Bernardo Magri
e2de9062d8
All checks were successful
Check / eval (push) Successful in 2m59s
Bernardo tested the lock screen after turning `fingerprint.pam` on: sudo took a finger, hyprlock did nothing. The PAM stack was not the problem — grosshack sits in /etc/pam.d/hyprlock at order 11400 exactly like sudo's. hyprlock just never asks it: its PAM conversation runs only on submit, so a module that wants to prompt *while* polling the reader never gets a turn. hyprlock has its own fprintd-over-D-Bus backend instead, behind `auth:fingerprint:enabled`, which nothing in the distro ever set. So `fingerprint.pam = true` promised "login + sudo" and silently skipped the surface you meet most often. The second half is the one worth having: enabling the backend alone yields a reader that works while the field still reads "password…". $FPRINTPROMPT is the ONLY slot hyprlock renders the ready/scanning/failed messages into, and ours hardcoded the placeholder — proven on hardware, where a test config with the backend on unlocked by finger and said nothing whatsoever. A feature that works and cannot be discovered fails VISION's "discoverable without reading the README" either way, so the placeholder now carries $FPRINTPROMPT and the messages mirror sudo's "Enter Password or Place finger". New `nomarchy.idle.fingerprint` (default false), mirroring `nomarchy.hardware.fingerprint.pam` the way `nomarchy.keyboard.layout` mirrors `services.xserver.xkb.layout`: hyprlock is configured in standalone Home Manager, which has no `osConfig` to derive the NixOS side from. Opt-in rather than implied, because with no reader hyprlock advertises a scan that cannot happen. Documented in the template (SoT for opt-in comments) and README — option-docs caught the missing row, which is the check doing its job. Verified V2: nix flake check --no-build; checks.option-docs passes (failed first with "undocumented option", as it should). V3 pending: Bernardo applies it and confirms the field reads "password… or scan finger" and both factors work — the mechanism itself is already proven on his reader via a test config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
18 KiB
18 KiB