<commit_before>{ config, lib, pkgs, ... }:

with lib;

let

  cfg = config.security;

  runSQL = sql: ''/usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "${sql}"'';

  allowAccess = client: runSQL ''INSERT or REPLACE INTO access VALUES ('kTCCServiceAccessibility','${client}',1,1,1,NULL,NULL)'';
  revokeAccess = clients: runSQL ''DELETE FROM access WHERE client LIKE '/nix/store/%' AND client NOT IN (${concatMapStringsSep "," (s: "'${s}'") clients})'';

in

{
  options = {
    security.accessibilityPrograms = mkOption {
      type = types.listOf types.path;
      default = [];
      description = "List of nix programs that are allowed control through the accessibility APIs.";
    };
  };

  config = {

    system.activationScripts.accessibility.text = ''
      # Set up programs that require accessibility permissions
      echo "setting up accessibility programs..." >&2

      ${revokeAccess cfg.accessibilityPrograms}
      ${concatMapStringsSep "\n" allowAccess cfg.accessibilityPrograms}
    '';

  };
}<commit_msg>security: add example for accessibilityPrograms<commit_after>{ config, lib, pkgs, ... }:

with lib;

let

  cfg = config.security;

  runSQL = sql: ''/usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "${sql}"'';

  allowAccess = client: runSQL ''INSERT or REPLACE INTO access VALUES ('kTCCServiceAccessibility','${client}',1,1,1,NULL,NULL)'';
  revokeAccess = clients: runSQL ''DELETE FROM access WHERE client LIKE '/nix/store/%' AND client NOT IN (${concatMapStringsSep "," (s: "'${s}'") clients})'';

in

{
  options = {
    security.accessibilityPrograms = mkOption {
      type = types.listOf types.path;
      default = [];
      example = literalExample ''[ ''${pkgs.hello}/bin/hello" ]'';
      description = "List of nix programs that are allowed control through the accessibility APIs.";
    };
  };

  config = {

    system.activationScripts.accessibility.text = ''
      # Set up programs that require accessibility permissions
      echo "setting up accessibility programs..." >&2

      ${revokeAccess cfg.accessibilityPrograms}
      ${concatMapStringsSep "\n" allowAccess cfg.accessibilityPrograms}
    '';

  };
}
{'fraction_non_alphanumeric': 0.14305239179954443, 'fraction_numerical': 0.004555808656036446, 'mean_word_length': 3.652542372881356, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6173558', 'n_tokens_mistral': 675, 'n_tokens_neox': 642, 'n_words': 177}