//go:build pam

// Package pamauth authenticates a username/password pair against the host's PAM
// stack (/etc/pam.d/<service>). It is the backend for uopi's built-in HTTP Basic
// authentication: because the uopi host is typically already an SSSD/LDAP client,
// validating through PAM reuses the exact same login path as `login`/`ssh`
// (pam_sss → the site directory) without uopi needing any directory schema.
//
// This file is the real implementation, compiled only with the `pam` build tag
// (which also requires cgo + libpam). The default fully-static CGO_ENABLED=0
// build uses stub.go instead, where Authenticate reports PAM is unavailable.
package pamauth

/*
#cgo LDFLAGS: -lpam
#include <security/pam_appl.h>
#include <stdlib.h>
#include <string.h>

// uopiPamConv answers every password-style PAM prompt with the password passed
// through appdata_ptr. Informational/error messages get a NULL response. The PAM
// library takes ownership of the returned responses and frees them.
static int uopiPamConv(int num_msg, const struct pam_message **msg,
                       struct pam_response **resp, void *appdata_ptr) {
    if (num_msg <= 0 || num_msg > PAM_MAX_NUM_MSG) {
        return PAM_CONV_ERR;
    }
    struct pam_response *r = calloc((size_t)num_msg, sizeof(struct pam_response));
    if (r == NULL) {
        return PAM_BUF_ERR;
    }
    for (int i = 0; i < num_msg; i++) {
        int style = msg[i]->msg_style;
        if (style == PAM_PROMPT_ECHO_OFF || style == PAM_PROMPT_ECHO_ON) {
            r[i].resp = strdup((const char *)appdata_ptr);
            if (r[i].resp == NULL) {
                for (int j = 0; j < i; j++) {
                    free(r[j].resp);
                }
                free(r);
                return PAM_BUF_ERR;
            }
        }
        r[i].resp_retcode = 0;
    }
    *resp = r;
    return PAM_SUCCESS;
}

// uopiPamAuth runs authentication + account management for service/user using
// pass. Returns PAM_SUCCESS or the failing PAM error code.
static int uopiPamAuth(const char *service, const char *user, char *pass) {
    struct pam_conv conv;
    conv.conv = uopiPamConv;
    conv.appdata_ptr = (void *)pass;

    pam_handle_t *pamh = NULL;
    int ret = pam_start(service, user, &conv, &pamh);
    if (ret != PAM_SUCCESS) {
        return ret;
    }
    ret = pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK);
    if (ret == PAM_SUCCESS) {
        ret = pam_acct_mgmt(pamh, PAM_DISALLOW_NULL_AUTHTOK);
    }
    pam_end(pamh, ret);
    return ret;
}

// uopiStrerror maps a PAM error code to a human-readable string. Linux-PAM
// ignores the handle, so NULL is fine after pam_end.
static const char *uopiStrerror(int code) {
    return pam_strerror(NULL, code);
}
*/
import "C"

import (
	"errors"
	"fmt"
	"unsafe"
)

// Available reports whether this build includes PAM support. True here.
const Available = true

// ErrUnavailable is returned by Authenticate in builds without PAM support. It
// is declared in both build variants so callers can compare against it.
var ErrUnavailable = errors.New("pamauth: PAM support not compiled in")

// Authenticate verifies username/password against the named PAM service
// (/etc/pam.d/<service>). It returns nil on success or an error describing the
// PAM failure. It is safe for concurrent use.
func Authenticate(service, username, password string) error {
	cService := C.CString(service)
	cUser := C.CString(username)
	cPass := C.CString(password)
	defer C.free(unsafe.Pointer(cService))
	defer C.free(unsafe.Pointer(cUser))
	defer C.free(unsafe.Pointer(cPass))

	if ret := C.uopiPamAuth(cService, cUser, cPass); ret != C.PAM_SUCCESS {
		return fmt.Errorf("pam: %s", C.GoString(C.uopiStrerror(ret)))
	}
	return nil
}