implement a large chunk of the auth system itself :D

1 files changed, 28 insertions, 0 deletions

diff --git a/auth-flow.conf.php b/auth-flow.conf.php
new file mode 100644
index 0000000..e9f6e61
--- /dev/null
+++ b/auth-flow.conf.php
@@ -0,0 +1,28 @@
+/*
+  in this file is where you can customise the authentication flow.
+  it's evaluated when a user goes to the login page.
+  you can access these variables:
+  - $context contains a Psso\Context object, describing what the user has
+    already done up to this point, and what's known about them
+  - $last contains the most recent ChallengeResult, or null if no challenges
+    were completed yet
+  you are expected to return either an array of Challenge subclasses, which
+  specifies what options the user has to continue (if you return multiple, they
+  will be presented in parallel for the user to choose just one to answer), or
+  an empty array, which indicates the auth flow has failed and cannot continue,
+  or the boolean 'true', which indicates the auth flow has succeeded and we can
+  trust that the user is who they say they are.
+*/
+
+use Psso\Challenge\{Username, Password, Totp};
+
+if ($last?->successful) {
+    // unfortunately only Dummy provider supports Totp so far, therefore don't
+    //return match ($last->type) {
+    //    Password::class => [Totp::class],
+    //    Totp::class => true,
+    //};
+    return true;
+}
+
+return [$last?->type ?? Password::class];