#!/bin/sh
# run-eap METHOD [IDENTITY] [PASSWORD]   method = silent | eap-tls | peap
# silent = bring the dot1x iface up with NO wpa_supplicant → hostapd MAB fallback.
# Baked into the endpoint image (no apk-at-boot). Auto-detects the dot1x interface.
set -e
METHOD=${1:?usage: run-eap METHOD [IDENT] [PASS]}
IFACE=${DOT1X_IF:-$(ip -o link show 2>/dev/null | awk -F': ' '$2!="lo" && $2!~/^eth0/ {print $2; exit}')}
IFACE=${IFACE:-eth1}
TIMEOUT=${WPA_TIMEOUT:-30}
pkill -f "wpa_supplicant -i $IFACE" 2>/dev/null || true
sleep 1
case "$METHOD" in
  silent)
    echo "[run-eap] silent: $IFACE up, no wpa_supplicant — MAB fallback expected"
    ip link set "$IFACE" up
    sleep "$TIMEOUT"
    echo "[run-eap] silent: ${TIMEOUT}s elapsed (MAB should have fired at the NAS)"
    ;;
  *) echo "[run-eap] method $METHOD not baked yet (silent/MAB is the E2E MAB path)"; exit 2 ;;
esac
