#!/bin/sh
# mirror-kiosk-console-guard — make sure the kiosk owns the console.
#
# Run by mirror-kiosk-console-guard.timer once a minute as root.
#
# The failure this exists for is invisible remotely: the kiosk session keeps
# running (loginctl says active, the mirror roster counts the wall as a viewer)
# while some other session holds the foreground VT, so the screen shows a login
# prompt and every check says everything is fine. That is exactly how the
# greeter-autospawn bug presented itself.
#
# It deliberately does very little: if the kiosk HAS a seat0 session and that
# session is not the foreground one, activate it. It never restarts gdm and
# never logs anyone out, because a display manager is a bad thing to fight
# automatically. If there is no kiosk session at all it only says so — that is a
# problem for a human, and the message lands in the journal.
#
# Debugging the console by hand? Stop the fight:
#     sudo systemctl stop mirror-kiosk-console-guard.timer

set -eu

KIOSK_USER="${KIOSK_USER:-kiosk}"
FG_VT=/sys/class/tty/tty0/active

say() { logger -t mirror-kiosk-guard -- "$*"; }

[ "$(id -u)" -eq 0 ] || { printf 'run me as root\n' >&2; exit 1; }

# SESSION UID USER SEAT ... — the kiosk's own session on the physical seat. The
# greeter also sits on seat0 but under the gdm-greeter user, so the name filter
# is what keeps this from chasing the greeter.
session=$(loginctl list-sessions --no-legend 2>/dev/null |
    awk -v u="$KIOSK_USER" '$3 == u && $4 == "seat0" { print $1; exit }')

if [ -z "$session" ]; then
    say "no $KIOSK_USER session on seat0: auto-login did not produce one. Not touching gdm."
    exit 0
fi

active=$(loginctl show-session "$session" -p Active --value 2>/dev/null || echo unknown)
tty=$(loginctl show-session "$session" -p TTY --value 2>/dev/null || echo "")
foreground=$(cat "$FG_VT" 2>/dev/null || echo "")

if [ "$active" = "yes" ] && [ -n "$tty" ] && [ "$foreground" = "$tty" ]; then
    exit 0 # the wall already has the screen
fi

say "console is on ${foreground:-unknown}, kiosk session $session is on ${tty:-unknown} (Active=$active) — activating it"
if loginctl activate "$session" 2>/dev/null; then
    say "kiosk session $session brought back to the foreground"
else
    say "could not activate kiosk session $session — look at journalctl -b -u gdm"
fi