Do not ask for password if not needed. (#69)

* Do not ask for password if not needed.

In certain circumstances we do not need to ask for a password because we
already have previously authenticated to sudo and can just reuse the
credentials.

Since there is no way to check if a sudo timestamp has timed out we run
a simple command and check the result.

Using an existing sudo timestamp from within nvim seems to work only if
the timestamp_type is set to 'global' in the sudo configuration file.

The assesment of the risk of setting the security relevant setting
timestamp_type to 'global' needs to be done by the user.

* Explain sudoers settings and limitations in user documentation.

Author: sstark

autoload/suda.vim

@@ -9,13 +9,24 @@ function! suda#system(cmd, ...) abort
   if v:shell_error == 0
     return result
   endif
-  try
-    call inputsave()
-    redraw | let password = inputsecret(g:suda#prompt)
-  finally
-    call inputrestore()
-  endtry
-  let cmd = printf('%s -p '''' -S %s', g:suda#executable, a:cmd)
+  " Let's try running a command non-interactively. If it works, we have a sudo
+  " timestamp that has not timed out yet. In this case there is no need to ask
+  " for a password.
+  " This only works if the timestamp_type is set to 'global' in the sudo
+  " configuation file. It does not work with 'ppid', 'kernel' or 'tty'.
+  let cmd = printf('%s -n true', g:suda#executable)
+  let result = system(cmd)
+  if v:shell_error == 0
+    let cmd = printf('%s %s', g:suda#executable, a:cmd)
+  else
+    try
+      call inputsave()
+      redraw | let password = inputsecret(g:suda#prompt)
+    finally
+      call inputrestore()
+    endtry
+    let cmd = printf('%s -p '''' -S %s', g:suda#executable, a:cmd)
+  endif
   return system(cmd, password . "\n" . (a:0 ? a:1 : ''))
 endfunction
 

doc/suda.txt

@@ -37,6 +37,17 @@ Make sure that the following shows 1.
 >
 	: echo executable('sudo')
 <
+*suda* will ask for a password each time sudo is used for reading or writing.
+However, you can set global timestamps in your sudoers configuration, if you
+have sudo version 1.8.21 or higher. This will enable *suda* to reuse an
+existing sudo authentication token. In this case, it will not ask for a
+password if not needed. To enable, configure sudo with this option:
+>
+        Defaults timestamp_type = global
+<
+The other types 'ppid', 'kernel' or 'tty' will not allow *suda* to use sudo
+credential caching. Please make sure this is in line with your security
+requirements.
 
 =============================================================================
 USAGE						*suda-usage*