#!/usr/bin/env bash
#
# Read a password previously stored with tpm-nv-store-password.sh from a
# TPM 2.0 NV index.
# Requires: tpm2-tools, access to /dev/tpmrm0 (tss group or root).

set -euo pipefail

HANDLE="0x1500016"

usage() {
	cat <<-EOF
	Usage: $(basename "$0") [-H handle]

	  -H handle   NV index the password was stored at (default: ${HANDLE})
	EOF
}

while getopts "H:h" opt; do
	case "$opt" in
	H) HANDLE="$OPTARG" ;;
	h) usage; exit 0 ;;
	*) usage; exit 1 ;;
	esac
done

command -v tpm2_nvread >/dev/null || {
	echo "tpm2-tools is required (apt install tpm2-tools)" >&2
	exit 1
}

if ! tpm2_nvreadpublic | grep -q "^${HANDLE}:"; then
	echo "No NV index found at ${HANDLE}" >&2
	exit 1
fi

tpm2_nvread -C o "$HANDLE"