feat: support automatic login for user sessions

[glyvut]

Add autologin support with dedicated ddm-autologin PAM service and nopasswdlogin group for passwordless login.

新增自动登录功能：提供独立的ddm-autologin PAM服务，并通过
nopasswdlogin用户组支持免密登录。重构Display登录流程，提取
startUserSession()复用会话启动逻辑，登录时根据配置决定直接
自动登录或显示登录界面。

Log: 支持用户自动登录
Influence: 配置Autologin后可跳过登录界面直接进入桌面；nopasswdlogin组成员可免密登录。

Summary by Sourcery

Enable configurable passwordless automatic login while preserving the existing greeter-based login flow.

New Features:

• Add configurable automatic user login with selectable sessions and passwordless authentication for members of the dedicated login group.

Enhancements:

• Refactor user-session startup into reusable logic for regular and automatic login flows.
• Show the greeter only when automatic login is disabled or unsuccessful, and limit automatic login attempts to the initial display connection.

Build:

• Install dedicated ddm-autologin PAM service configurations on Debian-based and other systems.

[deepin-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[sourcery-ai]

Reviewer's Guide

Adds an automatic user login feature by introducing a dedicated ddm‑autologin PAM service, new autologin configuration options, and refactoring the display login flow to reuse a shared session-start routine that supports both normal and passwordless login paths.

Sequence diagram for automatic login vs showing greeter

sequenceDiagram
    actor Greeter
    participant Display
    participant Auth
    participant Pam_ddm_autologin

    Greeter->>Display: connected(socket)
    Display->>Display: check auths for active sessions
    alt [no active user] and [Autologin.User set] and [Autologin.Timeout == 0]
        Display->>Display: startAutologin()
        Display->>Auth: new Auth(this, user)
        Display->>Auth: set pamService = ddm-autologin
        Auth->>Pam_ddm_autologin: authenticate(QByteArray())
        Pam_ddm_autologin-->>Auth: success/failure
        alt [authentication success]
            Display->>Display: startUserSession(auth, session)
            Display-->>Greeter: (no message, greeter stays hidden)
        else [authentication failed or session start failed]
            Display-->>Greeter: ShowGreeter
        end
    else other cases
        Display-->>Greeter: ShowGreeter
    end

Loading

File-Level Changes

Change	Details	Files
Introduce dedicated PAM service and system user configuration for passwordless autologin.	Install ddm-autologin PAM file alongside existing ddm PAM service for both Debian and non-Debian systems Add new ddm-autologin PAM configuration file defining passwordless authentication behavior Extend sysuser config templates to support nopasswdlogin group or related system user setup Adjust existing ddm PAM configs to integrate with autologin and nopasswdlogin behavior	services/CMakeLists.txt services/ddm-autologin.pam services/ddm-sysuser.conf.in services/debian.ddm-sysuser.conf.in services/ddm.pam services/debian.ddm.pam
Add configurable autologin options to the main configuration schema.	Introduce Autologin section with User, Session, Timeout, and InBackground entries Provide defaults and descriptions for new autologin-related config keys	src/common/Configuration.h
Extend daemon messaging to let the greeter know when to show the login screen versus autologin.	Add ShowGreeter message type to daemon messages enum Use ShowGreeter in display connection logic to instruct the greeter to present the login UI when autologin is not used or fails	src/common/Messages.h src/daemon/Display.cpp
Allow Auth to select PAM service dynamically and support autologin service.	Add pamService member to Auth with default "ddm" Change authentication startup to call pam_start with configurable pamService instead of hard-coded service name	src/daemon/Auth.h src/daemon/Auth.cpp
Refactor session startup logic and implement autologin flow in Display.	Extract session validation, VT allocation, display server startup, and logind registration into new startUserSession(Auth*, const Session&) helper returning success/failure Update existing login path to call startUserSession and emit loginFailed on failure Introduce startAutologin() which reads Autologin config, resolves the session, creates an Auth using ddm-autologin PAM service, runs passwordless authentication, saves last user/session, and starts the session via startUserSession Update Display::connected to check for active users and, when none, attempt immediate autologin according to Autologin.Timeout and User; on failure, send ShowGreeter to the greeter Fix logging and VT allocation calls to consistently use auth->user instead of a separate user variable	src/daemon/Display.cpp src/daemon/Display.h

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Sorry @glyvut, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[deepin-wm]

PR 审查结果

对 treeland #1305 + ddm #106 的联合审查中，ddm 部分的审查结论如下。整体方案连贯，无阻断性问题。

交互流程验证

三条路径均自洽：

• 自动登录成功：ddm connected() → startAutologin() → startUserSession() → activateSession() → TreelandDisplayServer::activateUser() 发送 UserActivateMessage → treeland 隐藏 greeter。✓
• 自动登录未启用/失败：ddm connected() 发送 ShowGreeter → treeland showLockScreen(false) 显示登录界面。✓
• DDM 超时/崩溃：treeland 5s 兜底定时器 → lock() → setLock(true) 显示登录界面。✓

设计合理的部分

• startUserSession() / startAutologin() 提取重构清晰，登录与自动登录复用会话启动逻辑。
• ddm-autologin PAM 使用 pam_permit.so + pam_succeed_if.so shell notin /sbin/nologin + pam_nologin.so，适合管理员配置的自动登录场景。
• nopasswdlogin 组加入 sysuser 配置；常规 ddm/debian.ddm PAM 新增 pam_succeed_if.so user ingroup nopasswdlogin sufficient 用于交互式免密登录。两条路径分离清晰。
• m_connectedOnce 标志避免 greeter 重启后重复尝试自动登录。
• 拒绝 dde 作为自动登录用户、要求有效 session 等守卫到位。

需要处理的问题

1. Autologin.InBackground 声明但从未使用；Autologin.Timeout 仅判断 == 0。 connected() 中 mainConfig.Autologin.Timeout.get() == 0 只支持立即自动登录，非零超时（延迟自动登录）和后台登录均未实现。建议要么实现这些功能，要么移除无用配置项，避免误导管理员。

2. startAutologin() 失败不发送 loginFailed —— 直接返回 false，connected() 回退到 ShowGreeter。静默回退到 greeter 是合理的，仅提示缺少用户反馈（除 qWarning 外）。

安全设计说明（澄清）

ddm-autologin PAM 不检查 nopasswdlogin 组成员，依赖 pam_permit.so。这是设计意图：自动登录是管理员配置功能（Autologin.User），不是用户/组属性；nopasswdlogin 组是交互式免密登录的独立机制，经常规 ddm PAM 实现。两者分离正确。ddm-autologin 中的 pam_succeed_if.so shell notin nologin 和 pam_nologin.so 提供了合理的安全护栏。

总结

无阻断性问题，建议合入前处理以下可操作项：

• 移除或实现 Autologin.InBackground 及非零 Timeout。

更新：撤回原第 2 条「startUserSession() 无条件删除 auth，建议将 session 有效性检查移到认证前」。经复核，该行为变更实际是改善——重构后所有失败路径（无效 session、VT 分配失败等）统一 emit loginFailed，而旧代码这些路径直接 return 不发送反馈；预存 auth 被删除亦无害。无需调整。

[Copilot]

Pull request overview

This PR adds configurable automatic login and passwordless login support to ddm’s daemon-side session flow. It introduces a dedicated ddm-autologin PAM service, a nopasswdlogin group bypass in PAM, and refactors the display login path to reuse shared session-start logic.

Changes:

• Add Autologin configuration (user + optional session) and trigger autologin on first greeter connection after boot.
• Refactor session startup into Display::startUserSession(Auth*, Session) to reuse logic between normal login and autologin.
• Install new PAM service files (ddm-autologin) and define nopasswdlogin group via sysusers on supported distributions.

中文说明：
本 PR 为 ddm 增加可配置的自动登录与免密登录能力：新增独立的 ddm-autologin PAM 服务与 nopasswdlogin 组免密规则，并重构 Display 登录流程以复用统一的会话启动逻辑。

变更点：

• 新增 Autologin 配置（用户 + 可选会话），并在 greeter 首次连接时尝试自动登录。
• 提取 Display::startUserSession(Auth*, Session)，复用普通登录与自动登录的会话启动逻辑。
• 安装 ddm-autologin PAM 配置，并通过 sysusers 定义 nopasswdlogin 用户组。

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/daemon/Display.h	Add session-start/autologin helpers and first-connect tracking flag.
src/daemon/Display.cpp	Implement autologin trigger + shared session startup refactor.
src/daemon/Auth.h	Add configurable PAM service name per Auth instance.
src/daemon/Auth.cpp	Use pamService when calling pam_start().
src/common/Messages.h	Add new daemon→greeter message ShowGreeter.
src/common/Configuration.h	Add Autologin config section entries.
services/debian.ddm.pam	Enable nopasswdlogin group passwordless auth on Debian.
services/debian.ddm-sysuser.conf.in	Add nopasswdlogin group for Debian sysusers.
services/debian.ddm-autologin.pam	Add Debian-specific autologin PAM service definition.
services/ddm.pam	Add nopasswdlogin group passwordless auth on non-Debian.
services/ddm-sysuser.conf.in	Add nopasswdlogin group for non-Debian sysusers.
services/ddm-autologin.pam	Add non-Debian autologin PAM service definition.
services/CMakeLists.txt	Install ddm-autologin PAM files on Debian and non-Debian.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: glyvut, zccrs

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment