From 49def6e75c1b4e06b0beed12970bb7e56f3a24dc Mon Sep 17 00:00:00 2001
From: michael <operations@dangerousthings.com>
Date: Sun, 26 Apr 2026 20:42:00 -0700
Subject: [PATCH] feat(packaging): polkit policy with 7 AuthForge actions

---
 debian/io.dangerousthings.AuthForge.policy | 80 ++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 debian/io.dangerousthings.AuthForge.policy

diff --git a/debian/io.dangerousthings.AuthForge.policy b/debian/io.dangerousthings.AuthForge.policy
new file mode 100644
index 0000000..4229ee8
--- /dev/null
+++ b/debian/io.dangerousthings.AuthForge.policy
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+
+  <vendor>Dangerous Things</vendor>
+  <vendor_url>https://dangerousthings.com</vendor_url>
+
+  <action id="io.dangerousthings.AuthForge.enroll-own">
+    <description>Enroll a security key for your own account</description>
+    <message>Authentication is required to enroll a security key.</message>
+    <defaults>
+      <allow_any>auth_self_keep</allow_any>
+      <allow_inactive>auth_self_keep</allow_inactive>
+      <allow_active>auth_self_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="io.dangerousthings.AuthForge.remove-own">
+    <description>Remove a security key from your own account</description>
+    <message>Authentication is required to remove a security key.</message>
+    <defaults>
+      <allow_any>auth_self_keep</allow_any>
+      <allow_inactive>auth_self_keep</allow_inactive>
+      <allow_active>auth_self_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="io.dangerousthings.AuthForge.enroll-other">
+    <description>Enroll a security key for another user</description>
+    <message>Administrator authentication is required to enroll on behalf of another user.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="io.dangerousthings.AuthForge.set-policy">
+    <description>Change AuthForge MFA policy</description>
+    <message>Administrator authentication is required to change MFA policy.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="io.dangerousthings.AuthForge.set-pending">
+    <description>Set a first-login enrollment flag for a user</description>
+    <message>Administrator authentication is required to require enrollment for a user.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="io.dangerousthings.AuthForge.clear-pending">
+    <description>Clear a user's first-login enrollment flag</description>
+    <message>Administrator authentication is required to clear a pending-enrollment flag.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="io.dangerousthings.AuthForge.generate-recovery">
+    <description>Generate a one-time recovery code for a user</description>
+    <message>Administrator authentication is required to generate a recovery code.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+</policyconfig>