sudo: add assertion; avoid silent errors

modules/common/sudo.nix

@@ -1,3 +1,6 @@
+{ config, ... }:
+
+# https://github.com/nix-community/srvos/blob/main/nixos/common/sudo.nix
 {
   security.sudo = {
     # Only allow members of the wheel group to execute sudo by setting the executable’s permissions accordingly. This prevents users that are not members of wheel from exploiting vulnerabilities in sudo such as CVE-2021-3156.
@@ -7,4 +10,18 @@
       Defaults lecture = never
     '';
   };
+
+  assertions =
+    let
+      validUsers = users: users == [ ] || users == [ "root" ];
+      validGroups = groups: groups == [ ] || groups == [ "wheel" ];
+      validUserGroups = builtins.all
+        (r: validUsers (r.users or [ ]) && validGroups (r.groups or [ ]))
+        config.security.sudo.extraRules;
+    in
+    [{
+      assertion = config.security.sudo.execWheelOnly -> validUserGroups;
+      message = "Some definitions in `security.sudo.extraRules` refer to users other than 'root' or groups other than 'wheel'. Disable `config.security.sudo.execWheelOnly`, or adjust the rules.";
+    }];
 }
+