#!/bin/sh
# r01-ui-set-pin USER [PIN]
#
# Compute an argon2id hash of PIN and store it in /etc/config/r01-ui under
# the right user slot. If PIN is omitted, read it from /dev/tty without
# echo so it doesn't end up in shell history.
#
# r01-ui itself contains an argon2 implementation. We call it through a
# tiny subcommand `r01-ui hash <pin>` that prints the PHC string and exits.
# (The subcommand is implemented in the same Rust binary so we avoid
# shipping a second tool.)

set -e

usage() {
	cat <<EOF >&2
usage: r01-ui-set-pin USER [PIN]

USER  must be 'admin' or 'guest'.
PIN   is read interactively from /dev/tty if omitted (no echo).
EOF
	exit 64
}

user="${1:-}"
pin="${2:-}"

case "$user" in
	admin|guest) ;;
	*) usage ;;
esac

if [ -z "$pin" ]; then
	printf 'PIN for %s (no echo): ' "$user" >&2
	stty -echo 2>/dev/null || true
	read -r pin < /dev/tty
	stty echo 2>/dev/null || true
	printf '\n' >&2
fi

if [ -z "$pin" ]; then
	echo "r01-ui-set-pin: empty PIN" >&2
	exit 65
fi

hash="$(/usr/bin/r01-ui hash "$pin" 2>/dev/null || true)"
if [ -z "$hash" ]; then
	echo "r01-ui-set-pin: failed to compute hash (is /usr/bin/r01-ui installed?)" >&2
	exit 70
fi

uci set "r01-ui.auth.${user}_pin_hash=$hash"
uci commit r01-ui

# Tell a running r01-ui to reload its UCI cache.
[ -x /etc/init.d/r01-ui ] && /etc/init.d/r01-ui reload >/dev/null 2>&1 || true

echo "set ${user} PIN hash" >&2
