From 89bf5a831a0f6060367c5ab9839219bb0f7a2655 Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Thu, 30 Jul 2026 19:09:34 +0900
Subject: [PATCH] assets/polkit: add policy + example rules

---
 assets/polkit/10-no.ntnu.pvv.roowho2.rules | 17 ++++++++++++
 assets/polkit/no.ntnu.pvv.roowho2.policy   | 30 ++++++++++++++++++++++
 flake.nix                                  |  1 +
 nix/package.nix                            |  3 +++
 4 files changed, 51 insertions(+)
 create mode 100644 assets/polkit/10-no.ntnu.pvv.roowho2.rules
 create mode 100644 assets/polkit/no.ntnu.pvv.roowho2.policy

diff --git a/assets/polkit/10-no.ntnu.pvv.roowho2.rules b/assets/polkit/10-no.ntnu.pvv.roowho2.rules
new file mode 100644
index 0000000..4622863
--- /dev/null
+++ b/assets/polkit/10-no.ntnu.pvv.roowho2.rules
@@ -0,0 +1,17 @@
+// Example site policy, layered on top of the <defaults> in no.ntnu.pvv.roowho2.policy.
+
+polkit.addRule(function (action, subject) {
+    if (action.id !== "no.ntnu.pvv.roowho2.wall" && action.id !== "no.ntnu.pvv.roowho2.write") {
+        return polkit.Result.NOT_HANDLED;
+    }
+
+    // `wall -g <group>` restricted to members of that same group.
+    if (action.id === "no.ntnu.pvv.roowho2.wall") {
+        var group = action.lookup("group");
+        if (group && !subject.isInGroup(group)) {
+            return polkit.Result.NO;
+        }
+    }
+
+    return polkit.Result.NOT_HANDLED;
+});
diff --git a/assets/polkit/no.ntnu.pvv.roowho2.policy b/assets/polkit/no.ntnu.pvv.roowho2.policy
new file mode 100644
index 0000000..f4ef7d6
--- /dev/null
+++ b/assets/polkit/no.ntnu.pvv.roowho2.policy
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>Programvareverkstedet</vendor>
+  <vendor_url>https://git.pvv.ntnu.no/Projects/roowho2</vendor_url>
+
+  <action id="no.ntnu.pvv.roowho2.wall">
+    <description>Broadcast a message to logged in users</description>
+    <message>Authentication is required to broadcast a message to all users</message>
+    <defaults>
+      <allow_any>auth_self</allow_any>
+      <allow_inactive>auth_self</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:roowho2</annotate>
+  </action>
+
+  <action id="no.ntnu.pvv.roowho2.write">
+    <description>Send a message to another user's terminal</description>
+    <message>Authentication is required to send a message to another user</message>
+    <defaults>
+      <allow_any>auth_self</allow_any>
+      <allow_inactive>auth_self</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:roowho2</annotate>
+  </action>
+</policyconfig>
diff --git a/flake.nix b/flake.nix
index 5eb3ee7..011f55b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -92,6 +92,7 @@
         fileset = lib.fileset.unions [
           (craneLib.fileset.commonCargoSources ./.)
           ./assets/systemd
+          ./assets/polkit
         ];
       };
 
diff --git a/nix/package.nix b/nix/package.nix
index ce9ec44..d916487 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -93,6 +93,9 @@ buildFunction ({
     install -Dm444 assets/systemd/roowho2.service "$out/lib/systemd/system/roowho2.service"
     substituteInPlace "$out/lib/systemd/system/roowho2.service" \
       --replace "/usr/bin/roowhod" "${placeholder "out"}/bin/${mainProgram}"
+
+    install -Dm444 assets/polkit/no.ntnu.pvv.roowho2.policy "$out/share/polkit-1/actions/no.ntnu.pvv.roowho2.policy"
+    install -Dm444 assets/polkit/10-no.ntnu.pvv.roowho2.rules "$out/share/polkit-1/rules.d/10-no.ntnu.pvv.roowho2.rules"
   '';
 
   meta = with lib; {