#!/usr/bin/env bash
# Remove Glance face unlock from Omarchy, in one command:
#
#   curl -fsSL https://www.glancelinux.website/uninstall.sh | bash
#
# Undoes everything install.sh did, in the order that keeps you able to log in:
#   1. Takes pam_glance out of every lock-screen PAM stack, and only once no
#      PAM file mentions it any more deletes the module itself — a stack that
#      names a missing module can refuse your password.
#   2. Restores the stock Omarchy lock screen and removes the post-update hook.
#   3. Stops and deletes the glanced user service.
#   4. Removes the Glance plugin.
#   5. Deletes ~/.local/share/glance: the daemon, the models, and your
#      encrypted face enrollment and remembered passphrase.
#   6. Restarts the Omarchy shell.
#
# It asks once before touching anything, and again for your password. Safe to
# run again: every step skips what is already gone.
#
# Everything is inside main(), which runs only after the whole script has
# downloaded, so a dropped connection cannot run half of it.

set -euo pipefail

PLUGIN_ID="io.github.ayandexyz.glance"
PLUGIN_DIR="$HOME/.config/omarchy/plugins/$PLUGIN_ID"
VENV="$HOME/.local/share/glance"
GLANCECTL="$VENV/bin/glancectl"
PAM_MODULE="/usr/lib/security/pam_glance.so"
PAM_STACKS=(/etc/pam.d/hyprlock /etc/pam.d/omarchy-lock-password /etc/pam.d/omarchy-lock-fingerprint)
LOCK_DIR="${OMARCHY_PATH:-/usr/share/omarchy}/shell/plugins/lock"
HOOK="$HOME/.config/omarchy/hooks/post-update.d/repair-glance-lock.hook"
UNIT="$HOME/.config/systemd/user/glanced.service"

say() { printf '\033[1m==> %s\033[0m\n' "$*"; }
die() { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; }

have_glancectl() { [[ -x $GLANCECTL ]]; }

remove_pam() {
  say "Removing pam_glance from the lock screen"
  if have_glancectl; then
    "$GLANCECTL" setup-pam --remove </dev/tty || true
  fi
  # Also covers an install whose daemon is already gone.
  local stack
  for stack in "${PAM_STACKS[@]}"; do
    if [[ -f $stack ]] && grep -q 'pam_glance\.so' "$stack"; then
      sudo sed -i '/pam_glance\.so/d' "$stack" </dev/tty
    fi
  done

  local still
  still=$(grep -rl 'pam_glance\.so' /etc/pam.d 2>/dev/null || true)
  if [[ -n $still ]]; then
    die "pam_glance is still referenced in: $still
Remove those lines first; the module is left in place so they keep working."
  fi
  if [[ -e $PAM_MODULE ]]; then
    sudo rm -f "$PAM_MODULE" </dev/tty
  fi
}

remove_lock_indicator() {
  say "Restoring the stock lock screen"
  if have_glancectl; then
    "$GLANCECTL" setup-lock --remove </dev/tty || true
  fi
  if [[ -e $LOCK_DIR/FaceUnlockIndicator.qml || -e $LOCK_DIR/unlock-spin.png ]]; then
    local f
    for f in LockView.qml Service.qml; do
      if [[ -f $LOCK_DIR/$f.orig ]]; then
        sudo mv -f "$LOCK_DIR/$f.orig" "$LOCK_DIR/$f" </dev/tty
      fi
    done
    sudo rm -f "$LOCK_DIR/FaceUnlockIndicator.qml" "$LOCK_DIR/unlock-spin.png" </dev/tty
  fi
  rm -f "$HOOK"
}

remove_service() {
  say "Stopping and removing the glanced service"
  systemctl --user disable --now glanced.service >/dev/null 2>&1 || true
  if [[ -e $UNIT ]]; then
    rm -f "$UNIT"
    systemctl --user daemon-reload
  fi
}

remove_plugin() {
  if [[ -e $PLUGIN_DIR || -L $PLUGIN_DIR ]]; then
    say "Removing the Glance plugin"
    omarchy plugin remove "$PLUGIN_ID" --yes
  fi
}

remove_files() {
  say "Deleting the daemon, models and your enrollment"
  rm -rf "$VENV" "${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/glance"
}

main() {
  command -v omarchy >/dev/null 2>&1 || die "this needs Omarchy (https://omarchy.org)"
  [[ -r /dev/tty ]] || die "run this from a terminal: it asks before removing anything"

  cat <<EOF
This removes Glance completely: the lock-screen PAM wiring and module, the
lock indicator, the glanced service, the plugin, and $VENV —
including your encrypted face enrollment. It cannot be undone.

EOF
  local answer
  read -r -p "Remove Glance? [y/N] " answer </dev/tty
  [[ $answer == [yY] || $answer == [yY][eE][sS] ]] || die "nothing was removed"

  # PAM first, while the daemon and glancectl still exist, so there is never a
  # moment where a lock screen asks a daemon that is gone.
  remove_pam
  remove_lock_indicator
  remove_service
  remove_plugin
  remove_files

  if command -v omarchy-restart-shell >/dev/null 2>&1; then
    say "Restarting the Omarchy shell"
    omarchy-restart-shell
  fi
  say "Glance is removed."
}

main "$@"