secure-dns on."
    fi
}
trap back_on EXIT

if $was_on; then
    say "sign in in the window that opens, then close it. Secure DNS is off until then."
else
    say "sign in in the window that opens, then close it."
fi
rc=0
"$INCOGNITO" --no-audio --signin "$START" || rc=$?
exit "$rc"