From 8c02940d702170feea7947f768aa807c11b65a41 Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Tue, 22 Oct 2024 22:38:17 +1100
Subject: [PATCH] users: ensure Full Disk Access is granted before trying to
 delete users

---
 modules/users/default.nix        | 40 ++++++++++++++++++++++++++++++--
 pkgs/nix-tools/darwin-rebuild.sh |  2 +-
 tests/users-groups.nix           |  8 +++----
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/modules/users/default.nix b/modules/users/default.nix
index e9e3ac4a..ce77d4d9 100644
--- a/modules/users/default.nix
+++ b/modules/users/default.nix
@@ -148,6 +148,42 @@ in
     system.activationScripts.users.text = mkIf (cfg.knownUsers != []) ''
       echo "setting up users..." >&2
 
+      deleteUser() {
+        fullDiskAccess=false
+
+        if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then
+          fullDiskAccess=true
+        fi
+
+        if [[ "$fullDiskAccess" != true ]]; then
+          printf >&2 '\e[1;31merror: users cannot be deleted without Full Disk Access, aborting activation\e[0m\n'
+          printf >&2 'The user %s could not be deleted as `darwin-rebuild` was not executed with Full Disk Access.' "$1"
+
+          printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n'
+          printf >&2 '\n'
+          # This command will fail if run as root and System Settings is already running
+          # even if System Settings was launched by root.
+          sudo -u $SUDO_USER open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"
+
+          if [[ -n "$SSH_CONNECTION" ]]; then
+            printf >&2 'Please enable Full Disk Access for programs over SSH by flipping\n'
+            printf >&2 'the switch for `sshd-keygen-wrapper`.\n'
+          else
+            printf >&2 'Please enable Full Disk Access for your terminal emulator by flipping\n'
+            printf >&2 'the switch in System Settings.\n'
+          fi
+
+          exit 1
+        fi
+
+        sysadminctl -deleteUser "$1" 2> /dev/null
+
+        if id -u "$1" > /dev/null 2>&1; then
+          printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1"
+          exit 1
+        fi
+      }
+
       ${concatMapStringsSep "\n" (v: let
         name = lib.escapeShellArg v.name;
         dsclUser = lib.escapeShellArg "/Users/${v.name}";
@@ -156,7 +192,7 @@ in
           u=$(id -u ${name} 2> /dev/null) || true
           if [[ "$u" -eq ${toString v.uid} ]]; then
             echo "deleting user ${v.name}..." >&2
-            sysadminctl -deleteUser ${name} 2> /dev/null
+            deleteUser ${name}
           else
             echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
           fi
@@ -182,7 +218,7 @@ in
         if [ -n "$u" ]; then
           if [ "$u" -gt 501 ]; then
             echo "deleting user ${name}..." >&2
-            sysadminctl -deleteUser ${lib.escapeShellArg name} 2> /dev/null
+            deleteUser ${lib.escapeShellArg name}
           else
             echo "warning: existing user '${name}' has unexpected uid $u, skipping..." >&2
           fi
diff --git a/pkgs/nix-tools/darwin-rebuild.sh b/pkgs/nix-tools/darwin-rebuild.sh
index c0ea55b7..325cf501 100644
--- a/pkgs/nix-tools/darwin-rebuild.sh
+++ b/pkgs/nix-tools/darwin-rebuild.sh
@@ -23,7 +23,7 @@ sudo() {
   if command sudo --help | grep -- --preserve-env= >/dev/null; then
     # We use `env` before our command to ensure the preserved PATH gets checked
     # when trying to resolve the command to execute
-    command sudo -H --preserve-env=PATH env "$@"
+    command sudo -H --preserve-env=PATH --preserve-env=SSH_CONNECTION env "$@"
   else
     command sudo -H "$@"
   fi
diff --git a/tests/users-groups.nix b/tests/users-groups.nix
index d15909b3..7df92ba8 100644
--- a/tests/users-groups.nix
+++ b/tests/users-groups.nix
@@ -46,19 +46,19 @@
     grep "sysadminctl -addUser ${lib.escapeShellArgs [ "foo" "-UID" 42000 "-GID" 42000 "-fullName" "Foo user" "-home" "/Users/foo" "-shell" "/run/current-system/sw/bin/bash" ]}" ${config.out}/activate
     grep "createhomedir -cu ${lib.escapeShellArg "foo"}" ${config.out}/activate
     grep "sysadminctl -addUser ${lib.escapeShellArgs [ "created.user" "-UID" 42001 ]} .* ${lib.escapeShellArgs [ "-shell" "/sbin/nologin" ]}" ${config.out}/activate
-    grep -qv "sysadminctl -deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
-    grep -qv "sysadminctl -deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
+    grep -qv "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
+    grep -qv "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
 
     # checking user properties always get updated in /activate
     grep "dscl . -create ${lib.escapeShellArg "/Users/foo"} UserShell ${lib.escapeShellArg "/run/current-system/sw/bin/bash"}" ${config.out}/activate
 
     # checking user deletion in /activate
-    grep "sysadminctl -deleteUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
+    grep "deleteUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
     grep -qv "sysadminctl -addUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
 
     # checking unknown user in /activate
     grep -qv "sysadminctl -addUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
-    grep -qv "sysadminctl -deleteUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
+    grep -qv "deleteUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
 
     set +v
   '';