/*

 * /net/reactivated/Fprint/Device/foo object implementation

 * Copyright (C) 2008 Daniel Drake <dsd@gentoo.org>

 * Copyright (C) 2020 Marco Trevisan <marco.trevisan@canonical.com>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License along

 * with this program; if not, write to the Free Software Foundation, Inc.,

 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

 */

#include "config.h"

#include <glib/gi18n.h>

#include <gio/gio.h>

#include <polkit/polkit.h>

#include <fprint.h>

#include <sys/types.h>

#include <pwd.h>

#include <errno.h>

#include "fprintd.h"

#include "storage.h"

static const char *FINGERS_NAMES[] = {

  [FP_FINGER_UNKNOWN]      = "unknown",

  [FP_FINGER_LEFT_THUMB]   = "left-thumb",

  [FP_FINGER_LEFT_INDEX]   = "left-index-finger",

  [FP_FINGER_LEFT_MIDDLE]  = "left-middle-finger",

  [FP_FINGER_LEFT_RING]    = "left-ring-finger",

  [FP_FINGER_LEFT_LITTLE]  = "left-little-finger",

  [FP_FINGER_RIGHT_THUMB]  = "right-thumb",

  [FP_FINGER_RIGHT_INDEX]  = "right-index-finger",

  [FP_FINGER_RIGHT_MIDDLE] = "right-middle-finger",

  [FP_FINGER_RIGHT_RING]   = "right-ring-finger",

  [FP_FINGER_RIGHT_LITTLE] = "right-little-finger"

};

static void fprint_device_dbus_skeleton_iface_init (FprintDBusDeviceIface *);

static gboolean action_authorization_handler (GDBusInterfaceSkeleton *,

                                              GDBusMethodInvocation *,

                                              gpointer user_data);

static GQuark quark_auth_user = 0;

typedef enum {

  ACTION_NONE = 0,

  ACTION_IDENTIFY,

  ACTION_VERIFY,

  ACTION_ENROLL,

  ACTION_OPEN,

  ACTION_CLOSE,

  ACTION_DELETE,

} FprintDeviceAction;

typedef enum {

  STATE_CLAIMED,

  STATE_UNCLAIMED,

  STATE_AUTO_CLAIM,

  STATE_ANYTIME,

} FprintDeviceClaimState;

typedef struct

{

  volatile gint _refcount;

  /* current method invocation */

  GDBusMethodInvocation *invocation;

  /* The current user of the device, if claimed */

  const char * const sender;

  /* The current user of the device, or if allowed,

   * what was passed as a username argument */

  const char * const username;

  gboolean           verify_status_reported;

} SessionData;

typedef struct

{

  guint32          id;

  FpDevice        *dev;

  SessionData     *_session;

  PolkitAuthority *auth;

  /* Hashtable of connected clients */

  GHashTable *clients;

  /* Required to restart the operation on a retry failure. */

  FpPrint   *verify_data;

  GPtrArray *identify_data;

  int        enroll_data;

  /* whether we're running an identify, or a verify */

  FprintDeviceAction     current_action;

  GCancellable          *current_cancellable;

  GDBusMethodInvocation *current_cancel_invocation;

} FprintDevicePrivate;

G_DEFINE_TYPE_WITH_CODE (FprintDevice, fprint_device,

                         FPRINT_DBUS_TYPE_DEVICE_SKELETON,

                         G_ADD_PRIVATE (FprintDevice)

                         G_IMPLEMENT_INTERFACE (FPRINT_DBUS_TYPE_DEVICE,

                                                fprint_device_dbus_skeleton_iface_init));

enum fprint_device_properties {

  FPRINT_DEVICE_CONSTRUCT_DEV = 1,

  FPRINT_DEVICE_IN_USE,

  FPRINT_DEVICE_NAME,

  FPRINT_DEVICE_NUM_ENROLL,

  FPRINT_DEVICE_SCAN_TYPE

};

enum fprint_device_signals {

  SIGNAL_VERIFY_STATUS,

  SIGNAL_VERIFY_FINGER_SELECTED,

  SIGNAL_ENROLL_STATUS,

  NUM_SIGNALS,

};

static guint32 last_id = ~0;

static guint signals[NUM_SIGNALS] = { 0, };

#ifndef POLKIT_HAS_AUTOPOINTERS

/* FIXME: Remove this once we're fine to depend on polkit 0.114 */

G_DEFINE_AUTOPTR_CLEANUP_FUNC (PolkitAuthorizationResult, g_object_unref)

G_DEFINE_AUTOPTR_CLEANUP_FUNC (PolkitSubject, g_object_unref)

#endif

static void

session_data_unref (SessionData *session)

{

  if (g_atomic_int_dec_and_test (&session->_refcount))

    {

      g_clear_pointer ((char **) &session->sender, g_free);

      g_clear_pointer ((char **) &session->username, g_free);

      g_clear_object (&session->invocation);

      g_free (session);

    }

}

G_DEFINE_AUTOPTR_CLEANUP_FUNC (SessionData, session_data_unref);

static SessionData *

session_data_get (FprintDevicePrivate *priv)

{

  SessionData *invalid = (SessionData *) &priv->_session;

  SessionData *cur;

  /* Get the current pointer and mark the pointer as "busy". */

  do

    {

      cur = priv->_session;

      /* Swap if cur is valid, otherwise busy loop. */

    }

  while (cur == invalid || !g_atomic_pointer_compare_and_exchange (&priv->_session, cur, invalid));

  /* We can safely increase the reference count now. */

  if (cur)

    g_atomic_int_inc (&cur->_refcount);

  /* Swap back, this must succeed. */

  if (!g_atomic_pointer_compare_and_exchange (&priv->_session, invalid, cur))

    g_assert_not_reached ();

  return cur;

}

/* Pass NULL sender and username to unset session data. */

static SessionData *

session_data_set_new (FprintDevicePrivate *priv, gchar *sender, gchar *username)

{

  SessionData *invalid = (SessionData *) &priv->_session;

  SessionData *new = NULL;

  SessionData *old;

  g_assert ((!sender && !username) || (sender && username));

  if (sender)

    {

      new = g_new0 (SessionData, 1);

      /* Internal reference of the pointer and returned reference. */

      new->_refcount = 2;

      *(char **) &new->sender = sender;

      *(char **) &new->username = username;

    }

  /* Get the current (but not if it is busy) and put the new one in place. */

  do

    {

      old = priv->_session;

      /* Swap if old is valid, otherwise busy loop as someone is ref'ing it currently. */

    }

  while (old == invalid || !g_atomic_pointer_compare_and_exchange (&priv->_session, old, new));

  /* We can safely drop the our internal reference now. */

  if (old)

    session_data_unref (old);

  return new;

}

static void

fprint_device_dispose (GObject *object)

{

  FprintDevice *self = (FprintDevice *) object;

  FprintDevicePrivate *priv = fprint_device_get_instance_private (self);

  g_hash_table_remove_all (priv->clients);

  G_OBJECT_CLASS (fprint_device_parent_class)->dispose (object);

}

static void

fprint_device_finalize (GObject *object)

{

  FprintDevice *self = (FprintDevice *) object;

  FprintDevicePrivate *priv = fprint_device_get_instance_private (self);

  g_hash_table_destroy (priv->clients);

  session_data_set_new (priv, NULL, NULL);

  g_clear_object (&priv->auth);

  g_clear_object (&priv->dev);

  if (priv->current_action != ACTION_NONE ||

      priv->_session ||

      priv->verify_data ||

      priv->identify_data ||

      priv->current_cancellable ||

      priv->current_cancel_invocation)

    g_critical ("Device was not cleaned up properly before being finalized.");

  G_OBJECT_CLASS (fprint_device_parent_class)->finalize (object);

}

static void

fprint_device_set_property (GObject *object, guint property_id,

                            const GValue *value, GParamSpec *pspec)

{

  FprintDevice *self = (FprintDevice *) object;

  FprintDevicePrivate *priv = fprint_device_get_instance_private (self);

  switch (property_id)

    {

    case FPRINT_DEVICE_CONSTRUCT_DEV:

      priv->dev = g_value_dup_object (value);

      break;

    default:

      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, property_id, pspec);

      break;

    }

}

static void

fprint_device_get_property (GObject *object, guint property_id,

                            GValue *value, GParamSpec *pspec)

{

  FprintDevice *self = (FprintDevice *) object;

  FprintDevicePrivate *priv = fprint_device_get_instance_private (self);

  switch (property_id)

    {

    case FPRINT_DEVICE_CONSTRUCT_DEV:

      g_value_set_object (value, priv->dev);

      break;

    case FPRINT_DEVICE_IN_USE:

      g_value_set_boolean (value, g_hash_table_size (priv->clients) != 0);

      break;

    case FPRINT_DEVICE_NAME:

      g_value_set_static_string (value, fp_device_get_name (priv->dev));

      break;

    case FPRINT_DEVICE_NUM_ENROLL:

      if (priv->dev)

        g_value_set_int (value, fp_device_get_nr_enroll_stages (priv->dev));

      else

        g_value_set_int (value, -1);

      break;

    case FPRINT_DEVICE_SCAN_TYPE: {

        const char *type;

        if (fp_device_get_scan_type (priv->dev) == FP_SCAN_TYPE_PRESS)

          type = "press";

        else

          type = "swipe";

        g_value_set_static_string (value, type);

        break;

      }

    default:

      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, property_id, pspec);

      break;

    }

}

static void

fprint_device_class_init (FprintDeviceClass *klass)

{

  GObjectClass *gobject_class = G_OBJECT_CLASS (klass);

  GParamSpec *pspec;

  gobject_class->dispose = fprint_device_dispose;

  gobject_class->finalize = fprint_device_finalize;

  gobject_class->set_property = fprint_device_set_property;

  gobject_class->get_property = fprint_device_get_property;

  pspec = g_param_spec_object ("dev", "Device",

                               "Set device construction property",

                               FP_TYPE_DEVICE,

                               G_PARAM_CONSTRUCT_ONLY | G_PARAM_WRITABLE | G_PARAM_READABLE);

  g_object_class_install_property (gobject_class,

                                   FPRINT_DEVICE_CONSTRUCT_DEV, pspec);

  pspec = g_param_spec_boolean ("in-use", "In use",

                                "Whether the device is currently in use", FALSE,

                                G_PARAM_READABLE);

  g_object_class_install_property (gobject_class,

                                   FPRINT_DEVICE_IN_USE, pspec);

  g_object_class_override_property (gobject_class,

                                    FPRINT_DEVICE_NAME,

                                    "name");

  g_object_class_override_property (gobject_class,

                                    FPRINT_DEVICE_SCAN_TYPE,

                                    "scan-type");

  g_object_class_override_property (gobject_class,

                                    FPRINT_DEVICE_NUM_ENROLL,

                                    "num-enroll-stages");

  signals[SIGNAL_VERIFY_STATUS] =

    g_signal_lookup ("verify-status", FPRINT_TYPE_DEVICE);

  signals[SIGNAL_ENROLL_STATUS] =

    g_signal_lookup ("enroll-status", FPRINT_TYPE_DEVICE);

  signals[SIGNAL_VERIFY_FINGER_SELECTED] =

    g_signal_lookup ("verify-finger-selected", FPRINT_TYPE_DEVICE);

  quark_auth_user = g_quark_from_static_string ("authorized-user");

}

static void

_unwatch_name (gpointer id)

{

  g_bus_unwatch_name (GPOINTER_TO_INT (id));

}

static void

fprint_device_init (FprintDevice *device)

{

  FprintDevicePrivate *priv = fprint_device_get_instance_private (device);

  priv->id = ++last_id;

  /* Setup PolicyKit */

  priv->auth = polkit_authority_get_sync (NULL, NULL);

  priv->clients = g_hash_table_new_full (g_str_hash,

                                         g_str_equal,

                                         g_free,

                                         _unwatch_name);

  g_signal_connect (device, "g-authorize-method",

                    G_CALLBACK (action_authorization_handler),

                    NULL);

}

FprintDevice *

fprint_device_new (FpDevice *dev)

{

  return g_object_new (FPRINT_TYPE_DEVICE, "dev", dev, NULL);

}

guint32

_fprint_device_get_id (FprintDevice *rdev)

{

  FprintDevicePrivate *priv = fprint_device_get_instance_private (rdev);

  return priv->id;

}

static const char *

fp_finger_to_name (FpFinger finger)

{

  if (finger == FP_FINGER_UNKNOWN)

    return "any";

  if (!FP_FINGER_IS_VALID (finger))

    return NULL;

  return FINGERS_NAMES[finger];

}

static FpFinger

finger_name_to_fp_finger (const char *finger_name)

{

  FpFinger i;

  if (finger_name == NULL || *finger_name == '\0' || g_str_equal (finger_name, "any"))

    return FP_FINGER_UNKNOWN;

  for (i = FP_FINGER_FIRST; i <= FP_FINGER_LAST; i++)

    if (g_str_equal (finger_name, FINGERS_NAMES[i]))

      return i;

  /* Invalid, let's try that */

  return FP_FINGER_UNKNOWN;

}

static const char *

verify_result_to_name (gboolean match, GError *error)

{

  if (!error)

    {

      if (match)

        return "verify-match";

      else

        return "verify-no-match";

    }

  if (error->domain == FP_DEVICE_RETRY)

    {

      switch (error->code)

        {

        case FP_DEVICE_RETRY_TOO_SHORT:

          return "verify-swipe-too-short";

        case FP_DEVICE_RETRY_CENTER_FINGER:

          return "verify-finger-not-centered";

        case FP_DEVICE_RETRY_REMOVE_FINGER:

          return "verify-remove-and-retry";

        default:

          return "verify-retry-scan";

        }

    }

  else

    {

      /* Which errors should be mapped to disconnection?

       * Are drivers/libfprint/fprintd really in agreement here?

       */

      if (g_error_matches (error, FP_DEVICE_ERROR, FP_DEVICE_ERROR_PROTO))

        return "verify-disconnected";

      else if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))

        return "verify-no-match";

      return "verify-unknown-error";

    }

}

static const char *

enroll_result_to_name (gboolean completed, gboolean enrolled, GError *error)

{

  if (!error)

    {

      if (!completed)

        return "enroll-stage-passed";

      else if (enrolled)

        return "enroll-completed";

      else

        return "enroll-failed";

    }

  if (error->domain == FP_DEVICE_RETRY)

    {

      switch (error->code)

        {

        case FP_DEVICE_RETRY_TOO_SHORT:

          return "enroll-swipe-too-short";

        case FP_DEVICE_RETRY_CENTER_FINGER:

          return "enroll-finger-not-centered";

        case FP_DEVICE_RETRY_REMOVE_FINGER:

          return "enroll-remove-and-retry";

        default:

          return "enroll-retry-scan";

        }

    }

  else

    {

      /* Which errors should be mapped to disconnection?

       * Are drivers/libfprint/fprintd really in agreement here?

       */

      if (g_error_matches (error, FP_DEVICE_ERROR, FP_DEVICE_ERROR_PROTO))

        return "enroll-disconnected";

      else if (g_error_matches (error, FP_DEVICE_ERROR, FP_DEVICE_ERROR_DATA_FULL))

        return "enroll-data-full";

      else if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))

        return "enroll-failed";

      return "enroll-unknown-error";

    }

}

static FprintDevicePermission

get_permissions_for_invocation (GDBusMethodInvocation *invocation)

{

  FprintDevicePermission required_perms;

  const char *method_name;

  required_perms = FPRINT_DEVICE_PERMISSION_NONE;

  method_name = g_dbus_method_invocation_get_method_name (invocation);

  if (g_str_equal (method_name, "Claim"))

    {

      required_perms |= FPRINT_DEVICE_PERMISSION_VERIFY;

      required_perms |= FPRINT_DEVICE_PERMISSION_ENROLL;

    }

  else if (g_str_equal (method_name, "DeleteEnrolledFingers"))

    {

      required_perms |= FPRINT_DEVICE_PERMISSION_ENROLL;

    }

  else if (g_str_equal (method_name, "DeleteEnrolledFingers2"))

    {

      required_perms |= FPRINT_DEVICE_PERMISSION_ENROLL;

    }

  else if (g_str_equal (method_name, "EnrollStart"))

    {

      required_perms |= FPRINT_DEVICE_PERMISSION_ENROLL;

    }

  else if (g_str_equal (method_name, "ListEnrolledFingers"))

    {

      required_perms |= FPRINT_DEVICE_PERMISSION_VERIFY;

    }

  else if (g_str_equal (method_name, "VerifyStart"))

    {

      required_perms |= FPRINT_DEVICE_PERMISSION_VERIFY;

    }

  else if (g_str_equal (method_name, "Release"))

    {

    }

  else if (g_str_equal (method_name, "EnrollStop"))

    {

    }

  else if (g_str_equal (method_name, "VerifyStop"))

    {

      /* Don't require permissiong for for release/stop operations.

       * We are authenticated already if we could start, and we don't

       * want to end up authorizing interactively again.

       */

    }

  else

    {

      g_assert_not_reached ();

    }

  return required_perms;

}

static FprintDeviceClaimState

get_claim_state_for_invocation (GDBusMethodInvocation *invocation)

{

  const char *method_name;

  method_name = g_dbus_method_invocation_get_method_name (invocation);

  if (g_str_equal (method_name, "Claim"))

    return STATE_UNCLAIMED;

  else if (g_str_equal (method_name, "DeleteEnrolledFingers"))

    return STATE_AUTO_CLAIM;

  else if (g_str_equal (method_name, "ListEnrolledFingers"))

    return STATE_ANYTIME;

  return STATE_CLAIMED;

}

static gboolean

_fprint_device_check_claimed (FprintDevice          *rdev,

                              GDBusMethodInvocation *invocation,

                              GError               **error)

{

  FprintDevicePrivate *priv = fprint_device_get_instance_private (rdev);

  g_autoptr(SessionData) session = NULL;

  FprintDeviceClaimState requested_state;

  const char *sender;

  requested_state = get_claim_state_for_invocation (invocation);

  if (requested_state == STATE_ANYTIME)

    return TRUE;

  session = session_data_get (priv);

  if (requested_state == STATE_AUTO_CLAIM)

    requested_state = session ? STATE_CLAIMED : STATE_UNCLAIMED;

  if (requested_state == STATE_UNCLAIMED)

    {

      /* Is it already claimed? */

      if (!session)

        return TRUE;

      g_set_error (error, FPRINT_ERROR, FPRINT_ERROR_ALREADY_IN_USE,

                   "Device was already claimed");

      return FALSE;

    }

  g_assert (requested_state == STATE_CLAIMED);

  /* The device wasn't claimed, exit */

  if (session == NULL)

    {

      g_set_error (error, FPRINT_ERROR, FPRINT_ERROR_CLAIM_DEVICE,

                   _("Device was not claimed before use"));

      return FALSE;

    }

  sender = g_dbus_method_invocation_get_sender (invocation);

  if (!g_str_equal (sender, session->sender) || session->invocation != NULL)

    {

      g_set_error (error, FPRINT_ERROR, FPRINT_ERROR_ALREADY_IN_USE,

                   _("Device already in use by another user"));

      return FALSE;

    }

  return TRUE;

}

static gboolean

_fprint_device_check_polkit_for_action (FprintDevice          *rdev,

                                        GDBusMethodInvocation *invocation,

                                        const char            *action,

                                        GError               **error)

{

  FprintDevicePrivate *priv = fprint_device_get_instance_private (rdev);

  const char *sender;

  g_autoptr(GError) local_error = NULL;

  g_autoptr(PolkitAuthorizationResult) result = NULL;

  g_autoptr(PolkitSubject) subject = NULL;

  /* Check that caller is privileged */

  sender = g_dbus_method_invocation_get_sender (invocation);

  subject = polkit_system_bus_name_new (sender);

  result = polkit_authority_check_authorization_sync (priv->auth,

                                                      subject,

                                                      action,

                                                      NULL,

                                                      POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION,

                                                      NULL, &local_error);

  if (result == NULL)

    {

      g_set_error (error, FPRINT_ERROR,

                   FPRINT_ERROR_PERMISSION_DENIED,

                   "Not Authorized: %s", local_error->message);

      return FALSE;

    }

  if (!polkit_authorization_result_get_is_authorized (result))

    {

      g_set_error (error, FPRINT_ERROR,

                   FPRINT_ERROR_PERMISSION_DENIED,

                   "Not Authorized: %s", action);

      return FALSE;

    }

  return TRUE;

}

static gboolean

fprint_device_check_polkit_for_permissions (FprintDevice          *rdev,

                                            GDBusMethodInvocation *invocation,

                                            FprintDevicePermission permissions,

                                            GError               **error)

{

  g_autoptr(GFlagsClass) permission_flags = NULL;

  unsigned i;

  if (permissions == FPRINT_DEVICE_PERMISSION_NONE)

    return TRUE;

  permission_flags = g_type_class_ref (FPRINT_TYPE_DEVICE_PERMISSION);

  for (i = 0; i < permission_flags->n_values; ++i)

    {

      GFlagsValue *value = &permission_flags->values[i];

      const char *action;

      if (!(value->value & permissions))

        continue;

      action = value->value_nick;

      g_debug ("Getting authorization to perform Polkit action %s",

               action);

      g_clear_error (error);

      if (_fprint_device_check_polkit_for_action (rdev, invocation,

                                                  action, error))

        return TRUE;

    }

  g_assert (!error || *error);

  return FALSE;

}

static char *

_fprint_device_check_for_username (FprintDevice          *rdev,

                                   GDBusMethodInvocation *invocation,

                                   const char            *username,

                                   GError               **error)

{

  g_autoptr(GVariant) ret = NULL;

  g_autoptr(GError) local_error = NULL;

  GDBusConnection *connection;

  const char *sender;

  struct passwd *user;

  guint32 uid;

  /* Get details about the current sender, and username/uid */

  connection = g_dbus_method_invocation_get_connection (invocation);

  sender = g_dbus_method_invocation_get_sender (invocation);

  ret = g_dbus_connection_call_sync (connection,

                                     "org.freedesktop.DBus",

                                     "/org/freedesktop/DBus",

                                     "org.freedesktop.DBus",

                                     "GetConnectionUnixUser",

                                     g_variant_new ("(s)", sender),

                                     NULL, G_DBUS_CALL_FLAGS_NONE, -1,

                                     NULL, &local_error);

  if (!ret)

    {

      g_set_error (error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,

                   "Could not get conection unix user ID: %s",

                   local_error->message);

      return NULL;

    }

  g_variant_get (ret, "(u)", &uid);

  user = getpwuid (uid);

  if (user == NULL)

    {

      g_set_error (error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,

                   "Failed to get information about user UID %u", uid);

      return NULL;

    }

  /* The current user is usually allowed to access their

   * own data, this should be followed by PolicyKit checks

   * anyway */

  if (username == NULL || *username == '\0' || g_str_equal (username, user->pw_name))

    return g_strdup (user->pw_name);

  /* If we're not allowed to set a different username,

   * then fail */

  if (!fprint_device_check_polkit_for_permissions (rdev, invocation,

                                                   FPRINT_DEVICE_PERMISSION_SETUSERNAME,

                                                   error))

    return NULL;

  return g_strdup (username);

}

static void

_fprint_device_client_vanished (GDBusConnection *connection,

                                const char      *name,

                                FprintDevice    *rdev)

{

  g_autoptr(GError) error = NULL;

  g_autoptr(SessionData) session = NULL;

  FprintDevicePrivate *priv = fprint_device_get_instance_private (rdev);

  session = session_data_get (priv);

  /* Was that the client that claimed the device? */

  if (session != NULL &&

      g_strcmp0 (session->sender, name) == 0)

    {

      while (priv->current_action != ACTION_NONE)

        {

          /* OPEN/CLOSE are not cancellable, we just need to wait */

          if (priv->current_cancellable)

            g_cancellable_cancel (priv->current_cancellable);

          g_main_context_iteration (NULL, TRUE);

        }

      /* The session may have disappeared at this point if the device

       * was already closing. */

      g_clear_pointer (&session, session_data_unref);

      session = session_data_get (priv);

      if (session && !fp_device_close_sync (priv->dev, NULL, &error))

        g_critical ("Error closing device after disconnect: %s", error->message);

      session_data_set_new (priv, NULL, NULL);

    }

  g_hash_table_remove (priv->clients, name);

  if (g_hash_table_size (priv->clients) == 0)

    g_object_notify (G_OBJECT (rdev), "in-use");

}

static void

_fprint_device_add_client (FprintDevice *rdev, const char *sender)

{

  FprintDevicePrivate *priv = fprint_device_get_instance_private (rdev);

  guint id;

  id = GPOINTER_TO_UINT (g_hash_table_lookup (priv->clients, sender));

  if (id == 0)

    {

      id = g_bus_watch_name (G_BUS_TYPE_SYSTEM,

                             sender,

                             G_BUS_NAME_WATCHER_FLAGS_NONE,

                             NULL,

                             (GBusNameVanishedCallback) _fprint_device_client_vanished,

                             rdev,

                             NULL);

      g_hash_table_insert (priv->clients, g_strdup (sender), GUINT_TO_POINTER (id));

      g_object_notify (G_OBJECT (rdev), "in-use");

    }

}

static void

dev_open_cb (FpDevice *dev, GAsyncResult *res, void *user_data)

{

  g_autoptr(GError) error = NULL;

  FprintDevice *rdev = user_data;

  FprintDevicePrivate *priv = fprint_device_get_instance_private (rdev);

  g_autoptr(SessionData) session = NULL;

  g_autoptr(GDBusMethodInvocation) invocation = NULL;

  session = session_data_get (priv);

  invocation = g_steal_pointer (&session->invocation);

  priv->current_action = ACTION_NONE;

  if (!fp_device_open_finish (dev, res, &error))

    {

      g_autoptr(GError) dbus_error = NULL;

      dbus_error = g_error_new (FPRINT_ERROR,

                                FPRINT_ERROR_INTERNAL,

                                "Open failed with error: %s", error->message);

      g_dbus_method_invocation_return_gerror (invocation, dbus_error);

      session_data_set_new (priv, NULL, NULL);

      return;

    }

  g_debug ("claimed device %d", priv->id);

  fprint_dbus_device_complete_claim (FPRINT_DBUS_DEVICE (rdev),

                                     invocation);

}

static gboolean

fprintd_device_authorize_user (FprintDevice          *rdev,

                               GDBusMethodInvocation *invocation,

                               GError               **error)

{

  GVariant *params = NULL;

  const char *username = NULL;

  g_autofree char *user = NULL;

  params = g_dbus_method_invocation_get_parameters (invocation);

  g_assert (g_variant_n_children (params) == 1);

  g_variant_get (params, "(&s)", &username);

  g_assert (username);

  user = _fprint_device_check_for_username (rdev,

                                            invocation,

                                            username,