#!/usr/bin/env bash
# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../../lib/dot/ui.sh
# shellcheck disable=SC1091
source "$SCRIPT_DIR/../../lib/dot/ui.sh"
# shellcheck source=../../lib/dot/platform.sh
# shellcheck disable=SC1091
source "$SCRIPT_DIR/../../lib/dot/platform.sh"

DRY_RUN=0
for arg in "$@"; do
  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
done
_run_cmd() {
  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
}

ui_init
ui_header "Lock Screen"

if [[ "$DRY_RUN" -eq 1 ]]; then
  ui_info "Mode" "dry-run (no changes will be made)"
elif [ "${DOTFILES_LOCK:-}" != "1" ]; then
  ui_warn "Lock screen" "disabled by default"
  ui_info "Re-run" "DOTFILES_LOCK=1"
  exit 1
fi

case "$(dot_platform_id)" in
  linux | wsl)
    if command -v gsettings >/dev/null; then
      ui_info "Enabling" "screen lock and idle timeout"
      _run_cmd gsettings set org.gnome.desktop.screensaver lock-enabled true || true
      _run_cmd gsettings set org.gnome.desktop.session idle-delay 300 || true
      _run_cmd gsettings set org.gnome.desktop.screensaver lock-delay 0 || true
    else
      ui_err "gsettings" "not found"
      exit 1
    fi
    ;;
  macos)
    ui_info "Enabling" "lock on sleep and screensaver (macOS)"
    _run_cmd defaults write com.apple.screensaver askForPassword -int 1 || true
    _run_cmd defaults write com.apple.screensaver askForPasswordDelay -int 0 || true
    # 5-minute idle timeout
    _run_cmd defaults -currentHost write com.apple.screensaver idleTime -int 300 || true
    ;;
  *)
    ui_err "Unsupported OS" "lock screen hardening"
    exit 1
    ;;
esac