From f73740ff07c9d6592be171020da329776849b7d8 Mon Sep 17 00:00:00 2001
From: Eduardo Escobar <8128376+e2escobar@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:04:47 -0500
Subject: [PATCH] Blank the lock screen while the fingerprint reader waits
 (#6817)

The blank timer was gated on `authenticating`, which is
`authenticatingPassword || fingerprintAuthenticating`. The fingerprint
PAM sits armed for the entire lock waiting for a finger, so on any
machine with a reader enrolled the gate is true from lock until unlock:
the timer is stopped when the lock begins and never re-armed, and the
display stays lit indefinitely.

Gate on `authenticatingPassword` instead. A password check in flight
still holds the display up, and the passive fingerprint wait no longer
does.


Claude-Session: https://claude.ai/code/session_01EDpyC9793TKZBS2jXUNECG

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 shell/plugins/lock/Service.qml              |  9 ++++--
 test/shell.d/lock-blank-fingerprint-test.sh | 33 +++++++++++++++++++++
 2 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100755 test/shell.d/lock-blank-fingerprint-test.sh

diff --git a/shell/plugins/lock/Service.qml b/shell/plugins/lock/Service.qml
index 84203a8f..9ecb1cc0 100644
--- a/shell/plugins/lock/Service.qml
+++ b/shell/plugins/lock/Service.qml
@@ -424,7 +424,10 @@ Item {
         root.armBlankTimer()
         return
       }
-      if (root.lockRequested && !root.authenticating) root.runBlank()
+      // Only a password check in flight should hold the display up. The
+      // fingerprint PAM stays armed for the whole lock, so gating on
+      // `authenticating` here would keep the panel lit until unlock.
+      if (root.lockRequested && !root.authenticatingPassword) root.runBlank()
     }
   }
 
@@ -472,9 +475,9 @@ Item {
     }
   }
 
-  onAuthenticatingChanged: {
+  onAuthenticatingPasswordChanged: {
     if (!lockRequested) return
-    if (authenticating) idleBlankTimer.stop()
+    if (authenticatingPassword) idleBlankTimer.stop()
     else armBlankTimer()
   }
 
diff --git a/test/shell.d/lock-blank-fingerprint-test.sh b/test/shell.d/lock-blank-fingerprint-test.sh
new file mode 100755
index 00000000..1c9cd9d6
--- /dev/null
+++ b/test/shell.d/lock-blank-fingerprint-test.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+run_node_test <<'JS'
+const fs = require('fs')
+const serviceQml = fs.readFileSync(path.join(root, 'shell/plugins/lock/Service.qml'), 'utf8')
+
+// The fingerprint PAM stays armed for the whole lock waiting for a finger, so
+// `authenticating` is true from lock until unlock on every machine with a
+// reader enrolled. Gating the blank on it leaves the panel lit all night.
+assert(
+  /if \(root\.lockRequested && !root\.authenticatingPassword\) root\.runBlank\(\)/.test(serviceQml),
+  'only a password check in flight stops the blank timer from blanking'
+)
+
+assert(
+  !/idleBlankTimer[\s\S]*?!root\.authenticating\)/.test(serviceQml),
+  'the blank timer never gates on the combined authenticating state'
+)
+
+assert(
+  /onAuthenticatingPasswordChanged: \{\s*if \(!lockRequested\) return\s*if \(authenticatingPassword\) idleBlankTimer\.stop\(\)\s*else armBlankTimer\(\)/.test(serviceQml),
+  'the blank timer is held off by password entry and re-armed when it finishes'
+)
+
+assert(
+  !/onAuthenticatingChanged:/.test(serviceQml),
+  'the combined authenticating state no longer drives the blank timer'
+)
+JS