chore: Move flathub setup to separate script, run with pkexec

system_files/desktop/shared/usr/bin/bazzite-flathub-setup

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+if grep -qz 'fedora' <<< $(flatpak remotes); then
+  flatpak remote-delete --user fedora --force
+fi
+flatpak remote-add --if-not-exists --user flathub /etc/flatpak/remotes.d/flathub.flatpakrepo
+flatpak remote-modify --user --enable flathub

system_files/desktop/shared/usr/bin/bazzite-user-setup

@@ -132,11 +132,7 @@ fi
 timedatectl set-ntp true
 
 # Setup Flathub
-if grep -qz 'fedora' <<< $(flatpak remotes); then
-  flatpak remote-delete --user fedora --force
-fi
-flatpak remote-add --if-not-exists --user flathub /etc/flatpak/remotes.d/flathub.flatpakrepo
-flatpak remote-modify --user --enable flathub
+pkexec /usr/bin/bazzite-flathub-setup
 
 # Prevent future executions
 echo "Writing state file"

system_files/desktop/shared/usr/share/polkit-1/actions/org.bazzite.flathub.policy

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+
+  <vendor>Bazzite</vendor>
+  <vendor_url>https://github.com/ublue-os/bazzite/</vendor_url>
+
+  <action id="org.bazzite.policykit.flathub.setup">
+    <description>Enables the flathub user repository automatically</description>
+    <icon_name>package-x-generic</icon_name>
+    <defaults>
+      <allow_any>yes</allow_any>
+      <allow_inactive>yes</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/bazzite-flathub-setup</annotate>
+  </action>
+
+</policyconfig>

system_files/desktop/shared/usr/share/polkit-1/rules.d/20-flathub.rules

@@ -0,0 +1,6 @@
+polkit.addRule(function(action, subject) {
+    if ((action.id == "org.bazzite.policykit.flathub.setup") &&
+         subject.isInGroup("wheel")) {
+        return polkit.Result.YES;
+    }
+});