// Members of the `punktfunk-update` group may START exactly one more unit: the punktfunk
// root-helper oneshot that updates the punktfunk CLIENT packages (planning:
// host-update-from-web-console.md §7). Sibling of 49-punktfunk-update.rules, which grants the
// host's unit; the group is the same one, so a box that has opted in has opted in once.
//
// The group ships EMPTY — joining it is the explicit, auditable opt-in for one-tap client
// updates (the Decky plugin's "Update client" button, `punktfunk-client --apply-update`):
//
//     sudo usermod -aG punktfunk-update <your user>
//
// Scope notes: `verb == "start"` keeps stop/restart/enable out of the grant, and the unit
// name pin keeps every other unit out. The unit's ExecStart is fixed and parameterless, so
// this grant authorizes "run the system's normal update for the punktfunk packages" and
// nothing else.
polkit.addRule(function (action, subject) {
    if (
        action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "punktfunk-client-update.service" &&
        action.lookup("verb") == "start" &&
        subject.isInGroup("punktfunk-update")
    ) {
        return polkit.Result.YES;
    }
});