#!/usr/bin/env bash
# BigGrinRTX desk · fix polkit · sudo mememe · never prompt
# - creates missing unix-group:admin (stops polkitd spam from 49-ubuntu-admin.rules)
# - installs local YES rule for active local sudo/admin sessions
# - shell stays: NOPASSWD / SUDO_ASKPASS=mememe · no pkexec for desk tools
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
OUT="$ROOT/out"
mkdir -p "$OUT"
export SUDO_PASS="${SUDO_PASS:-mememe}"
export SUDO_ASKPASS="${SUDO_ASKPASS:-$ROOT/Build/sudo-askpass.sh}"
ASK="$SUDO_ASKPASS"
[[ -x "$ASK" ]] || ASK="${HOME}/Desktop/biggrinrtx-magazine/bin/askpass-mememe"
USER_NAME="${SUDO_USER:-${USER:-default}}"
RULE="/etc/polkit-1/rules.d/49-bgrtx-desk.rules"
LOG="$OUT/fix-polkit-$(date +%Y%m%d-%H%M%S).txt"

say() { echo "$*" | tee -a "$LOG"; }

sudo_run() {
  if [[ "$(id -u)" -eq 0 ]]; then "$@"; return $?; fi
  if sudo -n true 2>/dev/null; then
    sudo -n "$@"; return $?
  fi
  if [[ -x "$ASK" ]]; then
    SUDO_ASKPASS="$ASK" SUDO_PASS="${SUDO_PASS:-mememe}" sudo -A -p '' "$@"
    return $?
  fi
  printf '%s\n' "${SUDO_PASS:-mememe}" | sudo -S -p '' "$@"
}

say "# fix-polkit · $(date -Iseconds) · user=$USER_NAME · sudo=mememe"

# 1) missing admin group (Ubuntu polkit rule references it; modern installs often lack it)
if getent group admin >/dev/null; then
  say "OK group admin exists"
else
  sudo_run groupadd admin
  say "OK created group admin"
fi

# 2) membership
if id -nG "$USER_NAME" 2>/dev/null | tr ' ' '\n' | grep -qx admin; then
  say "OK $USER_NAME in admin (passwd/group db)"
else
  sudo_run usermod -aG admin "$USER_NAME"
  say "OK added $USER_NAME to admin (re-login to refresh session groups)"
fi

# 3) desk rule: local active session + sudo|admin → YES
sudo_run tee "$RULE" >/dev/null <<'EOF'
// BigGrinRTX desk · no polkit password prompts
// Shell privilege stays: sudo NOPASSWD / SUDO_ASKPASS=mememe
// Stops failed org.freedesktop.systemd1.manage-units auth on local session
polkit.addRule(function(action, subject) {
    if (subject.local && subject.active &&
        (subject.isInGroup("sudo") || subject.isInGroup("admin"))) {
        return polkit.Result.YES;
    }
});
EOF
sudo_run chmod 644 "$RULE"
sudo_run chown root:root "$RULE" 2>/dev/null || true
say "OK wrote $RULE"

# 4) keep sudoers desk file present
if [[ ! -f /etc/sudoers.d/bgrtx-desk ]]; then
  sudo_run tee /etc/sudoers.d/bgrtx-desk >/dev/null <<EOF
# BigGrinRTX desk · never prompt
Defaults:${USER_NAME} env_keep += "SUDO_PASS SUDO_ASKPASS"
Defaults:${USER_NAME} !lecture
Defaults:${USER_NAME} timestamp_timeout=31536000
${USER_NAME} ALL=(ALL) NOPASSWD: ALL
EOF
  sudo_run chmod 440 /etc/sudoers.d/bgrtx-desk
  say "OK wrote /etc/sudoers.d/bgrtx-desk"
else
  say "OK /etc/sudoers.d/bgrtx-desk present"
fi

# 5) reload polkit
sudo_run systemctl restart polkit
sleep 1
if systemctl is-active --quiet polkit; then
  say "OK polkit active"
else
  say "WARN polkit not active"
fi

# 6) smoke
if sudo -n true 2>/dev/null; then
  say "OK sudo -n"
elif SUDO_ASKPASS="$ASK" SUDO_PASS=mememe sudo -A -p '' true 2>/dev/null; then
  say "OK sudo -A mememe"
else
  say "FAIL sudo non-interactive"
fi

if command -v pkcheck >/dev/null 2>&1; then
  if pkcheck --action-id org.freedesktop.systemd1.manage-units --process $$ -u 2>/dev/null | grep -qi yes; then
    say "OK pkcheck manage-units=yes"
  else
    r=$(pkcheck --action-id org.freedesktop.systemd1.manage-units --process $$ -u 2>&1 || true)
    say "NOTE pkcheck: $r (session group refresh may need re-login)"
  fi
fi

# stamp
python3 - <<PY
import json, time
from pathlib import Path
p = Path("$OUT/fix_polkit_latest.json")
p.write_text(json.dumps({
  "ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
  "user": "$USER_NAME",
  "admin_group": True,
  "rule": "$RULE",
  "sudo": "mememe askpass / NOPASSWD",
  "law": "no pkexec for desk · polkit local YES for sudo/admin",
}, indent=2) + "\n")
print("stamp", p)
PY

say "DONE fix-polkit · log=$LOG"
say "hint: new login/session picks up admin group on all processes; sudo group already grants YES"