From d9a2947001c921b9a83a517e9462c640bb2a5d66 Mon Sep 17 00:00:00 2001
From: Mitchell R <root@mitchellr.info>
Date: Sun, 10 May 2026 03:17:35 +0200
Subject: [PATCH] fix: single curl call for pairing claim to prevent credential
 wipe

---
 kiosk/prototype.sh | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/kiosk/prototype.sh b/kiosk/prototype.sh
index efa171b..c2549fe 100644
--- a/kiosk/prototype.sh
+++ b/kiosk/prototype.sh
@@ -85,25 +85,23 @@ pair_with_server() {
 
   # Poll until admin confirms
   echo "Waiting for admin to confirm..."
+  local tmpfile
+  tmpfile=$(mktemp)
   while true; do
-    local claim
-    claim=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${server}/api/pair/claim" \
+    local http_code
+    http_code=$(curl -s -w "%{http_code}" -o "$tmpfile" -X POST "${server}/api/pair/claim" \
       -H "Content-Type: application/json" \
       -d "{\"code\":\"${code}\"}" 2>/dev/null || echo "000")
 
-    if [[ "$claim" == "200" ]]; then
-      local claim_resp
-      claim_resp=$(curl -sf -X POST "${server}/api/pair/claim" \
-        -H "Content-Type: application/json" \
-        -d "{\"code\":\"${code}\"}")
-
+    if [[ "$http_code" == "200" ]]; then
       local kiosk_key
-      kiosk_key=$(echo "$claim_resp" | jq -r '.kiosk_key')
+      kiosk_key=$(jq -r '.kiosk_key' "$tmpfile")
       local kiosk_name
-      kiosk_name=$(echo "$claim_resp" | jq -r '.kiosk_name')
+      kiosk_name=$(jq -r '.kiosk_name' "$tmpfile")
 
       echo "$kiosk_key" > "$KEY_FILE"
       chmod 600 "$KEY_FILE"
+      rm -f "$tmpfile"
 
       echo "Paired as: ${kiosk_name}"
       return
@@ -111,6 +109,7 @@ pair_with_server() {
 
     sleep 2
   done
+  rm -f "$tmpfile"
 }
 
 # ---- Bundle ------------------------------------------------------------------