.gitea/workflows/update-pkgver.yaml

@@ -1,43 +0,0 @@
-# ABOUTME: Updates pkgver in moonarch-pkgbuilds after a push to main.
-# ABOUTME: Ensures paru detects new versions of this package.
-
-name: Update PKGBUILD version
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  update-pkgver:
-    runs-on: moonarch
-    steps:
-      - name: Checkout source repo
-        run: |
-          git clone --bare http://gitea:3000/nevaforget/moonlock.git source.git
-          cd source.git
-          PKGVER=$(git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./')
-          echo "New pkgver: $PKGVER"
-          echo "$PKGVER" > /tmp/pkgver
-
-      - name: Update PKGBUILD
-        run: |
-          PKGVER=$(cat /tmp/pkgver)
-          git clone http://gitea:3000/nevaforget/moonarch-pkgbuilds.git pkgbuilds
-          cd pkgbuilds
-
-          OLD_VER=$(grep '^pkgver=' moonlock-git/PKGBUILD | cut -d= -f2)
-          if [ "$OLD_VER" = "$PKGVER" ]; then
-            echo "pkgver already up to date ($PKGVER)"
-            exit 0
-          fi
-
-          sed -i "s/^pkgver=.*/pkgver=$PKGVER/" moonlock-git/PKGBUILD
-          sed -i "s/^\tpkgver = .*/\tpkgver = $PKGVER/" moonlock-git/.SRCINFO
-          echo "Updated pkgver: $OLD_VER → $PKGVER"
-
-          git config user.name "pkgver-bot"
-          git config user.email "gitea@moonarch.de"
-          git add moonlock-git/PKGBUILD moonlock-git/.SRCINFO
-          git commit -m "chore(moonlock-git): bump pkgver to $PKGVER"
-          git -c http.extraHeader="Authorization: token ${{ secrets.PKGBUILD_TOKEN }}" push

CLAUDE.md

@@ -1,5 +1,7 @@
 # Moonlock
 
+**Name**: Nyx (Göttin der Nacht — passend zum Lockscreen, der den Bildschirm verdunkelt)
+
 ## Projekt
 
 Moonlock ist ein sicherer Wayland-Lockscreen, gebaut mit Rust + gtk4-rs + ext-session-lock-v1.
@@ -17,7 +19,7 @@ Teil des Moonarch-Ökosystems.
 ## Projektstruktur
 
 - `src/` — Rust-Quellcode (main.rs, lockscreen.rs, auth.rs, fingerprint.rs, config.rs, i18n.rs, users.rs, power.rs)
-- `resources/` — GResource-Assets (style.css, default-avatar.svg)
+- `resources/` — GResource-Assets (style.css, wallpaper.jpg, default-avatar.svg)
 - `config/` — PAM-Konfiguration und Beispiel-Config
 
 ## Kommandos
@@ -35,14 +37,14 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 
 ## Architektur
 
-- `auth.rs` — PAM-Authentifizierung via Raw FFI (unsafe extern "C" conv callback, msg_style-aware, Zeroizing<CString>), check_account() für pam_acct_mgmt-Only-Checks nach Fingerprint-Unlock
-- `fingerprint.rs` — fprintd D-Bus Listener, async init/claim/verify via gio futures, sender-validated signal handler, cleanup_dbus() für sauberen D-Bus-Lifecycle, running_flag für Race-Safety in async restarts, on_exhausted callback after MAX_FP_ATTEMPTS, resume_async() für Neustart nach transientem Fehler (mit failed_attempts-Reset und Signal-Handler-Cleanup)
+- `auth.rs` — PAM-Authentifizierung via Raw FFI (unsafe extern "C" conv callback, msg_style-aware, Zeroizing<Vec<u8>>)
+- `fingerprint.rs` — fprintd D-Bus Listener, async init/claim/verify via gio futures, sender-validated signal handler, cleanup_dbus() für sauberen D-Bus-Lifecycle, running_flag für Race-Safety in async restarts, on_exhausted callback after MAX_FP_ATTEMPTS
 - `users.rs` — Aktuellen User via nix getuid, Avatar-Loading mit Symlink-Rejection
 - `power.rs` — Reboot/Shutdown via /usr/bin/systemctl
 - `i18n.rs` — Locale-Erkennung (OnceLock-cached) und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
-- `config.rs` — TOML-Config (background_path, background_blur clamped [0,200], fingerprint_enabled als Option<bool>) + Wallpaper-Fallback + Symlink-Rejection via symlink_metadata + Parse-Error-Logging
-- `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking mit 30s Timeout und Generation Counter, FP-Label/Start separat verdrahtet mit pam_acct_mgmt-Check und auto-resume, Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode (Downscale auf max 1920px), Blur/Avatar-Cache für Multi-Monitor
-- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Monitor-Hotplug via `connect_monitor`-Signal (v1_2), shared Blur/Avatar-Caches in Rc, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
+- `config.rs` — TOML-Config (background_path, background_blur, fingerprint_enabled als Option<bool>) + Wallpaper-Fallback + Symlink-Rejection für background_path + Parse-Error-Logging
+- `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking, FP-Label/Start separat verdrahtet, Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode, Blur/Avatar-Cache für Multi-Monitor
+- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Multi-Monitor mit shared Blur/Avatar-Caches, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
 
 ## Sicherheit
 
@@ -51,12 +53,9 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
 - Panic-Hook: Bei Crash wird geloggt, aber NIEMALS unlock() aufgerufen — Screen bleibt schwarz. Hook wird vor Logging installiert.
 - PAM-Callback: msg_style-aware (Passwort nur bei PAM_PROMPT_ECHO_OFF), strdup-OOM-sicher, num_msg-Guard gegen negative Werte
 - fprintd: D-Bus Signal-Sender wird gegen fprintd's unique bus name validiert (Anti-Spoofing)
-- Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<CString> im PAM-FFI-Layer (bekannte Einschränkung: GLib-GString und strdup-Kopie in PAM werden nicht gezeroized — inhärente GTK/libc-Limitierung)
-- Fingerprint-Unlock: pam_acct_mgmt-Check nach verify-match erzwingt Account-Policies (Lockout, Ablauf), resume_async() startet FP bei transientem Fehler neu (mit failed_attempts-Reset und Signal-Handler-Cleanup)
-- Wallpaper wird vor lock() geladen — connect_monitor feuert während lock() und braucht die Textur; lokales JPEG-Laden ist schnell genug
-- PAM-Timeout: 30s Timeout verhindert permanentes Aussperren bei hängenden PAM-Modulen, Generation Counter verhindert Interferenz paralleler Auth-Versuche
+- Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<Vec<u8>> im PAM-FFI-Layer (bekannte Einschränkung: GLib-GString und CString werden nicht gezeroized — inhärente GTK/libc-Limitierung)
 - Root-Check: Exit mit Fehler wenn als root gestartet
 - Faillock: UI-Warnung nach 3 Fehlversuchen, aber PAM entscheidet über Lockout (Entry bleibt aktiv)
 - Kein Schließen per Escape/Alt-F4 — nur durch erfolgreiche PAM-Auth oder Fingerprint
-- Peek-Icon am Passwortfeld aktiv (UX-Entscheidung, konsistent mit moongreet)
+- Kein Peek-Icon am Passwortfeld (Shoulder-Surfing-Schutz)
 - GResource-Bundle: CSS/Assets in der Binary kompiliert

Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "moonlock"
-version = "0.6.12"
+version = "0.6.0"
 dependencies = [
  "gdk-pixbuf",
  "gdk4",

Cargo.toml

@@ -1,13 +1,13 @@
 [package]
 name = "moonlock"
-version = "0.6.12"
+version = "0.6.1"
 edition = "2024"
 description = "A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
 license = "MIT"
 
 [dependencies]
 gtk4 = { version = "0.11", features = ["v4_10"] }
-gtk4-session-lock = { version = "0.4", features = ["v1_2"] }
+gtk4-session-lock = { version = "0.4", features = ["v1_1"] }
 glib = "0.22"
 gdk4 = "0.11"
 gdk-pixbuf = "0.22"
@@ -16,7 +16,7 @@ toml = "0.8"
 serde = { version = "1", features = ["derive"] }
 graphene-rs = { version = "0.22", package = "graphene-rs" }
 nix = { version = "0.29", features = ["user"] }
-zeroize = { version = "1", features = ["derive", "std"] }
+zeroize = { version = "1", features = ["derive"] }
 libc = "0.2"
 log = "0.4"
 systemd-journal-logger = "2.2"
@@ -28,6 +28,6 @@ tempfile = "3"
 glib-build-tools = "0.22"
 
 [profile.release]
-lto = "fat"
+lto = "thin"
 codegen-units = 1
 strip = true

DECISIONS.md

@@ -2,86 +2,30 @@
 
 Architectural and design decisions for Moonlock, in reverse chronological order.
 
-## 2026-04-24 – Audit LOW fixes: docs, rustdoc, check_account scope, debug gating, lto fat (v0.6.12)
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Six LOW findings cleared in a single pass. (1) Docs referenced the old `[0,100]` blur range; code clamps `[0,200]` since v0.6.8. (2) The `MAX_BLUR_DIMENSION` doc comment was split by a `// SYNC:` block, producing a truncated sentence in rustdoc. (3) `check_account` was `pub` and relied on callers only ever passing `getuid()`-derived usernames; the contract was not enforced by the type system. (4) `MOONLOCK_DEBUG` env var flipped log verbosity to Debug in release builds, letting a compromised session script escalate journal noise about fprintd / D-Bus. (5) `pam_setcred` absence was undocumented. (6) `[profile.release]` used `lto = "thin"` — fine for most crates, but for a latency-critical auth binary compiled once per release, fat LTO's extra cross-crate inlining is worth the ~1 min build hit.
-- **Tradeoffs**: `lto = "fat"` roughly doubles release build time (~30 s → ~60 s) for slightly better inlining across PAM FFI wrappers and the i18n/status paths. `#[cfg(debug_assertions)]` on the debug-level selector means you have to run a debug build to raise log level — inconvenient for live troubleshooting, but aligned with the security-first posture.
-- **How**: (1) `CLAUDE.md` + `README.md` updated to `[0,200]`. (2) `// SYNC:` block moved above the `///` doc so rustdoc renders one coherent paragraph. (3) `check_account` visibility narrowed to `pub(crate)` with a `Precondition` paragraph explaining the username contract. (4) Debug-level selection wrapped in `#[cfg(debug_assertions)]`; release builds always run at `LevelFilter::Info`. (5) Added a comment block in `authenticate()` documenting why `pam_setcred` is deliberately absent and where it would hook in if needed. (6) `lto = "fat"` in `Cargo.toml`.
-
-## 2026-04-24 – Audit MEDIUM fixes: D-Bus cleanup race, TOCTOU open, FP reset, GTK entry clear (v0.6.11)
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Second round after the HIGH fixes, addressing the four MEDIUM findings. (1) `cleanup_dbus` spawned VerifyStop + Release as fire-and-forget, then `resume_async` called Claim after only a 2 s timeout — shorter than the 3 s D-Bus timeout, so on a slow bus the Claim could race the Release and fprintd would reject it, leaving the FP listener permanently dead. (2) `load_background_texture` relied on the caller's `symlink_metadata` check, re-opening the path via `gdk::Texture::from_file` — a classic TOCTOU window. (3) `resume_async` unconditionally reset `failed_attempts`, allowing an attacker with sensor control to evade the 10-attempt cap by cycling verify-match → `check_account` fail → resume. (4) The GTK `PasswordEntry` buffer was only cleared on timeout or auth failure, leaving the password in GLib malloc'd memory longer than necessary.
-- **Tradeoffs**: The D-Bus cleanup is now split into a synchronous helper (`take_cleanup_proxy` — signal disconnect + flag clear) and an async helper (`perform_dbus_cleanup` — VerifyStop + Release), so `resume_async` can await the release while `stop()` stays fire-and-forget. Dropping the `failed_attempts` reset means a flaky sensor could reach 10 failures faster, but the correct remedy is a new lock session (construction) rather than a reset that also helps attackers.
-- **How**: (1) Split `cleanup_dbus` into `take_cleanup_proxy()` (sync) + `perform_dbus_cleanup(proxy)` (async). `resume_async` now awaits `perform_dbus_cleanup` before `begin_verification`. `stop()` still spawns the cleanup fire-and-forget. (2) `load_background_texture` opens with `O_NOFOLLOW` via `std::fs::OpenOptions::custom_flags`, reads to bytes, and builds the texture via `gdk::Texture::from_bytes`. (3) Removed `listener.borrow_mut().failed_attempts = 0` from `resume_async`. (4) `password_entry.set_text("")` now fires right after the `Zeroizing::new(entry.text().to_string())` extraction, shortening the GTK-side window.
-
-## 2026-04-24 – Audit fixes: RefCell borrow across await, async avatar decode
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Triple audit found two HIGH issues. (1) `init_fingerprint_async` held a `RefCell` immutable borrow across `is_available_async().await` — a concurrent `connect_monitor` signal (hotplug / suspend-resume) invoking `borrow_mut()` during the await would panic. (2) `set_avatar_from_file` decoded avatars synchronously via `Pixbuf::from_file_at_scale`, blocking the GTK main thread inside the `connect_monitor` handler. With `MAX_AVATAR_FILE_SIZE` at 10 MB the worst-case stall was 200–500 ms on monitor hotplug.
-- **Tradeoffs**: Avatar is shown as the symbolic default icon for a brief window while decoding completes. Wallpaper stays synchronous because `connect_monitor` fires during `lock()` and needs the texture already present (see 2026-04-09).
-- **How**: (1) Extract `username` into a local `String` in `init_fingerprint_async`, drop the borrow before the await, re-borrow in a new scope after — no awaits inside the second borrow, so hotplug during signal setup is safe. (2) `set_avatar_from_file` now uses `gio::File::read_future` + `Pixbuf::from_stream_at_scale_future` for async I/O and decode. The default icon is shown immediately; the decoded texture replaces it when ready. `Pixbuf` itself is `!Send`, so `gio::spawn_blocking` does not apply — the GIO async stream loader keeps the `Pixbuf` on the main thread while the kernel does the I/O asynchronously.
-
-## 2026-04-09 – Monitor hotplug via connect_monitor signal
-
-- **Who**: ClaudeCode, Dom
-- **Why**: moonlock crashed with segfault in libgtk-4.so after suspend/resume — HDMI monitor disconnect/reconnect invalidated GDK monitor objects, and the statically created windows referenced destroyed surfaces. Crash at consistent GTK4 offset (0x278 NULL dereference), 3x reproduced.
-- **Tradeoffs**: Wallpaper texture now loaded before `lock()` instead of after (connect_monitor fires during lock() and needs the texture). Local JPEG loading is fast enough that the delay is negligible. Shared state moved to Rc's for the signal closure — slightly more indirection but necessary for dynamic window creation.
-- **How**: (1) Bump gtk4-session-lock feature from `v1_1` to `v1_2` to enable `Instance::connect_monitor`. (2) Replace manual monitor iteration with `lock.connect_monitor()` signal handler that creates windows on demand. (3) Signal fires once per existing monitor at `lock()` and again on hotplug. (4) Windows auto-unmap when their monitor disappears (ext-session-lock-v1 guarantee). (5) Fingerprint listener published to shared Rc so hotplugged monitors get FP labels.
-
-## 2026-03-31 – Fourth audit: peek icon, blur limit, GResource compression, sync markers
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Fourth triple audit found blur limit inconsistency (moonlock 0–100 vs moongreet/moonset 0–200), missing GResource compression, peek icon inconsistency, and duplicated code without sync markers.
-- **Tradeoffs**: Peek icon enabled in lockscreen — user decision favoring UX consistency over shoulder-surfing protection. Acceptable for single-user desktop. Blur limit raised to 200 for ecosystem consistency.
-- **How**: (1) `show_peek_icon(true)` in lockscreen password entry. (2) `clamp(0.0, 200.0)` for blur in config.rs. (3) `compressed="true"` on CSS/SVG GResource entries. (4) SYNC comments on duplicated blur/background functions pointing to moongreet and moonset.
-
-## 2026-03-30 – Third audit: blur offset, lock-before-IO, FP signal lifecycle, TOCTOU
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Third triple audit (quality, performance, security) found: blur padding offset rendering texture at (0,0) instead of (-pad,-pad) causing edge darkening on left/top (BUG), wallpaper disk I/O blocking before lock() extending the unsecured window (PERF/SEC), signal handler duplication on resume_async (SEC), failed_attempts not reset on FP resume (SEC), unknown VerifyStatus with done=false hanging FP listener (SEC), TOCTOU in is_file+is_symlink checks (SEC), dead code in faillock_warning (QUALITY), unbounded blur sigma (SEC).
-- **Tradeoffs**: Wallpaper loads after lock() — screen briefly shows without wallpaper until texture is ready. Acceptable: security > aesthetics. Blur sigma clamped to [0.0, 100.0] — arbitrary upper bound but prevents GPU memory exhaustion.
-- **How**: (1) Texture offset to (-pad, -pad) in render_blurred_texture. (2) lock.lock() before resolve_background_path. (3) begin_verification disconnects old signal_id before registering new. (4) resume_async resets failed_attempts. (5) Unknown VerifyStatus with done=true triggers restart. (6) symlink_metadata() for atomic file+symlink check. (7) faillock_warning dead code removed, saturating_sub. (8) background_blur clamped. (9) Redundant Zeroizing<Vec<u8>> removed. (10) Default impl for FingerprintListener. (11) on_verify_status restricted to pub(crate). (12) Warn logging for non-UTF-8 GECOS and avatar paths.
-
-## 2026-03-30 – Second audit: zeroize CString, FP account check, PAM timeout, blur downscale
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Second triple audit (quality, performance, security) found: CString password copy not zeroized (HIGH), fingerprint unlock bypassing pam_acct_mgmt (MEDIUM), no PAM timeout leaving user locked out on hanging modules (MEDIUM), GPU blur on full wallpaper resolution (MEDIUM), no-monitor edge case doing `return` instead of `exit(1)` (MEDIUM).
-- **Tradeoffs**: PAM timeout (30s) uses a generation counter to avoid stale result interference — adds complexity but prevents parallel PAM sessions. FP restart after failed account check re-claims the device, adding a D-Bus round-trip, but prevents permanent FP death on transient failures. Blur downscale to 1920px cap trades negligible quality for ~4x less GPU work on 4K wallpapers.
-- **How**: (1) `Zeroizing<CString>` wraps password in auth.rs, `zeroize/std` feature enabled. (2) `check_account()` calls pam_acct_mgmt after FP match; `resume_async()` restarts FP on transient failure. (3) `auth_generation` counter invalidates stale PAM results; 30s timeout re-enables UI. (4) `MAX_BLUR_DIMENSION` caps blur input at 1920px, sigma scaled proportionally. (5) `exit(1)` on no-monitor after `lock.lock()`.
-
-## 2026-03-28 – Remove embedded wallpaper from binary
-
-- **Who**: ClaudeCode, Dom
-- **Why**: Wallpaper is installed by moonarch to /usr/share/moonarch/wallpaper.jpg. Embedding a 374K JPEG in the binary is redundant. GTK background color (Catppuccin Mocha base) is a clean fallback.
-- **Tradeoffs**: Without moonarch installed AND without config, lockscreen shows plain dark background instead of wallpaper. Acceptable — that's the expected minimal state.
-- **How**: Remove wallpaper.jpg from GResources, return None from resolve_background_path when no file found, skip background picture creation when no texture available.
-
 ## 2026-03-28 – Audit-driven security and lifecycle fixes (v0.6.0)
 
-- **Who**: ClaudeCode, Dom
+- **Who**: Nyx, Dom
 - **Why**: Triple audit (quality, performance, security) revealed a critical D-Bus signal spoofing vector, fingerprint lifecycle bugs, and multi-monitor performance issues.
 - **Tradeoffs**: `cleanup_dbus()` extraction adds a method but clarifies the stop/match ownership; `running_flag: Rc<Cell<bool>>` adds a field but prevents race between async restart and stop; sender validation adds a check per signal but closes the only known auth bypass.
 - **How**: (1) Validate D-Bus VerifyStatus sender against fprintd's unique bus name. (2) Extract `cleanup_dbus()` from `stop()`, call it on verify-match. (3) `Rc<Cell<bool>>` running flag checked after await in `restart_verify_async`. (4) Consistent 3s D-Bus timeouts. (5) Panic hook before logging. (6) Blur and avatar caches shared across monitors. (7) Peek icon disabled. (8) Symlink rejection for background_path. (9) TOML parse errors logged.
 
 ## 2026-03-28 – GPU blur via GskBlurNode replaces CPU blur
 
-- **Who**: ClaudeCode, Dom
+- **Who**: Nyx, Dom
 - **Why**: CPU-side Gaussian blur (`image` crate) blocked the GTK main thread for 500ms–2s on 4K wallpapers at cold cache. Disk cache mitigated repeat starts but added ~100 lines of complexity.
 - **Tradeoffs**: GPU blur quality is slightly different (box-blur approximation vs true Gaussian), acceptable for wallpaper. Removes `image` and `dirs` dependencies entirely. No disk cache needed.
 - **How**: `Snapshot::push_blur()` + `GskRenderer::render_texture()` on `connect_realize`. Blur happens once on the GPU when the widget gets its renderer, producing a concrete `gdk::Texture`. Zero startup latency.
 
 ## 2026-03-28 – Optional background blur via `image` crate (superseded)
 
-- **Who**: ClaudeCode, Dom
+- **Who**: Nyx, Dom
 - **Why**: Consistent with moonset/moongreet — blurred wallpaper as lockscreen background is a common UX pattern
 - **Tradeoffs**: Adds `image` crate dependency (~15 transitive crates); CPU-side Gaussian blur at load time adds startup latency proportional to image size and sigma. Acceptable because blur runs once and the texture is shared across monitors.
 - **How**: `load_background_texture(bg_path, blur_radius)` loads texture, optionally applies `imageops::blur()`, returns `gdk::Texture`. Config option `background_blur: Option<f32>` in TOML.
 
 ## 2026-03-28 – Shared wallpaper texture pattern (aligned with moonset/moongreet)
 
-- **Who**: ClaudeCode, Dom
+- **Who**: Nyx, Dom
 - **Why**: Previously loaded wallpaper per-window via `Picture::for_filename()`. Multi-monitor setups decoded the JPEG redundantly. Blur feature requires texture pixel access anyway.
 - **Tradeoffs**: Slightly more code in main.rs (texture loaded before window creation), but avoids redundant decoding and enables the blur feature.
 - **How**: `load_background_texture()` in lockscreen.rs decodes once, `create_background_picture()` wraps shared `gdk::Texture` in `gtk::Picture`. Same pattern as moonset/moongreet.

README.md

@@ -5,16 +5,14 @@ Part of the Moonarch ecosystem.
 
 ## Features
 
-- **ext-session-lock-v1** — Protocol-guaranteed screen locking (compositor keeps screen locked on crash, `exit(1)` in release if unsupported)
-- **PAM authentication** — Uses system PAM stack (`/etc/pam.d/moonlock`) with 30s timeout and generation counter
-- **Fingerprint unlock** — fprintd D-Bus integration with sender validation, async init (window appears instantly), `pam_acct_mgmt` check after verify, auto-resume on transient errors
-- **Multi-monitor + hotplug** — Lockscreen on every monitor with shared blur and avatar caches; monitors added after suspend/resume get windows automatically via `connect_monitor` signal
-- **GPU blur** — Background blur via GskBlurNode (downscale to max 1920px, configurable 0–200)
+- **ext-session-lock-v1** — Protocol-guaranteed screen locking (compositor keeps screen locked on crash)
+- **PAM authentication** — Uses system PAM stack (`/etc/pam.d/moonlock`)
+- **Fingerprint unlock** — fprintd D-Bus integration, async init (optional, window appears instantly)
+- **Multi-monitor** — Lockscreen on every monitor, single shared fingerprint listener
 - **i18n** — German and English (auto-detected)
-- **Faillock warning** — Progressive UI warning after failed attempts, PAM decides lockout
-- **Panic safety** — Panic hook logs but never unlocks (installed before logging)
-- **Password wiping** — `Zeroize` on drop from GTK entry through PAM FFI layer
-- **Journal logging** — `journalctl -t moonlock`, debug level via `MOONLOCK_DEBUG` env var
+- **Faillock warning** — UI counter + system pam_faillock
+- **Panic safety** — Panic hook logs but never unlocks
+- **Password wiping** — Zeroize on drop
 
 ## Requirements
 
@@ -48,7 +46,6 @@ Create `/etc/moonlock/moonlock.toml` or `~/.config/moonlock/moonlock.toml`:
 
 ```toml
 background_path = "/usr/share/wallpapers/moon.jpg"
-background_blur = 40.0    # 0.0–200.0, optional
 fingerprint_enabled = true
 ```
 

build.rs

@@ -1,5 +1,5 @@
 // ABOUTME: Build script for compiling GResource bundle.
-// ABOUTME: Bundles style.css and default-avatar.svg into the binary.
+// ABOUTME: Bundles style.css, wallpaper.jpg, and default-avatar.svg into the binary.
 
 fn main() {
     glib_build_tools::compile_resources(

resources/resources.gresource.xml

@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <gresources>
   <gresource prefix="/dev/moonarch/moonlock">
-    <file compressed="true">style.css</file>
-    <file compressed="true">default-avatar.svg</file>
+    <file>style.css</file>
+    <file>wallpaper.jpg</file>
+    <file>default-avatar.svg</file>
   </gresource>
 </gresources>

resources/style.css

@@ -1,9 +1,9 @@
 /* ABOUTME: GTK4 CSS stylesheet for the Moonlock lockscreen. */
-/* ABOUTME: Uses GTK theme colors for consistency with the active desktop theme. */
+/* ABOUTME: Dark theme styling matching the Moonarch ecosystem. */
 
 /* Main window background */
 window.lockscreen {
-    background-color: @theme_bg_color;
+    background-color: #1a1a2e;
     background-size: cover;
     background-position: center;
     opacity: 0;
@@ -23,18 +23,18 @@ window.lockscreen.visible {
 
 /* Round avatar image */
 .avatar {
-    border-radius: 9999px;
+    border-radius: 50%;
     min-width: 128px;
     min-height: 128px;
     background-color: @theme_selected_bg_color;
-    border: 3px solid alpha(@theme_fg_color, 0.3);
+    border: 3px solid alpha(white, 0.3);
 }
 
 /* Username label */
 .username-label {
     font-size: 24px;
     font-weight: bold;
-    color: @theme_fg_color;
+    color: white;
     margin-top: 12px;
     margin-bottom: 40px;
 }
@@ -46,29 +46,29 @@ window.lockscreen.visible {
 
 /* Error message label */
 .error-label {
-    color: @error_color;
+    color: #ff6b6b;
     font-size: 14px;
 }
 
 /* Fingerprint status indicator */
 .fingerprint-label {
-    color: alpha(@theme_fg_color, 0.6);
+    color: alpha(white, 0.6);
     font-size: 13px;
     margin-top: 8px;
 }
 
 .fingerprint-label.success {
-    color: @success_color;
+    color: #51cf66;
 }
 
 .fingerprint-label.failed {
-    color: @error_color;
+    color: #ff6b6b;
 }
 
 /* Confirmation prompt */
 .confirm-label {
     font-size: 16px;
-    color: @theme_fg_color;
+    color: white;
     margin-bottom: 4px;
 }
 
@@ -103,12 +103,12 @@ window.lockscreen.visible {
     min-height: 48px;
     padding: 0px;
     border-radius: 24px;
-    background-color: alpha(@theme_fg_color, 0.1);
-    color: @theme_fg_color;
+    background-color: alpha(white, 0.1);
+    color: white;
     border: none;
     margin: 4px;
 }
 
 .power-button:hover {
-    background-color: alpha(@theme_fg_color, 0.25);
+    background-color: alpha(white, 0.25);
 }

src/auth.rs

@@ -149,9 +149,10 @@ unsafe extern "C" fn pam_conv_callback(
 /// Returns true on success, false on authentication failure.
 /// The password is wiped from memory after use via zeroize.
 pub fn authenticate(username: &str, password: &str) -> bool {
-    // CString::new takes ownership of the Vec — Zeroizing<CString> wipes on drop
-    let password_cstr = match CString::new(password.as_bytes().to_vec()) {
-        Ok(c) => Zeroizing::new(c),
+    // Use Zeroizing to ensure password bytes are wiped on drop
+    let password_bytes = Zeroizing::new(password.as_bytes().to_vec());
+    let password_cstr = match CString::new(password_bytes.as_slice()) {
+        Ok(c) => c,
         Err(_) => return false, // Password contains null byte
     };
 
@@ -167,7 +168,7 @@ pub fn authenticate(username: &str, password: &str) -> bool {
 
     let conv = PamConv {
         conv: pam_conv_callback,
-        appdata_ptr: std::ptr::from_ref::<CString>(&password_cstr) as *mut libc::c_void,
+        appdata_ptr: &password_cstr as *const CString as *mut libc::c_void,
     };
 
     let mut handle: *mut libc::c_void = ptr::null_mut();
@@ -191,12 +192,7 @@ pub fn authenticate(username: &str, password: &str) -> bool {
         return false;
     }
 
-    // Safety: handle is valid and non-null after successful pam_start.
-    // Note: pam_setcred is intentionally NOT called here. A lockscreen unlocks
-    // an existing session whose credentials were already established at login;
-    // refreshing them would duplicate work done by the session's login manager.
-    // If per-unlock credential refresh (Kerberos tickets, pam_gnome_keyring)
-    // is ever desired, hook it here with PAM_ESTABLISH_CRED.
+    // Safety: handle is valid and non-null after successful pam_start
     let auth_ret = unsafe { pam_authenticate(handle, 0) };
     let acct_ret = if auth_ret == PAM_SUCCESS {
         // Safety: handle is valid, check account restrictions
@@ -211,56 +207,6 @@ pub fn authenticate(username: &str, password: &str) -> bool {
     acct_ret == PAM_SUCCESS
 }
 
-/// Check account restrictions via PAM without authentication.
-///
-/// Used after fingerprint unlock to enforce account policies (lockout, expiry)
-/// that would otherwise be bypassed when not going through pam_authenticate.
-/// Returns true if the account is valid and allowed to log in.
-///
-/// **Precondition**: `username` must be the authenticated system user, derived
-/// via `users::get_current_user()` (which reads `getuid()`). Calling this with
-/// an attacker-controlled username is unsafe — `pam_acct_mgmt` returns SUCCESS
-/// for any valid unlocked account, giving a trivial unlock bypass.
-pub(crate) fn check_account(username: &str) -> bool {
-    let service = match CString::new("moonlock") {
-        Ok(c) => c,
-        Err(_) => return false,
-    };
-
-    let username_cstr = match CString::new(username) {
-        Ok(c) => c,
-        Err(_) => return false,
-    };
-
-    // No password needed — we only check account status, not authenticate.
-    // PAM conv callback is required by pam_start but won't be called for acct_mgmt.
-    let empty_password = Zeroizing::new(CString::new("").unwrap());
-    let conv = PamConv {
-        conv: pam_conv_callback,
-        appdata_ptr: std::ptr::from_ref::<CString>(&empty_password) as *mut libc::c_void,
-    };
-
-    let mut handle: *mut libc::c_void = ptr::null_mut();
-
-    let ret = unsafe {
-        pam_start(
-            service.as_ptr(),
-            username_cstr.as_ptr(),
-            &conv,
-            &mut handle,
-        )
-    };
-
-    if ret != PAM_SUCCESS || handle.is_null() {
-        return false;
-    }
-
-    let acct_ret = unsafe { pam_acct_mgmt(handle, 0) };
-    unsafe { pam_end(handle, acct_ret) };
-
-    acct_ret == PAM_SUCCESS
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -295,16 +241,4 @@ mod tests {
         let result = authenticate("", "password");
         assert!(!result);
     }
-
-    #[test]
-    fn check_account_empty_username_fails() {
-        let result = check_account("");
-        assert!(!result);
-    }
-
-    #[test]
-    fn check_account_null_byte_username_fails() {
-        let result = check_account("user\0name");
-        assert!(!result);
-    }
 }

src/config.rs

@@ -6,6 +6,7 @@ use std::fs;
 use std::path::{Path, PathBuf};
 
 const MOONARCH_WALLPAPER: &str = "/usr/share/moonarch/wallpaper.jpg";
+const GRESOURCE_PREFIX: &str = "/dev/moonarch/moonlock";
 
 fn default_config_paths() -> Vec<PathBuf> {
     let mut paths = vec![PathBuf::from("/etc/moonlock/moonlock.toml")];
@@ -51,9 +52,7 @@ pub fn load_config(config_paths: Option<&[PathBuf]>) -> Config {
             match toml::from_str::<RawConfig>(&content) {
                 Ok(parsed) => {
                     if parsed.background_path.is_some() { merged.background_path = parsed.background_path; }
-                    if let Some(blur) = parsed.background_blur {
-                        merged.background_blur = Some(blur.clamp(0.0, 200.0));
-                    }
+                    if parsed.background_blur.is_some() { merged.background_blur = parsed.background_blur; }
                     if let Some(fp) = parsed.fingerprint_enabled { merged.fingerprint_enabled = fp; }
                 }
                 Err(e) => {
@@ -65,19 +64,17 @@ pub fn load_config(config_paths: Option<&[PathBuf]>) -> Config {
     merged
 }
 
-pub fn resolve_background_path(config: &Config) -> Option<PathBuf> {
+pub fn resolve_background_path(config: &Config) -> PathBuf {
     resolve_background_path_with(config, Path::new(MOONARCH_WALLPAPER))
 }
 
-pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> Option<PathBuf> {
+pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> PathBuf {
     if let Some(ref bg) = config.background_path {
         let path = PathBuf::from(bg);
-        if let Ok(meta) = path.symlink_metadata() {
-            if meta.is_file() && !meta.file_type().is_symlink() { return Some(path); }
+        if path.is_file() && !path.is_symlink() { return path; }
     }
-    }
-    if moonarch_wallpaper.is_file() { return Some(moonarch_wallpaper.to_path_buf()); }
-    None
+    if moonarch_wallpaper.is_file() { return moonarch_wallpaper.to_path_buf(); }
+    PathBuf::from(format!("{GRESOURCE_PREFIX}/wallpaper.jpg"))
 }
 
 #[cfg(test)]
@@ -112,7 +109,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let wp = dir.path().join("bg.jpg"); fs::write(&wp, "fake").unwrap();
         let c = Config { background_path: Some(wp.to_str().unwrap().to_string()), ..Config::default() };
-        assert_eq!(resolve_background_path_with(&c, Path::new("/nonexistent")), Some(wp));
+        assert_eq!(resolve_background_path_with(&c, Path::new("/nonexistent")), wp);
     }
     #[test] fn empty_user_config_preserves_system_fingerprint() {
         let dir = tempfile::tempdir().unwrap();
@@ -123,10 +120,10 @@ mod tests {
         let c = load_config(Some(&[sys_conf, usr_conf]));
         assert!(!c.fingerprint_enabled);
     }
-    #[test] fn resolve_no_wallpaper_returns_none() {
+    #[test] fn resolve_gresource_fallback() {
         let c = Config::default();
         let r = resolve_background_path_with(&c, Path::new("/nonexistent"));
-        assert!(r.is_none());
+        assert!(r.to_str().unwrap().contains("moonlock"));
     }
     #[test] fn toml_parse_error_returns_default() {
         let dir = tempfile::tempdir().unwrap();
@@ -144,8 +141,8 @@ mod tests {
         fs::write(&real, "fake").unwrap();
         std::os::unix::fs::symlink(&real, &link).unwrap();
         let c = Config { background_path: Some(link.to_str().unwrap().to_string()), ..Config::default() };
-        // Symlink should be rejected — falls through to None
+        // Symlink should be rejected — falls through to moonarch wallpaper or gresource
         let r = resolve_background_path_with(&c, Path::new("/nonexistent"));
-        assert!(r.is_none());
+        assert_ne!(r, link);
     }
 }

src/fingerprint.rs

@@ -13,7 +13,6 @@ const FPRINTD_DEVICE_IFACE: &str = "net.reactivated.Fprint.Device";
 
 const MAX_FP_ATTEMPTS: u32 = 10;
 const DBUS_TIMEOUT_MS: i32 = 3000;
-const FPRINTD_DEVICE_PREFIX: &str = "/net/reactivated/Fprint/Device/";
 
 /// Retry-able statuses — finger not read properly, try again.
 const RETRY_STATUSES: &[&str] = &[
@@ -36,8 +35,10 @@ pub struct FingerprintListener {
     on_exhausted: Option<Box<dyn Fn() + 'static>>,
 }
 
-impl Default for FingerprintListener {
-    fn default() -> Self {
+impl FingerprintListener {
+    /// Create a lightweight FingerprintListener without any D-Bus calls.
+    /// Call `init_async().await` afterwards to connect to fprintd.
+    pub fn new() -> Self {
         FingerprintListener {
             device_proxy: None,
             signal_id: None,
@@ -49,14 +50,6 @@ impl Default for FingerprintListener {
             on_exhausted: None,
         }
     }
-}
-
-impl FingerprintListener {
-    /// Create a lightweight FingerprintListener without any D-Bus calls.
-    /// Call `init_async().await` afterwards to connect to fprintd.
-    pub fn new() -> Self {
-        Self::default()
-    }
 
     /// Connect to fprintd and get the default device asynchronously.
     pub async fn init_async(&mut self) {
@@ -100,10 +93,6 @@ impl FingerprintListener {
         if device_path.is_empty() {
             return;
         }
-        if !device_path.starts_with(FPRINTD_DEVICE_PREFIX) {
-            log::warn!("Unexpected fprintd device path: {device_path}");
-            return;
-        }
 
         match gio::DBusProxy::for_bus_future(
             gio::BusType::System,
@@ -165,6 +154,14 @@ impl FingerprintListener {
         G: Fn() + 'static,
         H: Fn() + 'static,
     {
+        let proxy = {
+            let inner = listener.borrow();
+            match inner.device_proxy.clone() {
+                Some(p) => p,
+                None => return,
+            }
+        };
+
         {
             let mut inner = listener.borrow_mut();
             inner.on_success = Some(Box::new(on_success));
@@ -172,51 +169,6 @@ impl FingerprintListener {
             inner.on_exhausted = Some(Box::new(on_exhausted));
         }
 
-        Self::begin_verification(listener, username).await;
-    }
-
-    /// Resume fingerprint verification after a transient interruption (e.g. failed
-    /// PAM account check). Reuses previously stored callbacks. Re-claims the device
-    /// and restarts verification from scratch. Awaits any in-flight VerifyStop +
-    /// Release before re-claiming the device so fprintd does not reject the Claim
-    /// while the previous session is still being torn down.
-    pub async fn resume_async(
-        listener: &Rc<RefCell<FingerprintListener>>,
-        username: &str,
-    ) {
-        // Drain in-flight cleanup so the device is actually released before Claim.
-        // Without this, a fast resume after on_verify_status's fire-and-forget
-        // cleanup races the Release call and fprintd returns "already claimed".
-        let proxy = listener.borrow_mut().take_cleanup_proxy();
-        if let Some(proxy) = proxy {
-            Self::perform_dbus_cleanup(proxy).await;
-        }
-        // Deliberately do NOT reset failed_attempts here. An attacker with sensor
-        // control could otherwise cycle verify-match → check_account fail → resume,
-        // and the 10-attempt cap would never trigger. The counter decays only via
-        // a fresh lock session (listener construction).
-        Self::begin_verification(listener, username).await;
-    }
-
-    /// Claim device, start verification, and connect D-Bus signal handler.
-    /// Assumes device_proxy is set and callbacks are already stored.
-    async fn begin_verification(
-        listener: &Rc<RefCell<FingerprintListener>>,
-        username: &str,
-    ) {
-        let proxy = {
-            let mut inner = listener.borrow_mut();
-            let proxy = match inner.device_proxy.clone() {
-                Some(p) => p,
-                None => return,
-            };
-            // Disconnect any previous signal handler to prevent duplicates on resume
-            if let Some(old_id) = inner.signal_id.take() {
-                proxy.disconnect(old_id);
-            }
-            proxy
-        };
-
         // Claim the device
         let args = glib::Variant::from((&username,));
         if let Err(e) = proxy
@@ -294,7 +246,7 @@ impl FingerprintListener {
     }
 
     /// Process a VerifyStatus signal from fprintd.
-    pub(crate) fn on_verify_status(&mut self, status: &str, done: bool) {
+    pub fn on_verify_status(&mut self, status: &str, done: bool) {
         if !self.running {
             return;
         }
@@ -334,9 +286,6 @@ impl FingerprintListener {
         }
 
         log::debug!("Unhandled fprintd status: {status}");
-        if done {
-            self.restart_verify_async();
-        }
     }
 
     /// Restart fingerprint verification asynchronously after a completed attempt.
@@ -364,37 +313,26 @@ impl FingerprintListener {
         }
     }
 
-    /// Disconnect the signal handler and clear running flags. Returns the proxy
-    /// the caller should use for the async D-Bus cleanup (VerifyStop + Release).
-    ///
-    /// Split into a sync part (signal disconnect, flags) and an async part
-    /// (`perform_dbus_cleanup`) so callers can either spawn the async work
-    /// fire-and-forget (via `cleanup_dbus`) or await it to serialize with a
-    /// subsequent Claim (via `resume_async`).
-    fn take_cleanup_proxy(&mut self) -> Option<gio::DBusProxy> {
+    /// Disconnect the signal handler and send VerifyStop + Release to fprintd.
+    /// Signal disconnect is synchronous to prevent further callbacks.
+    /// D-Bus cleanup is fire-and-forget to avoid blocking the UI.
+    fn cleanup_dbus(&mut self) {
         self.running = false;
         self.running_flag.set(false);
 
-        let proxy = self.device_proxy.clone()?;
+        if let Some(ref proxy) = self.device_proxy {
             if let Some(id) = self.signal_id.take() {
                 proxy.disconnect(id);
             }
-        Some(proxy)
-    }
-
-    async fn perform_dbus_cleanup(proxy: gio::DBusProxy) {
+            let proxy = proxy.clone();
+            glib::spawn_future_local(async move {
                 let _ = proxy
                     .call_future("VerifyStop", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
                     .await;
                 let _ = proxy
                     .call_future("Release", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
                     .await;
-    }
-
-    /// Fire-and-forget cleanup for code paths that cannot await (e.g. drop, stop).
-    fn cleanup_dbus(&mut self) {
-        if let Some(proxy) = self.take_cleanup_proxy() {
-            glib::spawn_future_local(Self::perform_dbus_cleanup(proxy));
+            });
         }
     }
 
@@ -446,13 +384,11 @@ mod tests {
         let called_clone = called.clone();
         let mut listener = FingerprintListener::new();
         listener.running = true;
-        listener.running_flag.set(true);
         listener.on_failure = Some(Box::new(move || { called_clone.set(true); }));
 
         listener.on_verify_status("verify-no-match", false);
         assert!(called.get());
         assert!(listener.running);
-        assert!(listener.running_flag.get());
         assert_eq!(listener.failed_attempts, 1);
     }
 

src/i18n.rs

@@ -28,7 +28,6 @@ pub struct Strings {
     pub confirm_no: &'static str,
     pub faillock_attempts_remaining: &'static str,
     pub faillock_locked: &'static str,
-    pub auth_timeout: &'static str,
 }
 
 const STRINGS_DE: Strings = Strings {
@@ -47,7 +46,6 @@ const STRINGS_DE: Strings = Strings {
     confirm_no: "Abbrechen",
     faillock_attempts_remaining: "Noch {n} Versuch(e) vor Kontosperrung!",
     faillock_locked: "Konto ist möglicherweise gesperrt",
-    auth_timeout: "Authentifizierung abgelaufen — bitte erneut versuchen",
 };
 
 const STRINGS_EN: Strings = Strings {
@@ -66,7 +64,6 @@ const STRINGS_EN: Strings = Strings {
     confirm_no: "Cancel",
     faillock_attempts_remaining: "{n} attempt(s) remaining before lockout!",
     faillock_locked: "Account may be locked",
-    auth_timeout: "Authentication timed out — please try again",
 };
 
 fn parse_lang_prefix(lang: &str) -> String {
@@ -100,13 +97,10 @@ pub fn load_strings(locale: Option<&str>) -> &'static Strings {
     match locale { "de" => &STRINGS_DE, _ => &STRINGS_EN }
 }
 
-/// Returns a warning when the user is close to lockout (2 or fewer attempts remaining).
-/// Caller is responsible for handling the locked state (count >= max_attempts).
 pub fn faillock_warning(attempt_count: u32, max_attempts: u32, strings: &Strings) -> Option<String> {
-    let remaining = max_attempts.saturating_sub(attempt_count);
-    if remaining > 0 && remaining <= 2 {
-        return Some(strings.faillock_attempts_remaining.replace("{n}", &remaining.to_string()));
-    }
+    if attempt_count >= max_attempts { return Some(strings.faillock_locked.to_string()); }
+    let remaining = max_attempts - attempt_count;
+    if remaining == 1 { return Some(strings.faillock_attempts_remaining.replace("{n}", &remaining.to_string())); }
     None
 }
 
@@ -140,35 +134,7 @@ mod tests {
     }
 
     #[test] fn faillock_zero() { assert!(faillock_warning(0, 3, load_strings(Some("en"))).is_none()); }
-    #[test] fn faillock_one() { assert!(faillock_warning(1, 3, load_strings(Some("en"))).is_some()); }
+    #[test] fn faillock_one() { assert!(faillock_warning(1, 3, load_strings(Some("en"))).is_none()); }
     #[test] fn faillock_two() { assert!(faillock_warning(2, 3, load_strings(Some("en"))).is_some()); }
-    #[test] fn faillock_three() { assert!(faillock_warning(3, 3, load_strings(Some("en"))).is_none()); }
-
-    #[test]
-    fn faillock_caller_contract() {
-        // Mirrors the lockscreen.rs usage: caller handles count >= max separately,
-        // faillock_warning is only called when count < max.
-        let max = 3u32;
-        let strings = load_strings(Some("en"));
-        for count in 0..max {
-            let result = faillock_warning(count, max, strings);
-            let remaining = max - count;
-            if remaining <= 2 {
-                assert!(result.is_some(), "should warn at count={count} (remaining={remaining})");
-            } else {
-                assert!(result.is_none(), "should not warn at count={count}");
-            }
-        }
-    }
-
-    #[test]
-    fn faillock_warns_progressively_with_higher_max() {
-        let strings = load_strings(Some("en"));
-        // With max=5: warn at count 3 (rem=2) and count 4 (rem=1), not at 0-2
-        assert!(faillock_warning(0, 5, strings).is_none());
-        assert!(faillock_warning(2, 5, strings).is_none());
-        assert!(faillock_warning(3, 5, strings).is_some());
-        assert!(faillock_warning(4, 5, strings).is_some());
-        assert!(faillock_warning(5, 5, strings).is_none()); // at max, caller handles lockout
-    }
+    #[test] fn faillock_three() { assert_eq!(faillock_warning(3, 3, load_strings(Some("en"))).unwrap(), "Account may be locked"); }
 }

src/lockscreen.rs

@@ -7,7 +7,7 @@ use glib::clone;
 use graphene_rs as graphene;
 use gtk4::prelude::*;
 use gtk4::{self as gtk, gio};
-use std::cell::{Cell, RefCell};
+use std::cell::RefCell;
 use std::path::Path;
 use std::rc::Rc;
 
@@ -32,7 +32,6 @@ pub struct LockscreenHandles {
 
 const AVATAR_SIZE: i32 = 128;
 const FAILLOCK_MAX_ATTEMPTS: u32 = 3;
-const PAM_TIMEOUT_SECS: u64 = 30;
 
 /// Shared mutable state for the lockscreen.
 struct LockscreenState {
@@ -45,7 +44,7 @@ struct LockscreenState {
 /// The `blur_cache` and `avatar_cache` are shared across monitors for multi-monitor
 /// setups, avoiding redundant GPU renders and SVG rasterizations.
 pub fn create_lockscreen_window(
-    bg_texture: Option<&gdk::Texture>,
+    bg_texture: &gdk::Texture,
     config: &Config,
     app: &gtk::Application,
     unlock_callback: Rc<dyn Fn()>,
@@ -87,11 +86,9 @@ pub fn create_lockscreen_window(
     let overlay = gtk::Overlay::new();
     window.set_child(Some(&overlay));
 
-    // Background wallpaper (if available — otherwise GTK background color shows through)
-    if let Some(texture) = bg_texture {
-        let background = create_background_picture(texture, config.background_blur, blur_cache);
+    // Background wallpaper
+    let background = create_background_picture(bg_texture, config.background_blur, blur_cache);
     overlay.set_child(Some(&background));
-    }
 
     // Centered vertical box
     let main_box = gtk::Box::new(gtk::Orientation::Vertical, 0);
@@ -137,7 +134,7 @@ pub fn create_lockscreen_window(
     // Password entry
     let password_entry = gtk::PasswordEntry::builder()
         .placeholder_text(strings.password_placeholder)
-        .show_peek_icon(true)
+        .show_peek_icon(false)
         .hexpand(true)
         .build();
     password_entry.add_css_class("password-entry");
@@ -222,19 +219,13 @@ pub fn create_lockscreen_window(
 
     overlay.add_overlay(&power_box);
 
-    // Password entry "activate" handler.
-    // A generation counter tracks which auth attempt is current. When the user
-    // submits a new password, the generation increments — stale PAM results from
-    // prior attempts are ignored (except success: a correct password always unlocks).
+    // Password entry "activate" handler
     let username = user.username.clone();
-    let auth_generation = Rc::new(Cell::new(0u32));
     password_entry.connect_activate(clone!(
         #[strong]
         state,
         #[strong]
         unlock_callback,
-        #[strong]
-        auth_generation,
         #[weak]
         error_label,
         #[weak]
@@ -244,44 +235,11 @@ pub fn create_lockscreen_window(
             if password.is_empty() {
                 return;
             }
-            // Clear the GTK entry's internal buffer as early as possible. GTK allocates
-            // the backing GString via libc malloc, which zeroize cannot reach — the
-            // best we can do is shorten the window during which it resides in memory.
-            entry.set_text("");
 
             entry.set_sensitive(false);
             let username = username.clone();
             let unlock_cb = unlock_callback.clone();
 
-            // Invalidate stale timeouts/results from prior attempts
-            let auth_gen = auth_generation.get().wrapping_add(1);
-            auth_generation.set(auth_gen);
-            let gen_timeout = auth_generation.clone();
-            let gen_result = auth_generation.clone();
-
-            // If PAM hangs (e.g. broken LDAP module), the timeout re-enables the UI
-            glib::timeout_add_local_once(
-                std::time::Duration::from_secs(PAM_TIMEOUT_SECS),
-                clone!(
-                    #[weak]
-                    error_label,
-                    #[weak]
-                    password_entry,
-                    move || {
-                        if gen_timeout.get() != auth_gen {
-                            return;
-                        }
-                        log::error!("PAM authentication timed out after {PAM_TIMEOUT_SECS}s");
-                        let strings = load_strings(None);
-                        password_entry.set_text("");
-                        password_entry.set_sensitive(true);
-                        password_entry.grab_focus();
-                        error_label.set_text(strings.auth_timeout);
-                        error_label.set_visible(true);
-                    }
-                ),
-            );
-
             glib::spawn_future_local(clone!(
                 #[strong]
                 state,
@@ -295,20 +253,6 @@ pub fn create_lockscreen_window(
                         auth::authenticate(&user, &password)
                     }).await;
 
-                    // Stale result from a superseded attempt — only unlock on success
-                    // (a correct password should always unlock, regardless of timing)
-                    if gen_result.get() != auth_gen {
-                        if matches!(result, Ok(true)) {
-                            let s = state.borrow();
-                            if let Some(ref fp_rc) = s.fp_listener_rc {
-                                fp_rc.borrow_mut().stop();
-                            }
-                            drop(s);
-                            unlock_cb();
-                        }
-                        return;
-                    }
-
                     match result {
                         Ok(true) => {
                             let s = state.borrow();
@@ -427,12 +371,10 @@ pub fn start_fingerprint(
     let unlock_cb_fp = handles.unlock_callback.clone();
 
     let fp_rc_success = fp_rc.clone();
-    let fp_username = handles.username.clone();
     let on_success = move || {
         let label = fp_label_success.clone();
         let cb = unlock_cb_fp.clone();
         let fp = fp_rc_success.clone();
-        let username = fp_username.clone();
         glib::idle_add_local_once(move || {
             let strings = load_strings(None);
             label.set_text(strings.fingerprint_success);
@@ -440,39 +382,7 @@ pub fn start_fingerprint(
             // stop() is idempotent — cleanup_dbus() already ran inside on_verify_status,
             // but this mirrors the PAM success path for defense-in-depth.
             fp.borrow_mut().stop();
-
-            // Enforce PAM account policies (lockout, expiry) before unlocking.
-            // Fingerprint auth bypasses pam_authenticate, so we must explicitly
-            // check account restrictions via pam_acct_mgmt.
-            glib::spawn_future_local(async move {
-                let user = username.clone();
-                let result = gio::spawn_blocking(move || {
-                    auth::check_account(&user)
-                }).await;
-                match result {
-                    Ok(true) => cb(),
-                    _ => {
-                        log::error!("PAM account check failed after fingerprint auth");
-                        let strings = load_strings(None);
-                        label.set_text(strings.wrong_password);
-                        label.remove_css_class("success");
-                        label.add_css_class("failed");
-                        // Restart FP verification after delay — the failure may be
-                        // transient (e.g. PAM module timeout). If the account is truly
-                        // locked, check_account will fail again on next match.
-                        glib::timeout_add_local_once(
-                            std::time::Duration::from_secs(2),
-                            move || {
-                                label.set_text(load_strings(None).fingerprint_prompt);
-                                label.remove_css_class("failed");
-                                glib::spawn_future_local(async move {
-                                    FingerprintListener::resume_async(&fp, &username).await;
-                                });
-                            },
-                        );
-                    }
-                }
-            });
+            cb();
         });
     };
 
@@ -520,39 +430,18 @@ pub fn start_fingerprint(
 }
 
 /// Load the wallpaper as a texture once, for sharing across all windows.
-/// Returns None if no wallpaper path is provided or the file cannot be loaded.
 /// Blur is applied at render time via GPU (GskBlurNode), not here.
-///
-/// Opens the file with O_NOFOLLOW to close the TOCTOU window between the
-/// symlink check in `resolve_background_path_with` and this read. If the path
-/// was swapped for a symlink after the check, `open` fails with ELOOP.
-pub fn load_background_texture(bg_path: &Path) -> Option<gdk::Texture> {
-    use std::io::Read;
-    use std::os::unix::fs::OpenOptionsExt;
+pub fn load_background_texture(bg_path: &Path) -> gdk::Texture {
+    let fallback = "/dev/moonarch/moonlock/wallpaper.jpg";
 
-    let mut file = match std::fs::OpenOptions::new()
-        .read(true)
-        .custom_flags(libc::O_NOFOLLOW)
-        .open(bg_path)
-    {
-        Ok(f) => f,
-        Err(e) => {
-            log::warn!("Failed to open wallpaper {}: {e}", bg_path.display());
-            return None;
-        }
-    };
-    let mut bytes = Vec::new();
-    if let Err(e) = file.read_to_end(&mut bytes) {
-        log::warn!("Failed to read wallpaper {}: {e}", bg_path.display());
-        return None;
-    }
-    let glib_bytes = glib::Bytes::from_owned(bytes);
-    match gdk::Texture::from_bytes(&glib_bytes) {
-        Ok(texture) => Some(texture),
-        Err(e) => {
-            log::warn!("Failed to decode wallpaper {}: {e}", bg_path.display());
-            None
-        }
+    if bg_path.starts_with("/dev/moonarch/moonlock") {
+        let resource_path = bg_path.to_str().unwrap_or(fallback);
+        gdk::Texture::from_resource(resource_path)
+    } else {
+        let file = gio::File::for_path(bg_path);
+        gdk::Texture::from_file(&file).unwrap_or_else(|_| {
+            gdk::Texture::from_resource(fallback)
+        })
     }
 }
 
@@ -592,24 +481,8 @@ fn create_background_picture(
     background
 }
 
-// SYNC: MAX_BLUR_DIMENSION, render_blurred_texture, and create_background_picture
-// are duplicated in moongreet/src/greeter.rs and moonset/src/panel.rs.
-// Changes here must be mirrored to the other two projects.
-
-/// Maximum texture dimension for blur input. Textures larger than this are
-/// downscaled before blurring — the blur destroys detail anyway, so there is
-/// no visible quality loss, but GPU work is reduced significantly.
-const MAX_BLUR_DIMENSION: f32 = 1920.0;
-
 /// Render a blurred texture using the widget's GPU renderer.
 /// Returns None if the renderer is not available.
-///
-/// To avoid edge darkening (blur samples transparent pixels outside bounds),
-/// the texture is rendered with padding equal to 3x the blur sigma. The blur
-/// is applied to the padded area, then cropped back to the original size.
-///
-/// Large textures (> MAX_BLUR_DIMENSION) are downscaled before blurring to
-/// reduce GPU work. The sigma is scaled proportionally.
 fn render_blurred_texture(
     widget: &impl IsA<gtk::Widget>,
     texture: &gdk::Texture,
@@ -617,74 +490,36 @@ fn render_blurred_texture(
 ) -> Option<gdk::Texture> {
     let native = widget.native()?;
     let renderer = native.renderer()?;
-
-    let orig_w = texture.width() as f32;
-    let orig_h = texture.height() as f32;
-
-    // Downscale large textures to reduce GPU blur work
-    let max_dim = orig_w.max(orig_h);
-    let scale = if max_dim > MAX_BLUR_DIMENSION {
-        MAX_BLUR_DIMENSION / max_dim
-    } else {
-        1.0
-    };
-    let w = (orig_w * scale).round();
-    let h = (orig_h * scale).round();
-    let scaled_sigma = sigma * scale;
-
-    // Padding must cover the blur kernel radius (typically ~3x sigma)
-    let pad = (scaled_sigma * 3.0).ceil();
-
     let snapshot = gtk::Snapshot::new();
-    // Clip output to scaled texture size
-    snapshot.push_clip(&graphene::Rect::new(pad, pad, w, h));
-    snapshot.push_blur(scaled_sigma as f64);
-    // Render texture with padding on all sides (edges repeat via oversized bounds)
-    snapshot.append_texture(texture, &graphene::Rect::new(-pad, -pad, w + 2.0 * pad, h + 2.0 * pad));
-    snapshot.pop(); // blur
-    snapshot.pop(); // clip
-
+    let bounds = graphene::Rect::new(
+        0.0,
+        0.0,
+        texture.width() as f32,
+        texture.height() as f32,
+    );
+    snapshot.push_blur(sigma as f64);
+    snapshot.append_texture(texture, &bounds);
+    snapshot.pop();
     let node = snapshot.to_node()?;
-    let viewport = graphene::Rect::new(pad, pad, w, h);
-    Some(renderer.render_texture(&node, Some(&viewport)))
+    Some(renderer.render_texture(&node, None))
 }
 
 /// Load an image file and set it as the avatar. Stores the texture in the cache.
-/// Decoding runs via GIO async I/O + async pixbuf stream loader so the GTK main
-/// loop stays responsive — avatars may be loaded inside the `connect_monitor`
-/// signal handler at hotplug time, which must not block. The fallback icon is
-/// shown immediately; the decoded texture replaces it when ready.
 fn set_avatar_from_file(
     image: &gtk::Image,
     path: &Path,
     cache: &Rc<RefCell<Option<gdk::Texture>>>,
 ) {
-    image.set_icon_name(Some("avatar-default-symbolic"));
-
-    let display_path = path.to_path_buf();
-    let file = gio::File::for_path(path);
-    let image_clone = image.clone();
-    let cache_clone = cache.clone();
-
-    glib::spawn_future_local(async move {
-        let stream = match file.read_future(glib::Priority::default()).await {
-            Ok(s) => s,
-            Err(e) => {
-                log::warn!("Failed to open avatar {}: {e}", display_path.display());
-                return;
-            }
-        };
-        match Pixbuf::from_stream_at_scale_future(&stream, AVATAR_SIZE, AVATAR_SIZE, true).await {
+    match Pixbuf::from_file_at_scale(path.to_str().unwrap_or(""), AVATAR_SIZE, AVATAR_SIZE, true) {
         Ok(pixbuf) => {
             let texture = gdk::Texture::for_pixbuf(&pixbuf);
-                image_clone.set_paintable(Some(&texture));
-                *cache_clone.borrow_mut() = Some(texture);
+            image.set_paintable(Some(&texture));
+            *cache.borrow_mut() = Some(texture);
         }
-            Err(e) => {
-                log::warn!("Failed to decode avatar from {}: {e}", display_path.display());
+        Err(_) => {
+            image.set_icon_name(Some("avatar-default-symbolic"));
         }
     }
-    });
 }
 
 /// Load the default avatar SVG from GResources, tinted with the foreground color.

src/main.rs

@@ -24,7 +24,7 @@ fn load_css(display: &gdk::Display) {
     gtk::style_context_add_provider_for_display(
         display,
         &css_provider,
-        gtk::STYLE_PROVIDER_PRIORITY_USER,
+        gtk::STYLE_PROVIDER_PRIORITY_APPLICATION,
     );
 }
 
@@ -40,14 +40,16 @@ fn activate(app: &gtk::Application) {
     load_css(&display);
 
     let config = config::load_config(None);
+    let bg_path = config::resolve_background_path(&config);
+    let bg_texture = lockscreen::load_background_texture(&bg_path);
 
     if gtk4_session_lock::is_supported() {
-        activate_with_session_lock(app, &display, &config);
+        activate_with_session_lock(app, &display, &bg_texture, &config);
     } else {
         #[cfg(debug_assertions)]
         {
             log::warn!("ext-session-lock-v1 not supported — running in development mode");
-            activate_without_lock(app, &config);
+            activate_without_lock(app, &bg_texture, &config);
         }
         #[cfg(not(debug_assertions))]
         {
@@ -59,18 +61,14 @@ fn activate(app: &gtk::Application) {
 
 fn activate_with_session_lock(
     app: &gtk::Application,
-    _display: &gdk::Display,
+    display: &gdk::Display,
+    bg_texture: &gdk::Texture,
     config: &config::Config,
 ) {
     let lock = gtk4_session_lock::Instance::new();
+    lock.lock();
 
-    // Load wallpaper before lock — connect_monitor fires during lock() and needs the
-    // texture. This means disk I/O happens before locking, but loading a local JPEG
-    // is fast enough that the delay is negligible.
-    let bg_texture: Rc<Option<gdk::Texture>> = Rc::new(
-        config::resolve_background_path(config)
-            .and_then(|path| lockscreen::load_background_texture(&path)),
-    );
+    let monitors = display.monitors();
 
     // Shared unlock callback — unlocks session and quits.
     // Guard prevents double-unlock if PAM and fingerprint succeed simultaneously.
@@ -92,127 +90,77 @@ fn activate_with_session_lock(
     let blur_cache: Rc<RefCell<Option<gdk::Texture>>> = Rc::new(RefCell::new(None));
     let avatar_cache: Rc<RefCell<Option<gdk::Texture>>> = Rc::new(RefCell::new(None));
 
-    // Shared config for use in the monitor signal handler
-    let config = Rc::new(config.clone());
-
-    // Shared handles list — populated by connect_monitor, read by fingerprint init
-    let all_handles: Rc<RefCell<Vec<lockscreen::LockscreenHandles>>> =
-        Rc::new(RefCell::new(Vec::new()));
-
-    // Shared fingerprint listener — None until async init completes.
-    // The monitor handler checks this to wire up FP labels on hotplugged monitors.
-    let shared_fp: Rc<RefCell<Option<Rc<RefCell<FingerprintListener>>>>> =
-        Rc::new(RefCell::new(None));
-
-    // The ::monitor signal fires once per existing monitor at lock(), and again
-    // whenever a monitor is hotplugged (e.g. after suspend/resume). This replaces
-    // the old manual monitor iteration and handles hotplug automatically.
-    let lock_for_signal = lock.clone();
-    lock.connect_monitor(glib::clone!(
-        #[strong]
-        app,
-        #[strong]
-        config,
-        #[strong]
-        bg_texture,
-        #[strong]
-        unlock_callback,
-        #[strong]
-        blur_cache,
-        #[strong]
-        avatar_cache,
-        #[strong]
-        all_handles,
-        #[strong]
-        shared_fp,
-        move |_instance, monitor| {
-            log::debug!("Monitor signal: creating lockscreen window");
+    // Create all monitor windows immediately — no D-Bus calls here
+    let mut all_handles = Vec::new();
+    let mut created_any = false;
+    for i in 0..monitors.n_items() {
+        if let Some(monitor) = monitors
+            .item(i)
+            .and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
+        {
             let handles = lockscreen::create_lockscreen_window(
-                bg_texture.as_ref().as_ref(),
-                &config,
-                &app,
+                bg_texture,
+                config,
+                app,
                 unlock_callback.clone(),
                 &blur_cache,
                 &avatar_cache,
             );
-            lock_for_signal.assign_window_to_monitor(&handles.window, monitor);
+            lock.assign_window_to_monitor(&handles.window, &monitor);
             handles.window.present();
-
-            // If fingerprint is already initialized, wire up the label
-            if let Some(ref fp_rc) = *shared_fp.borrow() {
-                lockscreen::show_fingerprint_label(&handles, fp_rc);
+            all_handles.push(handles);
+            created_any = true;
+        }
     }
 
-            all_handles.borrow_mut().push(handles);
+    if !created_any {
+        log::error!("No lockscreen windows created — screen stays locked (compositor policy)");
+        return;
     }
-    ));
-
-    lock.lock();
 
     // Async fprintd initialization — runs after windows are visible
     if config.fingerprint_enabled {
-        init_fingerprint_async(all_handles, shared_fp);
+        init_fingerprint_async(all_handles);
     }
 }
 
 /// Initialize fprintd asynchronously after windows are visible.
 /// Uses a single FingerprintListener shared across all monitors —
-/// only the first monitor's handles get the fingerprint verification wired up.
-/// The `shared_fp` is set after init so that the connect_monitor handler can
-/// wire up FP labels on monitors that appear after initialization.
-fn init_fingerprint_async(
-    all_handles: Rc<RefCell<Vec<lockscreen::LockscreenHandles>>>,
-    shared_fp: Rc<RefCell<Option<Rc<RefCell<FingerprintListener>>>>>,
-) {
+/// only the first monitor's handles get the fingerprint UI wired up.
+fn init_fingerprint_async(all_handles: Vec<lockscreen::LockscreenHandles>) {
     glib::spawn_future_local(async move {
         let mut listener = FingerprintListener::new();
         listener.init_async().await;
 
-        // Extract username without holding a borrow across the await below —
-        // otherwise a concurrent connect_monitor signal (hotplug / suspend-resume)
-        // that tries to borrow_mut() panics at runtime.
-        let username = {
-            let handles = all_handles.borrow();
-            if handles.is_empty() {
+        // Use the first monitor's username to check enrollment
+        let username = &all_handles[0].username;
+        if username.is_empty() {
             return;
         }
-            let u = handles[0].username.clone();
-            if u.is_empty() {
-                return;
-            }
-            u
-        };
 
-        if !listener.is_available_async(&username).await {
+        if !listener.is_available_async(username).await {
             log::debug!("fprintd not available or no enrolled fingers");
             return;
         }
 
         let fp_rc = Rc::new(RefCell::new(listener));
 
-        // Re-borrow after the await — no further awaits in this scope, so it is
-        // safe to hold the borrow briefly while wiring up the labels.
-        {
-            let handles = all_handles.borrow();
-            for h in handles.iter() {
-                lockscreen::show_fingerprint_label(h, &fp_rc);
-            }
-            lockscreen::start_fingerprint(&handles[0], &fp_rc);
+        // Show fingerprint label on all monitors
+        for handles in &all_handles {
+            lockscreen::show_fingerprint_label(handles, &fp_rc);
         }
 
-        // Publish the listener so hotplugged monitors get FP labels too
-        *shared_fp.borrow_mut() = Some(fp_rc);
+        // Start verification listener on the first monitor only
+        lockscreen::start_fingerprint(&all_handles[0], &fp_rc);
     });
 }
 
 #[cfg(debug_assertions)]
 fn activate_without_lock(
     app: &gtk::Application,
+    bg_texture: &gdk::Texture,
     config: &config::Config,
 ) {
-    let bg_texture = config::resolve_background_path(config)
-        .and_then(|path| lockscreen::load_background_texture(&path));
-
     let app_clone = app.clone();
     let unlock_callback: Rc<dyn Fn()> = Rc::new(move || {
         app_clone.quit();
@@ -221,7 +169,7 @@ fn activate_without_lock(
     let blur_cache = Rc::new(RefCell::new(None));
     let avatar_cache = Rc::new(RefCell::new(None));
     let handles = lockscreen::create_lockscreen_window(
-        bg_texture.as_ref(),
+        bg_texture,
         config,
         app,
         unlock_callback,
@@ -233,9 +181,7 @@ fn activate_without_lock(
 
     // Async fprintd initialization for development mode
     if config.fingerprint_enabled {
-        let all_handles = Rc::new(RefCell::new(vec![handles]));
-        let shared_fp = Rc::new(RefCell::new(None));
-        init_fingerprint_async(all_handles, shared_fp);
+        init_fingerprint_async(vec![handles]);
     }
 }
 
@@ -250,17 +196,11 @@ fn setup_logging() {
             eprintln!("Failed to create journal logger: {e}");
         }
     }
-    // Debug level is only selectable in debug builds. Release binaries ignore
-    // MOONLOCK_DEBUG so a session script cannot escalate log verbosity to leak
-    // fprintd / D-Bus internals into the journal.
-    #[cfg(debug_assertions)]
     let level = if std::env::var("MOONLOCK_DEBUG").is_ok() {
         log::LevelFilter::Debug
     } else {
         log::LevelFilter::Info
     };
-    #[cfg(not(debug_assertions))]
-    let level = log::LevelFilter::Info;
     log::set_max_level(level);
 }
 

src/users.rs

@@ -18,13 +18,7 @@ pub struct User {
 pub fn get_current_user() -> Option<User> {
     let uid = getuid();
     let nix_user = NixUser::from_uid(uid).ok()??;
-    let gecos = match nix_user.gecos.to_str() {
-        Ok(s) => s.to_string(),
-        Err(_) => {
-            log::warn!("GECOS field is not valid UTF-8, falling back to username");
-            String::new()
-        }
-    };
+    let gecos = nix_user.gecos.to_str().unwrap_or("").to_string();
     let display_name = if !gecos.is_empty() {
         let first = gecos.split(',').next().unwrap_or("");
         if first.is_empty() { nix_user.name.clone() } else { first.to_string() }
@@ -37,17 +31,13 @@ pub fn get_avatar_path(home: &Path, username: &str) -> Option<PathBuf> {
 }
 
 pub fn get_avatar_path_with(home: &Path, username: &str, accountsservice_dir: &Path) -> Option<PathBuf> {
-    // ~/.face takes priority — single stat via symlink_metadata to avoid TOCTOU
+    // ~/.face takes priority
     let face = home.join(".face");
-    if let Ok(meta) = face.symlink_metadata() {
-        if meta.is_file() && !meta.file_type().is_symlink() { return Some(face); }
-    }
+    if face.exists() && !face.is_symlink() { return Some(face); }
     // AccountsService icon
     if accountsservice_dir.exists() {
         let icon = accountsservice_dir.join(username);
-        if let Ok(meta) = icon.symlink_metadata() {
-            if meta.is_file() && !meta.file_type().is_symlink() { return Some(icon); }
-        }
+        if icon.exists() && !icon.is_symlink() { return Some(icon); }
     }
     None
 }