# Allow the multiportal service user to manage its queue worker instances via
# systemctl. Derived from the argv shapes QueueService actually executes via
# sudo (common/components/QueueService.php executeSystemdCommand callsites) -
# nothing more:
#   - start/stop/enable/disable on digit-bounded instances ([0-9] matches
#     exactly one digit and cannot contain a space or slash, so there are no
#     bare wildcards);
#   - stop on the LITERAL glob argument multiportal-queue@\*.service - the app
#     passes the asterisk as one argv element and systemctl expands it against
#     loaded units itself; the backslash makes sudo match only a literal '*'.
# is-active/status are unprivileged and deliberately not granted.
# daemon-reload and the websocket/cron units are deliberately NOT granted:
# packaged units are shipped under /lib and the unit-file management actions
# in QueueService are disabled in packaged mode; mpctl manages the services.
Cmnd_Alias MULTIPORTAL_QUEUE = \
    /usr/bin/systemctl start multiportal-queue@[0-9].service, \
    /usr/bin/systemctl start multiportal-queue@[0-9][0-9].service, \
    /usr/bin/systemctl stop multiportal-queue@[0-9].service, \
    /usr/bin/systemctl stop multiportal-queue@[0-9][0-9].service, \
    /usr/bin/systemctl stop multiportal-queue@\*.service, \
    /usr/bin/systemctl enable multiportal-queue@[0-9].service, \
    /usr/bin/systemctl enable multiportal-queue@[0-9][0-9].service, \
    /usr/bin/systemctl disable multiportal-queue@[0-9].service, \
    /usr/bin/systemctl disable multiportal-queue@[0-9][0-9].service

multiportal ALL=(root) NOPASSWD: MULTIPORTAL_QUEUE
