pamsocket

type ConsentInfo struct {
	// If set, Redirect contains the URL to redirect to
	// immediately. No consent screen needs to be shown.
	Redirect string
	//
	Target string
	//
	Scopes []*Scope
}

type LoginFlow interface {
	// PreLogin is run before the sign-in flow. It may conclude
	// the sign-in flow is unnecessary, and return a URL to
	// redirect to. If an empty URL is returned, the login flow
	// should proceed.
	PreLogin(r *http.Request) (string, error)
	// Authenticated is run after the sign-in flow, to indicate
	// that the given user has been authenticated. This function
	// should return a URL to redirect to. This accepts a
	// `subject`, not a username, so it could be an anonymized
	// identifier (i.e., the UID) instead of the
	// username/email/etc. This must be a stable identifier.
	Authenticated(r *http.Request, subject string) (string, error)
	// RequestConsent is called after a user is authenticated to
	// determine if the target application should be permitted to
	// learn some information (such as username, or full name, or
	// email).
	RequestConsent(r *http.Request) (*ConsentInfo, error)
	// AcceptConsent is called after the user specifies they
	// accept the requested application learn some information.
	AcceptConsent(r *http.Request) (string, error)
	// SupportsOidc returns true if this login flow is OpenID
	// Connect capable, and false otherwise. This is primarily
	// used for testing, wher the NoopFlow indicates it does not
	// support OIDC so that the client-side app will not register
	// its URL handlers.
	SupportsOidc() bool
}

type NoopFlow struct{}

type PamSocket struct {
	// Service is the specific PAM profile to use. This
	// corresponds to a configuration file of the same name in the
	// configured ConfDir. Typically, this is something like
	// `passwd`, but note that that requires running this program
	// with privileges to read /etc/shadow, which is not
	// generally recommended.
	Service string
	// ConfDir is the directory where the PAM service
	// configurations live. By default, this is `/etc/pam.d/`.
	ConfDir string
	// Flow is a series of functions that are called as part of
	// the login process. If you do not need to customize the
	// login process, use NoopFlow.
	Flow LoginFlow
}

type Scope struct {
	Name        string
	Description string
	Hidden      bool
}