// The classroom user cannot be shown a saved Wi-Fi password.
//
// These are shared computers in rooms full of people. The account a
// teacher uses must be able to USE the church's Wi-Fi and must never be
// able to READ its password, and those two are much closer together in a
// stock desktop than they look.
//
// WHY THIS IS NOT DONE IN THE PANEL.
//
// Plasma's network applet offers "Show Network's QR Code" on every saved
// wireless connection — a contextual action in ConnectionItem.qml — and
// that QR code contains the pre-shared key in plain text. Next to it is
// "Configure…", which opens the connection editor. Neither is covered by
// the Kiosk key that hides the applet's own settings button: measured,
// authorizeControlModule("kcm_networkmanagement") gates the toolbar entry
// and not those two.
//
// So hiding buttons cannot be the answer. Every one of those paths ends
// at the same place — NetworkManager's GetSecrets over D-Bus — and polkit
// is where that is answered once, for the applet, the editor, nmcli, a
// future Plasma version and anything else that asks.
//
// WHAT IS REFUSED, AND WHAT IS DELIBERATELY NOT.
//
// Refused: reading or changing stored connections, and the two sharing
// actions that exist to hand the password to somebody.
//
// settings.modify.own is the one that matters most and is the easiest to
// miss. Debian ships it as "yes" — no authentication at all — and it
// applies to any connection whose connection.permissions names this user.
// A Wi-Fi network added from the desktop is created that way by default,
// so a password typed in by a teacher would be readable by the next
// person to sit down. This is why the church's Wi-Fi must be provisioned
// as a SYSTEM connection by an administrator; see classroom-wifi.
//
// Not refused: network-control, wifi.scan and the enable/disable actions.
// Those are what connecting to a network and seeing that it is there are
// made of, and none of them returns a secret. Automatic reconnection does
// not go through polkit at all — NetworkManager does it as root — so
// nothing here can stop the room coming back on the network after a
// reboot.
//
// Scoped to the classroom user by name. A technician's account and root
// are untouched, which is what keeps the machine serviceable: an
// administrator on SSH can still read, edit and add connections normally.
//
// To lift this for maintenance, drop a file of the same name into
// /etc/polkit-1/rules.d/, which polkit reads ahead of this one.

polkit.addRule(function (action, subject) {
    if (subject.user !== "classroom") {
        return polkit.Result.NOT_HANDLED;
    }

    var refused = [
        // Reading or writing the secrets of a connection this user owns.
        // Debian's default for this is "yes".
        "org.freedesktop.NetworkManager.settings.modify.own",
        // The same for a connection belonging to the system. Debian asks
        // for an administrator password here; the classroom has no
        // administrator standing at it, and a prompt a teacher cannot
        // answer is worse than no menu entry.
        "org.freedesktop.NetworkManager.settings.modify.system",
        // Handing the password to somebody: the QR code, and the open
        // network equivalent.
        "org.freedesktop.NetworkManager.wifi.share.protected",
        "org.freedesktop.NetworkManager.wifi.share.open",
        // Machine-wide settings a classroom has no business changing.
        "org.freedesktop.NetworkManager.settings.modify.hostname",
        "org.freedesktop.NetworkManager.settings.modify.global-dns",
        "org.freedesktop.NetworkManager.reload",
        "org.freedesktop.NetworkManager.checkpoint-rollback",
    ];

    for (var i = 0; i < refused.length; i++) {
        if (action.id === refused[i]) {
            polkit.log(
                "ekklesia-classroom: refusing " + action.id +
                " for the classroom user"
            );
            return polkit.Result.NO;
        }
    }

    return polkit.Result.NOT_HANDLED;
});