#!/usr/bin/env bash
set -Eeuo pipefail

[[ "${PAM_TYPE:-}" == "close_session" ]] || exit 0
case "${PAM_SERVICE:-}" in
    lightdm|gdm-password|sddm) ;;
    *) exit 0 ;;
esac

username="${PAM_USER:-}"
[[ "$username" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] || exit 0
marker="/etc/celita-reset-users/$username"
archive="/var/lib/celita-user-manager/baselines/$username/home.tar"
[[ -f "$marker" && -f "$archive" ]] || exit 0

uid="$(id -u "$username")"
[[ "$uid" -ge 1000 && "$uid" -lt 60000 ]] || exit 0
home="$(getent passwd "$username" | cut -d: -f6)"
[[ "$home" == /home/* && "$home" != /home/ && -d "$home" ]] || exit 0

exec 9>"/run/lock/celita-reset-$username.lock"
flock -n 9 || exit 0
find "$home" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
tar --acls --xattrs -C "$home" -xpf "$archive"
chown -R "$username":"$(id -gn "$username")" "$home"
