Fall back to polkit when the DNS sudoers grant is missing (#7492)

grant_covers re-implemented etc/sudoers.d/omarchy-dns in bash -- one of
the three providers, and %wheel -- but never asked whether the rule was
installed. It ships in the etc/ tree that omarchy-settings copies, so
every machine still on an older settings package answers yes to a grant
it does not have. require_root then execs into sudo with no way back,
and the panel's one-click toggle dies on a password prompt it has no
terminal to show.

Ask sudo instead. `sudo -l` alone reports whether a command is
permitted, which the blanket %wheel rule answers yes to for everything,
but the long listing prints the matched entry's tags -- !authenticate is
the grant and nothing else. It runs nothing, and under -n it prompts for
nothing, so a machine without the rule falls through to polkit and gets
a prompt on screen.

The provider list and the wheel check go away with it; sudo owns that
policy now, and it stays right if the rule is ever edited or removed.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

bin/omarchy-dns

@@ -33,45 +33,28 @@ provider_from_arg() {
 # where $OMARCHY_PATH points at a checkout.
 PACKAGED_PATH=/usr/bin/omarchy-dns
 
-# True when etc/sudoers.d/omarchy-dns covers this invocation. Both halves of the
-# rule have to hold -- one of the three providers, and %wheel -- or sudo asks
-# for a password like any other command.
-grant_covers() {
-  local provider="${1:-}"
-  local group
-
-  case "$provider" in
-  Cloudflare | Google | DHCP) ;;
-  *) return 1 ;;
-  esac
-
-  for group in $(id -nG 2>/dev/null); do
-    [[ $group == wheel ]] && return 0
-  done
-
-  return 1
+# True when sudo would run this exact command without stopping for a password.
+# `sudo -l` on its own reports whether a command is permitted, which the blanket
+# %wheel rule answers yes to for everything; the long listing prints the matched
+# entry's tags, so !authenticate is the grant in etc/sudoers.d/omarchy-dns and
+# nothing else. Listing runs nothing and, under -n, prompts for nothing, so a
+# machine whose omarchy-settings predates that file falls through to polkit
+# instead of dying on a password prompt it has no terminal to show.
+sudo_grants_passwordless() {
+  sudo -n -l -l "$PACKAGED_PATH" "$@" 2>/dev/null | grep -q '!authenticate'
 }
 
 require_root() {
   if (( EUID == 0 )); then
     return
-  fi
-
-  # A terminal can carry sudo's own password prompt. Without one, sudo is still
-  # right when etc/sudoers.d/omarchy-dns covers this invocation: that grant is
-  # what keeps the panel's one-click provider switch from raising a polkit
-  # prompt. Custom and a caller outside %wheel still go through polkit, which
-  # can at least offer to authenticate as someone else.
-  #
-  # Do not swap this for a `sudo -n -l` probe. That reports whether a command is
-  # permitted, not whether it is passwordless, so the blanket %wheel rule
-  # answers yes for every argument and Custom dies on `sudo -n` instead of
-  # falling through to pkexec.
-  if [[ -t 0 ]] || grant_covers "${1:-}"; then
+  elif [[ -t 0 ]] || sudo_grants_passwordless "$@"; then
+    # A terminal can carry sudo's own password prompt. Without one, sudo is
+    # right only where the grant reaches; polkit can at least put a prompt on
+    # screen, and offer to authenticate as someone else.
     exec sudo "$PACKAGED_PATH" "$@"
+  else
+    exec pkexec "$PACKAGED_PATH" "$@"
   fi
-
-  exec pkexec "$PACKAGED_PATH" "$@"
 }
 
 networkmanager_global_dns() {