#!/usr/bin/env bash
# Toggle passwordless sudo for the current user.
#   pwswitch on   -> sudo asks for a password again (default behavior)
#   pwswitch off  -> sudo runs without a password
# Works by adding/removing a drop-in file in /etc/sudoers.d.
set -euo pipefail

user="${SUDO_USER:-$USER}"
# "zz-" prefix so it sorts last and overrides earlier rules.
dropin="/etc/sudoers.d/zz-passwordswitch-${user}"

case "${1:-}" in
off)
  tmp="$(mktemp)"
  trap 'rm -f "$tmp"' EXIT
  echo "${user} ALL=(ALL) NOPASSWD: ALL" >"$tmp"
  # Validate before installing so a bad file can never lock sudo.
  sudo visudo -cqf "$tmp"
  sudo install -m 0440 -o root -g root "$tmp" "$dropin"
  echo "Passwordless sudo ENABLED for ${user}. Run '$(basename "$0") on' when done."
  ;;
on)
  sudo rm -f "$dropin"
  sudo -k
  echo "Password required for sudo again."
  ;;
*)
  echo "Usage: $(basename "$0") on|off" >&2
  exit 1
  ;;
esac