From b422b6ded608807c7d3bb8b965b3797ca513610b Mon Sep 17 00:00:00 2001
From: winter Sparkles
Date: Sat, 8 Aug 2026 23:01:51 +0100
Subject: implement a large chunk of the auth system itself :D

---
 auth-flow.conf.php | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 auth-flow.conf.php

(limited to 'auth-flow.conf.php')

diff --git a/auth-flow.conf.php b/auth-flow.conf.php
new file mode 100644
index 0000000..e9f6e61
--- /dev/null
+++ b/auth-flow.conf.php
@@ -0,0 +1,28 @@
+/*
+  in this file is where you can customise the authentication flow.
+  it's evaluated when a user goes to the login page.
+  you can access these variables:
+  - $context contains a Psso\Context object, describing what the user has
+    already done up to this point, and what's known about them
+  - $last contains the most recent ChallengeResult, or null if no challenges
+    were completed yet
+  you are expected to return either an array of Challenge subclasses, which
+  specifies what options the user has to continue (if you return multiple, they
+  will be presented in parallel for the user to choose just one to answer), or
+  an empty array, which indicates the auth flow has failed and cannot continue,
+  or the boolean 'true', which indicates the auth flow has succeeded and we can
+  trust that the user is who they say they are.
+*/
+
+use Psso\Challenge\{Username, Password, Totp};
+
+if ($last?->successful) {
+    // unfortunately only Dummy provider supports Totp so far, therefore don't
+    //return match ($last->type) {
+    //    Password::class => [Totp::class],
+    //    Totp::class => true,
+    //};
+    return true;
+}
+
+return [$last?->type ?? Password::class];
-- 
cgit v1.3