Let the laptop say what it is doing: battery percentage, the lid, a fingerprint

Three surfaces the first laptop install showed were missing. The bar's battery icon gets an optional exact number beside it -- GNOME's "Show Battery Percentage", off by default for GNOME's reason, one color with the icon so it reads as one indicator. The Power page says what closing the lid does. The policy already existed (LidPolicy holds a suspend inhibitor while an external display is connected) but was surfaced nowhere, so the machine's most physical behavior was undiscoverable -- and the deliberate absence of an override deserves stating rather than leaving someone to hunt for a switch that does not exist. And the Users page grows a Fingerprint card, because fingerprint login is two systems that fail silently when they disagree: fprintd holds the enrolled prints, authselect decides whether PAM ever asks the reader. This machine arrived with a finger enrolled from its GNOME days and with-fingerprint off, which reads as "the reader is broken". The card shows both facts, flips the authselect feature through polkit with a stated reason, and hands enrollment to GNOME's Users panel, which owns the only good capture dialog -- a named exception in the handoff contract. Everything through scripts/panama-fingerprint, pinned by a stub-driven contract. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh
2026-08-23 11:07:37 -04:00
parent c2eddc2c5b
commit dfc0c49877
15 changed files with 416 additions and 9 deletions
@@ -0,0 +1,95 @@
+pragma Singleton
+
+// The fingerprint reader, for the Users page.
+//
+// Two facts, owned by two different systems: fprintd holds the enrolled
+// prints (GNOME's Users panel owns the enrollment dialog and Panama hands off
+// to it), and authselect decides whether PAM asks the reader at unlock. Both
+// come through scripts/panama-fingerprint, and the one privileged change --
+// flipping authselect's with-fingerprint feature -- prompts through polkit
+// with a stated reason, like everything else on that page.
+//
+// Read when the page opens rather than at shell startup: probing fprintd
+// bus-activates the daemon, and most sessions never open this page.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-fingerprint"
+
+    property bool readerPresent: false
+    property string readerName: ""
+    property var enrolled: []
+    property bool pamEnabled: false
+    property bool scanned: false
+    property bool busy: false
+    property string lastError: ""
+
+    // "right-index-finger" -> "Right index finger". Presentation lives here
+    // rather than in the page, the way PowerProfiles.label does, so nothing
+    // can disagree about what a finger is called.
+    function fingerLabel(finger: string): string {
+        const words = String(finger).split("-").join(" ");
+        return words.slice(0, 1).toUpperCase() + words.slice(1);
+    }
+
+    function refresh(): void {
+        if (!query.running)
+            query.running = true;
+    }
+
+    function setUnlockEnabled(on: bool): void {
+        if (root.busy)
+            return;
+        root.busy = true;
+        root.lastError = "";
+        apply.command = [root.helperPath, "set-unlock", on ? "on" : "off"];
+        apply.running = true;
+    }
+
+    Process {
+        id: query
+        command: [root.helperPath, "status"]
+        stdout: StdioCollector {
+            onStreamFinished: {
+                try {
+                    const parsed = JSON.parse(this.text);
+                    root.readerPresent = parsed.reader === true;
+                    root.readerName = String(parsed.readerName ?? "");
+                    root.enrolled = Array.isArray(parsed.enrolled) ? parsed.enrolled : [];
+                    root.pamEnabled = parsed.pamEnabled === true;
+                    if (String(parsed.error ?? "") !== "")
+                        root.lastError = String(parsed.error);
+                } catch (error) {
+                    root.readerPresent = false;
+                    root.lastError = "Could not read the fingerprint helper's output.";
+                    console.warn("Fingerprint: could not parse helper output:", error);
+                }
+                root.scanned = true;
+            }
+        }
+    }
+
+    Process {
+        id: apply
+        stderr: StdioCollector {
+            // A dismissed polkit prompt is a normal outcome on this page, not
+            // a failure to report.
+            onStreamFinished: {
+                const text = this.text.trim();
+                if (text !== "" && !/dismissed|not authorized/i.test(text))
+                    root.lastError = text;
+            }
+        }
+        // Re-read rather than assuming: authselect may refuse, and the
+        // prompt may have been dismissed.
+        onExited: {
+            root.busy = false;
+            root.refresh();
+        }
+    }
+}