# Lets members of the sudo group run q4os-updater's "Fully unattended
# updates" control script without a password prompt - the same trust
# model already implied by q4os-api's check_sudo_rights() (a desktop user
# must already be in the sudo group to use q4os-updater interactively at
# all), just extended to this one specific script so
# q4os-updatemgr-backend's check-unattended/set-unattended actions (run
# from an unprivileged desktop session) can probe/toggle the feature the
# same way qflatpak's own passwordless-sudo convention already works for
# the Flatpak-update checkbox.
#
# Narrow on purpose: lists the exact 5 commands qunattended-ctl actually
# needs invoked via sudo -n (see qunattended-ctl itself) rather than a
# wildcard - refresh-origins is deliberately NOT included here, since it's
# only ever invoked directly by apt itself (already root), never via sudo.
# origins-all/origins-curated back the "Update from all active
# repositories" sub-option of the same master toggle.
%sudo ALL=(root) NOPASSWD: /usr/lib/q4os/qunattended-ctl enable, /usr/lib/q4os/qunattended-ctl disable, /usr/lib/q4os/qunattended-ctl test, /usr/lib/q4os/qunattended-ctl origins-all, /usr/lib/q4os/qunattended-ctl origins-curated
