From 73e5968c64fe1ad9168a3dca8ce5000eadc575c4 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Fri, 17 Jul 2026 17:45:29 -0700
Subject: [PATCH] Show context in polkit prompt

---
 shell/plugins/polkit/PolkitAgent.qml | 28 ++++++++++++++++++++++++++++
 shell/plugins/polkit/PolkitModel.js  |  9 ++++++++-
 test/shell.d/polkit-test.sh          | 11 +++++++++++
 3 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/shell/plugins/polkit/PolkitAgent.qml b/shell/plugins/polkit/PolkitAgent.qml
index 4cc34f2e..a27ab019 100644
--- a/shell/plugins/polkit/PolkitAgent.qml
+++ b/shell/plugins/polkit/PolkitAgent.qml
@@ -44,6 +44,10 @@ Item {
     return PolkitModel.promptLooksFingerprint(text)
   }
 
+  function authorizationLabel(message) {
+    return PolkitModel.authorizationLabel(message)
+  }
+
   function loadPamConfig(raw) {
     fingerprintFirst = PolkitModel.fingerprintFirstFromPamConfig(raw)
   }
@@ -325,5 +329,29 @@ Item {
         }
       }
     }
+
+    Rectangle {
+      width: Math.min(justificationText.implicitWidth + Style.space(24), panel.width - Style.gapsOut * 2)
+      height: Style.space(28)
+      anchors.horizontalCenter: card.horizontalCenter
+      anchors.bottom: card.top
+      anchors.bottomMargin: Style.space(10)
+      radius: root.cornerRadius
+      color: root.background
+
+      Text {
+        id: justificationText
+        anchors.fill: parent
+        anchors.leftMargin: Style.space(12)
+        anchors.rightMargin: Style.space(12)
+        text: root.authorizationLabel(root.currentMessage)
+        color: root.foreground
+        font.family: root.fontFamily
+        font.pixelSize: Style.font.bodySmall
+        horizontalAlignment: Text.AlignHCenter
+        verticalAlignment: Text.AlignVCenter
+        elide: Text.ElideMiddle
+      }
+    }
   }
 }
diff --git a/shell/plugins/polkit/PolkitModel.js b/shell/plugins/polkit/PolkitModel.js
index 02444d55..ca2ea142 100644
--- a/shell/plugins/polkit/PolkitModel.js
+++ b/shell/plugins/polkit/PolkitModel.js
@@ -14,9 +14,16 @@ function fingerprintFirstFromPamConfig(raw) {
   return false
 }
 
+function authorizationLabel(message) {
+  var text = String(message || "")
+  var match = text.match(/^Authentication is (?:needed|required) to run [`']([^`']+)[`'] as /i)
+  return match ? "Authorize running '" + match[1] + "'" : text
+}
+
 if (typeof module !== "undefined") {
   module.exports = {
     promptLooksFingerprint: promptLooksFingerprint,
-    fingerprintFirstFromPamConfig: fingerprintFirstFromPamConfig
+    fingerprintFirstFromPamConfig: fingerprintFirstFromPamConfig,
+    authorizationLabel: authorizationLabel
   }
 }
diff --git a/test/shell.d/polkit-test.sh b/test/shell.d/polkit-test.sh
index 1ca2a935..2683e2b5 100644
--- a/test/shell.d/polkit-test.sh
+++ b/test/shell.d/polkit-test.sh
@@ -11,6 +11,17 @@ assert(polkit.promptLooksFingerprint('Swipe your finger'), 'polkit detects finge
 assert(polkit.promptLooksFingerprint('fprintd verification'), 'polkit detects fprint prompts')
 assert(!polkit.promptLooksFingerprint('Password:'), 'polkit ignores password prompts')
 
+assertEqual(
+  polkit.authorizationLabel("Authentication is needed to run `/usr/bin/true' as the super user"),
+  "Authorize running '/usr/bin/true'",
+  'polkit shortens the standard pkexec message'
+)
+assertEqual(
+  polkit.authorizationLabel('Authentication is required to change system settings'),
+  'Authentication is required to change system settings',
+  'polkit preserves custom authorization messages'
+)
+
 assert(
   polkit.fingerprintFirstFromPamConfig(`
 # comment