#!/bin/sh

#
# Wrapper for 'doveadm' tool for creating password hashes for Dovecot.
#
# example:
#
# using password within rockyou.txt:
#
# pam_bloom_doveadm.sh -s ARGON2ID
# Enter new password:
# Retype new password:
# password matches filter: rockyou.txt
# Password rejected by password policy.
#
# using password not in rockyou.txt:
#
# pam_bloom_doveadm.sh -s ARGON2ID
# Enter new password:
# Retype new password:
# {ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$fIS250e9vnNxz.....
#

prompt_password()
{
    prompt=$1
    printf '%s' "$prompt" >/dev/tty

    stty -echo </dev/tty
    IFS= read -r REPLY </dev/tty
    status=$?
    stty echo </dev/tty

    printf '\n' >/dev/tty
    return "$status"
}

prompt_password "Enter new password: " || exit 1
password=$REPLY

prompt_password "Retype new password: " || exit 1
password2=$REPLY

if [ "$password" != "$password2" ]; then
    echo "Passwords do not match." >&2
    unset password password2 REPLY
    exit 1
fi

unset password2 REPLY

printf '%s\n' "$password" | pam_bloom_check
status=$?

case "$status" in
    0)
        ;;
    1)
        echo "Password rejected by password policy." >&2
        unset password
        exit 1
        ;;
    *)
        echo "Unable to check password policy." >&2
        unset password
        exit 2
        ;;
esac

printf '%s\n%s\n' "$password" "$password" | doveadm pw "$@"
status=$?

unset password
exit "$status"