#!/bin/bash

## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

# shellcheck source=/usr/libexec/helper-scripts/has.sh
source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.sh

## Return codes:
## 0: Secure Boot enabled.
## 1: Secure Boot disabled.
## 2: Secure Boot state unknown ('mokutil' not installed or gave inconclusive output)
## Also echoes mokutil's output for debugging purposes.
check_secure_boot_enabled() {
  local mokutil_output

  ## leaprun uses hardcoded full path 'leaprun', so also use 'has' on the full path.
  if ! has '/usr/bin/mokutil'; then
    printf '%s\n' "$0: 'mokutil' not installed or not executable."
    return 2
  fi

  if [ "$(id -u)" = '0' ]; then
    mokutil_output="$(/usr/bin/mokutil --sb-state 2>&1)" || true
  else
    mokutil_output="$(leaprun mokutil-sb-state 2>&1)" || true
  fi
  printf '%s\n' "${mokutil_output}"

  if [[ "${mokutil_output}" = *enabled* ]]; then
    return 0
  elif [[ "${mokutil_output}" = *disabled* ]]; then
    return 1
  else
    return 2
  fi
}
