From d37d898d895eab4c9b83aae59bd2f3dbfa11a523 Mon Sep 17 00:00:00 2001
From: zhangkun <zhangkun2@uniontech.com>
Date: Tue, 20 Oct 2026 16:01:49 +0800
Subject: [PATCH] fix(power): deny inactive authorization without prompting

Reject inactive-session power authorization without authentication prompts and log rejected D-Bus callers.

PMS: BUG-379055

PMS: BUG-377891
---
 src/plugin-qt/power/system/misc/org.deepin.dde.power.policy | 2 +-
 src/plugin-qt/power/system/powermanager.cpp                 | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy b/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy
index cc0f37e6..3592cc27 100644
--- a/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy
+++ b/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy
@@ -9,7 +9,7 @@
                 <message>Authentication is required to perform this action</message>
                 <defaults>
                         <allow_any>auth_admin</allow_any>
-                        <allow_inactive>auth_admin</allow_inactive>
+                        <allow_inactive>no</allow_inactive>
                         <allow_active>yes</allow_active>
                 </defaults>
                 <description xml:lang="en_US">Check Authentication</description>
diff --git a/src/plugin-qt/power/system/powermanager.cpp b/src/plugin-qt/power/system/powermanager.cpp
index 89c6e7e0..26e9b171 100644
--- a/src/plugin-qt/power/system/powermanager.cpp
+++ b/src/plugin-qt/power/system/powermanager.cpp
@@ -310,6 +310,9 @@ bool SystemPowerManager::authorizePowerAction()
         return false;
     }
     if (result != PolkitQt1::Authority::Yes) {
+        qWarning(logPowerSystem) << "Polkit authorization denied: action=" << kPowerAction
+                                 << "sender=" << sender << "interface=" << message().interface()
+                                 << "member=" << message().member();
         sendErrorReply(QDBusError::AccessDenied, QStringLiteral("Authentication failed"));
         return false;
     }