setup-wsl.ps1

<#
.SYNOPSIS
    Audits or configures the default user for an existing WSL distribution.
.DESCRIPTION
    This optional helper is separate from setup.ps1 because it changes the
    selected Linux distribution. It never installs WSL or a distribution.
#>
param(
    [string]$Distribution,
    [ValidatePattern("^[a-z_][a-z0-9_-]*$")]
    [string]$UserName,
    [switch]$Audit,
    [switch]$Configure
)

$ErrorActionPreference = "Stop"
. (Join-Path $PSScriptRoot "src\config.ps1")

function Invoke-Wsl {
    param([string[]]$Arguments)

    $output = & wsl.exe @Arguments 2>&1
    if ($LASTEXITCODE -ne 0) {
        throw "wsl.exe $($Arguments -join ' ') failed: $($output -join [Environment]::NewLine)"
    }
    return $output
}

function Invoke-WslRootScript {
    param([string]$Script, [string]$TargetUser)

  $output = $Script | & wsl.exe -d $Distribution -u root -- bash -s -- $TargetUser 2>&1
    if ($LASTEXITCODE -ne 0) {
    throw "WSL configuration failed: $($output -join [Environment]::NewLine)"
    }
}

function Test-WslCommand {
  param([string[]]$Arguments)

  & wsl.exe @Arguments 2>$null | Out-Null
  return $LASTEXITCODE -eq 0
}

function Get-WslUserState {
  param([string[]]$BaseArguments, [string]$Name)

  $problems = @()
  $userId = (Invoke-Wsl ($BaseArguments + @("--exec", "id", "-u")) | Select-Object -Last 1).Trim()
  $entry = (Invoke-Wsl ($BaseArguments + @("--exec", "getent", "passwd", $Name)) | Select-Object -Last 1).Trim()
  $fields = $entry -split ":", 7
  $homeDirectory = if ($fields.Count -eq 7) { $fields[5] } else { "" }
  $shell = if ($fields.Count -eq 7) { $fields[6] } else { "" }

  if ($Name -eq "root" -or $userId -eq "0") { $problems += "default user is root" }
  if ($fields.Count -ne 7 -or $fields[0] -ne $Name) { $problems += "passwd entry is missing" }
  if (-not $homeDirectory -or -not (Test-WslCommand ($BaseArguments + @("--exec", "test", "-d", $homeDirectory)))) { $problems += "home directory is missing" }
  elseif (-not (Test-WslCommand ($BaseArguments + @("--exec", "test", "-w", $homeDirectory)))) { $problems += "home directory is not writable" }
  if (-not $shell -or -not (Test-WslCommand ($BaseArguments + @("--exec", "test", "-x", $shell)))) { $problems += "login shell is unavailable" }
  if (-not (Test-WslCommand ($BaseArguments + @("--exec", "sudo", "-n", "true")))) { $problems += "passwordless sudo is unavailable" }

  return [pscustomobject]@{
    Name = $Name
    UserId = $userId
    HomeDirectory = $homeDirectory
    Shell = $shell
    Problems = $problems
    MeetsCriteria = $problems.Count -eq 0
  }
}

if (-not (Get-Command wsl.exe -ErrorAction SilentlyContinue)) {
    Write-DevSetupStatus skip "WSL" "wsl.exe is not installed"
    exit 0
}

$distributions = @(Invoke-Wsl @("--list", "--quiet") | Where-Object { $_.Trim() })
if ($distributions.Count -eq 0) {
    Write-DevSetupStatus skip "WSL" "no distributions are installed"
    exit 0
}

if ($Distribution -and $distributions -notcontains $Distribution) {
    throw "WSL distribution '$Distribution' is not installed. Available: $($distributions -join ', ')"
}

$wslArguments = @()
if ($Distribution) { $wslArguments += @("-d", $Distribution) }
$currentUser = (Invoke-Wsl ($wslArguments + @("--exec", "whoami")) | Select-Object -Last 1).Trim()
$target = if ($Distribution) { $Distribution } else { "the default distribution" }
$currentUserState = Get-WslUserState $wslArguments $currentUser

if ($currentUserState.MeetsCriteria) {
  Write-DevSetupStatus found "WSL" "$target starts as $currentUser with a writable home, login shell, and passwordless sudo"
    exit 0
}

if (-not $Configure) {
  $mode = if ($Audit) { "would configure" } else { "run with -Configure -UserName <name> to configure" }
  Write-DevSetupStatus warn "WSL" "$target is not ready: $($currentUserState.Problems -join '; '); $mode a non-root default user"
    exit 0
}

if (-not $UserName) {
  if ($currentUser -eq "root") {
    throw "-Configure requires -UserName <name> when the default WSL user is root."
  }
  $UserName = $currentUser
}

$rootArguments = @()
if ($Distribution) { $rootArguments += @("-d", $Distribution) }
$rootArguments += @("-u", "root", "--exec", "id", "-u", $UserName)
$userExists = Test-WslCommand $rootArguments
if ($userExists) {
  Write-DevSetupStatus found "WSL" "$UserName already exists; updating its WSL access"
} else {
  Write-DevSetupStatus install "WSL" "creating $UserName in $target"
}
$configurationScript = @'
set -euo pipefail
user_name="$1"
if ! id -u "$user_name" >/dev/null 2>&1; then
  useradd -m -s /bin/bash "$user_name"
fi
printf '%s ALL=(ALL) NOPASSWD: ALL\n' "$user_name" > "/etc/sudoers.d/$user_name"
chmod 0440 "/etc/sudoers.d/$user_name"
visudo -cf "/etc/sudoers.d/$user_name"
config_file=/etc/wsl.conf
temp_file="$(mktemp)"
if [ -f "$config_file" ]; then
  awk -v user="$user_name" '
    BEGIN { in_user = 0; seen_user = 0; wrote_default = 0 }
    /^[[:space:]]*\[user\][[:space:]]*$/ {
      if (in_user && !wrote_default) print "default=" user
      in_user = 1; seen_user = 1; wrote_default = 0; print; next
    }
    /^[[:space:]]*\[/ {
      if (in_user && !wrote_default) print "default=" user
      in_user = 0
    }
    in_user && /^[[:space:]]*default[[:space:]]*=/ {
      if (!wrote_default) print "default=" user
      wrote_default = 1; next
    }
    { print }
    END {
      if (in_user && !wrote_default) print "default=" user
      if (!seen_user) print "[user]\ndefault=" user
    }
  ' "$config_file" > "$temp_file"
else
  printf '[user]\ndefault=%s\n' "$user_name" > "$temp_file"
fi
cat "$temp_file" > "$config_file"
rm -f "$temp_file"
'@
Invoke-WslRootScript $configurationScript $UserName

Write-DevSetupStatus install "WSL" "restarting WSL to apply default user"
Invoke-Wsl @("--shutdown") | Out-Null
$verifyArguments = @()
if ($Distribution) { $verifyArguments += @("-d", $Distribution) }
$verifiedUser = (Invoke-Wsl ($verifyArguments + @("--exec", "whoami")) | Select-Object -Last 1).Trim()
if ($verifiedUser -ne $UserName) {
    throw "WSL still starts as $verifiedUser; expected $UserName."
}
$verifiedState = Get-WslUserState $verifyArguments $verifiedUser
if (-not $verifiedState.MeetsCriteria) {
  throw "WSL user $verifiedUser is not ready: $($verifiedState.Problems -join '; ')"
}
Write-DevSetupStatus found "WSL" "$target starts as $verifiedUser with a writable home, login shell, and passwordless sudo"