cubes: user:add gets optional PUBKEY, space-separated GROUPS, exists guard

PUBKEY defaults to empty now — empty means no key is authorised, and some
users need none. GROUPS was always split on whitespace by deploy.py, so the
comma-separated prompt label and README were documenting a bug; both now say
space-separated. The deploy script checks the Users fact up front and noops
when the user exists, since rerunning reset the password and overwrote
~/.config/fish.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ce5atB2tXDXyz2jd9s1bqE

packages/nopy-cubes-core/cubes/user/add/deploy.py

@@ -1,6 +1,6 @@
 from pyinfra import host
 from pyinfra.operations import server, files, apt
-from io import StringIO
+from pyinfra.facts.server import Users
 
 # Define the username, password, and public key for the new admin user
 USER = host.data.USER
@@ -11,83 +11,89 @@ PASSWORD = host.data.PASSWORD
 # line, so an absent key means no key rather than a blank one.
 PUBKEY = host.data.PUBKEY
 PUBKEYS = [PUBKEY] if PUBKEY and str(PUBKEY).strip() else []
-GROUPS = list(filter(None, map(str.strip, str(host.data.GROUPS).split())))
+GROUPS = str(host.data.GROUPS).split()
 FISH_PATH = "/usr/bin/fish"
 FISH_CONFIG_DIR = f"{HOME_DIR}/.config/fish"
 FISH_CONFIG_FILE = f"{FISH_CONFIG_DIR}/config.fish"
 FISH_RC_DIR = f"{FISH_CONFIG_DIR}/rc"
 SSH_AGENT_SCRIPT = f"{FISH_RC_DIR}/ssh-agent.fish"
 
-apt.packages(
-    name='Ensure fish shell is installed',
-    packages=[ 'fish'],
-    _sudo=True
-)
+# An existing user is left entirely alone — everything below would reset the
+# password and overwrite ~/.config/fish, clobbering whatever the user has
+# changed since their account was created.
+if host.get_fact(Users).get(USER):
+    host.noop(f"User {USER} already exists")
+else:
+    apt.packages(
+        name='Ensure fish shell is installed',
+        packages=[ 'fish'],
+        _sudo=True
+    )
 
 
-# Ensure the user exists with a login shell
-server.user(
-    name=f"Create user {USER} [{GROUPS}]",
-    present=True,
-    user=USER,
-    password=PASSWORD,
-    create_home=True,
-    groups=GROUPS,
-    shell=FISH_PATH,
-    public_keys=PUBKEYS,
-    _sudo=True
-)
+    # Ensure the user exists with a login shell
+    server.user(
+        name=f"Create user {USER} [{GROUPS}]",
+        present=True,
+        user=USER,
+        password=PASSWORD,
+        create_home=True,
+        groups=GROUPS,
+        shell=FISH_PATH,
+        public_keys=PUBKEYS,
+        _sudo=True
+    )
 
-for dir in [f"{HOME_DIR}/.ssh", FISH_RC_DIR, TMP_DIR]:
-    files.directory(
-        name=f"Ensure {dir} directory exists",
-        path=dir,
+    for dir in [f"{HOME_DIR}/.ssh", FISH_RC_DIR, TMP_DIR]:
+        files.directory(
+            name=f"Ensure {dir} directory exists",
+            path=dir,
+            present=True,
+            mode=700,
+            user=USER,
+            group=USER,
+            _sudo=True,
+            _sudo_user=USER,
+            _use_sudo_login=True
+        )
+
+    files.file(
+        name="Ensure .ssh/config exists",
+        path=f"{HOME_DIR}/.ssh/config",
         present=True,
-        mode=700,
         user=USER,
         group=USER,
+        _sudo=True
+    )
+
+    server.shell(
+        name=f"Install OMF(Oh My Fish) for {USER}",
+        commands=[
+            f"curl https://raw.githubusercontent.com/oh-my-fish/oh-my-fish/master/bin/install > install-omf",
+            f"fish install-omf --yes --noninteractive",
+        ],
         _sudo=True,
         _sudo_user=USER,
         _use_sudo_login=True
     )
 
-files.file(
-    name="Ensure .ssh/config exists",
-    path=f"{HOME_DIR}/.ssh/config",
-    present=True,
-    user=USER,
-    group=USER,
-    _sudo=True
-)
+    files.put(
+        name="Add SSH agent auto-load script to Fish rc directory",
+        src="ssh-agent.fish",
+        dest=SSH_AGENT_SCRIPT,
+        user=USER,
+        group=USER,
+        mode="755",  # Make it executable
+        _sudo=True,
 
-server.shell(
-    name=f"Install OMF(Oh My Fish) for {USER}",
-    commands=[
-        f"curl https://raw.githubusercontent.com/oh-my-fish/oh-my-fish/master/bin/install > install-omf",
-        f"fish install-omf --yes --noninteractive",
-    ],
-    _sudo=True,
-    _sudo_user=USER,
-    _use_sudo_login=True
-)
+    )
 
-files.put(
-    name="Add SSH agent auto-load script to Fish rc directory",
-    src="ssh-agent.fish",
-    dest=SSH_AGENT_SCRIPT,
-    user=USER,
-    group=USER,
-    mode="755",  # Make it executable
-    _sudo=True,
-
-)
-
-files.put(
-    name="Add custom config.fish",
-    src="config.fish",
-    dest=FISH_CONFIG_FILE,
-    user=USER,
-    group=USER,
-    mode="755",  # Make it executable
-    _sudo=True,
-)
+    files.put(
+        name="Add custom config.fish",
+        src="config.fish",
+        dest=FISH_CONFIG_FILE,
+        user=USER,
+        group=USER,
+        mode="755",  # Make it executable
+        _sudo=True,
+    )