3 files changed, 75 insertions, 0 deletions
diff --git a/Psso/Challenge/Password.php b/Psso/Challenge/Password.php
new file mode 100644
index 0000000..c20f5e2
--- /dev/null
+++ b/Psso/Challenge/Password.php
@@ -0,0 +1,32 @@
+<?php
+namespace Psso\Challenge;
+
+use Psso\{Challenge, ChallengeResult, Input, AuthProvider, AuthInterface};
+
+class Password extends Challenge {    
+    public function getInputs(): array {
+        if (isset($this->context->user)) {
+            return [
+                new Input('password', Input::SECRET, 'challenge.input.password')
+            ];
+        }
+        return [
+            new Input('username', Input::TEXT, 'challenge.input.username'),
+            new Input('password', Input::SECRET, 'challenge.input.password'),
+        ];
+    }
+
+    public function validate(
+        AuthProvider $provider, array $inputData
+    ): ChallengeResult {
+        self::requireInterface($provider, AuthInterface\Password::class);
+        $successful = $provider->validatePassword(
+            $inputData['username'] ?? $this->context->user,
+            $inputData['password']
+        );
+        return new ChallengeResult(
+            self::class, $successful, $inputData['username'] ?? null,
+            $successful ? null : 'challenge.message.wrong-password'
+        );
+    }
+}
diff --git a/Psso/Challenge/Totp.php b/Psso/Challenge/Totp.php
new file mode 100644
index 0000000..4fd47f4
--- /dev/null
+++ b/Psso/Challenge/Totp.php
@@ -0,0 +1,27 @@
+<?php
+namespace Psso\Challenge;
+use Psso\{Challenge, AuthProvider, ChallengeResult, Context, Input, AuthInterface};
+
+class Totp extends Challenge {
+    public static function create(Context $context): static {
+        self::requireKnownUser($context);
+        return new self($context);
+    }
+
+    public function getInputs(): array {
+        return [new Input('otp', Input::NUMERIC, 'challenge.input.otp')];
+    }
+
+    public function validate(
+        AuthProvider $provider, array $inputData
+    ): ChallengeResult {
+        self::requireInterface($provider, AuthInterface\Totp::class);
+        $success = $provider->validateTotp(
+            $this->context->user, $inputData['otp']
+        );
+        return new ChallengeResult(
+            self::class, $success, null,
+            $success ? null : 'challenge.message.wrong-otp'
+        );
+    }
+}
diff --git a/Psso/Challenge/Username.php b/Psso/Challenge/Username.php
new file mode 100644
index 0000000..43de085
--- /dev/null
+++ b/Psso/Challenge/Username.php
@@ -0,0 +1,16 @@
+<?php
+namespace Psso\Challenge;
+use Psso\{Challenge, AuthProvider, ChallengeResult, Input};
+
+/** Just asks for a username and sets it in the context. Always succeeds. */
+class Username extends Challenge {
+    public function getInputs(): array {
+        return [new Input('user', Input::TEXT, 'challenge.input.username')];
+    }
+
+    public function validate(
+        AuthProvider $provider, array $inputData
+    ): ChallengeResult {
+        return new ChallengeResult(self::class, true, $inputData['user'], null);
+    }
+}