#!/bin/bash
# Installs a TEMPORARY /etc/sudoers.d/mac-setup (NOPASSWD for seth) so an unattended setup run
# has sudo for Homebrew's long, child-spawning install. Reads the sudo password from stdin.
# Called by run.sh, which removes the drop-in afterward; a 40-min self-destruct is the backstop.
set -euo pipefail
read -r SUDO_PW
tmp=$(mktemp)
printf 'seth ALL=(ALL) NOPASSWD: ALL\n' > "$tmp"
sudo -S -p '' -v <<<"$SUDO_PW"                          # prime once from the piped password
sudo visudo -cf "$tmp"                                  # validate OFF to the side (bad sudoers breaks sudo)
sudo install -m 440 -o root -g wheel "$tmp" /etc/sudoers.d/mac-setup
rm -f "$tmp"
nohup sudo bash -c 'sleep 2400; rm -f /etc/sudoers.d/mac-setup' >/dev/null 2>&1 &  # survives ssh drop
echo "[set] temp NOPASSWD drop-in installed (+40m self-destruct)"