blanket: fix dbus sandboxing

hosts/common/programs/assorted.nix

@@ -452,11 +452,6 @@ in
 
     bash-language-server.sandbox.whitelistPwd = true;
 
-    blanket.buildCost = 1;
-    blanket.sandbox.whitelistAudio = true;
-    # blanket.sandbox.whitelistDbus.user = true;  #< TODO: reduce  # TODO: untested
-    blanket.sandbox.whitelistWayland = true;
-
     bridge-utils.sandbox.net = "all";
 
     "cacert.unbundled".sandbox.enable = false;  #< data only

hosts/common/programs/blanket.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  sane.programs.blanket = {
+    # com.rafaelmardojai.Blanket
+    buildCost = 1;
+    sandbox.whitelistAudio = true;
+    sandbox.whitelistDbus.user.own = [
+      "com.rafaelmardojai.Blanket"
+      "org.mpris.MediaPlayer2.Blanket"
+    ];
+    sandbox.whitelistWayland = true;
+  };
+}

hosts/common/programs/default.nix

@@ -13,6 +13,7 @@
     ./avahi.nix
     ./bemenu.nix
     ./bitcoin-cli.nix
+    ./blanket.nix
     ./blueberry.nix
     ./blueman.nix
     ./bonsai.nix