From 514bba69f51bc1d312130b4025e6a2c8184e3e82 Mon Sep 17 00:00:00 2001
From: NeilClack <cnclack@pm.me>
Date: Fri, 13 Mar 2026 20:41:24 -0500
Subject: [PATCH] Fix Network Manager handling

---
 flake.nix                   |  2 +-
 internal/network/network.go | 39 ++++++++++++++++++++++---------------
 2 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/flake.nix b/flake.nix
index bfd8a88..789d3ff 100644
--- a/flake.nix
+++ b/flake.nix
@@ -49,7 +49,7 @@
       {
         packages.default = pkgs.buildGoModule {
           pname = "rhemawave";
-          version = "v1.0.2";
+          version = "v1.0.3";
           src = ./.;
 
           vendorHash = null;
diff --git a/internal/network/network.go b/internal/network/network.go
index a99f611..ef2aee0 100644
--- a/internal/network/network.go
+++ b/internal/network/network.go
@@ -331,34 +331,41 @@ func (m *Manager) Connect(wifiDevice Device, ap AccessPoint, passphrase string)
 			"uuid":           dbus.MakeVariant(uuid.NewString()),
 			"id":             dbus.MakeVariant(ap.SSID),
 			"interface-name": dbus.MakeVariant(wifiDevice.InterfaceName),
+			"permissions":    dbus.MakeVariant([]string{}), // Shared connection
+			"autoconnect":    dbus.MakeVariant(true),
 		},
 		"802-11-wireless": {
 			"ssid": dbus.MakeVariant([]byte(ap.SSID)),
 			"mode": dbus.MakeVariant("infrastructure"),
 		},
+		"ipv4": {"method": dbus.MakeVariant("auto")},
+		"ipv6": {"method": dbus.MakeVariant("auto")},
 	}
 
 	if ap.IsProtected {
-		settings["802-11-wireless"]["security"] = dbus.MakeVariant("802-11-wireless-security")
-		secSettings := make(map[string]dbus.Variant)
-
-		// Default to WPA-PSK, but override with more specific types if found.
-		secSettings["key-mgmt"] = dbus.MakeVariant("wpa-psk")
-		if (ap.RsnFlags & APSecKeyMgmtSAE) != 0 {
-			secSettings["key-mgmt"] = dbus.MakeVariant("sae") // WPA3
-		} else if (ap.RsnFlags&APSecKeyMgmtEAP) != 0 || (ap.WpaFlags&APSecKeyMgmtEAP) != 0 {
-			log.Println("network: Enterprise AP (EAP) detected. Full configuration may be required.")
-			secSettings["key-mgmt"] = dbus.MakeVariant("wpa-eap")
+		settings["802-11-wireless-security"] = map[string]dbus.Variant{
+			"key-mgmt": dbus.MakeVariant("wpa-psk"),
+			"auth-alg": dbus.MakeVariant("open"),
+			"psk":      dbus.MakeVariant(passphrase),
 		}
-
-		secSettings["psk"] = dbus.MakeVariant(passphrase)
-		settings["802-11-wireless-security"] = secSettings
+		// 0 means "The secret is not saved or is managed by an external agent"
+		// In a kiosk, we want NM to just handle it.
+		settings["802-11-wireless-security"]["psk-flags"] = dbus.MakeVariant(uint32(0))
 	}
 
-	call := m.nmObject.Call(nmInterface+".AddAndActivateConnection", 0, settings, wifiDevice.Path, ap.ObjectPath)
-	if call.Err != nil {
-		return fmt.Errorf("AddAndActivateConnection D-Bus call error: %w", call.Err)
+	var connectionPath dbus.ObjectPath
+	var activeConnectionPath dbus.ObjectPath
+
+	// Capture the two return values from AddAndActivateConnection
+	err := m.nmObject.Call(nmInterface+".AddAndActivateConnection", 0, settings, wifiDevice.Path, ap.ObjectPath).Store(&connectionPath, &activeConnectionPath)
+
+	if err != nil {
+		// THIS IS THE LOG YOU NEED TO SEE IN SSH
+		log.Printf("NETWORK MANAGER FAIL: %v", err)
+		return fmt.Errorf("AddAndActivateConnection failed: %w", err)
 	}
+
+	log.Printf("Connection created: %s, Active path: %s", connectionPath, activeConnectionPath)
 	return nil
 }