#!/usr/bin/env bash
# policy: usr_admin — global sudo grant for FreeIPA usr_admin user group.
# When the IPA group exists, a sudoers drop-in grants full sudo (SSSD-resolved).
# The drop-in is removed when the group is deleted from FreeIPA.

USR_ADMIN_DROPIN="/etc/sudoers.d/ansipa-usr-admin"
USR_ADMIN_STATE="$STATE_DIR/usr-admin"

if [[ "$WANT_USR_ADMIN" == true ]]; then
    if [[ ! -f "$USR_ADMIN_DROPIN" ]]; then
        log "Installing usr_admin sudoers drop-in"
        printf '%%usr_admin ALL=(ALL:ALL) ALL\n' > "$USR_ADMIN_DROPIN"
        chmod 440 "$USR_ADMIN_DROPIN"
    fi
    touch "$USR_ADMIN_STATE"
else
    if [[ -f "$USR_ADMIN_STATE" ]] || [[ -f "$USR_ADMIN_DROPIN" ]]; then
        rm -f "$USR_ADMIN_DROPIN" "$USR_ADMIN_STATE"
        log "Removed usr_admin sudoers drop-in (IPA group no longer exists)"
    fi
fi