inputaccess.h

#pragma once
#include <QString>

// The Linux udev-rule install that grants this session read access to pointer
// devices, so the dwell timer can track the cursor over every window on Wayland
// (docs/INTERNAL.md §2).
//
// This is the single most security-sensitive thing TrackClick does: it runs a
// shell command as root through pkexec.  §3 asks for that path to be kept
// audited, which is the reason it lives here rather than inside MainWindow —
// "what exactly do we run as root?" should be answerable by reading one short
// file.
//
// Deliberately UI-free: it takes no parent widget, shows no dialogs and holds no
// translatable strings.  The caller owns every message, which also keeps the
// existing MainWindow translation context intact.
namespace InputAccess {

// Where the rule is installed, and the text that gets installed.  Exposed so the
// caller can show manual instructions when pkexec is unavailable.
QString ruleDestinationPath();
// The bundled rule text, or an empty string if the resource could not be read.
QString bundledRuleText();

enum class InstallResult {
    Installed,        // pkexec ran and the rule is in place
    RuleUnavailable,  // the bundled resource could not be read — internal error
    TempFileFailed,   // could not stage the rule in a temporary file
    HelperMissing,    // pkexec is not available; offer manual instructions
    Refused,          // pkexec ran but authentication failed or was cancelled
};

// Stage the bundled rule in a temporary file and install it as root via pkexec
// (graphical polkit auth), then reload udev and re-tag input devices so the
// uaccess ACL applies to the current session.
//
// Blocks while the password prompt is up (up to two minutes), so call it from a
// context where that is acceptable.  The temporary file is always removed.
//
// Every path interpolated into the root shell command is app-controlled — the
// destination is a compile-time constant and the source is our own
// QTemporaryFile.  Never interpolate user-supplied strings here.
InstallResult installUdevRule();

} // namespace InputAccess