# perf-tray: let pln switch perf.sh modes without a password prompt, scoped to
# the ROOT-OWNED deployed copy and the exact mode flags only (no wildcard).
#
# Why a deployed copy and not ~/Work/Sound/Tidal/perf.sh directly:
# NOPASSWD on a user-writable script = passwordless root by the back door
# (you could edit the script to do anything). The deployed copy is owned by
# root and only root can change it, so the privilege stays scoped to the
# vetted modes below.
#
# Install:
#   sudo install -m 755 -o root -g root ~/Work/Sound/Tidal/perf.sh /usr/local/sbin/perf-audio
#   sudo install -m 440 -o root -g root ~/Work/Sound/Tidal/perf-audio.sudoers /etc/sudoers.d/perf-audio
#   sudo visudo -cf /etc/sudoers.d/perf-audio   # validate
#
# Re-run the first line whenever you change perf.sh and want the tray to pick it up.

pln ALL=(root) NOPASSWD: /usr/local/sbin/perf-audio --cool, /usr/local/sbin/perf-audio --silent, /usr/local/sbin/perf-audio --optimize, /usr/local/sbin/perf-audio --extreme, /usr/local/sbin/perf-audio --stop
