#!/usr/bin/env bash
# Glance face unlock for Omarchy, in one command:
#
#   curl -fsSL https://www.glancelinux.website/install.sh | bash
#
# What this does, and nothing else:
#   1. Adds the Glance plugin with `omarchy plugin add` (or updates it if it is
#      already there). Omarchy asks you to confirm before it clones anything.
#   2. Builds a venv at ~/.local/share/glance, the one place the panel looks.
#   3. Installs the daemon into it from the plugin's own lock file: every one of
#      its packages pinned to an exact version and SHA-256, so a substituted or
#      tampered download fails the install instead of running.
#   4. Runs `glancectl setup`: models, user service, PAM and the lock-screen
#      indicator, behind one sudo prompt.
#   5. Restarts the Omarchy shell, so the lock-screen indicator loads.
#
# Then click Enroll in the Glance panel. Run it again any time to update.
#
# Everything is inside main(), which runs only after the whole script has
# downloaded, so a dropped connection cannot run half of it.

set -euo pipefail

PLUGIN_URL="https://github.com/ayandexyz/omarchy-glance.git"
PLUGIN_ID="io.github.ayandexyz.glance"
PLUGIN_DIR="$HOME/.config/omarchy/plugins/$PLUGIN_ID"
VENV="$HOME/.local/share/glance"
# The lock's wheels are built for this interpreter; another one would fail the
# hash check halfway through, so it is refused up front instead.
PYTHON_VERSION="3.14"

say() { printf '\033[1m==> %s\033[0m\n' "$*"; }
die() { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; }

main() {
  command -v omarchy >/dev/null 2>&1 || die "this needs Omarchy (https://omarchy.org)"
  command -v python3 >/dev/null 2>&1 || die "python3 is not installed"
  local have
  have=$(python3 -c 'import sys; print("%d.%d" % sys.version_info[:2])')
  [[ $have == "$PYTHON_VERSION" ]] ||
    die "python3 is $have; the pinned daemon is built for $PYTHON_VERSION, which is what Omarchy ships"
  # Piped from curl, this script's stdin is the download. Prompts belong to
  # the person at the keyboard, so they read the terminal instead.
  [[ -r /dev/tty ]] || die "run this from a terminal: the plugin and sudo both need to ask you something"

  if [[ -d $PLUGIN_DIR ]]; then
    say "Updating the Glance plugin"
    omarchy plugin update "$PLUGIN_ID" </dev/tty
  else
    say "Adding the Glance plugin"
    omarchy plugin add "$PLUGIN_URL" --enable </dev/tty
  fi

  local locks=("$PLUGIN_DIR"/glanced-*.lock)
  [[ ${#locks[@]} -eq 1 && -f ${locks[0]} ]] ||
    die "expected exactly one glanced-*.lock in $PLUGIN_DIR"

  say "Installing the daemon from $(basename "${locks[0]}")"
  [[ -x $VENV/bin/pip ]] || python3 -m venv "$VENV"
  "$VENV/bin/pip" install --quiet --disable-pip-version-check --require-hashes -r "${locks[0]}"

  say "Setting up the service, PAM and the lock screen"
  "$VENV/bin/glancectl" setup </dev/tty

  # The lock-screen indicator is QML inside the running shell, so it only
  # loads on a restart. Your terminal and windows are untouched.
  if command -v omarchy-restart-shell >/dev/null 2>&1; then
    say "Restarting the Omarchy shell to load the lock-screen indicator"
    omarchy-restart-shell
  else
    say "Restart the Omarchy shell to load the lock-screen indicator"
  fi

  say "Done. Open the Glance panel from the bar and click Enroll."
}

main "$@"