#!/bin/sh
# Apply the ism-1558 limbs a character-level rule can enforce on a Debian 13 (trixie) host: monotonic runs, repeated characters and account-derived strings. The word count is debian-13-pam-wordcount's.
#
# Requires debian-13-pwquality-base: pam_pwquality must already be installed and in
# the password stack, or nothing this component configures is enforced. This script
# installs one drop-in and changes nothing else.
#
# Usage: apply-predictability.sh
# Idempotent: safe to re-run.

set -eu

[ "$(id -u)" -eq 0 ] || { echo "error: must run as root" >&2; exit 1; }

BASE_DIR="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
DROPIN=50-ism-predictability.conf

grep -qE '^[^#]*pam_pwquality\.so' /etc/pam.d/common-password || {
	echo "error: requires debian-13-pwquality-base: pam_pwquality.so is not in /etc/pam.d/common-password," >&2
	echo "       so nothing this component configures would be enforced." >&2
	exit 1
}

echo "==> installing $DROPIN"
install -d -m 0755 /etc/security/pwquality.conf.d
install -m 0644 "$BASE_DIR/config/pwquality.conf.d/$DROPIN" "/etc/security/pwquality.conf.d/$DROPIN"

echo "==> applied. Verify with: scripts/verify-predictability.sh"