fix(global): refresh dns recovery sudoers rule

Author: roodboi

src/commands/global.ts

@@ -792,12 +792,7 @@ async function globalAuthorize(): Promise<number> {
     return 1;
   }
 
-  if (await pathExists(MAC_DNS_SUDOERS_PATH)) {
-    logger.info({
-      message: `${MAC_DNS_SUDOERS_PATH} already installed`,
-    });
-    return 0;
-  }
+  const sudoersRuleExists = await pathExists(MAC_DNS_SUDOERS_PATH);
 
   const brew = await findExecutableInPath("brew");
   if (!brew) {
@@ -826,6 +821,12 @@ async function globalAuthorize(): Promise<number> {
     return 0;
   }
 
+  if (sudoersRuleExists) {
+    logger.info({
+      message: `Refreshing ${MAC_DNS_SUDOERS_PATH}`,
+    });
+  }
+
   const tempDir = resolve(getGlobalPaths().root, "tmp");
   await ensureDir(tempDir);
   const tempPath = resolve(tempDir, MAC_DNS_SUDOERS_TEMP_FILENAME);

tests/global-command.macos.test.ts

@@ -316,6 +316,39 @@ test("global authorize installs passwordless dns recovery sudoers rule", async (
   );
 });
 
+test("global authorize refreshes an existing dns recovery sudoers rule", async () => {
+  pathExistsOverrides.set("/etc/sudoers.d/dance.hack-dns-recovery", true);
+
+  const { runCli } = await import("../src/cli/run.ts");
+  const code = await runCli(["global", "authorize"]);
+
+  expect(code).toBe(0);
+  expect(runCalls).toEqual(
+    expect.arrayContaining([
+      [
+        "/usr/bin/mock-bin",
+        "-cf",
+        expect.stringContaining("dance.hack-dns-recovery.sudoers"),
+      ],
+      ["sudo", "install", "-d", "-m", "0755", "/etc/sudoers.d"],
+      [
+        "sudo",
+        "install",
+        "-m",
+        "0440",
+        expect.stringContaining("dance.hack-dns-recovery.sudoers"),
+        "/etc/sudoers.d/dance.hack-dns-recovery",
+      ],
+      [
+        "sudo",
+        "/usr/bin/mock-bin",
+        "-cf",
+        "/etc/sudoers.d/dance.hack-dns-recovery",
+      ],
+    ])
+  );
+});
+
 test("global authorize uses the OS account lookup instead of USER env", async () => {
   idUser = "real-login-user";
   process.env.USER = "spoofed-user";