// Allow kiosk user to run apt update, apt install for rhemawave packages,
// and restart getty for application reloading
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.policykit.exec" &&
        subject.user == "kiosk") {

        var program = action.lookup("program");
        var cmdline = action.lookup("command_line");

        // Allow dpkg --configure -a
        if (program == "/usr/bin/dpkg") {
            if (cmdline && cmdline.indexOf("--configure") >= 0) {
                return polkit.Result.YES;
            }
        }

        // Allow apt update
        if (program == "/usr/bin/apt") {
            if (cmdline && cmdline.indexOf("update") >= 0) {
                return polkit.Result.YES;
            }

            // Allow: apt install --only-upgrade rhemawave[-dev]
            if (cmdline &&
                cmdline.indexOf("install") >= 0 &&
                cmdline.indexOf("--only-upgrade") >= 0 &&
                cmdline.indexOf("rhemawave") >= 0) {
                return polkit.Result.YES;
            }
        }

        // Allow systemctl restart getty@tty1.service
        if (program == "/usr/bin/systemctl") {
            if (cmdline &&
                cmdline.indexOf("restart") >= 0 &&
                cmdline.indexOf("getty@tty1.service") >= 0) {
                return polkit.Result.YES;
            }
        }

        // Allow sh for Tailscale install script
        if (program == "/usr/bin/sh" || program == "/bin/sh") {
            if (cmdline && cmdline.indexOf("tailscale.com/install.sh") >= 0) {
                return polkit.Result.YES;
            }
        }

        // Allow tailscale set --operator
        if (program == "/usr/bin/tailscale") {
            if (cmdline && cmdline.indexOf("set") >= 0 && cmdline.indexOf("--operator") >= 0) {
                return polkit.Result.YES;
            }
        }
    }
});