// =====================================================================
// Who may unfreeze a base image.
//
// The check is subject.active - a live, foreground login session of the
// operator. Deliberately NOT a group membership test: a group is
// inherited by every process a member starts, including a background
// service, and the whole point of this gate is that a human is present.
//
// `subject.local` was in this rule first and was removed on purpose.
// This machine's GNOME desktop is normally reached over RDP rather than
// at the console, and logind does not call such a session local - so the
// strict form refused the operator at their own desktop while changing
// nothing about what it excludes. The agent has no session at all;
// vmd has no session at all; a systemd service has no session at all.
// `active` already rules out every one of them.
//
// The agent is not in this picture at all. It runs as owuivm, which
// cannot write a base image by file permission, and it has no verb that
// asks anything else to. This rule is what a person passes through, not
// a check the agent could fail.
// =====================================================================
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units") {
        var unit = action.lookup("unit") || "";
        if (unit.indexOf("owuivm-maint@") === 0 ||
            unit.indexOf("owuivm-detach@") === 0 ||
            unit.indexOf("owuivm-thaw@") === 0 ||
            unit.indexOf("owuivm-freeze@") === 0 ||
            // Putting a disc in the library, and renaming a machine.
            // Neither touches a base image, but both write somewhere the
            // operator's own account cannot, so they pass the same gate
            // as everything else here rather than inventing a second one.
            unit.indexOf("owuivm-insert@") === 0 ||
            unit.indexOf("owuivm-rename@") === 0) {
            if (subject.active && subject.user == "@OPERATOR@") {
                return polkit.Result.YES;
            }
            return polkit.Result.NO;
        }
    }
});