## The WirePlumber access configuration

access.permission-managers = [
  ## The list of access permission managers

  ## The following is an example of how to create a custom permission manager
  ## that removes all permissions on all Audio/Source nodes
  # {
  #   ## The unique name of the permission manager. This is mandatory.
  #   name = "custom"
  #
  #   ## The default permissions to apply on all objects that dont have a match
  #   default_permissions = "all"
  #
  #   ## The permissions to apply specifically on the PipeWire core object
  #   ## (ID 0). This is useful to allow clients to interact with the core
  #   ## (e.g. enumerate objects) while restricting access to individual objects.
  #   ## If not set, the default_permissions value is used for the core as well.
  #   core_permissions = "rx"
  #
  #   ## The rules to apply specific permissions to matched objects
  #   rules = [
  #     {
  #       matches = [
  #         {
  #           media.class = "Audio/Source"
  #         }
  #       ]
  #       actions = {
  #         set-permissions = "-"
  #       }
  #     }
  #   ]
  # }
]

access.rules = [
  ## The list of access rules

  ## This rule attaches the 'custom' permission manager to paplay clients.
  ## Note: This is only used if there is no 'default_permissions' action.
  # {
  #   matches = [
  #     {
  #       application.name = "paplay"
  #     }
  #   ]
  #   actions = {
  #     update-props = {
  #       permission_manager_name = "custom"
  #     }
  #   }
  # }

  ## This rule grants read-only permissions to paplay clients for all objects.
  ## Note: This has precedence over the 'permission_manager_name' action.
  # {
  #   matches = [
  #     {
  #       application.name = "paplay"
  #     }
  #   ]
  #   actions = {
  #     update-props = {
  #       default_permissions = "r"
  #     }
  #   }
  # }

  ## This rule sets the pipewire effective access to 'flatpak-manager' for
  ## clients with both 'flatpak' access and 'Manager' media category, and all
  ## grants all permissions.
  ## Note: WirePlumber already does this by default.
  # {
  #   matches = [
  #     {
  #       pipewire.access = "flatpak"
  #       media.category = "Manager"
  #     }
  #   ]
  #   actions = {
  #     update-props = {
  #       access = "flatpak-manager"
  #       default_permissions = "all",
  #     }
  #   }
  # }

  ## This rule grants read-exec-only permissions to clients with 'flatpak'
  ## access and without 'Manager' media category.
  ## Note: WirePlumber already does this by default.
  # {
  #   matches = [
  #     {
  #       pipewire.access = "flatpak"
  #       media.category = "!\"Manager\""
  #     }
  #   ]
  #   actions = {
  #     update-props = {
  #       default_permissions = "rx"
  #     }
  #   }
  # }

  ## This rule grants read-exec-only permissions to clients with 'restricted'
  ## access.
  ## Note: WirePlumber already does this by default.
  # {
  #   matches = [
  #     {
  #       pipewire.access = "restricted"
  #     }
  #   ]
  #   actions = {
  #     update-props = {
  #       default_permissions = "rx"
  #     }
  #   }
  # }

  ## This rule grants all permissions to clients with 'unrestricted' access.
  ## Note: WirePlumber already does this by default.
  # {
  #   matches = [
  #     {
  #       pipewire.access = "unrestricted"
  #     }
  #   ]
  #   actions = {
  #     update-props = {
  #       default_permissions = "all"
  #     }
  #   }
  # }
]