[CUPS] Authentication for local GUI admin tasks

Hello,

I am working on printer setup integration for COSMIC Settings. Till
suggested that I ask here about the recommended authentication path
for local CUPS admin operations from a GUI application.

Current architecture:

  - UI: cosmic-settings
  - Backend: cosmic-settings-daemon
  - Communication: varlink/zlink
  - CUPS access: cups-rs/libcups

The main issue is that privileged CUPS operations may require
authentication. Examples include:

  - Setting the system-wide default printer
  - Updating printer location
  - Removing a printer
  - Setting system-wide printer options, such as paper size

If libcups asks for a password inside the daemon, this is not suitable
for the UI.

From what I understand, the possible fallback order is:

  1. Use cups-pk-helper + polkit for local privileged operations when available.
  2. Fall back to direct libcups/cups-rs admin requests, preferably
over the local UNIX socket.
  3. As a last fallback, use per-user settings in ~/.cups/lpoptions,
with a warning that this is not system-wide.

My questions are:

  - Is this fallback order reasonable for a modern desktop settings app?
  - Is CUPS 2.5 OAuth2 relevant for authenticating a local GUI app as
a CUPS admin user, or is it mainly for network printer/service
authentication?

Any guidance would be appreciated.

Thank you,
Abdelrahman Khalifa