Enable the Touch ID authentication module on macOS (e.g. for sudo)

pam-tid.rb

#! /usr/bin/env ruby
if Process.euid.nonzero?
  $stderr.puts "Please run: sudo #{$0}"
  exit 1
end

PAM_PATH = "/etc/pam.d/sudo"
# The line to be inserted
LINE = "auth       sufficient     pam_tid.so"
# A regular expression that matches said line, plus whitespace variations
LINE_RE = /^\s*(#\s*)?#{Regexp.escape(LINE).gsub(/(\\?\s|\\t)+/, '\s+')}\s*$/m

pam = File.read(PAM_PATH)
if pam !~ LINE_RE
  # Line wasn't found
  $stderr.puts "Adding Touch ID"
  pam = pam.sub(/^(?!\s*#)/m, LINE + "\n")
elsif $1
  # Line was found, but the test for a leading "#" matched
  $stderr.puts "Uncommenting Touch ID"
  pam = "#{$`}#{LINE}#{$'}"
else
  # Line was found with no leading "#"
  $stderr.puts "Touch ID already applied"
  exit
end

File.write PAM_PATH, pam