#%PAM-1.0
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
#
# The service kscreenlocker's /etc/pam.d/kde-fingerprint substacks, and which
# nothing on Alpine provides -- so on a stock pmOS image every fingerprint
# unlock fails before it reaches any daemon, with PAM unable to open the
# substack rather than anything about fingerprints. kscreenlocker ships
# kde-fingerprint (auth/account/password/session all `include fingerprint-auth`)
# and Alpine ships pam_fprintd, and the file joining them is simply absent.
#
# It lives in the vendor directory /usr/lib/pam.d, next to Alpine's own
# base-auth, so an administrator can still override it in /etc/pam.d.
#
# fingerprintd ships it because fingerprintd is what makes it mean anything:
# this package provides fprintd, so it owns the bus name pam_fprintd talks to.

# pam_fprintd asks the daemon to verify, prompting through the PAM
# conversation; sufficient, so a match ends the stack successfully and a
# failure falls through to pam_deny rather than to a password -- the caller
# (kde-fingerprint) is the one that decides whether to offer a password next.
# timeout: pam_fprintd defaults to 30 seconds and the lock screen arms
# fingerprint exactly ONCE when it appears, so on a stock setup the sensor is
# live for half a minute and then silently is not -- a press after that reaches
# nothing at all, which reads as a broken sensor rather than an expired window.
# 60 s is a compromise, not a fix: every second of it is our verify loop
# polling the trustlet at ~5 Hz, so the honest ceiling on this number is set by
# the idle-IRQ work (fp6 journal/fingerprint, "SENSOR POWER"). Raise it once an
# idle verify costs nothing.
auth       required    pam_env.so
auth       sufficient  pam_fprintd.so timeout=60
auth       required    pam_deny.so

account    include     base-account

# A fingerprint cannot set a password, and kde-fingerprint includes this
# service for `password` as well.
password   required    pam_deny.so

session    include     base-session
