# roles/thin-client/identity/sudo.nix
#
# Sudo policy:
# - Members of "domain admins" may sudo WITH their password.
# - Local users in wheel (sascha.koenig, jannik.mueller) may sudo WITH
#   their password.
# - Normal domain users may NOT sudo (everything they need — USB mount,
#   audio, screen-lock — runs via polkit/udisks).
#
# Q7 decision: "Ja, aber mit Passwort" — passwordless sudo is disabled.
{
  config,
  lib,
  ...
}: let
  inherit (lib) mkIf;
  cfg = config.az.tc;
in {
  config = mkIf cfg.enable {
    security.sudo = {
      enable = true;
      execWheelOnly = true;
      extraRules = [
        {
          groups = ["wheel"];
          commands = [
            {
              command = "ALL";
              options = ["PASSWD"];
            }
          ];
        }
        {
          # SSSD maps "domain admins" via gid; reference by name with escaping.
          groups = ["domain admins"];
          commands = [
            {
              command = "ALL";
              options = ["PASSWD"];
            }
          ];
        }
      ];
    };
  };
}