#!/bin/bash

# blob:summary=Toggle passwordless sudo for the current user.
# blob:args=[MINUTES]
# blob:requires-sudo=true

NOPASSWD_FILE="/etc/sudoers.d/99-blob-nopasswd-${USER}"
TIMER_NAME="blob-nopasswd-expire-${USER}"

MINUTES=${1:-15}
if [[ $1 && ! $1 =~ ^[0-9]+$ ]]; then
  echo "Usage: blob-sudo-passwordless [MINUTES]" >&2
  exit 1
fi

arm_expiry() {
  if sudo systemd-run --on-active=${MINUTES}m --timer-property=AccuracySec=1s --unit="$TIMER_NAME" \
    rm -f -- "$NOPASSWD_FILE"; then
    return 0
  fi

  echo "Failed to schedule passwordless sudo expiry. Revoking access now." >&2
  if ! sudo rm -f -- "$NOPASSWD_FILE"; then
    echo "CRITICAL: Could not remove $NOPASSWD_FILE. Remove it as root immediately." >&2
  fi
  return 1
}

echo "Toggle passwordless sudo..."

# Safety: if the file exists but the timer doesn't (e.g. after reboot), clean up
if sudo test -f "$NOPASSWD_FILE" && ! systemctl is-active "${TIMER_NAME}.timer" &>/dev/null; then
  sudo rm "$NOPASSWD_FILE"
fi

# Check for the file directly — sudo -n can stay cached or be granted by other rules
if sudo test -f "$NOPASSWD_FILE"; then
  if [[ $1 ]]; then
    sudo systemctl stop "${TIMER_NAME}.timer" 2>/dev/null
    arm_expiry || exit 1
    echo "Passwordless sudo timer updated. It will now automatically disable in ${MINUTES} minutes."
  else
    sudo rm "$NOPASSWD_FILE"
    sudo systemctl stop "${TIMER_NAME}.timer" 2>/dev/null
    echo "Passwordless sudo has been DISABLED. Sudo will require a password again."
  fi
else
  echo ""
  echo "⚠️ WARNING: This will allow ANY process running as your user to"
  echo "execute ANY command as root WITHOUT a password for ${MINUTES} minutes."
  echo ""
  echo "This is useful for AI agents that need to run sudo commands,"
  echo "but it significantly weakens the security of your system."
  echo "Anyone or anything with access to your user account gets full root."
  echo ""
  echo "Passwordless sudo will automatically disable after ${MINUTES} minutes."
  echo "Run this command again to disable it early."
  echo ""

  if gum confirm "Enable passwordless sudo for ${MINUTES} minutes? This is a significant security risk!"; then
    echo "${USER} ALL=(ALL) NOPASSWD: ALL" | sudo tee "$NOPASSWD_FILE" > /dev/null
    sudo chmod 440 "$NOPASSWD_FILE"
    arm_expiry || exit 1

    echo ""
    echo "Passwordless sudo has been ENABLED. It will automatically disable in ${MINUTES} minutes."
    echo "A restart removes the passwordless sudo rule as well."
  else
    echo "Aborted. No changes made."
  fi
fi