From 04a8438bd31565c5023495f2d4bce4da9b60a952 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Mon, 2 Nov 2026 01:00:39 +0800
Subject: [PATCH] refactor(canokey): rely on systemd uaccess rules instead of
 custom udev

systemd's 60-fido-id.rules marks the FIDO hidraw node and the CCID USB
device as security tokens, and 70-uaccess.rules grants them to the
active seat. Drop the hand-written rules and the plugdev membership.

Assisted-by: Claude Code (claude-opus-5-5)
---
 modules/nixos/desktop/canokey.nix | 21 +--------------------
 1 file changed, 1 insertion(+), 20 deletions(-)

diff --git a/modules/nixos/desktop/canokey.nix b/modules/nixos/desktop/canokey.nix
index ebc5cd58..cba61865 100644
--- a/modules/nixos/desktop/canokey.nix
+++ b/modules/nixos/desktop/canokey.nix
@@ -2,7 +2,6 @@
   pkgs,
   config,
   lib,
-  myvars,
   ...
 }:
 let
@@ -14,27 +13,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # systemd tags FIDO/CCID devices uaccess (60-fido-id.rules); pcscd covers OpenPGP.
     services.pcscd.enable = true;
 
-    # The FIDO2 udev rule below hands the key to the plugdev group.
-    users.users.${myvars.username}.extraGroups = [ "plugdev" ];
-
-    services.udev.extraRules = ''
-      # CanoKey - GnuPG/pcsclite
-      SUBSYSTEM!="usb", GOTO="canokey_rules_end"
-      ACTION!="add|change", GOTO="canokey_rules_end"
-      ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", ENV{ID_SMARTCARD_READER}="1"
-      LABEL="canokey_rules_end"
-
-      # CanoKey - FIDO2
-      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", TAG+="uaccess", GROUP="plugdev", MODE="0660"
-
-      # CanoKey - WebUSB
-      # Upstream ships this as MODE:="0666" (world-writable), which lets any
-      # local user access the key; restrict it to the plugdev group instead.
-      SUBSYSTEMS=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="42d4", GROUP="plugdev", MODE="0660"
-    '';
-
     environment.systemPackages = with pkgs; [
       ccid
       pcsc-tools