touchid_sudo.plugin.zsh

# touchid_sudo.plugin.zsh

function enable_touchid_sudo() {
  local quiet=0

  if [[ "$1" == "--quiet" ]]; then
    quiet=1
  fi

  # Check if Touch ID is already enabled for sudo
  touchid_enabled=$(grep -q "auth.*pam_tid.so" /etc/pam.d/sudo && echo "true" || echo "false")

  # Ensure Touch ID is the first auth option
  touchid_first_option=$(grep -E -m1 "^auth" /etc/pam.d/sudo | grep -q "pam_tid.so" && echo "true" || echo "false")

  if [ "$touchid_enabled" = "false" ] || [ "$touchid_first_option" = "false" ]; then
    (($quiet)) || echo "Updating sudo configuration for Touch ID..."
    sudo cp /etc/pam.d/sudo /etc/pam.d/sudo.backup
    sudo awk -v touchid='auth       sufficient     pam_tid.so' '
      BEGIN { printed = 0 }
      /^auth/ && !printed { print touchid; printed = 1 }
      !/^auth.*pam_tid.so/ { print }
    ' /etc/pam.d/sudo > /tmp/sudo.tmp && sudo mv /tmp/sudo.tmp /etc/pam.d/sudo
    (($quiet)) || echo "Touch ID is now enabled for sudo authentication and set as the first option."
  else
    (($quiet)) || echo "Touch ID is already enabled and set as the first option for sudo authentication."
  fi
}

# Run the function at the start of a new terminal session
enable_touchid_sudo --quiet