# ------------------------------------------------------------------
#
#    Copyright (C) 2026 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:ft=apparmor

abi <abi/5.0>,
include <tunables/global>

include <tunables/glycin>

profile loupe /usr/bin/loupe {
  include <abstractions/base>
  include <abstractions/dconf>
  include <abstractions/dbus-session-strict>
  include <abstractions/gnome>
  include <abstractions/glycin>

  include <abstractions/dbus-xdg/portal-file-chooser>
  include <abstractions/dbus-xdg/portal-file-transfer>
  include <abstractions/dbus-xdg/portal-inhibit>
  include <abstractions/dbus-xdg/portal-registry>
  include <abstractions/dbus-xdg/portal-request>
  include <abstractions/dbus-xdg/portal-session>
  include <abstractions/dbus-xdg/portal-settings>

  @{exec_path} mr,

  /var/lib/snapd/desktop/icons/ r,

  owner @{HOME}/[^.]**.@{glycin_file_ext} rw,

  owner /mnt/**.@{glycin_file_ext} rw,
  owner /media/**.@{glycin_file_ext} rw,
  /mnt/**.@{glycin_file_ext} r,
  /media/**.@{glycin_file_ext} r,

  /tmp/**.@{glycin_file_ext} rw,
  /var/tmp/**.@{glycin_file_ext} rw,

  /usr/**.@{glycin_file_ext} r,
  /opt/**.@{glycin_file_ext} r,

  dbus bus=session name="org.gnome.Loupe",
  dbus (receive)
    bus=session
    path="/org/gnome/Loupe{,/window/*}",

  dbus (send)
    bus=session
    path=/org/gnome/Loupe
    member=Changed
    peer=(name=org.freedesktop.DBus),

  # TODO: this should be in an abstraction of some kind
  dbus (send)
    bus={accessibility,session}
    path=/org/freedesktop/DBus
    interface=org.freedesktop.DBus
    member={AddMatch,GetNameOwner,Hello,ReleaseName,RemoveMatch,RequestName,StartServiceByName}
    peer=(name=org.freedesktop.DBus),

  dbus (send)
      bus=session
      path=/org/freedesktop/DBus
      interface=org.freedesktop.DBus
      member=ListActivatableNames
      peer=(name=org.freedesktop.DBus, label=unconfined),

  # TODO: narrow this down
  dbus bus=accessibility,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/loupe>
}
