Polkit rule that allows members in 'wheel' to use `machinectl` without password authentication

10-nopassword-machinectl.rules

/* Allow members in 'wheel' to use machinectl without password authentication
 *
 * Thanks to the followings:
 * - https://unix.stackexchange.com/a/595725
 * - https://wiki.archlinux.org/index.php/Polkit#For_specific_actions
 */

polkit.addRule(function(action, subject) {
    if (
        (
            action.id == "org.freedesktop.machine1.shell" ||
            action.id == "org.freedesktop.machine1.manage-machines" ||
            action.id == "org.freedesktop.machine1.manage-images" ||
            action.id == "org.freedesktop.machine1.login" ||
            (
                action.id == "org.freedesktop.systemd1.manage-units" &&
                RegExp('systemd-nspawn@[A-Za-z0-9_-]+.service').test(action.lookup("unit")) === true
            )
        )
        && subject.isInGroup("wheel")
    ) {
        return polkit.Result.YES;
    }
});