refactor: run pre-sudo before pre-cmds && clear cached credential aft…

config.example.toml

@@ -25,6 +25,7 @@
 
 # Run `sudo -v` to cache credentials at the start of the run
 # This avoids a blocking password prompt in the middle of an unattended run
+# This cached credential will be cleared after execution
 #pre_sudo = false
 
 # Run inside tmux

src/config.rs

@@ -1424,8 +1424,7 @@ impl Config {
         self.config_file.misc.as_ref().and_then(|misc| misc.sudo_command)
     }
 
-    /// If `true`, `sudo` should be called after `pre_commands` in order to elevate at the
-    /// start of the session (and not in the middle).
+    /// If `true`, `sudo` would be called before everything to cache the credential.
     pub fn pre_sudo(&self) -> bool {
         self.config_file
             .misc

src/main.rs

@@ -114,6 +114,12 @@ fn run() -> Result<()> {
     let ctx = execution_context::ExecutionContext::new(run_type, sudo, &git, &config);
     let mut runner = runner::Runner::new(&ctx);
 
+    if config.pre_sudo() {
+        if let Some(sudo) = ctx.sudo() {
+            sudo.elevate(&ctx)?;
+        }
+    }
+
     #[cfg(feature = "self-update")]
     {
         let config_self_upgrade = env::var("TOPGRADE_NO_SELF_UPGRADE").is_err() && !config.no_self_update();
@@ -146,12 +152,6 @@ fn run() -> Result<()> {
         }
     }
 
-    if config.pre_sudo() {
-        if let Some(sudo) = ctx.sudo() {
-            sudo.elevate(&ctx)?;
-        }
-    }
-
     if let Some(topgrades) = config.remote_topgrades() {
         for remote_topgrade in topgrades.iter().filter(|t| config.should_execute_remote(t)) {
             runner.execute(Step::Remotes, format!("Remote ({remote_topgrade})"), || {
@@ -457,6 +457,13 @@ fn run() -> Result<()> {
     }
     runner.execute(Step::Vagrant, "Vagrant boxes", || vagrant::upgrade_vagrant_boxes(&ctx))?;
 
+    // Clear the cached credential after executing all the steps
+    if config.pre_sudo() {
+        if let Some(sudo) = ctx.sudo() {
+            sudo.clear_credential(&ctx)?;
+        }
+    }
+
     if !runner.report().data().is_empty() {
         print_separator("Summary");
 

src/sudo.rs

@@ -89,6 +89,41 @@ impl Sudo {
         cmd.status_checked().wrap_err("Failed to elevate permissions")
     }
 
+    /// Clear the cached credential.
+    ///
+    /// No-op if the underlying sudo does not support this feature.
+    pub fn clear_credential(&self, ctx: &ExecutionContext) -> Result<()> {
+        print_separator("Sudo - Clear Cached Credential");
+        let mut cmd = ctx.run_type().execute(self);
+        match self.kind {
+            SudoKind::Doas => {
+                // From man page https://man.archlinux.org/man/doas.1.en
+                //
+                // -L: Clear any persisted authentications from previous invocations,
+                //     then immediately exit. No command is executed.
+                cmd.arg("-L");
+            }
+            SudoKind::Sudo => {
+                // From its man page:
+                //
+                // -k: When used without a command, invalidates the user's cached
+                //     credentials for the current session.
+                cmd.arg("-k");
+            }
+            SudoKind::Gsudo => {
+                // From https://gerardog.github.io/gsudo/docs/credentials-cache
+                cmd.arg("-k");
+            }
+            SudoKind::Pkexec => {
+                return Ok(());
+            }
+            SudoKind::Please => {
+                return Ok(());
+            }
+        }
+        cmd.status_checked()
+    }
+
     /// Execute a command with `sudo`.
     pub fn execute_elevated(&self, ctx: &ExecutionContext, command: &Path, interactive: bool) -> Executor {
         let mut cmd = ctx.run_type().execute(self);