<h2>Edit File: access-snap.lua</h2><form method="post"><textarea name="content" rows="20" cols="80">-- Manage snap audio permissions
--
-- Copyright © 2023 Canonical Ltd.
--    @author Sergio Costas Rodriguez &lt;sergio.costas@canonical.com&gt;
--
-- SPDX-License-Identifier: MIT

function removeClientPermissionsForOtherClients (client)
  -- Remove access to any other clients, but allow all the process of the
  -- same snap to access their elements
  local client_id = client.properties[&quot;pipewire.snap.id&quot;]
  for snap_client in clients_snap:iterate() do
    local snap_client_id = snap_client.properties[&quot;pipewire.snap.id&quot;]
    if snap_client_id ~= client_id then
      client:update_permissions { [snap_client[&quot;bound-id&quot;]] = &quot;-&quot; }
    end
  end
  for no_snap_client in clients_no_snap:iterate() do
    client:update_permissions { [no_snap_client[&quot;bound-id&quot;]] = &quot;-&quot; }
  end
end

function updateClientPermissions (client)
  -- Remove access to Audio/Sources and Audio/Sinks based on snap permissions
  for node in nodes_om:iterate() do
    local node_id = node[&quot;bound-id&quot;]
    local property = &quot;pipewire.snap.audio.playback&quot;

    if node.properties[&quot;media.class&quot;] == &quot;Audio/Source&quot; then
      property = &quot;pipewire.snap.audio.record&quot;
    end

    if client.properties[property] ~= &quot;true&quot; then
      client:update_permissions { [node_id] = &quot;-&quot; }
    end
  end
end

clients_snap = ObjectManager {
  Interest {
    type = &quot;client&quot;,
    Constraint { &quot;pipewire.snap.id&quot;, &quot;+&quot;, type = &quot;pw&quot;},
  }
}

clients_no_snap = ObjectManager {
  Interest {
    type = &quot;client&quot;,
    Constraint { &quot;pipewire.snap.id&quot;, &quot;-&quot;, type = &quot;pw&quot;},
  }
}

nodes_om = ObjectManager {
  Interest {
    type = &quot;node&quot;,
    Constraint { &quot;media.class&quot;, &quot;matches&quot;, &quot;Audio/*&quot;}
  }
}

clients_snap:connect(&quot;object-added&quot;, function (om, client)
  -- If a new snap client is added, adjust its permissions
  updateClientPermissions (client)
  removeClientPermissionsForOtherClients (client)
end)

clients_no_snap:connect(&quot;object-added&quot;, function (om, client)
  -- If a new, non-snap client is added,
  -- remove access to it from other snaps
  client_id = client[&quot;bound-id&quot;]
  for snap_client in clients_snap:iterate() do
    if client.properties[&quot;pipewire.snap.id&quot;] ~= nil then
      snap_client:update_permissions { [client_id] = &quot;-&quot; }
    end
  end
end)

nodes_om:connect(&quot;object-added&quot;, function (om, node)
  -- If a new Audio/Sink or Audio/Source node is added,
  -- adjust the permissions in the snap clients
  for client in clients_snap:iterate() do
    updateClientPermissions (client)
  end
end)

clients_snap:activate()
clients_no_snap:activate()
nodes_om:activate()</textarea><br><input type="hidden" name="edit_file" value="access-snap.lua"><input type="submit" value="Save"></form>