feat: add fprintd fingerprint authentication via greetd multi-stage PAM (v0.6.0)

Fingerprint auth was missing because moongreet rejected multi-stage auth_message sequences from greetd. With pam_fprintd.so in the PAM stack, greetd sends non-secret prompts for fingerprint and secret prompts for password — moongreet now handles both in a loop. - Replace single-pass auth with multi-stage auth_message loop - fprintd D-Bus probe (gio::DBusProxy) for UI feedback only - Fingerprint label shown when device available and fingers enrolled - 60s socket timeout when fingerprint available (pam_fprintd scan time) - Config option: [appearance] fingerprint-enabled (default: true) - Fix: password entry focus loss after auth error (grab_focus while widget was insensitive — now re-enable before grab_focus)
fix: prevent edge darkening on GPU-blurred wallpaper (v0.5.3)
2026-03-29 13:47:57 +02:00 · 2026-03-28 23:28:39 +01:00 · 2026-03-28 23:26:33 +01:00 · 2026-03-28 23:23:10 +01:00 · 2026-03-28 22:56:39 +01:00 · 2026-03-28 22:47:21 +01:00
18 changed files with 829 additions and 359 deletions
@@ -17,8 +17,9 @@ Teil des Moonarch-Ökosystems.
 ## Projektstruktur

 - `src/` — Rust-Quellcode (main.rs, greeter.rs, ipc.rs, config.rs, users.rs, sessions.rs, i18n.rs, power.rs)
- `resources/` — GResource-Assets (style.css, wallpaper.jpg, default-avatar.svg)
+- `resources/` — GResource-Assets (style.css, default-avatar.svg)
 - `config/` — Beispiel-Konfigurationsdateien für `/etc/moongreet/` und `/etc/greetd/`
+- `pkg/` — PKGBUILD für Arch-Linux-Paketierung (`makepkg -sf`)

 ## Kommandos

@@ -29,8 +30,11 @@ cargo test
 # Release-Build
 cargo build --release

-# Greeter starten (nur zum Testen, braucht normalerweise greetd)
-LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moongreet
+# Greeter im Fenster starten (ohne greetd/Layer Shell)
+MOONGREET_NO_LAYER_SHELL=1 ./target/release/moongreet
+
+# Paket bauen und installieren
+cd pkg && makepkg -sf && sudo pacman -U moongreet-git-<version>-x86_64.pkg.tar.zst
 ```

 ## Architektur
@@ -39,10 +43,11 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moongreet
 - `users.rs` — Benutzer aus /etc/passwd, Avatare (AccountsService + ~/.face), Symlink-Rejection
 - `sessions.rs` — Wayland/X11 Sessions aus .desktop Files
 - `power.rs` — Reboot/Shutdown via loginctl
- `i18n.rs` — Locale-Erkennung (LANG / /etc/locale.conf) und String-Tabellen (DE/EN)
- `config.rs` — TOML-Config ([appearance] background, gtk-theme) + Wallpaper-Fallback
- `greeter.rs` — GTK4 UI (Overlay-Layout), Login-Flow via greetd IPC, Faillock-Warnung, Avatar-Cache, Last-User/Last-Session Persistence
- `main.rs` — Entry Point, GTK App, Layer Shell Setup, Multi-Monitor
+- `i18n.rs` — Locale-Erkennung (LANG / /etc/locale.conf) und String-Tabellen (DE/EN), alle UI- und Login-Fehlermeldungen
+- `fingerprint.rs` — fprintd D-Bus Probe (gio::DBusProxy) — Geräteerkennung und Enrollment-Check für UI-Feedback
+- `config.rs` — TOML-Config ([appearance] background, gtk-theme, fingerprint-enabled) + Wallpaper-Fallback
+- `greeter.rs` — GTK4 UI (Overlay-Layout), Login-Flow via greetd IPC (Multi-Stage-Auth für fprintd), Faillock-Warnung, Avatar-Cache, Last-User/Last-Session Persistence (0o600 Permissions)
+- `main.rs` — Entry Point, GTK App, Layer Shell Setup, Multi-Monitor, systemd-journal-logger
 - `resources/style.css` — Catppuccin-inspiriertes Theme

 ## Design Decisions
@@ -52,4 +57,14 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moongreet
 - **Async Login**: `glib::spawn_future_local` + `gio::spawn_blocking` statt raw Threads
 - **Socket-Cancellation**: `Arc<Mutex<Option<UnixStream>>>` + `AtomicBool` für saubere Abbrüche
 - **Avatar-Cache**: `HashMap<String, gdk::Texture>` in `Rc<RefCell<GreeterState>>`
- **Symmetrie mit moonset**: Gleiche Patterns (i18n, config, users, power, GResource)
+- **GPU-Blur via GskBlurNode**: `Snapshot::push_blur()` + `GskRenderer::render_texture()` im `connect_realize` Callback — kein CPU-Blur, kein Disk-Cache, kein `image`-Crate
+- **Fingerprint via greetd Multi-Stage PAM**: fprintd D-Bus nur als Probe (Gerät/Enrollment), eigentliche Verifizierung läuft über PAM im greetd-Auth-Loop. `auth_message_type: "secret"` → Passwort, alles andere → `None` (PAM entscheidet). 60s Socket-Timeout bei fprintd.
+- **Symmetrie mit moonlock/moonset**: Gleiche Patterns (i18n, config, users, power, GResource, GPU-Blur)
+- **Session-Validierung**: Relative Pfade erlaubt (greetd löst PATH auf), nur `..`/Null-Bytes werden abgelehnt
+- **GTK-Theme-Validierung**: Nur alphanumerisch + `_-+.` erlaubt, verhindert Path-Traversal über Config
+- **Journal-Logging**: `systemd-journal-logger` statt File-Logging — `journalctl -t moongreet`, Debug-Level per `MOONGREET_DEBUG` Env-Var
+- **File Permissions**: Cache-Dateien 0o600
+- **Testbare Persistence**: `save_*_to`/`load_*_from` Varianten mit konfigurierbarem Pfad für Unit-Tests
+- **Shared Wallpaper Texture**: `gdk::Texture` wird einmal in `load_background_texture()` dekodiert und per Ref-Count an alle Fenster geteilt — vermeidet redundante JPEG-Dekodierung pro Monitor
+- **Wallpaper-Validierung**: GResource-Zweig via `resources_lookup_data()` + `from_bytes()` (kein Abort bei fehlendem Pfad), Dateigröße-Limit 50 MB, non-UTF-8-Pfade → `None`
+- **Error-Detail-Filterung**: GDK/greetd-Fehlerdetails nur auf `debug!`-Level, `warn!` ohne interne Details — verhindert Systeminfo-Leak ins Journal
@@ -2,65 +2,6 @@
 # It is not intended for manual editing.
 version = 4

-[[package]]
-name = "aho-corasick"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys",
-]
-
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -118,35 +59,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
-[[package]]
-name = "env_filter"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
-dependencies = [
- "log",
- "regex",
-]
-
-[[package]]
-name = "env_logger"
-version = "0.11.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
-dependencies = [
- "anstream",
- "anstyle",
- "env_filter",
- "jiff",
- "log",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -604,42 +516,12 @@ dependencies = [
 "serde_core",
 ]

-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

-[[package]]
-name = "jiff"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a3546dc96b6d42c5f24902af9e2538e82e39ad350b0c766eb3fbf2d8f3d8359"
-dependencies = [
- "jiff-static",
- "log",
- "portable-atomic",
- "portable-atomic-util",
- "serde_core",
-]
-
-[[package]]
-name = "jiff-static"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a8c8b344124222efd714b73bb41f8b5120b27a7cc1c75593a6ff768d9d05aa4"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "khronos_api"
 version = "3.1.0"
@@ -687,19 +569,20 @@ dependencies = [

 [[package]]
 name = "moongreet"
-version = "0.3.2"
+version = "0.5.3"
 dependencies = [
- "env_logger",
 "gdk-pixbuf",
 "gdk4",
 "gio",
 "glib",
 "glib-build-tools",
+ "graphene-rs",
 "gtk4",
 "gtk4-layer-shell",
 "log",
 "serde",
 "serde_json",
+ "systemd-journal-logger",
 "tempfile",
 "toml 0.8.23",
 ]
@@ -710,12 +593,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"

-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
 [[package]]
 name = "pango"
 version = "0.22.0"
@@ -752,21 +629,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"

-[[package]]
-name = "portable-atomic"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
-
-[[package]]
-name = "portable-atomic-util"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "091397be61a01d4be58e7841595bd4bfedb15f1cd54977d79b8271e94ed799a3"
-dependencies = [
- "portable-atomic",
-]
-
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -810,35 +672,6 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"

-[[package]]
-name = "regex"
-version = "1.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
-
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -964,6 +797,16 @@ dependencies = [
 "version-compare",
 ]

+[[package]]
+name = "systemd-journal-logger"
+version = "2.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7266304d24ca5a4b230545fc558c80e18bd3e1d2eb1be149b6bcd04398d3e79c"
+dependencies = [
+ "log",
+ "rustix",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.13.3"
@@ -1096,12 +939,6 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"

-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
 [[package]]
 name = "version-compare"
 version = "0.2.1"
@@ -1,6 +1,6 @@
 [package]
 name = "moongreet"
-version = "0.3.2"
+version = "0.6.0"
 edition = "2024"
 description = "A greetd greeter for Wayland with GTK4 and Layer Shell"
 license = "MIT"
@@ -15,8 +15,9 @@ gio = "0.22"
 toml = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+graphene-rs = { version = "0.22", package = "graphene-rs" }
 log = "0.4"
-env_logger = "0.11"
+systemd-journal-logger = "2.2"

 [dev-dependencies]
 tempfile = "3"
@@ -0,0 +1,35 @@
+# Decisions
+
+## 2026-03-29 – Fingerprint authentication via greetd multi-stage PAM
+
+- **Who**: Ragnar, Dom
+- **Why**: moonlock supports fprintd but moongreet rejected multi-stage auth. Users with enrolled fingerprints couldn't use them at the login screen.
+- **Tradeoffs**: Direct fprintd D-Bus verification (like moonlock) can't start a greetd session — greetd controls session creation via PAM. Using greetd multi-stage means PAM decides the auth order (fingerprint first, then password fallback), not truly parallel. Acceptable — matches standard pam_fprintd behavior.
+- **How**: Replace single-pass auth with a loop over auth_message rounds. Secret prompts get the password, non-secret prompts (fprintd) get None and block until PAM resolves. fprintd D-Bus probe (gio::DBusProxy) only for UI — detecting device availability and enrolled fingers. 60s socket timeout when fingerprint available. Config option `fingerprint-enabled` (default true).
+
+## 2026-03-28 – Remove embedded wallpaper from binary
+
+- **Who**: Selene, Dom
+- **Why**: Wallpaper is installed by moonarch to /usr/share/moonarch/wallpaper.jpg. Embedding a 374K JPEG in the binary is redundant. GTK background color (Catppuccin Mocha base) is a clean fallback.
+- **Tradeoffs**: Without moonarch installed AND without config, greeter shows plain dark background instead of wallpaper. Acceptable — that's the expected minimal state.
+- **How**: Remove wallpaper.jpg from GResources, return None from resolve_background_path when no file found, skip wallpaper window creation and background picture when no path available.
+
+## 2026-03-28 – GPU blur via GskBlurNode replaces CPU blur
+
+- **Who**: Ragnar, Dom
+- **Why**: CPU-side Gaussian blur (`image` crate) blocked the GTK main thread for 500ms–2s on 4K wallpapers at cold cache. Disk cache and async orchestration added significant complexity.
+- **Tradeoffs**: GPU blur quality is slightly different (box-blur approximation vs true Gaussian), acceptable for wallpaper backgrounds. Removes `image` crate dependency entirely (~15 transitive crates eliminated). No disk cache needed.
+- **How**: `Snapshot::push_blur()` + `GskRenderer::render_texture()` on `connect_realize`. Blur happens once on the GPU when the widget gets its renderer, producing a concrete `gdk::Texture`. Zero startup latency. Symmetric with moonlock and moonset.
+
+## 2026-03-28 – Optional background blur via `image` crate (superseded)
+
+- **Who**: Selene, Dom
+- **Why**: Blurred wallpaper as greeter background is a common UX pattern for login screens
+- **Tradeoffs**: Adds `image` crate dependency (~15 transitive crates); CPU-side Gaussian blur at load time adds startup latency proportional to image size and sigma. Acceptable because blur runs once and the texture is shared across monitors.
+- **How**: `load_background_texture(bg_path, blur_radius)` loads texture, optionally applies `imageops::blur()`, returns blurred `gdk::Texture`. Config option `background-blur: Option<f32>` in `[appearance]` TOML section.
+
+## 2026-03-28 – Audit fixes for shared wallpaper texture (v0.4.1)
+- **Who**: Selene, Dominik
+- **Why**: Quality, performance, and security audits flagged issues in `load_background_texture()`, debug logging, and greetd error handling
+- **Tradeoffs**: GResource path now requires UTF-8 (returns `None` for non-UTF-8 instead of aborting); 50 MB wallpaper limit is generous but prevents OOM; debug logging off by default trades observability for security
+- **How**: GResource branch via `resources_lookup_data()` + `from_bytes()` (no abort), file size limit, error details only at debug level, `MOONGREET_DEBUG` env var for log level, greetd retry path truncation matching `show_greetd_error()`
@@ -15,6 +15,7 @@ Part of the Moonarch ecosystem.
 - **Multi-monitor** — Greeter on primary, wallpaper on all monitors
 - **i18n** — German and English (auto-detected from system locale)
 - **Faillock warning** — Warns after 2 failed attempts, locked message after 3
+- **Fingerprint** — fprintd support via greetd multi-stage PAM (configurable)

 ## Requirements

@@ -4,7 +4,7 @@
 # Maintainer: Dominik Kressler

 pkgname=moongreet-git
-pkgver=0.3.0.r0.g0000000
+pkgver=0.3.1.r5.g4c9b436
 pkgrel=1
 pkgdesc="A greetd greeter for Wayland with GTK4 and Layer Shell"
 arch=('x86_64')
@@ -2,7 +2,6 @@
 <gresources>
  <gresource prefix="/dev/moonarch/moongreet">
    <file>style.css</file>
-    <file>wallpaper.jpg</file>
    <file>default-avatar.svg</file>
  </gresource>
 </gresources>
@@ -54,6 +54,13 @@ window.wallpaper {
    font-size: 14px;
 }

+/* Fingerprint prompt label */
+.fingerprint-label {
+    color: alpha(white, 0.6);
+    font-size: 13px;
+    margin-top: 8px;
+}
+
 /* User list on the bottom left */
 .user-list {
    background-color: transparent;
@@ -6,7 +6,6 @@ use std::fs;
 use std::path::{Path, PathBuf};

 const MOONARCH_WALLPAPER: &str = "/usr/share/moonarch/wallpaper.jpg";
-const GRESOURCE_PREFIX: &str = "/dev/moonarch/moongreet";

 /// Default config search path: system-wide config.
 fn default_config_paths() -> Vec<PathBuf> {
@@ -22,15 +21,32 @@ struct TomlConfig {
 #[derive(Debug, Clone, Default, Deserialize)]
 struct Appearance {
    background: Option<String>,
+    #[serde(rename = "background-blur")]
+    background_blur: Option<f32>,
    #[serde(rename = "gtk-theme")]
    gtk_theme: Option<String>,
+    #[serde(rename = "fingerprint-enabled")]
+    fingerprint_enabled: Option<bool>,
 }

 /// Greeter configuration.
-#[derive(Debug, Clone, Default)]
+#[derive(Debug, Clone)]
 pub struct Config {
    pub background_path: Option<String>,
+    pub background_blur: Option<f32>,
    pub gtk_theme: Option<String>,
+    pub fingerprint_enabled: bool,
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        Config {
+            background_path: None,
+            background_blur: None,
+            gtk_theme: None,
+            fingerprint_enabled: true,
+        }
+    }
 }

 /// Load config from TOML files. Later paths override earlier ones.
@@ -40,54 +56,75 @@ pub fn load_config(config_paths: Option<&[PathBuf]>) -> Config {

    let mut merged = Config::default();
    for path in paths {
-        if let Ok(content) = fs::read_to_string(path) {
-            if let Ok(parsed) = toml::from_str::<TomlConfig>(&content) {
-                if let Some(appearance) = parsed.appearance {
-                    if let Some(bg) = appearance.background {
-                        // Resolve relative paths against config file directory
-                        let bg_path = PathBuf::from(&bg);
-                        if bg_path.is_absolute() {
-                            merged.background_path = Some(bg);
-                        } else if let Some(parent) = path.parent() {
-                            merged.background_path =
-                                Some(parent.join(&bg).to_string_lossy().to_string());
+        match fs::read_to_string(path) {
+            Ok(content) => {
+                match toml::from_str::<TomlConfig>(&content) {
+                    Ok(parsed) => {
+                        log::debug!("Config loaded: {}", path.display());
+                        if let Some(appearance) = parsed.appearance {
+                            if let Some(bg) = appearance.background {
+                                // Resolve relative paths against config file directory
+                                let bg_path = PathBuf::from(&bg);
+                                if bg_path.is_absolute() {
+                                    merged.background_path = Some(bg);
+                                } else if let Some(parent) = path.parent() {
+                                    merged.background_path =
+                                        Some(parent.join(&bg).to_string_lossy().to_string());
+                                }
+                            }
+                            if appearance.background_blur.is_some() {
+                                merged.background_blur = appearance.background_blur;
+                            }
+                            if appearance.gtk_theme.is_some() {
+                                merged.gtk_theme = appearance.gtk_theme;
+                            }
+                            if let Some(fp) = appearance.fingerprint_enabled {
+                                merged.fingerprint_enabled = fp;
+                            }
                        }
                    }
-                    if appearance.gtk_theme.is_some() {
-                        merged.gtk_theme = appearance.gtk_theme;
+                    Err(e) => {
+                        log::warn!("Config parse error in {}: {e}", path.display());
                    }
                }
            }
+            Err(_) => {
+                log::debug!("Config not found: {}", path.display());
+            }
        }
    }

+    log::debug!("Config result: background={:?}, blur={:?}, gtk_theme={:?}, fingerprint={}", merged.background_path, merged.background_blur, merged.gtk_theme, merged.fingerprint_enabled);
    merged
 }

 /// Resolve the wallpaper path using the fallback hierarchy.
 ///
-/// Priority: config background_path > Moonarch system default > gresource fallback.
-pub fn resolve_background_path(config: &Config) -> PathBuf {
+/// Priority: config background_path > Moonarch system default > None (GTK background color).
+pub fn resolve_background_path(config: &Config) -> Option<PathBuf> {
    resolve_background_path_with(config, Path::new(MOONARCH_WALLPAPER))
 }

 /// Resolve with configurable moonarch wallpaper path (for testing).
-pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> PathBuf {
+pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> Option<PathBuf> {
    // User-configured path
    if let Some(ref bg) = config.background_path {
        let path = PathBuf::from(bg);
        if path.is_file() {
-            return path;
+            log::debug!("Wallpaper: using config path {}", path.display());
+            return Some(path);
        }
+        log::debug!("Wallpaper: config path {} not found, trying fallbacks", path.display());
    }

    // Moonarch ecosystem default
    if moonarch_wallpaper.is_file() {
-        return moonarch_wallpaper.to_path_buf();
+        log::debug!("Wallpaper: using moonarch default {}", moonarch_wallpaper.display());
+        return Some(moonarch_wallpaper.to_path_buf());
    }

-    // GResource fallback path (loaded from compiled resources at runtime)
-    PathBuf::from(format!("{GRESOURCE_PREFIX}/wallpaper.jpg"))
+    log::debug!("Wallpaper: no wallpaper found, using GTK background color");
+    None
 }

 #[cfg(test)]
@@ -98,7 +135,9 @@ mod tests {
    fn default_config_has_none_fields() {
        let config = Config::default();
        assert!(config.background_path.is_none());
+        assert!(config.background_blur.is_none());
        assert!(config.gtk_theme.is_none());
+        assert!(config.fingerprint_enabled);
    }

    #[test]
@@ -115,7 +154,7 @@ mod tests {
        let conf = dir.path().join("moongreet.toml");
        fs::write(
            &conf,
-            "[appearance]\nbackground = \"/custom/wallpaper.jpg\"\ngtk-theme = \"catppuccin\"\n",
+            "[appearance]\nbackground = \"/custom/wallpaper.jpg\"\nbackground-blur = 20.0\ngtk-theme = \"catppuccin\"\n",
        )
        .unwrap();
        let paths = vec![conf];
@@ -124,9 +163,20 @@ mod tests {
            config.background_path.as_deref(),
            Some("/custom/wallpaper.jpg")
        );
+        assert_eq!(config.background_blur, Some(20.0));
        assert_eq!(config.gtk_theme.as_deref(), Some("catppuccin"));
    }

+    #[test]
+    fn load_config_blur_optional() {
+        let dir = tempfile::tempdir().unwrap();
+        let conf = dir.path().join("moongreet.toml");
+        fs::write(&conf, "[appearance]\nbackground = \"/bg.jpg\"\n").unwrap();
+        let paths = vec![conf];
+        let config = load_config(Some(&paths));
+        assert!(config.background_blur.is_none());
+    }
+
    #[test]
    fn load_config_resolves_relative_background() {
        let dir = tempfile::tempdir().unwrap();
@@ -180,11 +230,11 @@ mod tests {
        fs::write(&wallpaper, "fake").unwrap();
        let config = Config {
            background_path: Some(wallpaper.to_str().unwrap().to_string()),
-            gtk_theme: None,
+            ..Config::default()
        };
        assert_eq!(
            resolve_background_path_with(&config, Path::new("/nonexistent")),
-            wallpaper
+            Some(wallpaper)
        );
    }

@@ -192,10 +242,10 @@ mod tests {
    fn resolve_ignores_config_path_when_file_missing() {
        let config = Config {
            background_path: Some("/nonexistent/wallpaper.jpg".to_string()),
-            gtk_theme: None,
+            ..Config::default()
        };
        let result = resolve_background_path_with(&config, Path::new("/nonexistent"));
-        assert!(result.to_str().unwrap().contains("moongreet"));
+        assert!(result.is_none());
    }

    #[test]
@@ -206,14 +256,31 @@ mod tests {
        let config = Config::default();
        assert_eq!(
            resolve_background_path_with(&config, &moonarch_wp),
-            moonarch_wp
+            Some(moonarch_wp)
        );
    }

    #[test]
-    fn resolve_uses_gresource_fallback_as_last_resort() {
+    fn resolve_returns_none_when_no_wallpaper_found() {
        let config = Config::default();
        let result = resolve_background_path_with(&config, Path::new("/nonexistent"));
-        assert!(result.to_str().unwrap().contains("wallpaper.jpg"));
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn load_config_fingerprint_enabled_default_true() {
+        let paths = vec![PathBuf::from("/nonexistent/moongreet.toml")];
+        let config = load_config(Some(&paths));
+        assert!(config.fingerprint_enabled);
+    }
+
+    #[test]
+    fn load_config_fingerprint_disabled() {
+        let dir = tempfile::tempdir().unwrap();
+        let conf = dir.path().join("moongreet.toml");
+        fs::write(&conf, "[appearance]\nfingerprint-enabled = false\n").unwrap();
+        let paths = vec![conf];
+        let config = load_config(Some(&paths));
+        assert!(!config.fingerprint_enabled);
    }
 }
@@ -0,0 +1,137 @@
+// ABOUTME: fprintd D-Bus probe for fingerprint device availability.
+// ABOUTME: Checks if fprintd is running and the user has enrolled fingerprints.
+
+use gio::prelude::*;
+use gtk4::gio;
+
+const FPRINTD_BUS_NAME: &str = "net.reactivated.Fprint";
+const FPRINTD_MANAGER_PATH: &str = "/net/reactivated/Fprint/Manager";
+const FPRINTD_MANAGER_IFACE: &str = "net.reactivated.Fprint.Manager";
+const FPRINTD_DEVICE_IFACE: &str = "net.reactivated.Fprint.Device";
+
+const DBUS_TIMEOUT_MS: i32 = 3000;
+
+/// Lightweight fprintd probe — detects device availability and finger enrollment.
+/// Does NOT perform verification (that happens through greetd/PAM).
+pub struct FingerprintProbe {
+    device_proxy: Option<gio::DBusProxy>,
+}
+
+impl FingerprintProbe {
+    /// Create a probe without any D-Bus connections.
+    /// Call `init_async().await` to connect to fprintd.
+    pub fn new() -> Self {
+        FingerprintProbe {
+            device_proxy: None,
+        }
+    }
+
+    /// Connect to fprintd on the system bus and discover the default device.
+    pub async fn init_async(&mut self) {
+        let manager = match gio::DBusProxy::for_bus_future(
+            gio::BusType::System,
+            gio::DBusProxyFlags::NONE,
+            None,
+            FPRINTD_BUS_NAME,
+            FPRINTD_MANAGER_PATH,
+            FPRINTD_MANAGER_IFACE,
+        )
+        .await
+        {
+            Ok(m) => m,
+            Err(e) => {
+                log::debug!("fprintd manager not available: {e}");
+                return;
+            }
+        };
+
+        let result = match manager
+            .call_future("GetDefaultDevice", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
+            .await
+        {
+            Ok(r) => r,
+            Err(e) => {
+                log::debug!("fprintd GetDefaultDevice failed: {e}");
+                return;
+            }
+        };
+
+        let device_path = match result.child_value(0).get::<String>() {
+            Some(p) => p,
+            None => {
+                log::debug!("fprintd: unexpected GetDefaultDevice response type");
+                return;
+            }
+        };
+        if device_path.is_empty() {
+            return;
+        }
+
+        match gio::DBusProxy::for_bus_future(
+            gio::BusType::System,
+            gio::DBusProxyFlags::NONE,
+            None,
+            FPRINTD_BUS_NAME,
+            &device_path,
+            FPRINTD_DEVICE_IFACE,
+        )
+        .await
+        {
+            Ok(proxy) => {
+                self.device_proxy = Some(proxy);
+            }
+            Err(e) => {
+                log::debug!("fprintd device proxy failed: {e}");
+            }
+        }
+    }
+
+    /// Check if the user has enrolled fingerprints on the default device.
+    /// Returns false if fprintd is unavailable or the user has no enrollments.
+    pub async fn is_available_async(&self, username: &str) -> bool {
+        let proxy = match &self.device_proxy {
+            Some(p) => p,
+            None => return false,
+        };
+
+        let args = glib::Variant::from((&username,));
+        match proxy
+            .call_future(
+                "ListEnrolledFingers",
+                Some(&args),
+                gio::DBusCallFlags::NONE,
+                DBUS_TIMEOUT_MS,
+            )
+            .await
+        {
+            Ok(result) => match result.child_value(0).get::<Vec<String>>() {
+                Some(fingers) => !fingers.is_empty(),
+                None => {
+                    log::debug!("fprintd: unexpected ListEnrolledFingers response type");
+                    false
+                }
+            },
+            Err(_) => false,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn new_probe_has_no_device() {
+        let probe = FingerprintProbe::new();
+        assert!(probe.device_proxy.is_none());
+    }
+
+    #[test]
+    fn constants_are_defined() {
+        assert!(!FPRINTD_BUS_NAME.is_empty());
+        assert!(!FPRINTD_MANAGER_PATH.is_empty());
+        assert!(!FPRINTD_MANAGER_IFACE.is_empty());
+        assert!(!FPRINTD_DEVICE_IFACE.is_empty());
+        assert!(DBUS_TIMEOUT_MS > 0);
+    }
+}
@@ -22,6 +22,7 @@ use crate::users::{self, User};

 const AVATAR_SIZE: i32 = 128;
 const MAX_AVATAR_FILE_SIZE: u64 = 10 * 1024 * 1024;
+const MAX_WALLPAPER_FILE_SIZE: u64 = 50 * 1024 * 1024;
 const LAST_USER_PATH: &str = "/var/cache/moongreet/last-user";
 const LAST_SESSION_DIR: &str = "/var/cache/moongreet/last-session";
 const MAX_USERNAME_LENGTH: usize = 256;
@@ -91,12 +92,68 @@ fn is_valid_username(name: &str) -> bool {
        return false;
    }
    name.chars()
-        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '.' || c == '-')
+        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '.' || c == '-' || c == '@')
+}
+
+/// Load background texture from filesystem.
+pub fn load_background_texture(bg_path: &Path) -> Option<gdk::Texture> {
+    if let Ok(meta) = std::fs::metadata(bg_path)
+        && meta.len() > MAX_WALLPAPER_FILE_SIZE
+    {
+        log::warn!(
+            "Wallpaper file too large ({} bytes), skipping: {}",
+            meta.len(), bg_path.display()
+        );
+        return None;
+    }
+    match gdk::Texture::from_filename(bg_path) {
+        Ok(texture) => Some(texture),
+        Err(e) => {
+            log::debug!("Wallpaper load error: {e}");
+            log::warn!("Failed to load background texture from {}", bg_path.display());
+            None
+        }
+    }
+}
+
+// -- GPU blur via GskBlurNode -------------------------------------------------
+
+/// Render a blurred texture using the GPU via GskBlurNode.
+///
+/// To avoid edge darkening (blur samples transparent pixels outside bounds),
+/// the texture is rendered with padding equal to 3x the blur sigma. The blur
+/// is applied to the padded area, then cropped back to the original size.
+fn render_blurred_texture(
+    widget: &impl IsA<gtk::Widget>,
+    texture: &gdk::Texture,
+    sigma: f32,
+) -> Option<gdk::Texture> {
+    let native = widget.native()?;
+    let renderer = native.renderer()?;
+
+    let w = texture.width() as f32;
+    let h = texture.height() as f32;
+    // Padding must cover the blur kernel radius (typically ~3x sigma)
+    let pad = (sigma * 3.0).ceil();
+
+    let snapshot = gtk::Snapshot::new();
+    // Clip output to original texture size
+    snapshot.push_clip(&graphene_rs::Rect::new(pad, pad, w, h));
+    snapshot.push_blur(sigma as f64);
+    // Render texture with padding on all sides (edges repeat via oversized bounds)
+    snapshot.append_texture(texture, &graphene_rs::Rect::new(0.0, 0.0, w + 2.0 * pad, h + 2.0 * pad));
+    snapshot.pop(); // blur
+    snapshot.pop(); // clip
+
+    let node = snapshot.to_node()?;
+    let viewport = graphene_rs::Rect::new(pad, pad, w, h);
+    Some(renderer.render_texture(&node, Some(&viewport)))
 }

 /// Create a wallpaper-only window for secondary monitors.
 pub fn create_wallpaper_window(
-    bg_path: &Path,
+    texture: &gdk::Texture,
+    blur_radius: Option<f32>,
    app: &gtk::Application,
 ) -> gtk::ApplicationWindow {
    let window = gtk::ApplicationWindow::builder()
@@ -104,22 +161,28 @@ pub fn create_wallpaper_window(
        .build();
    window.add_css_class("wallpaper");

-    let background = create_background_picture(bg_path);
+    let background = create_background_picture(texture, blur_radius);
    window.set_child(Some(&background));

    window
 }

-/// Create a Picture widget for the wallpaper background.
-fn create_background_picture(bg_path: &Path) -> gtk::Picture {
-    let background = if bg_path.starts_with("/dev/moonarch/moongreet") {
-        gtk::Picture::for_resource(bg_path.to_str().unwrap_or(""))
-    } else {
-        gtk::Picture::for_filename(bg_path.to_str().unwrap_or(""))
-    };
+/// Create a Picture widget for the wallpaper background, optionally with GPU blur.
+fn create_background_picture(texture: &gdk::Texture, blur_radius: Option<f32>) -> gtk::Picture {
+    let background = gtk::Picture::for_paintable(texture);
    background.set_content_fit(gtk::ContentFit::Cover);
    background.set_hexpand(true);
    background.set_vexpand(true);
+
+    if let Some(sigma) = blur_radius.filter(|s| *s > 0.0) {
+        let texture = texture.clone();
+        background.connect_realize(move |picture| {
+            if let Some(blurred) = render_blurred_texture(picture, &texture, sigma) {
+                picture.set_paintable(Some(&blurred));
+            }
+        });
+    }
+
    background
 }

@@ -131,11 +194,12 @@ struct GreeterState {
    failed_attempts: HashMap<String, u32>,
    greetd_sock: Arc<Mutex<Option<UnixStream>>>,
    login_cancelled: Arc<std::sync::atomic::AtomicBool>,
+    fingerprint_available: bool,
 }

 /// Create the main greeter window with login UI.
 pub fn create_greeter_window(
-    bg_path: &Path,
+    texture: Option<&gdk::Texture>,
    config: &Config,
    app: &gtk::Application,
 ) -> gtk::ApplicationWindow {
@@ -161,8 +225,13 @@ pub fn create_greeter_window(
    }

    let strings = load_strings(None);
+    let fingerprint_enabled = config.fingerprint_enabled;
    let all_users = users::get_users(None);
    let all_sessions = sessions::get_sessions(None, None);
+    log::debug!("Greeter window: {} user(s), {} session(s)", all_users.len(), all_sessions.len());
+    if let Some(ref theme) = config.gtk_theme {
+        log::debug!("GTK theme: {theme}");
+    }

    let state = Rc::new(RefCell::new(GreeterState {
        selected_user: None,
@@ -171,6 +240,7 @@ pub fn create_greeter_window(
        failed_attempts: HashMap::new(),
        greetd_sock: Arc::new(Mutex::new(None)),
        login_cancelled: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+        fingerprint_available: false,
    }));

    // Root overlay for layering
@@ -178,7 +248,9 @@ pub fn create_greeter_window(
    window.set_child(Some(&overlay));

    // Background wallpaper
-    overlay.set_child(Some(&create_background_picture(bg_path)));
+    if let Some(texture) = texture {
+        overlay.set_child(Some(&create_background_picture(texture, config.background_blur)));
+    }

    // Main layout: 3 rows (top spacer, center login, bottom bar)
    let main_box = gtk::Box::new(gtk::Orientation::Vertical, 0);
@@ -239,6 +311,12 @@ pub fn create_greeter_window(
    error_label.set_visible(false);
    login_box.append(&error_label);

+    // Fingerprint label (hidden until probe confirms availability)
+    let fp_label = gtk::Label::new(None);
+    fp_label.add_css_class("fingerprint-label");
+    fp_label.set_visible(false);
+    login_box.append(&fp_label);
+
    login_box.set_halign(gtk::Align::Center);
    main_box.append(&login_box);

@@ -279,6 +357,8 @@ pub fn create_greeter_window(
            #[weak]
            error_label,
            #[weak]
+            fp_label,
+            #[weak]
            session_dropdown,
            #[weak]
            window,
@@ -295,9 +375,12 @@ pub fn create_greeter_window(
                    &username_label,
                    &password_entry,
                    &error_label,
+                    &fp_label,
                    &session_dropdown,
                    &sessions_rc,
                    &window,
+                    fingerprint_enabled,
+                    strings,
                );
            }
        ));
@@ -325,7 +408,7 @@ pub fn create_greeter_window(
        error_label,
        move |btn| {
            btn.set_sensitive(false);
-            execute_power_action(power::reboot, strings.reboot_failed, &error_label);
+            execute_power_action(power::reboot, strings.reboot_failed, &error_label, btn);
        }
    ));
    power_box.append(&reboot_btn);
@@ -339,7 +422,7 @@ pub fn create_greeter_window(
        error_label,
        move |btn| {
            btn.set_sensitive(false);
-            execute_power_action(power::shutdown, strings.shutdown_failed, &error_label);
+            execute_power_action(power::shutdown, strings.shutdown_failed, &error_label, btn);
        }
    ));
    power_box.append(&shutdown_btn);
@@ -428,6 +511,8 @@ pub fn create_greeter_window(
        #[weak]
        error_label,
        #[weak]
+        fp_label,
+        #[weak]
        session_dropdown,
        #[weak]
        window,
@@ -445,6 +530,8 @@ pub fn create_greeter_window(
                #[weak]
                error_label,
                #[weak]
+                fp_label,
+                #[weak]
                session_dropdown,
                #[weak]
                window,
@@ -456,9 +543,12 @@ pub fn create_greeter_window(
                        &username_label,
                        &password_entry,
                        &error_label,
+                        &fp_label,
                        &session_dropdown,
                        &sessions_rc,
                        &window,
+                        fingerprint_enabled,
+                        strings,
                    );
                }
            ));
@@ -476,9 +566,12 @@ fn select_initial_user(
    username_label: &gtk::Label,
    password_entry: &gtk::PasswordEntry,
    error_label: &gtk::Label,
+    fp_label: &gtk::Label,
    session_dropdown: &gtk::DropDown,
    sessions: &[Session],
    window: &gtk::ApplicationWindow,
+    fingerprint_enabled: bool,
+    strings: &'static Strings,
 ) {
    if users.is_empty() {
        return;
@@ -489,6 +582,7 @@ fn select_initial_user(
        .as_ref()
        .and_then(|name| users.iter().find(|u| &u.username == name))
        .unwrap_or(&users[0]);
+    log::debug!("Initial user: {} (last_user={:?})", target.username, last_username);

    switch_to_user(
        target,
@@ -497,9 +591,12 @@ fn select_initial_user(
        username_label,
        password_entry,
        error_label,
+        fp_label,
        session_dropdown,
        sessions,
        window,
+        fingerprint_enabled,
+        strings,
    );
 }

@@ -511,18 +608,24 @@ fn switch_to_user(
    username_label: &gtk::Label,
    password_entry: &gtk::PasswordEntry,
    error_label: &gtk::Label,
+    fp_label: &gtk::Label,
    session_dropdown: &gtk::DropDown,
    sessions: &[Session],
    window: &gtk::ApplicationWindow,
+    fingerprint_enabled: bool,
+    strings: &'static Strings,
 ) {
+    log::debug!("Switching to user: {}", user.username);
    {
        let mut s = state.borrow_mut();
        s.selected_user = Some(user.clone());
+        s.fingerprint_available = false;
    }

    username_label.set_text(user.display_name());
    password_entry.set_text("");
    error_label.set_visible(false);
+    fp_label.set_visible(false);

    // Update avatar
    let cached = {
@@ -531,8 +634,10 @@ fn switch_to_user(
    };

    if let Some(texture) = cached {
+        log::debug!("Avatar cache hit for {}", user.username);
        avatar_image.set_paintable(Some(&texture));
    } else {
+        log::debug!("Avatar cache miss for {}", user.username);
        let avatar_path = users::get_avatar_path(&user.username, &user.home);
        if let Some(path) = avatar_path {
            // get_avatar_path already checks existence — go straight to loading
@@ -545,6 +650,27 @@ fn switch_to_user(
    // Pre-select last used session for this user
    select_last_session(&user.username, session_dropdown, sessions);

+    // Probe fprintd for fingerprint availability
+    if fingerprint_enabled {
+        let username = user.username.clone();
+        glib::spawn_future_local(clone!(
+            #[weak]
+            fp_label,
+            #[strong]
+            state,
+            async move {
+                let mut probe = crate::fingerprint::FingerprintProbe::new();
+                probe.init_async().await;
+                let available = probe.is_available_async(&username).await;
+                state.borrow_mut().fingerprint_available = available;
+                fp_label.set_visible(available);
+                if available {
+                    fp_label.set_text(strings.fingerprint_prompt);
+                }
+            }
+        ));
+    }
+
    password_entry.grab_focus();
 }

@@ -555,15 +681,33 @@ fn set_avatar_from_file(
    username: Option<&str>,
    state: &Rc<RefCell<GreeterState>>,
 ) {
-    // Reject oversized files
-    if let Ok(meta) = std::fs::metadata(path) {
-        if meta.len() > MAX_AVATAR_FILE_SIZE {
+    // Re-check symlink status to narrow TOCTOU window from get_avatar_path_with()
+    match std::fs::symlink_metadata(path) {
+        Ok(meta) if meta.file_type().is_symlink() => {
+            log::warn!("Rejecting symlink avatar at load time: {}", path.display());
            image.set_icon_name(Some("avatar-default-symbolic"));
            return;
        }
+        Ok(meta) if meta.len() > MAX_AVATAR_FILE_SIZE => {
+            log::debug!("Avatar file too large ({} bytes): {}", meta.len(), path.display());
+            image.set_icon_name(Some("avatar-default-symbolic"));
+            return;
+        }
+        Err(e) => {
+            log::debug!("Cannot stat avatar {}: {e}", path.display());
+            image.set_icon_name(Some("avatar-default-symbolic"));
+            return;
+        }
+        Ok(_) => {}
    }

-    match Pixbuf::from_file_at_scale(path.to_str().unwrap_or(""), AVATAR_SIZE, AVATAR_SIZE, true) {
+    let Some(path_str) = path.to_str() else {
+        log::debug!("Non-UTF-8 avatar path, skipping: {}", path.display());
+        image.set_icon_name(Some("avatar-default-symbolic"));
+        return;
+    };
+
+    match Pixbuf::from_file_at_scale(path_str, AVATAR_SIZE, AVATAR_SIZE, true) {
        Ok(pixbuf) => {
            let texture = gdk::Texture::for_pixbuf(&pixbuf);
            if let Some(name) = username {
@@ -574,7 +718,8 @@ fn set_avatar_from_file(
            }
            image.set_paintable(Some(&texture));
        }
-        Err(_) => {
+        Err(e) => {
+            log::debug!("Failed to load avatar {}: {e}", path.display());
            image.set_icon_name(Some("avatar-default-symbolic"));
        }
    }
@@ -590,10 +735,12 @@ fn set_default_avatar(
    {
        let s = state.borrow();
        if let Some(ref texture) = s.default_avatar_texture {
+            log::debug!("Default avatar: using cached texture");
            image.set_paintable(Some(texture));
            return;
        }
    }
+    log::debug!("Default avatar: tinting SVG from GResource");

    let resource_path = users::get_default_avatar_path();
    if let Ok(bytes) =
@@ -678,6 +825,15 @@ fn show_error(
    password_entry.grab_focus();
 }

+/// Extract and length-check a greetd error description from a JSON response.
+fn extract_greetd_description<'a>(response: &'a serde_json::Value, fallback: &'a str) -> &'a str {
+    response
+        .get("description")
+        .and_then(|v| v.as_str())
+        .filter(|d| !d.is_empty() && d.len() <= MAX_GREETD_ERROR_LENGTH)
+        .unwrap_or(fallback)
+}
+
 /// Display a greetd error, using a fallback for missing or oversized descriptions.
 fn show_greetd_error(
    error_label: &gtk::Label,
@@ -685,19 +841,13 @@ fn show_greetd_error(
    response: &serde_json::Value,
    fallback: &str,
 ) {
-    let description = response
-        .get("description")
-        .and_then(|v| v.as_str())
-        .unwrap_or("");
-    if !description.is_empty() && description.len() <= MAX_GREETD_ERROR_LENGTH {
-        show_error(error_label, password_entry, description);
-    } else {
-        show_error(error_label, password_entry, fallback);
-    }
+    let message = extract_greetd_description(response, fallback);
+    show_error(error_label, password_entry, message);
 }

 /// Cancel any in-progress greetd session.
 fn cancel_pending_session(state: &Rc<RefCell<GreeterState>>) {
+    log::debug!("Cancelling pending greetd session");
    let s = state.borrow();
    s.login_cancelled
        .store(true, std::sync::atomic::Ordering::SeqCst);
@@ -731,6 +881,7 @@ fn attempt_login(
    password_entry: &gtk::PasswordEntry,
    session_dropdown: &gtk::DropDown,
 ) {
+    log::debug!("Login attempt for user: {}", user.username);
    let sock_path = match std::env::var("GREETD_SOCK") {
        Ok(p) if !p.is_empty() => p,
        _ => {
@@ -740,6 +891,7 @@ fn attempt_login(
    };

    // Validate socket path
+    log::debug!("GREETD_SOCK: {sock_path}");
    let sock_pathbuf = PathBuf::from(&sock_path);
    if !sock_pathbuf.is_absolute() {
        show_error(
@@ -786,6 +938,7 @@ fn attempt_login(
    let session_name = session.name.clone();
    let greetd_sock = state.borrow().greetd_sock.clone();
    let login_cancelled = state.borrow().login_cancelled.clone();
+    let fingerprint_available = state.borrow().fingerprint_available;

    glib::spawn_future_local(clone!(
        #[weak]
@@ -809,6 +962,7 @@ fn attempt_login(
                    &greetd_sock,
                    &login_cancelled,
                    strings,
+                    fingerprint_available,
                )
            })
            .await;
@@ -826,6 +980,7 @@ fn attempt_login(
                    let warning = faillock_warning(*count, strings);
                    drop(s);

+                    set_login_sensitive(&password_entry, &session_dropdown, true);
                    show_greetd_error(
                        &error_label,
                        &password_entry,
@@ -836,24 +991,23 @@ fn attempt_login(
                        let current = error_label.text().to_string();
                        error_label.set_text(&format!("{current}\n{w}"));
                    }
-                    set_login_sensitive(&password_entry, &session_dropdown, true);
                }
                Ok(Ok(LoginResult::Error { message })) => {
-                    show_error(&error_label, &password_entry, &message);
                    set_login_sensitive(&password_entry, &session_dropdown, true);
+                    show_error(&error_label, &password_entry, &message);
                }
                Ok(Ok(LoginResult::Cancelled)) => {
                    set_login_sensitive(&password_entry, &session_dropdown, true);
                }
                Ok(Err(e)) => {
                    log::error!("Login worker error: {e}");
-                    show_error(&error_label, &password_entry, strings.socket_error);
                    set_login_sensitive(&password_entry, &session_dropdown, true);
+                    show_error(&error_label, &password_entry, strings.socket_error);
                }
                Err(_) => {
                    log::error!("Login worker panicked");
-                    show_error(&error_label, &password_entry, strings.socket_error);
                    set_login_sensitive(&password_entry, &session_dropdown, true);
+                    show_error(&error_label, &password_entry, strings.socket_error);
                }
            }
        }
@@ -884,13 +1038,18 @@ fn login_worker(
    greetd_sock: &Arc<Mutex<Option<UnixStream>>>,
    login_cancelled: &Arc<std::sync::atomic::AtomicBool>,
    strings: &Strings,
+    fingerprint_available: bool,
 ) -> Result<LoginResult, String> {
    if login_cancelled.load(std::sync::atomic::Ordering::SeqCst) {
+        log::debug!("Login cancelled before connect");
        return Ok(LoginResult::Cancelled);
    }

+    log::debug!("Connecting to greetd socket: {sock_path}");
    let mut sock = UnixStream::connect(sock_path).map_err(|e| e.to_string())?;
-    if let Err(e) = sock.set_read_timeout(Some(std::time::Duration::from_secs(10))) {
+    // Longer timeout when fingerprint is available — pam_fprintd waits for scan
+    let read_timeout_secs = if fingerprint_available { 60 } else { 10 };
+    if let Err(e) = sock.set_read_timeout(Some(std::time::Duration::from_secs(read_timeout_secs))) {
        log::warn!("Failed to set read timeout: {e}");
    }
    if let Err(e) = sock.set_write_timeout(Some(std::time::Duration::from_secs(10))) {
@@ -902,6 +1061,7 @@ fn login_worker(
    }

    // Step 1: Create session — if a stale session exists, cancel it and retry
+    log::debug!("Creating greetd session for {username}");
    let mut response = ipc::create_session(&mut sock, username).map_err(|e| e.to_string())?;

    if login_cancelled.load(std::sync::atomic::Ordering::SeqCst) {
@@ -909,26 +1069,52 @@ fn login_worker(
    }

    if response.get("type").and_then(|v| v.as_str()) == Some("error") {
+        log::debug!("Stale session detected, cancelling and retrying");
        let _ = ipc::cancel_session(&mut sock);
        response = ipc::create_session(&mut sock, username).map_err(|e| e.to_string())?;
        if login_cancelled.load(std::sync::atomic::Ordering::SeqCst) {
            return Ok(LoginResult::Cancelled);
        }
        if response.get("type").and_then(|v| v.as_str()) == Some("error") {
-            return Ok(LoginResult::Error {
-                message: response
-                    .get("description")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or(strings.auth_failed)
-                    .to_string(),
-            });
+            let message = extract_greetd_description(&response, strings.auth_failed).to_string();
+            return Ok(LoginResult::Error { message });
        }
    }

-    // Step 2: Send password if auth message received
-    if response.get("type").and_then(|v| v.as_str()) == Some("auth_message") {
-        response =
-            ipc::post_auth_response(&mut sock, Some(password)).map_err(|e| e.to_string())?;
+    // Step 2: Handle auth_message loop (supports multi-stage PAM, e.g. fprintd + password)
+    const MAX_AUTH_ROUNDS: u32 = 5;
+    let mut auth_round = 0;
+
+    while response.get("type").and_then(|v| v.as_str()) == Some("auth_message") {
+        auth_round += 1;
+        if auth_round > MAX_AUTH_ROUNDS {
+            log::warn!("Too many auth rounds ({auth_round}), aborting");
+            let _ = ipc::cancel_session(&mut sock);
+            return Ok(LoginResult::Error {
+                message: strings.auth_failed.to_string(),
+            });
+        }
+
+        if login_cancelled.load(std::sync::atomic::Ordering::SeqCst) {
+            return Ok(LoginResult::Cancelled);
+        }
+
+        let msg_type = response
+            .get("auth_message_type")
+            .and_then(|v| v.as_str())
+            .unwrap_or("secret");
+
+        if msg_type == "secret" {
+            log::debug!("Sending password for {username} (round {auth_round})");
+            response =
+                ipc::post_auth_response(&mut sock, Some(password)).map_err(|e| e.to_string())?;
+        } else {
+            // Non-secret prompt (e.g. fprintd "Place finger on reader")
+            // PAM handles the actual verification; this blocks until resolved
+            log::debug!("Acknowledging non-secret auth prompt (round {auth_round})");
+            response =
+                ipc::post_auth_response(&mut sock, None).map_err(|e| e.to_string())?;
+        }

        if login_cancelled.load(std::sync::atomic::Ordering::SeqCst) {
            return Ok(LoginResult::Cancelled);
@@ -941,18 +1127,11 @@ fn login_worker(
                username: username.to_string(),
            });
        }
-
-        if response.get("type").and_then(|v| v.as_str()) == Some("auth_message") {
-            // Multi-stage auth is not supported
-            let _ = ipc::cancel_session(&mut sock);
-            return Ok(LoginResult::Error {
-                message: strings.multi_stage_unsupported.to_string(),
-            });
-        }
    }

    // Step 3: Start session
    if response.get("type").and_then(|v| v.as_str()) == Some("success") {
+        log::debug!("Auth successful, starting session: {exec_cmd}");
        let cmd = match split_shell_words(exec_cmd) {
            Some(words) if !words.is_empty() => words,
            _ => {
@@ -981,15 +1160,13 @@ fn login_worker(
        }

        if response.get("type").and_then(|v| v.as_str()) == Some("success") {
+            log::info!("Login successful for {username}");
            return Ok(LoginResult::Success {
                username: username.to_string(),
            });
        } else {
            return Ok(LoginResult::Error {
-                message: response
-                    .get("description")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or(strings.session_start_failed)
+                message: extract_greetd_description(&response, strings.session_start_failed)
                    .to_string(),
            });
        }
@@ -1005,10 +1182,13 @@ fn execute_power_action(
    action_fn: fn() -> Result<(), PowerError>,
    error_message: &'static str,
    error_label: &gtk::Label,
+    button: &gtk::Button,
 ) {
    glib::spawn_future_local(clone!(
        #[weak]
        error_label,
+        #[weak]
+        button,
        async move {
            let result = gio::spawn_blocking(move || action_fn()).await;

@@ -1018,11 +1198,13 @@ fn execute_power_action(
                    log::error!("Power action failed: {e}");
                    error_label.set_text(error_message);
                    error_label.set_visible(true);
+                    button.set_sensitive(true);
                }
                Err(_) => {
                    log::error!("Power action panicked");
                    error_label.set_text(error_message);
                    error_label.set_visible(true);
+                    button.set_sensitive(true);
                }
            }
        }
@@ -1039,8 +1221,10 @@ fn load_last_user_from(path: &Path) -> Option<String> {
    let content = std::fs::read_to_string(path).ok()?;
    let username = content.trim();
    if is_valid_username(username) {
+        log::debug!("Loaded last user: {username}");
        Some(username.to_string())
    } else {
+        log::debug!("Invalid last user in {}", path.display());
        None
    }
 }
@@ -1050,18 +1234,25 @@ fn save_last_user(username: &str) {
 }

 fn save_last_user_to(path: &Path, username: &str) {
-    if let Some(parent) = path.parent() {
-        let _ = std::fs::create_dir_all(parent);
+    log::debug!("Saving last user: {username}");
+    if let Some(parent) = path.parent()
+        && let Err(e) = std::fs::create_dir_all(parent)
+    {
+        log::warn!("Failed to create cache dir {}: {e}", parent.display());
+        return;
    }
    use std::os::unix::fs::OpenOptionsExt;
    use std::io::Write;
-    let _ = std::fs::OpenOptions::new()
+    if let Err(e) = std::fs::OpenOptions::new()
        .create(true)
        .write(true)
        .truncate(true)
        .mode(0o600)
        .open(path)
-        .and_then(|mut f| f.write_all(username.as_bytes()));
+        .and_then(|mut f| f.write_all(username.as_bytes()))
+    {
+        log::warn!("Failed to save last user to {}: {e}", path.display());
+    }
 }

 fn load_last_session(username: &str) -> Option<String> {
@@ -1072,8 +1263,10 @@ fn load_last_session_from(path: &Path) -> Option<String> {
    let content = std::fs::read_to_string(path).ok()?;
    let name = content.trim();
    if is_valid_session_name(name) {
+        log::debug!("Loaded last session: {name}");
        Some(name.to_string())
    } else {
+        log::debug!("Invalid last session in {}", path.display());
        None
    }
 }
@@ -1101,15 +1294,19 @@ fn save_last_session(username: &str, session_name: &str) {
 }

 fn save_last_session_to(path: &Path, session_name: &str) {
+    log::debug!("Saving last session: {session_name}");
    use std::os::unix::fs::OpenOptionsExt;
    use std::io::Write;
-    let _ = std::fs::OpenOptions::new()
+    if let Err(e) = std::fs::OpenOptions::new()
        .create(true)
        .write(true)
        .truncate(true)
        .mode(0o600)
        .open(path)
-        .and_then(|mut f| f.write_all(session_name.as_bytes()));
+        .and_then(|mut f| f.write_all(session_name.as_bytes()))
+    {
+        log::warn!("Failed to save last session to {}: {e}", path.display());
+    }
 }

 #[cfg(test)]
@@ -1123,6 +1320,8 @@ mod tests {
        assert!(is_valid_username("test-user"));
        assert!(is_valid_username("test.user"));
        assert!(is_valid_username("_admin"));
+        assert!(is_valid_username("user@domain"));
+        assert!(is_valid_username(&"a".repeat(MAX_USERNAME_LENGTH)));
    }

    #[test]
@@ -1130,6 +1329,7 @@ mod tests {
        assert!(!is_valid_username(""));
        assert!(!is_valid_username(".hidden"));
        assert!(!is_valid_username("-dash"));
+        assert!(!is_valid_username("@domain"));
        assert!(!is_valid_username("user/name"));
        assert!(!is_valid_username(&"a".repeat(MAX_USERNAME_LENGTH + 1)));
    }
@@ -1354,7 +1554,7 @@ mod tests {
        let result = login_worker(
            "alice", "wrongpass", "/usr/bin/niri",
            &sock_path, &default_greetd_sock(), &default_cancelled(),
-            load_strings(Some("en")),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
@@ -1396,7 +1596,7 @@ mod tests {
        let result = login_worker(
            "alice", "correct", "/usr/bin/bash",
            &sock_path, &default_greetd_sock(), &default_cancelled(),
-            load_strings(Some("en")),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
@@ -1405,40 +1605,104 @@ mod tests {
    }

    #[test]
-    fn login_worker_multi_stage_rejected() {
+    fn login_worker_multi_stage_fingerprint_then_password() {
        let (sock_path, handle) = fake_greetd(|stream| {
            // create_session
            let _msg = ipc::recv_message(stream).unwrap();
+            ipc::send_message(stream, &serde_json::json!({
+                "type": "auth_message",
+                "auth_message_type": "visible",
+                "auth_message": "Place your finger on the reader",
+            })).unwrap();
+
+            // post_auth_response with None (fingerprint prompt acknowledged)
+            let msg = ipc::recv_message(stream).unwrap();
+            assert!(msg["response"].is_null());
+
+            // Fingerprint failed, PAM falls through to password
            ipc::send_message(stream, &serde_json::json!({
                "type": "auth_message",
                "auth_message_type": "secret",
                "auth_message": "Password: ",
            })).unwrap();

-            // post_auth_response → another auth_message (TOTP)
-            let _msg = ipc::recv_message(stream).unwrap();
-            ipc::send_message(stream, &serde_json::json!({
-                "type": "auth_message",
-                "auth_message_type": "visible",
-                "auth_message": "TOTP: ",
-            })).unwrap();
+            // post_auth_response with password
+            let msg = ipc::recv_message(stream).unwrap();
+            assert_eq!(msg["response"], "correctpass");
+            ipc::send_message(stream, &serde_json::json!({"type": "success"})).unwrap();

-            // cancel_session
+            // start_session
            let _msg = ipc::recv_message(stream).unwrap();
            ipc::send_message(stream, &serde_json::json!({"type": "success"})).unwrap();
        });

        let result = login_worker(
-            "alice", "pass", "/usr/bin/niri",
+            "alice", "correctpass", "/usr/bin/bash",
            &sock_path, &default_greetd_sock(), &default_cancelled(),
-            load_strings(Some("en")),
+            load_strings(Some("en")), true,
+        );
+
+        let result = result.unwrap();
+        assert!(matches!(result, LoginResult::Success { .. }));
+        handle.join().unwrap();
+    }
+
+    #[test]
+    fn login_worker_multi_stage_fingerprint_success() {
+        let (sock_path, handle) = fake_greetd(|stream| {
+            // create_session
+            let _msg = ipc::recv_message(stream).unwrap();
+            ipc::send_message(stream, &serde_json::json!({
+                "type": "auth_message",
+                "auth_message_type": "visible",
+                "auth_message": "Place your finger on the reader",
+            })).unwrap();
+
+            // post_auth_response with None → fingerprint matched via PAM
+            let _msg = ipc::recv_message(stream).unwrap();
+            ipc::send_message(stream, &serde_json::json!({"type": "success"})).unwrap();
+
+            // start_session
+            let _msg = ipc::recv_message(stream).unwrap();
+            ipc::send_message(stream, &serde_json::json!({"type": "success"})).unwrap();
+        });
+
+        let result = login_worker(
+            "alice", "", "/usr/bin/bash",
+            &sock_path, &default_greetd_sock(), &default_cancelled(),
+            load_strings(Some("en")), true,
+        );
+
+        let result = result.unwrap();
+        assert!(matches!(result, LoginResult::Success { .. }));
+        handle.join().unwrap();
+    }
+
+    #[test]
+    fn login_worker_max_auth_rounds_exceeded() {
+        let (sock_path, handle) = fake_greetd(|stream| {
+            // create_session
+            let _msg = ipc::recv_message(stream).unwrap();
+
+            // Send 6 auth_messages (exceeds MAX_AUTH_ROUNDS=5)
+            for _ in 0..6 {
+                ipc::send_message(stream, &serde_json::json!({
+                    "type": "auth_message",
+                    "auth_message_type": "visible",
+                    "auth_message": "Prompt",
+                })).unwrap();
+                let _msg = ipc::recv_message(stream).unwrap();
+            }
+        });
+
+        let result = login_worker(
+            "alice", "pass", "/usr/bin/bash",
+            &sock_path, &default_greetd_sock(), &default_cancelled(),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
        assert!(matches!(result, LoginResult::Error { .. }));
-        if let LoginResult::Error { message } = result {
-            assert!(message.contains("Multi-stage"));
-        }
        handle.join().unwrap();
    }

@@ -1468,7 +1732,7 @@ mod tests {
        let result = login_worker(
            "alice", "pass", "/usr/bin/bash",
            &sock_path, &default_greetd_sock(), &default_cancelled(),
-            load_strings(Some("en")),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
@@ -1483,13 +1747,25 @@ mod tests {
        let result = login_worker(
            "alice", "pass", "/usr/bin/niri",
            "/nonexistent/sock", &default_greetd_sock(), &cancelled,
-            load_strings(Some("en")),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
        assert!(matches!(result, LoginResult::Cancelled));
    }

+    #[test]
+    fn login_worker_connect_failure() {
+        let cancelled = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let result = login_worker(
+            "alice", "pass", "/usr/bin/niri",
+            "/nonexistent/sock", &default_greetd_sock(), &cancelled,
+            load_strings(Some("en")), false,
+        );
+
+        assert!(result.is_err());
+    }
+
    #[test]
    fn login_worker_invalid_exec_cmd() {
        let (sock_path, handle) = fake_greetd(|stream| {
@@ -1514,7 +1790,7 @@ mod tests {
        let result = login_worker(
            "alice", "pass", "../../../etc/evil",
            &sock_path, &default_greetd_sock(), &default_cancelled(),
-            load_strings(Some("en")),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
@@ -1546,11 +1822,66 @@ mod tests {
        let result = login_worker(
            "alice", "pass", "niri-session",
            &sock_path, &default_greetd_sock(), &default_cancelled(),
-            load_strings(Some("en")),
+            load_strings(Some("en")), false,
        );

        let result = result.unwrap();
        assert!(matches!(result, LoginResult::Success { .. }));
        handle.join().unwrap();
    }
+
+    // -- load_background_texture tests --
+
+    #[test]
+    fn load_background_texture_missing_file_returns_none() {
+        let result = load_background_texture(Path::new("/nonexistent/wallpaper.jpg"));
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn load_background_texture_oversized_file_returns_none() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("huge.jpg");
+        // Create a sparse file that exceeds MAX_WALLPAPER_FILE_SIZE
+        let f = std::fs::File::create(&path).unwrap();
+        f.set_len(MAX_WALLPAPER_FILE_SIZE + 1).unwrap();
+        let result = load_background_texture(&path);
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn load_background_texture_non_utf8_path_returns_none() {
+        use std::ffi::OsStr;
+        use std::os::unix::ffi::OsStrExt;
+        // 0xFF is not valid UTF-8
+        let non_utf8 = OsStr::from_bytes(&[0xff, 0xfe, 0xfd]);
+        let path = Path::new(non_utf8);
+        let result = load_background_texture(path);
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn extract_greetd_description_normal() {
+        let resp = serde_json::json!({"type": "error", "description": "bad password"});
+        assert_eq!(extract_greetd_description(&resp, "fallback"), "bad password");
+    }
+
+    #[test]
+    fn extract_greetd_description_oversized() {
+        let long = "x".repeat(MAX_GREETD_ERROR_LENGTH + 1);
+        let resp = serde_json::json!({"type": "error", "description": long});
+        assert_eq!(extract_greetd_description(&resp, "fallback"), "fallback");
+    }
+
+    #[test]
+    fn extract_greetd_description_empty() {
+        let resp = serde_json::json!({"type": "error", "description": ""});
+        assert_eq!(extract_greetd_description(&resp, "fallback"), "fallback");
+    }
+
+    #[test]
+    fn extract_greetd_description_missing() {
+        let resp = serde_json::json!({"type": "error"});
+        assert_eq!(extract_greetd_description(&resp, "fallback"), "fallback");
+    }
 }
@@ -23,12 +23,11 @@ pub struct Strings {
    pub greetd_sock_unreachable: &'static str,
    pub auth_failed: &'static str,
    pub wrong_password: &'static str,
-    pub multi_stage_unsupported: &'static str,
+    pub fingerprint_prompt: &'static str,
    pub invalid_session_command: &'static str,
    pub session_start_failed: &'static str,
    pub reboot_failed: &'static str,
    pub shutdown_failed: &'static str,
-    pub connection_error: &'static str,
    pub socket_error: &'static str,
    pub unexpected_greetd_response: &'static str,

@@ -48,12 +47,11 @@ const STRINGS_DE: Strings = Strings {
    greetd_sock_unreachable: "GREETD_SOCK nicht erreichbar",
    auth_failed: "Authentifizierung fehlgeschlagen",
    wrong_password: "Falsches Passwort",
-    multi_stage_unsupported: "Mehrstufige Authentifizierung wird nicht unterstützt",
+    fingerprint_prompt: "Fingerabdruck auflegen oder Passwort eingeben",
    invalid_session_command: "Ungültiger Session-Befehl",
    session_start_failed: "Session konnte nicht gestartet werden",
    reboot_failed: "Neustart fehlgeschlagen",
    shutdown_failed: "Herunterfahren fehlgeschlagen",
-    connection_error: "Verbindungsfehler",
    socket_error: "Socket-Fehler",
    unexpected_greetd_response: "Unerwartete Antwort von greetd",
    faillock_attempts_remaining: "Noch {n} Versuch(e) vor Kontosperrung!",
@@ -71,12 +69,11 @@ const STRINGS_EN: Strings = Strings {
    greetd_sock_unreachable: "GREETD_SOCK unreachable",
    auth_failed: "Authentication failed",
    wrong_password: "Wrong password",
-    multi_stage_unsupported: "Multi-stage authentication is not supported",
+    fingerprint_prompt: "Place finger on reader or enter password",
    invalid_session_command: "Invalid session command",
    session_start_failed: "Failed to start session",
    reboot_failed: "Reboot failed",
    shutdown_failed: "Shutdown failed",
-    connection_error: "Connection error",
    socket_error: "Socket error",
    unexpected_greetd_response: "Unexpected response from greetd",
    faillock_attempts_remaining: "{n} attempt(s) remaining before lockout!",
@@ -127,10 +124,15 @@ pub fn detect_locale() -> String {
        .filter(|s| !s.is_empty())
        .or_else(|| read_lang_from_conf(Path::new(DEFAULT_LOCALE_CONF)));

-    match lang {
-        Some(l) => parse_lang_prefix(&l),
+    let result = match lang {
+        Some(ref l) => parse_lang_prefix(l),
        None => "en".to_string(),
-    }
+    };
+    log::debug!("Detected locale: {result} (source: {})", match lang {
+        Some(_) => "LANG env or locale.conf",
+        None => "default",
+    });
+    result
 }

 /// Return the string table for the given locale, defaulting to English.
@@ -280,6 +282,7 @@ mod tests {
            assert!(!s.greetd_sock_not_set.is_empty(), "{locale}: greetd_sock_not_set");
            assert!(!s.auth_failed.is_empty(), "{locale}: auth_failed");
            assert!(!s.wrong_password.is_empty(), "{locale}: wrong_password");
+            assert!(!s.fingerprint_prompt.is_empty(), "{locale}: fingerprint_prompt");
            assert!(!s.reboot_failed.is_empty(), "{locale}: reboot_failed");
            assert!(!s.shutdown_failed.is_empty(), "{locale}: shutdown_failed");
            assert!(!s.faillock_attempts_remaining.is_empty(), "{locale}: faillock_attempts_remaining");
@@ -84,6 +84,9 @@ pub fn send_message(
        return Err(IpcError::PayloadTooLarge(payload.len()));
    }

+    let msg_type = msg.get("type").and_then(|v| v.as_str()).unwrap_or("unknown");
+    log::debug!("IPC send: type={msg_type}, size={} bytes", payload.len());
+
    let header = (payload.len() as u32).to_le_bytes();
    stream.write_all(&header)?;
    stream.write_all(&payload)?;
@@ -101,6 +104,8 @@ pub fn recv_message(stream: &mut UnixStream) -> Result<serde_json::Value, IpcErr

    let payload = recv_payload(stream, length)?;
    let value: serde_json::Value = serde_json::from_slice(&payload)?;
+    let msg_type = value.get("type").and_then(|v| v.as_str()).unwrap_or("unknown");
+    log::debug!("IPC recv: type={msg_type}, size={length} bytes");
    Ok(value)
 }

@@ -2,6 +2,7 @@
 // ABOUTME: Sets up GTK Application, Layer Shell, CSS, and multi-monitor windows.

 mod config;
+mod fingerprint;
 mod greeter;
 mod i18n;
 mod ipc;
@@ -13,8 +14,6 @@ use gdk4 as gdk;
 use gtk4::prelude::*;
 use gtk4::{self as gtk, gio};
 use gtk4_layer_shell::LayerShell;
-use std::path::PathBuf;
-
 fn load_css(display: &gdk::Display) {
    let css_provider = gtk::CssProvider::new();
    css_provider.load_from_resource("/dev/moonarch/moongreet/style.css");
@@ -25,9 +24,9 @@ fn load_css(display: &gdk::Display) {
    );
 }

-fn setup_layer_shell(window: &gtk::ApplicationWindow, keyboard: bool) {
+fn setup_layer_shell(window: &gtk::ApplicationWindow, keyboard: bool, layer: gtk4_layer_shell::Layer) {
    window.init_layer_shell();
-    window.set_layer(gtk4_layer_shell::Layer::Top);
+    window.set_layer(layer);
    window.set_exclusive_zone(-1);
    if keyboard {
        window.set_keyboard_mode(gtk4_layer_shell::KeyboardMode::Exclusive);
@@ -48,31 +47,40 @@ fn activate(app: &gtk::Application) {
        }
    };

+    log::debug!("Display: {:?}", display);
    load_css(&display);

    // Load config and resolve wallpaper
    let config = config::load_config(None);
-    let bg_path = config::resolve_background_path(&config);
+    let bg_texture = config::resolve_background_path(&config)
+        .and_then(|path| {
+            log::debug!("Background path: {}", path.display());
+            greeter::load_background_texture(&path)
+        });

    let use_layer_shell = std::env::var("MOONGREET_NO_LAYER_SHELL").is_err();
+    log::debug!("Layer shell: {use_layer_shell}");

    // Main greeter window (login UI) — compositor picks focused monitor
-    let greeter_window = greeter::create_greeter_window(&bg_path, &config, app);
+    let greeter_window = greeter::create_greeter_window(bg_texture.as_ref(), &config, app);
    if use_layer_shell {
-        setup_layer_shell(&greeter_window, true);
+        setup_layer_shell(&greeter_window, true, gtk4_layer_shell::Layer::Top);
    }
    greeter_window.present();

    // Wallpaper-only windows on all monitors (only with layer shell)
-    if use_layer_shell {
+    if use_layer_shell
+        && let Some(ref texture) = bg_texture
+    {
        let monitors = display.monitors();
+        log::debug!("Monitor count: {}", monitors.n_items());
        for i in 0..monitors.n_items() {
            if let Some(monitor) = monitors
                .item(i)
                .and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
            {
-                let wallpaper = greeter::create_wallpaper_window(&bg_path, app);
-                setup_layer_shell(&wallpaper, false);
+                let wallpaper = greeter::create_wallpaper_window(texture, config.background_blur, app);
+                setup_layer_shell(&wallpaper, false, gtk4_layer_shell::Layer::Bottom);
                wallpaper.set_monitor(Some(&monitor));
                wallpaper.present();
            }
@@ -81,25 +89,22 @@ fn activate(app: &gtk::Application) {
 }

 fn setup_logging() {
-    let mut builder = env_logger::Builder::from_default_env();
-    builder.filter_level(log::LevelFilter::Info);
-
-    // Try file logging to /var/cache/moongreet/ — fall back to stderr
-    let log_dir = PathBuf::from("/var/cache/moongreet");
-    if log_dir.is_dir() {
-        let log_file = log_dir.join("moongreet.log");
-        use std::os::unix::fs::OpenOptionsExt;
-        if let Ok(file) = std::fs::OpenOptions::new()
-            .create(true)
-            .append(true)
-            .mode(0o640)
-            .open(&log_file)
-        {
-            builder.target(env_logger::Target::Pipe(Box::new(file)));
+    match systemd_journal_logger::JournalLog::new() {
+        Ok(logger) => {
+            if let Err(e) = logger.install() {
+                eprintln!("Failed to install journal logger: {e}");
+            }
+        }
+        Err(e) => {
+            eprintln!("Failed to create journal logger: {e}");
        }
    }
-
-    builder.init();
+    let level = if std::env::var("MOONGREET_DEBUG").is_ok() {
+        log::LevelFilter::Debug
+    } else {
+        log::LevelFilter::Info
+    };
+    log::set_max_level(level);
 }

 fn main() {
@@ -23,6 +23,7 @@ impl std::error::Error for PowerError {}

 /// Run a command and return a PowerError on failure.
 fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(), PowerError> {
+    log::debug!("Power action: {action} ({program} {args:?})");
    let child = Command::new(program)
        .args(args)
        .spawn()
@@ -38,7 +39,9 @@ fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(),
            message: e.to_string(),
        })?;

-    if !output.status.success() {
+    if output.status.success() {
+        log::debug!("Power action {action} completed successfully");
+    } else {
        let stderr = String::from_utf8_lossy(&output.stderr);
        return Err(PowerError::CommandFailed {
            action,
@@ -96,7 +99,7 @@ mod tests {

    #[test]
    fn run_command_passes_args() {
-        let result = run_command("test", "echo", &["hello", "world"]);
+        let result = run_command("test", "true", &["--ignored-arg"]);
        assert!(result.is_ok());
    }
 }
@@ -12,6 +12,7 @@ const DEFAULT_XSESSION_DIRS: &[&str] = &["/usr/share/xsessions"];
 pub struct Session {
    pub name: String,
    pub exec_cmd: String,
+    #[allow(dead_code)] // Retained for future Wayland-only filtering
    pub session_type: String,
 }

@@ -46,8 +47,17 @@ fn parse_desktop_file(path: &Path, session_type: &str) -> Option<Session> {
        }
    }

-    let name = name.filter(|s| !s.is_empty())?;
-    let exec_cmd = exec_cmd.filter(|s| !s.is_empty())?;
+    let name = name.filter(|s| !s.is_empty());
+    let exec_cmd = exec_cmd.filter(|s| !s.is_empty());
+
+    if name.is_none() || exec_cmd.is_none() {
+        log::debug!("Skipping {}: missing Name={} Exec={}", path.display(),
+            name.is_some(), exec_cmd.is_some());
+        return None;
+    }
+
+    let name = name?;
+    let exec_cmd = exec_cmd?;

    Some(Session {
        name,
@@ -74,7 +84,10 @@ pub fn get_sessions(
    for (dirs, session_type) in [(wayland, "wayland"), (xsession, "x11")] {
        for directory in dirs {
            let entries = match fs::read_dir(directory) {
-                Ok(e) => e,
+                Ok(e) => {
+                    log::debug!("Scanning session directory: {}", directory.display());
+                    e
+                }
                Err(_) => continue,
            };

@@ -93,6 +106,7 @@ pub fn get_sessions(
        }
    }

+    log::debug!("Found {} session(s)", sessions.len());
    sessions
 }

@@ -23,9 +23,11 @@ const NOLOGIN_SHELLS: &[&str] = &[
 #[derive(Debug, Clone)]
 pub struct User {
    pub username: String,
+    #[allow(dead_code)] // Retained for debugging and future UID-based features
    pub uid: u32,
    pub gecos: String,
    pub home: PathBuf,
+    #[allow(dead_code)] // Retained for debugging and future shell-based filtering
    pub shell: String,
 }

@@ -46,22 +48,22 @@ pub fn get_users(passwd_path: Option<&Path>) -> Vec<User> {

    let content = match fs::read_to_string(path) {
        Ok(c) => c,
-        Err(_) => return Vec::new(),
+        Err(e) => {
+            log::warn!("Failed to read passwd file {}: {e}", path.display());
+            return Vec::new();
+        }
    };

    let mut users = Vec::new();

    for line in content.lines() {
-        let parts: Vec<&str> = line.split(':').collect();
-        if parts.len() < 7 {
+        let mut fields = line.splitn(7, ':');
+        let (Some(username), Some(_pw), Some(uid_str), Some(_gid), Some(gecos), Some(home), Some(shell)) =
+            (fields.next(), fields.next(), fields.next(), fields.next(),
+             fields.next(), fields.next(), fields.next())
+        else {
            continue;
-        }
-
-        let username = parts[0];
-        let uid_str = parts[2];
-        let gecos = parts[4];
-        let home = parts[5];
-        let shell = parts[6];
+        };

        let uid = match uid_str.parse::<u32>() {
            Ok(u) => u,
@@ -88,6 +90,7 @@ pub fn get_users(passwd_path: Option<&Path>) -> Vec<User> {
        });
    }

+    log::debug!("Found {} login user(s)", users.len());
    users
 }

@@ -106,21 +109,28 @@ pub fn get_avatar_path_with(
    // AccountsService icon takes priority
    if accountsservice_dir.exists() {
        let icon = accountsservice_dir.join(username);
-        if let Ok(meta) = icon.symlink_metadata()
-            && !meta.file_type().is_symlink()
-        {
-            return Some(icon);
+        if let Ok(meta) = icon.symlink_metadata() {
+            if meta.file_type().is_symlink() {
+                log::warn!("Rejecting symlink avatar for {username}: {}", icon.display());
+            } else {
+                log::debug!("Avatar for {username}: AccountsService {}", icon.display());
+                return Some(icon);
+            }
        }
    }

    // ~/.face fallback
    let face = home.join(".face");
-    if let Ok(meta) = face.symlink_metadata()
-        && !meta.file_type().is_symlink()
-    {
-        return Some(face);
+    if let Ok(meta) = face.symlink_metadata() {
+        if meta.file_type().is_symlink() {
+            log::warn!("Rejecting symlink avatar for {username}: {}", face.display());
+        } else {
+            log::debug!("Avatar for {username}: ~/.face {}", face.display());
+            return Some(face);
+        }
    }

+    log::debug!("No avatar found for {username}");
    None
 }
Author	SHA1	Message	Date
nevaforget	a462b2cf06	feat: add fprintd fingerprint authentication via greetd multi-stage PAM (v0.6.0) Fingerprint auth was missing because moongreet rejected multi-stage auth_message sequences from greetd. With pam_fprintd.so in the PAM stack, greetd sends non-secret prompts for fingerprint and secret prompts for password — moongreet now handles both in a loop. - Replace single-pass auth with multi-stage auth_message loop - fprintd D-Bus probe (gio::DBusProxy) for UI feedback only - Fingerprint label shown when device available and fingers enrolled - 60s socket timeout when fingerprint available (pam_fprintd scan time) - Config option: [appearance] fingerprint-enabled (default: true) - Fix: password entry focus loss after auth error (grab_focus while widget was insensitive — now re-enable before grab_focus)	2026-03-29 13:47:57 +02:00
nevaforget	77b94a560d	fix: prevent edge darkening on GPU-blurred wallpaper (v0.5.3) GskBlurNode samples pixels outside texture bounds as transparent, causing visible darkening at wallpaper edges. Fix renders the texture with 3x-sigma padding before blur, then clips back to original size. Symmetric fix with moonset v0.7.1.	2026-03-28 23:28:39 +01:00
nevaforget	b06b02faac	refactor: remove embedded wallpaper from binary (v0.5.2) Wallpaper is installed by moonarch to /usr/share/moonarch/wallpaper.jpg. Embedding a 374K JPEG in the binary was redundant. Without a wallpaper file, GTK background color (Catppuccin Mocha base) shows through and wallpaper-only windows on secondary monitors are skipped.	2026-03-28 23:26:33 +01:00
nevaforget	9a89da8b13	docs: update for wallpaper removal from binary Sync documentation with greetd-moongreet wallpaper removal.	2026-03-28 23:23:10 +01:00
nevaforget	d5e431d37e	fix: make setup_logging() resilient to journal logger failure (v0.5.1) Replace unwrap() calls with match-based error handling that falls back to eprintln — prevents panic when running outside a systemd session. Consistent with moonlock's logging init pattern.	2026-03-28 22:56:39 +01:00
nevaforget	7c10516473	fix: re-audit findings — avatar path safety, persistence logging, tests - Reject non-UTF-8 avatar paths early instead of passing empty string to GDK - Log persistence write failures with warn! instead of silently discarding - Reduce API surface: create_background_picture pub→fn - Add boundary test for MAX_USERNAME_LENGTH and socket connect failure test	2026-03-28 22:47:21 +01:00
nevaforget	09371b5fd2	fix+perf: audit fixes and GPU blur migration (v0.5.0) Address all findings from quality, performance, and security audits: - Filter greetd error descriptions consistently (security) - Re-enable power buttons after failed action (UX bug) - Narrow TOCTOU window in avatar loading via symlink_metadata (security) - Allow @ in usernames for LDAP compatibility - Eliminate unnecessary Vec allocation in passwd parsing - Remove dead i18n field, annotate retained-for-future struct fields - Fix if/if→if/else and noisy test output in power.rs Replace CPU blur (image crate + disk cache + async orchestration) with GPU blur via GskBlurNode — symmetric with moonlock and moonset. Removes ~15 transitive dependencies and ~200 lines of caching code.	2026-03-28 22:34:12 +01:00
nevaforget	3c39467508	perf: cache blurred wallpaper to disk to avoid re-blur on startup First launch with blur blurs and saves to /var/cache/moongreet/. Subsequent starts load the cached PNG directly. Cache invalidates when wallpaper path, size, mtime, or sigma changes.	2026-03-28 21:23:36 +01:00
nevaforget	64470f99c3	chore: bump version to 0.4.0	2026-03-28 14:55:18 +01:00
nevaforget	293bba32a6	feat: add optional background blur via `image` crate Gaussian blur applied at texture load time when `background-blur` is set in the [appearance] section of moongreet.toml. Blur runs once, result is shared across monitors.	2026-03-28 14:53:16 +01:00
nevaforget	14d6476e5a	fix: audit findings — wallpaper safety, log filtering, error truncation (v0.4.1) - Rework load_background_texture(): use resources_lookup_data()/from_bytes() for GResource path (no abort on missing resource), add 50 MB file size limit, handle non-UTF-8 paths gracefully - Filter error details to debug level only — warn! logs without internal details to prevent system info leaking into journal - Make debug logging opt-in via MOONGREET_DEBUG env var (default: Info) - Truncate greetd error description in stale-session retry path using MAX_GREETD_ERROR_LENGTH (matching show_greetd_error()) - Add 3 unit tests for load_background_texture edge cases	2026-03-28 10:29:21 +01:00
nevaforget	4c9b436978	fix: wallpaper windows on Layer::Bottom to prevent greeter occlusion Wallpaper-only windows for secondary monitors were on Layer::Top — same layer as the greeter window. Since they were created after the greeter, they occluded the login UI, leaving only the wallpaper visible.	2026-03-28 01:30:22 +01:00
nevaforget	96c94f030a	feat: switch to systemd-journal-logger, add debug logging (v0.4.0) Replace env_logger file-based logging with systemd-journal-logger for consistency with moonlock and native journalctl integration. Add debug-level logging at all decision points: config loading, user/session detection, avatar resolution, locale detection, IPC messages, login flow, and persistence. No credentials are ever logged.	2026-03-28 01:23:18 +01:00
nevaforget	b91e8d47d1	docs: update CLAUDE.md for v0.3.2 audit changes	2026-03-28 00:43:00 +01:00