gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Give identity its due: native enrollment, honest deletion, and sign-in that stays home

Browse Source 
Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8
This commit is contained in:
Gabriel Brown
2026-08-24 18:55:38 -04:00
parent 5a0643357f
commit 4ec8bd94d9
25 changed files with 4713 additions and 407 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/dot/quickshell/services/Fingerprint.qml
+155 -32
View File
@@ -2,12 +2,22 @@ pragma Singleton
// The fingerprint reader, for the Users page.
//
// Two facts, owned by two different systems: fprintd holds the enrolled
// prints (GNOME's Users panel owns the enrollment dialog and Panama hands off
// to it), and authselect decides whether PAM asks the reader at unlock. Both
// come through scripts/panama-fingerprint, and the one privileged change --
// flipping authselect's with-fingerprint feature -- prompts through polkit
// with a stated reason, like everything else on that page.
// Two facts, owned by two different systems: fprintd holds the enrolled prints,
// and authselect decides whether PAM asks the reader at unlock. Both come
// through scripts/panama-fingerprint, and the one privileged change -- flipping
// authselect's with-fingerprint feature -- prompts through polkit with a stated
// reason, like everything else on that page.
//
// The two facts are kept apart deliberately. `unlockFeatureEnabled` is a
// property of the PAM configuration and is reported whether or not a reader
// exists, because the state worth seeing most is the one where the feature is
// on and the reader is gone: nothing works, nothing says why, and the switch
// that would fix it used to be hidden behind the missing hardware. Hence
// `cardVisible`.
//
// Enrollment happens here now rather than in GNOME's Users panel. The helper
// drives fprintd's own Claim/EnrollStart cycle and prints one line of JSON per
// touch, which is what `enrollStage of enrollTotal` counts.
//
// Read when the page opens rather than at shell startup: probing fprintd
// bus-activates the daemon, and most sessions never open this page.
@@ -23,55 +33,134 @@ Singleton {
property bool readerPresent: false
property string readerName: ""
property var enrolled: []
property bool pamEnabled: false
// The fingers fprintd currently holds a print for, by fprintd's own names.
property var fingers: []
property bool unlockFeatureEnabled: false
property bool scanned: false
property bool busy: false
property string lastError: ""
// Guards read the Process objects; this is only for the page to bind to.
readonly property bool busy: apply.running || change.running
// The card is worth drawing when there is a reader OR when PAM has been
// told to use one. The second half is the stuck state: no reader, nothing
// enrolled, and a feature switched on that quietly slows every unlock down.
readonly property bool cardVisible: root.readerPresent || root.unlockFeatureEnabled
// ── What a finger is called ──────────────────────────────────────────────
//
// fprintd's vocabulary lives here and only here, so nothing can disagree
// about what a finger is named or how it reads.
readonly property var allFingers: [
"right-index-finger", "right-middle-finger", "right-ring-finger",
"right-little-finger", "right-thumb",
"left-index-finger", "left-middle-finger", "left-ring-finger",
"left-little-finger", "left-thumb"
]
// The ones still worth offering: enrolling a finger twice replaces the
// print rather than adding one, which is not what "Add a fingerprint" says.
readonly property var availableFingers:
root.allFingers.filter(finger => root.fingers.indexOf(finger) === -1)
// "right-index-finger" -> "Right index finger". Presentation lives here
// rather than in the page, the way PowerProfiles.label does, so nothing
// can disagree about what a finger is called.
// rather than in the page, the way PowerProfiles.label does.
function fingerLabel(finger: string): string {
const words = String(finger).split("-").join(" ");
return words.slice(0, 1).toUpperCase() + words.slice(1);
}
// ── Enrollment ───────────────────────────────────────────────────────────
property bool enrolling: false
// Touches taken, of touches the reader wants. Both zero until the device
// has said how many it needs.
property int enrollStage: 0
property int enrollTotal: 0
// The finger being enrolled, and fprintd's last word about the last touch
// ("enroll-stage-passed", "enroll-retry-scan-too-short", ...). The page
// turns the retries into "Try again, a little slower".
property string enrollFinger: ""
property string enrollResult: ""
// claiming | scanning | done | failed | cancelled
property string enrollPhase: ""
function refresh(): void {
if (!query.running)
query.running = true;
}
function setUnlockEnabled(on: bool): void {
if (root.busy)
if (apply.running)
return;
root.busy = true;
root.lastError = "";
apply.command = [root.helperPath, "set-unlock", on ? "on" : "off"];
apply.running = true;
}
function startEnroll(finger: string): void {
if (enroll.running)
return;
root.lastError = "";
root.enrollFinger = finger;
root.enrollStage = 0;
root.enrollTotal = 0;
root.enrollResult = "";
root.enrollPhase = "claiming";
root.enrolling = true;
enroll.command = [root.helperPath, "enroll", finger];
enroll.running = true;
}
// Stopping the process is the cancellation: the helper catches the signal,
// stops the enrollment and releases the reader, which is the part that
// matters -- a claimed device belonging to a dead process refuses the next
// attempt.
function cancelEnroll(): void {
if (enroll.running)
enroll.running = false;
}
function removeFinger(finger: string): void {
if (change.running)
return;
root.lastError = "";
change.command = [root.helperPath, "remove", finger];
change.running = true;
}
function removeAll(): void {
if (change.running)
return;
root.lastError = "";
change.command = [root.helperPath, "remove-all"];
change.running = true;
}
// Every verb that reports state answers in the same shape, so there is one
// place that reads it.
function absorb(text: string): void {
try {
const parsed = JSON.parse(text);
root.readerPresent = parsed.reader === true;
root.readerName = String(parsed.readerName ?? "");
root.fingers = Array.isArray(parsed.enrolled) ? parsed.enrolled : [];
root.unlockFeatureEnabled = parsed.unlockFeatureEnabled === true;
if (String(parsed.error ?? "") !== "")
root.lastError = String(parsed.error);
} catch (error) {
root.readerPresent = false;
root.lastError = "Could not read the fingerprint helper's output.";
console.warn("Fingerprint: could not parse helper output:", error);
}
root.scanned = true;
}
Process {
id: query
command: [root.helperPath, "status"]
stdout: StdioCollector {
onStreamFinished: {
try {
const parsed = JSON.parse(this.text);
root.readerPresent = parsed.reader === true;
root.readerName = String(parsed.readerName ?? "");
root.enrolled = Array.isArray(parsed.enrolled) ? parsed.enrolled : [];
root.pamEnabled = parsed.pamEnabled === true;
if (String(parsed.error ?? "") !== "")
root.lastError = String(parsed.error);
} catch (error) {
root.readerPresent = false;
root.lastError = "Could not read the fingerprint helper's output.";
console.warn("Fingerprint: could not parse helper output:", error);
}
root.scanned = true;
}
}
stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
}
Process {
@@ -87,8 +176,42 @@ Singleton {
}
// Re-read rather than assuming: authselect may refuse, and the
// prompt may have been dismissed.
onExited: root.refresh()
}
Process {
id: change
// Removing answers with the fresh state, so the list updates from the
// removal itself and never has to ask again.
stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
}
Process {
id: enroll
stdout: SplitParser {
// One JSON object per touch. A reader takes five or so, seconds
// apart, so this is a trickle rather than a stream to drain.
onRead: line => {
try {
const update = JSON.parse(line);
root.enrollPhase = String(update.stage ?? root.enrollPhase);
root.enrollTotal = Number(update.total ?? root.enrollTotal);
root.enrollStage = Number(update.done ?? root.enrollStage);
root.enrollResult = String(update.result ?? "");
if (update.ok === false)
root.lastError = String(update.error ?? "That finger could not be enrolled.");
} catch (error) {
// A line that is not JSON is not worth abandoning an
// enrollment over; the exit status is what decides.
}
}
}
onExited: {
root.busy = false;
root.enrolling = false;
// Cancelled by stopping the process: the helper had no chance to
// say anything, and there is nothing to report.
if (root.enrollPhase !== "done" && root.enrollPhase !== "failed")
root.enrollPhase = "cancelled";
root.refresh();
}
}