setup_permissions.sh

#!/bin/bash
set -euo pipefail

if [ "$(id -u)" -ne 0 ]; then
    echo "Run once with: pkexec bash setup_permissions.sh"
    exit 1
fi

TARGET_USER="${SUDO_USER:-${USER}}"
if [ "$TARGET_USER" = "root" ] && [ -n "${PKEXEC_UID:-}" ]; then
    TARGET_USER="$(id -nu "$PKEXEC_UID")"
fi

getent group amper >/dev/null 2>&1 || groupadd amper
usermod -aG amper "$TARGET_USER"

cat > /etc/sudoers.d/amper <<'EOF'
%amper ALL=(ALL) NOPASSWD: /usr/bin/systemctl start *
%amper ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop *
%amper ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart *
%amper ALL=(ALL) NOPASSWD: /usr/bin/apt install *
%amper ALL=(ALL) NOPASSWD: /usr/bin/apt remove *
%amper ALL=(ALL) NOPASSWD: /usr/bin/dnf install *
%amper ALL=(ALL) NOPASSWD: /usr/bin/dnf remove *
%amper ALL=(ALL) NOPASSWD: /usr/bin/yum install *
%amper ALL=(ALL) NOPASSWD: /usr/bin/yum remove *
%amper ALL=(ALL) NOPASSWD: /usr/bin/pacman -S *
%amper ALL=(ALL) NOPASSWD: /usr/bin/pacman -R *
%amper ALL=(ALL) NOPASSWD: /usr/bin/zypper install *
%amper ALL=(ALL) NOPASSWD: /usr/bin/zypper remove *
%amper ALL=(ALL) NOPASSWD: /usr/bin/cp *
%amper ALL=(ALL) NOPASSWD: /usr/bin/chown *
EOF

chmod 440 /etc/sudoers.d/amper
visudo -cf /etc/sudoers.d/amper

echo "Amper permissions installed for user: $TARGET_USER"
echo "Log out and back in, or run: newgrp amper"
echo "Then restart Amper — no more password prompts."