# roles/thin-client/identity/sudo.nix
#
# Sudo policy:
# - Members of "domain admins" may sudo WITH their password.
# - Local users in wheel (sascha.koenig, jannik.mueller) may sudo WITH
#   their password.
# - Normal domain users may NOT sudo (everything they need — USB mount,
#   audio, screen-lock — runs via polkit/udisks).
#
# Q7 decision: "Ja, aber mit Passwort" — passwordless sudo is disabled.
{
  config,
  lib,
  ...
}: let
  inherit (lib) mkIf;
  cfg = config.az.tc;
in {
  config = mkIf cfg.enable {
    # Use extraConfig because sudoers syntax requires escaping the space
    # in "domain admins" as `\ `. extraRules would not let us inject that.
    security.sudo = {
      enable = true;
      execWheelOnly = true;
      extraConfig = ''
        # Domain Admins — sudo WITH password (Q7 decision).
        # The backslash-space escapes the space in "domain admins".
        %domain\ admins ALL=(ALL:ALL) PASSWD: ALL
        Defaults:%domain\ admins env_keep+=TERMINFO_DIRS
        Defaults:%domain\ admins env_keep+=TERMINFO
      '';
    };
  };
}