Repository: microsoft/terminal
File: src/cascadia/TerminalApp/AppLogic.cpp (C++)

Code before:
        winrt::IInspectable g = resources.Lookup(key);
        auto brush = g.try_as<winrt::Windows::UI::Xaml::Media::Brush>();
        textRun.Foreground(brush);
    }

    return textRun;
}

// Method Description:
// - Returns whether the user is either a member of the Administrators group or
//   is currently elevated.
// - This will return **FALSE** if the user has UAC disabled entirely, because
//   there's no separation of power between the user and an admin in that case.
// Return Value:
// - true if the user is an administrator
static bool _isUserAdmin() noexcept
try
{
    DWORD dwSize;
    wil::unique_handle hToken;
    TOKEN_ELEVATION_TYPE elevationType;
    TOKEN_ELEVATION elevationState{ 0 };

    OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken);
    THROW_IF_WIN32_BOOL_FALSE(GetTokenInformation(hToken.get(), TokenElevationType, &elevationType, sizeof(elevationType), &dwSize));
    THROW_IF_WIN32_BOOL_FALSE(GetTokenInformation(hToken.get(), TokenElevation, &elevationState, sizeof(elevationState), &dwSize));
    if (elevationType == TokenElevationTypeDefault && elevationState.TokenIsElevated)
    {
        // In this case, the user has UAC entirely disabled. This is sort of
        // weird, we treat this like the user isn't an admin at all. There's no
        // separation of powers, so the things we normally want to gate on
        // "having special powers" doesn't apply.
        //
        // See GH#7754, GH#11096
        return false;
    }

    SID_IDENTIFIER_AUTHORITY ntAuthority{ SECURITY_NT_AUTHORITY };
    wil::unique_sid adminGroupSid{};
    THROW_IF_WIN32_BOOL_FALSE(AllocateAndInitializeSid(&ntAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &adminGroupSid));
    BOOL b;
    THROW_IF_WIN32_BOOL_FALSE(CheckTokenMembership(NULL, adminGroupSid.get(), &b));
    return !!b;
}
catch (...)
{
    LOG_CAUGHT_EXCEPTION();
    return false;
}

namespace winrt::TerminalApp::implementation

Review comment (suggestion):
You're gonna think this is crazy, but... check this out.

I *think* you can do this with WIL, and I believe that you can even use the pseudotokens that do not need lifetime management.

```suggestion
    auto elevationType = wil::get_token_information<TOKEN_ELEVATION_TYPE>(GetCurrentProcessToken());
    auto elevationState = wil::get_token_information<TOKEN_ELEVATION>(GetCurrentProcessToken());
```

Code after:
    {
        winrt::IInspectable g = resources.Lookup(key);
        auto brush = g.try_as<winrt::Windows::UI::Xaml::Media::Brush>();
        textRun.Foreground(brush);
    }

    return textRun;
}

// Method Description:
// - Returns whether the user is either a member of the Administrators group or
//   is currently elevated.
// - This will return **FALSE** if the user has UAC disabled entirely, because
//   there's no separation of power between the user and an admin in that case.
// Return Value:
// - true if the user is an administrator
static bool _isUserAdmin() noexcept
try
{
    wil::unique_handle processToken{ GetCurrentProcessToken() };
    const auto elevationType = wil::get_token_information<TOKEN_ELEVATION_TYPE>(processToken.get());
    const auto elevationState = wil::get_token_information<TOKEN_ELEVATION>(processToken.get());
    if (elevationType == TokenElevationTypeDefault && elevationState.TokenIsElevated)
    {
        // In this case, the user has UAC entirely disabled. This is sort of
        // weird, we treat this like the user isn't an admin at all. There's no
        // separation of powers, so the things we normally want to gate on
        // "having special powers" doesn't apply.
        //
        // See GH#7754, GH#11096
        return false;
    }

    return wil::test_token_membership(nullptr, SECURITY_NT_AUTHORITY, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS);
}
catch (...)
{
    LOG_CAUGHT_EXCEPTION();
    return false;
}

namespace winrt::TerminalApp::implementation
{
    // Function Description:
    // - Get the AppLogic for the current active Xaml application, or null if there isn't one.
    // Return value:
    // - A pointer (bare) to the AppLogic, or nullptr. The app logic outlives all other objects,
    //   unless the application is in a terrible way, so this is "safe."
    AppLogic* AppLogic::Current() noexcept
    try
    {