privileged.py

from __future__ import annotations

import grp
import os
import shutil
import subprocess
from pathlib import Path

SUDOERS_PATH = Path("/etc/sudoers.d/amper")
GROUP_NAME = "amper"
SETUP_SCRIPT = Path(__file__).resolve().parent / "setup_permissions.sh"


def _run(args: list[str]) -> subprocess.CompletedProcess[str]:
    return subprocess.run(args, capture_output=True, text=True, check=False)


def user_in_amper_group() -> bool:
    try:
        group_id = grp.getgrnam(GROUP_NAME).gr_gid
    except KeyError:
        return False
    return group_id in os.getgroups()


def sudoers_installed() -> bool:
    return SUDOERS_PATH.is_file()


def can_run_without_password() -> bool:
    if not shutil.which("sudo"):
        return False
    if not sudoers_installed() or not user_in_amper_group():
        return False
    probe = _run(["sudo", "-n", "systemctl", "is-system-running"])
    return probe.returncode in {0, 1}


def is_ready() -> bool:
    return can_run_without_password()


def wrap(command: list[str]) -> list[str]:
    if can_run_without_password():
        return ["sudo", "-n", *command]
    if shutil.which("pkexec"):
        return ["pkexec", *command]
    return command


def popen(command: list[str], **kwargs) -> subprocess.Popen:
    return subprocess.Popen(
        wrap(command),
        stdout=kwargs.get("stdout", subprocess.DEVNULL),
        stderr=kwargs.get("stderr", subprocess.DEVNULL),
    )


def run(command: list[str]) -> subprocess.CompletedProcess[str]:
    return _run(wrap(command))


def setup_script_path() -> Path:
    return SETUP_SCRIPT