# Invoked by the fred-lock wrapper, with coreutils, systemd and qs on PATH.
set -euo pipefail

timeout 5s systemctl --user start quickshell-lock.service
deadline=$((SECONDS + 10))
while (( SECONDS < deadline )); do
    # Select the running service, including one from an older generation.
    locker_pid=$(timeout 1s systemctl --user show quickshell-lock.service --property=MainPID --value)
    if [[ "$locker_pid" =~ ^[1-9][0-9]*$ ]] &&
        timeout 1s qs ipc --pid "$locker_pid" call lock lock >/dev/null 2>&1 &&
        secure=$(timeout 1s qs ipc --pid "$locker_pid" call lock secure 2>/dev/null) &&
        [[ "$secure" == true ]]; then
        exit 0
    fi
    sleep 0.1
done
echo "The compositor did not confirm a secure session lock" >&2
exit 1