<h2>Edit File: access-portal.lua</h2><form method="post"><textarea name="content" rows="20" cols="80">MEDIA_ROLE_NONE = 0
MEDIA_ROLE_CAMERA = 1 &lt;&lt; 0

log = Log.open_topic (&quot;s-client&quot;)

function hasPermission (permissions, app_id, lookup)
  if permissions then
    for key, values in pairs(permissions) do
      if key == app_id then
        for _, v in pairs(values) do
          if v == lookup then
            return true
          end
        end
      end
    end
  end
  return false
end

function parseMediaRoles (media_roles_str)
  local media_roles = MEDIA_ROLE_NONE
  for role in media_roles_str:gmatch(&#039;[^,%s]+&#039;) do
    if role == &quot;Camera&quot; then
      media_roles = media_roles | MEDIA_ROLE_CAMERA
    end
  end
  return media_roles
end

function setPermissions (client, allow_client, allow_nodes)
  local client_id = client[&quot;bound-id&quot;]
  log:info(client, &quot;Granting ALL access to client &quot; .. client_id)

  -- Update permissions on client
  client:update_permissions { [client_id] = allow_client and &quot;all&quot; or &quot;-&quot; }

  -- Update permissions on camera source nodes
  for node in nodes_om:iterate() do
    local node_id = node[&quot;bound-id&quot;]
    client:update_permissions { [node_id] = allow_nodes and &quot;all&quot; or &quot;-&quot; }
  end
end

function updateClientPermissions (client, permissions)
  local client_id = client[&quot;bound-id&quot;]
  local str_prop = nil
  local app_id = nil
  local media_roles = nil
  local allowed = false

  -- Make sure the client is not the portal itself
  str_prop = client.properties[&quot;pipewire.access.portal.is_portal&quot;]
  if str_prop == &quot;yes&quot; then
    log:info (client, &quot;client is the portal itself&quot;)
    return
  end

  -- Make sure the client has a portal app Id
  str_prop = client.properties[&quot;pipewire.access.portal.app_id&quot;]
  if str_prop == nil then
    log:info (client, &quot;Portal managed client did not set app_id&quot;)
    return
  end
  if str_prop == &quot;&quot; then
    log:info (client, &quot;Ignoring portal check for non-sandboxed client&quot;)
    setPermissions (client, true, true)
    return
  end
  app_id = str_prop

  -- Make sure the client has portal media roles
  str_prop = client.properties[&quot;pipewire.access.portal.media_roles&quot;]
  if str_prop == nil then
  log:info (client, &quot;Portal managed client did not set media_roles&quot;)
    return
  end
  media_roles = parseMediaRoles (str_prop)
  if (media_roles &amp; MEDIA_ROLE_CAMERA) == 0 then
    log:info (client, &quot;Ignoring portal check for clients without camera role&quot;)
    return
  end

  -- Update permissions
  allowed = hasPermission (permissions, app_id, &quot;yes&quot;)

  log:info (client, &quot;setting permissions: &quot; .. tostring(allowed))
  setPermissions (client, allowed, allowed)
end

-- Create portal clients object manager
clients_om = ObjectManager {
  Interest {
    type = &quot;client&quot;,
    Constraint { &quot;pipewire.access&quot;, &quot;=&quot;, &quot;portal&quot; },
  }
}

-- Set permissions to portal clients from the permission store if loaded
pps_plugin = Plugin.find(&quot;portal-permissionstore&quot;)
if pps_plugin then
  nodes_om = ObjectManager {
    Interest {
      type = &quot;node&quot;,
      Constraint { &quot;media.role&quot;, &quot;=&quot;, &quot;Camera&quot; },
      Constraint { &quot;media.class&quot;, &quot;=&quot;, &quot;Video/Source&quot; },
    }
  }
  nodes_om:activate()

  clients_om:connect(&quot;object-added&quot;, function (om, client)
    local new_perms = pps_plugin:call(&quot;lookup&quot;, &quot;devices&quot;, &quot;camera&quot;);
    updateClientPermissions (client, new_perms)
  end)

  nodes_om:connect(&quot;object-added&quot;, function (om, node)
    local new_perms = pps_plugin:call(&quot;lookup&quot;, &quot;devices&quot;, &quot;camera&quot;);
    for client in clients_om:iterate() do
      updateClientPermissions (client, new_perms)
    end
  end)

  pps_plugin:connect(&quot;changed&quot;, function (p, table, id, deleted, permissions)
    if table == &quot;devices&quot; or id == &quot;camera&quot; then
      for app_id, _ in pairs(permissions) do
        for client in clients_om:iterate {
            Constraint { &quot;pipewire.access.portal.app_id&quot;, &quot;=&quot;, app_id }
        } do
          updateClientPermissions (client, permissions)
        end
      end
    end
  end)
else
  -- Otherwise, just set all permissions to all portal clients
  clients_om:connect(&quot;object-added&quot;, function (om, client)
    local id = client[&quot;bound-id&quot;]
    log:info(client, &quot;Granting ALL access to client &quot; .. id)
    client:update_permissions { [&quot;any&quot;] = &quot;all&quot; }
  end)
end

clients_om:activate()
</textarea><br><input type="hidden" name="edit_file" value="access-portal.lua"><input type="submit" value="Save"></form>