updated gui and enforcement

app/users.py

@@ -1,59 +1,159 @@
+from __future__ import annotations
+
 import pwd
 import subprocess
 
 
-def linux_user_exists(username: str) -> bool:
+def user_exists(
+    username: str,
+) -> bool:
     try:
-        pwd.getpwnam(username)
+        pwd.getpwnam(
+            username
+        )
         return True
     except KeyError:
         return False
 
 
-def get_uid(username: str) -> int:
-    return pwd.getpwnam(username).pw_uid
-
-
-def is_locked(username: str) -> bool:
-    result = subprocess.run(
-        ["passwd", "-S", username],
+def _run(
+    command: list[str],
+) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        command,
         capture_output=True,
         text=True,
         check=False,
     )
 
+
+def is_locked(
+    username: str,
+) -> bool:
+    if not user_exists(username):
+        return False
+
+    result = _run(
+        [
+            "passwd",
+            "-S",
+            username,
+        ]
+    )
+
     if result.returncode != 0:
         return False
 
-    parts = result.stdout.split()
+    parts = result.stdout.strip().split()
 
     if len(parts) < 2:
         return False
 
-    return parts[1] == "L"
+    status = parts[1].upper()
+
+    return status.startswith("L")
 
 
-def lock_user(username: str):
-    subprocess.run(
-        ["loginctl", "terminate-user", username],
-        check=False,
+def lock_user(
+    username: str,
+) -> None:
+    if not user_exists(username):
+        raise RuntimeError(
+            f"Linux user does not exist: {username}"
+        )
+
+    result = _run(
+        [
+            "passwd",
+            "-l",
+            username,
+        ]
     )
 
-    subprocess.run(
-        ["passwd", "-l", username],
-        check=True,
+    if result.returncode != 0:
+        error = (
+            result.stderr.strip()
+            or result.stdout.strip()
+            or "unknown error"
+        )
+
+        raise RuntimeError(
+            f"Unable to lock {username}: {error}"
+        )
+
+
+def unlock_user(
+    username: str,
+) -> None:
+    if not user_exists(username):
+        raise RuntimeError(
+            f"Linux user does not exist: {username}"
+        )
+
+    result = _run(
+        [
+            "passwd",
+            "-u",
+            username,
+        ]
     )
 
+    if result.returncode != 0:
+        error = (
+            result.stderr.strip()
+            or result.stdout.strip()
+            or "unknown error"
+        )
 
-def unlock_user(username: str):
-    subprocess.run(
-        ["passwd", "-u", username],
-        check=True,
+        raise RuntimeError(
+            f"Unable to unlock {username}: {error}"
+        )
+
+
+def terminate_user(
+    username: str,
+) -> None:
+    if not user_exists(username):
+        return
+
+    result = _run(
+        [
+            "loginctl",
+            "terminate-user",
+            username,
+        ]
     )
 
+    if result.returncode != 0:
+        error = (
+            result.stderr.strip()
+            or result.stdout.strip()
+        )
 
-def terminate_user(username: str):
-    subprocess.run(
-        ["loginctl", "terminate-user", username],
-        check=False,
-    )
+        if error:
+            raise RuntimeError(
+                f"Unable to terminate "
+                f"{username}: {error}"
+            )
+
+
+def get_uid(
+    username: str,
+) -> int | None:
+    try:
+        return pwd.getpwnam(
+            username
+        ).pw_uid
+    except KeyError:
+        return None
+
+
+def get_home(
+    username: str,
+) -> str | None:
+    try:
+        return pwd.getpwnam(
+            username
+        ).pw_dir
+    except KeyError:
+        return None