auth: add some more intelligent pam config resolution for lock screen

and greeter
related #2789

port: 1.5

quickshell/Modules/DankDash/Overview/CalendarEventDetail.qml

@@ -18,10 +18,9 @@ Item {
 
     readonly property bool _descriptionIsHtml: /<[a-z][^>]*>/i.test((eventData && eventData.description) || "")
 
-    // _locationUrl makes the location row clickable: the location itself when
-    // it is a URL, the meeting link when the event has one (conference
-    // events carry placeholder locations like "Microsoft Teams Meeting"),
-    // otherwise a geo: search (RFC 5870) so addresses open in the maps app.
+    // _locationUrl makes the location row clickable: a URL location opens
+    // directly, conference placeholders open the meeting link, and anything
+    // else opens as a geo: search in the maps app.
     function _locationUrl() {
         const loc = ((eventData && eventData.location) || "").trim();
         if (loc === "")
@@ -249,7 +248,21 @@ Item {
                             anchors.fill: parent
                             enabled: root._locationUrl() !== ""
                             cursorShape: enabled ? Qt.PointingHandCursor : Qt.ArrowCursor
-                            onClicked: Qt.openUrlExternally(root._locationUrl())
+                            // Qt.openUrlExternally can't handle geo: URIs, so
+                            // route those through the dankcal daemon's opener.
+                            onClicked: {
+                                const url = root._locationUrl();
+                                if (url.startsWith("geo:") && CalendarDankBackend.connected) {
+                                    CalendarDankBackend.sendRequest("system.openUri", {
+                                        "uri": url
+                                    }, response => {
+                                        if (response && response.error)
+                                            Qt.openUrlExternally(url);
+                                    });
+                                    return;
+                                }
+                                Qt.openUrlExternally(url);
+                            }
                         }
                     }
                 }

quickshell/Modules/Lock/Pam.qml

@@ -111,14 +111,60 @@ Scope {
         printErrors: false
     }
 
+    // Fallback stack written by `dms auth resolve-lock` when no managed
+    // /etc/pam.d/dankshell exists. See #2789.
+    readonly property string userPamDir: Paths.strip(Paths.state) + "/pam"
+
+    FileView {
+        id: userPamWatcher
+
+        path: root.userPamDir + "/dankshell"
+        printErrors: false
+    }
+
+    Process {
+        id: resolveUserPam
+
+        command: ["dms", "auth", "resolve-lock", "--quiet"]
+        running: false
+        onExited: exitCode => {
+            if (exitCode === 0)
+                userPamWatcher.reload();
+        }
+    }
+
+    function ensureUserPamConfig(): void {
+        if (root.runningFromNixStore || resolveUserPam.running)
+            return;
+        resolveUserPam.running = true;
+    }
+
+    Component.onCompleted: ensureUserPamConfig()
+
     // Detects Nix-installed DMS on non-NixOS systems
     readonly property bool runningFromNixStore: Quickshell.shellDir.startsWith("/nix/store/")
 
     PamContext {
         id: passwd
 
-        config: dankshellConfigWatcher.loaded ? "dankshell" : "login"
-        configDirectory: (dankshellConfigWatcher.loaded || nixosMarker.loaded || root.runningFromNixStore) ? "/etc/pam.d" : Quickshell.shellDir + "/assets/pam"
+        config: {
+            if (dankshellConfigWatcher.loaded)
+                return "dankshell";
+            if (nixosMarker.loaded || root.runningFromNixStore)
+                return "login";
+            if (userPamWatcher.loaded)
+                return "dankshell";
+            return "login";
+        }
+        configDirectory: {
+            if (dankshellConfigWatcher.loaded)
+                return "/etc/pam.d";
+            if (nixosMarker.loaded || root.runningFromNixStore)
+                return "/etc/pam.d";
+            if (userPamWatcher.loaded)
+                return root.userPamDir;
+            return Quickshell.shellDir + "/assets/pam";
+        }
 
         onMessageChanged: {
             // collected by position, not text, so it works in any locale
@@ -415,6 +461,8 @@ Scope {
         root.attemptInfoMessages = [];
         root.lockoutAnnouncedThisAttempt = false;
         root.resetAuthFlows();
+        if (!dankshellConfigWatcher.loaded && !nixosMarker.loaded && !userPamWatcher.loaded)
+            ensureUserPamConfig();
         fprint.checkAvail();
         u2f.checkAvail();
     }