# Maestro KDS appliance — the app's ONE privileged command.
#
# Installed to /etc/sudoers.d/maestro-kds, mode 0440.
#
# This file is deliberately the SMALLEST and DULLEST thing in the appliance,
# because it is the one piece that cannot be fixed over the air: everything else
# — the helper, the session script, the units, the compositor config — ships
# inside the app bundle and is re-planted by `maestro-kds-ctl sync` on every
# update. A mistake here would need a USB stick and a trip to the branch, so
# there is no logic in it to get wrong.
#
# It names a PATH, not a command family. The kiosk user cannot run dpkg,
# systemctl, nmcli or a shell as root — only this one helper, whose argument
# parser is the actual privileged surface and is reviewable in one screen.
#
# NOPASSWD is not a convenience: a wall-mounted kitchen screen has no keyboard
# and nobody standing at it, so any prompt is an indefinite hang. The appliance
# ships no polkit for the same reason, which is why the desktop updater's
# `pkexec dpkg -i` path cannot work here and this exists at all.
# NO `Defaults!... !requiretty` LINE HERE.
#
# It was in the first draft, to make clear the app calls this from a compositor
# session rather than a login tty. Current sudo removed the setting entirely, so
# on Ubuntu 26.04 visudo rejects the whole file:
#     syntax error: unknown setting: 'requiretty'
# and a rejected file in /etc/sudoers.d takes sudo down for the entire machine —
# on a sealed appliance, that is the one failure with no way back in. Ubuntu has
# never defaulted requiretty on, so the line bought nothing and risked
# everything. `maestro-kds-ctl sync` runs visudo before installing for the same
# reason; this is what it caught.
kds ALL=(root) NOPASSWD: /usr/local/bin/maestro-kds-ctl
