#!/bin/sh
# Start the elevation consent prompt (User Account Control): its own X server
# on the compositor's privileged socket, and sg-consent.exe on it.
#
#   sg-consent-ui admin|cred REQUESTER PROGRAM
#
# Started by sg-brokerd after it has put the compositor into SECURE mode; the
# broker's pipes are this script's stdin and stdout, and the prompt inherits
# them. Nothing else may hold them open, so Xwayland gets /dev/null.
#
# As with the lock screen (sg-lock-ui), the X server is separate from the
# requester's on purpose: in SECURE mode the compositor shows and sends input
# only to privileged clients, so no program in the requester's session can see
# the prompt, click Yes or type into it (ADR 0009, ADR 0012).
set -u
SG_LIB="${SG_LIB:-/usr/lib/stained-glass}"
# shellcheck source=lib/sg-common.sh
. "$SG_LIB/sg-common.sh"
sg_wine_env
unset WAYLAND_DISPLAY SG_WINSTATION

mode="${1:?mode}"
requester="${2:?requester}"
program="${3:-}"
case "$mode" in admin|cred|shadow) ;; *) echo DENY; exit 2 ;; esac

N="${SG_CONSENT_DISPLAY_NUM:-${SG_LOCK_DISPLAY_NUM:-99}}"
while [ -e "/tmp/.X${N}-lock" ] || [ -e "/tmp/.X11-unix/X${N}" ]; do N=$((N + 1)); done

# Only this account may connect to it: an Xwayland started without -auth
# admits every local account, and any program in any session could then type
# into this prompt (XTEST) or read it (XGetImage).
XDIR=$(mktemp -d "${TMPDIR:-/tmp}/sg-consent-XXXXXX") || { echo DENY; exit 2; }
sg_x_cookie "$XDIR/Xauthority" || { rm -rf "$XDIR"; echo DENY; exit 2; }
WAYLAND_DISPLAY="${SG_LOCK_PRIV:?SG_LOCK_PRIV}" Xwayland ":$N" -noreset -auth "$XDIR/Xauthority" -nolisten tcp \
    </dev/null >/dev/null 2>&1 &
_w=0
while [ ! -e "/tmp/.X11-unix/X$N" ] && [ "$_w" -lt 100 ]; do sleep 0.1; _w=$((_w + 1)); done

DISPLAY=":$N"
XAUTHORITY="$XDIR/Xauthority"
export DISPLAY XAUTHORITY
# Not exec: the cookie goes when the prompt does.
# at the display scale the screen recommends (the machine's account never
# picks one): on a high-resolution screen it was a small box (sg-common.sh)
sg_ui_scale x
wine "${SG_LIBEXEC:-/usr/libexec/stained-glass}/sg-consent64.exe" /consent "$mode" "$requester" "$program" \
    2>>"${SG_LOG_DIR:-/tmp}/consent-ui.log"
rc=$?
rm -rf "$XDIR"
exit $rc
