#!/bin/bash
set -euo pipefail

echo "LittleBit's CachyOS Secure Boot Setup"
echo "Based on the guide from CachyOS: https://wiki.cachyos.org/configuration/secure_boot_setup/"
echo
echo "Make sure your Secure Boot keys are cleared in the BIOS before continuing."
echo "ONLY USE THIS TOOL IF YOU ARE USING THE LIMINE BOOTLOADER!"
echo
echo "This tool requires root, you may be asked for your password by sudo."
echo

while true; do
    read -p "Do you want to proceed? (y/n) " yn
    case $yn in
        [Yy]* ) echo "Proceeding..."; break;;
        [Nn]* ) echo "Aborting."; exit;;
        * ) echo "Please answer yes or no.";;
    esac
done

# Install sbctl (Fixed missing package name)
sudo pacman -S --needed sbctl

# Setup Mode check
echo "Checking Secure Boot status..."
sudo sbctl status

echo
echo "Read the above command's output."
echo 'To continue, the above command must read "Setup Mode: Enabled".'
echo "Continuing with Setup Mode disabled will result in an error!"
echo

while true; do
    read -p "Is Setup Mode enabled? (y/n) " yn
    case $yn in
        [Yy]* ) echo "Proceeding..."; break;;
        [Nn]* ) echo "Aborting. Reboot and go to BIOS setup, and look for the option to clear Secure Boot keys."; exit;;
        * ) echo "Please answer yes or no.";;
    esac
done

# Generate owner key
sudo sbctl create-keys

# Enroll the owner keys alongside Microsoft and OEM keys
sudo sbctl enroll-keys --microsoft --firmware-builtin

# Final status check
sudo sbctl status

# Set up Limine
echo "Signing Limine configuration..."
sudo limine-enroll-config
sudo limine-update

echo
echo "Setup complete! Please reboot to finalize Secure Boot enrollment."