#!/bin/bash
set -euo pipefail
source /usr/local/lib/pivilion/common.sh
[ "$(id -u)" -eq 0 ] || exec sudo "$0" "$@"
pivilion_load_config
IFACE=$(pivilion_wifi_interface)
[ -n "$IFACE" ] || { echo "No Wi-Fi interface found." >&2; exit 1; }

read -r -p "Wi-Fi SSID: " ssid
read -r -s -p "Wi-Fi password: " password
printf '\n'
[ -n "$ssid" ] || { echo "SSID cannot be empty." >&2; exit 1; }
[ "${#password}" -ge 8 ] && [ "${#password}" -le 63 ] || {
    echo "WPA password must contain 8-63 characters." >&2; exit 1;
}

if pivilion_uses_networkmanager; then
    nmcli connection delete pivilion-onion >/dev/null 2>&1 || true
    nmcli connection add type wifi ifname "$IFACE" con-name pivilion-onion ssid "$ssid" >/dev/null
    nmcli connection modify pivilion-onion 802-11-wireless.mode infrastructure \
        802-11-wireless-security.key-mgmt wpa-psk 802-11-wireless-security.psk "$password" \
        ipv4.method auto ipv6.method auto connection.autoconnect yes
else
    tmp=$(mktemp)
    trap 'rm -f "$tmp"' EXIT
    wpa_passphrase "$ssid" "$password" | sed '/^[[:space:]]*#psk=/d' > "$tmp"
    install -d -m 0755 /etc/wpa_supplicant
    install -m 0600 "$tmp" /etc/wpa_supplicant/pivilion.conf
    touch /etc/wpa_supplicant/wpa_supplicant.conf
    grep -Fqx 'include=/etc/wpa_supplicant/pivilion.conf' /etc/wpa_supplicant/wpa_supplicant.conf || \
        printf '\ninclude=/etc/wpa_supplicant/pivilion.conf\n' >> /etc/wpa_supplicant/wpa_supplicant.conf
    chmod 0600 /etc/wpa_supplicant/wpa_supplicant.conf
fi
unset password
echo "Wi-Fi credentials saved. Run onion and reboot when ready."