[pmg-devel] [PATCH api 2/6] add PMG::TFAConfig module

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
---
 src/Makefile         |  1 +
 src/PMG/TFAConfig.pm | 80 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)
 create mode 100644 src/PMG/TFAConfig.pm

diff --git a/src/Makefile b/src/Makefile
index eac682b..de05aa0 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -82,6 +82,7 @@ LIBSOURCES =				\
 	PMG/Quarantine.pm		\
 	PMG/Report.pm			\
 	PMG/SACustom.pm			\
+	PMG/TFAConfig.pm		\
 	PMG/RuleDB/Group.pm		\
 	PMG/RuleDB/Rule.pm		\
 	PMG/RuleDB/Object.pm		\
diff --git a/src/PMG/TFAConfig.pm b/src/PMG/TFAConfig.pm
new file mode 100644
index 0000000..998e266
--- /dev/null
+++ b/src/PMG/TFAConfig.pm
@@ -0,0 +1,80 @@
+package PMG::TFAConfig;
+
+use strict;
+use warnings;
+
+use PVE::Tools;
+use PVE::INotify;
+use PVE::JSONSchema qw(get_standard_option);
+use PVE::Exception qw(raise);
+
+use PMG::Utils;
+use PMG::UserConfig;
+
+use base 'PMG::RS::TFA';
+
+my $inotify_file_id = 'pmg-tfa.json';
+my $config_filename = '/etc/pmg/tfa.json';
+
+sub new {
+    my ($type) = @_;
+
+    my $class = ref($type) || $type;
+
+    my $cfg = PVE::INotify::read_file($inotify_file_id);
+
+    return bless $cfg, $class;
+}
+
+sub write {
+    my ($self) = @_;
+
+    PVE::INotify::write_file($inotify_file_id, $self);
+}
+
+# This lives in `UserConfig` in order to enforce lock order.
+sub lock_config {
+    return PMG::UserConfig::lock_tfa_config(@_);
+}
+
+my sub read_tfa_conf : prototype($$) {
+    my ($filename, $fh) = @_;
+
+    my $raw;
+    if ($fh) {
+	$raw = do { local $/ = undef; <$fh> };
+    } else {
+	$raw = '{}';
+    }
+
+    my $cfg = PMG::RS::TFA->new($raw);
+
+    # Purge invalid users:
+    my $usercfg = PMG::UserConfig->new();
+    foreach my $user ($cfg->users()->@*) {
+	if (!$usercfg->lookup_user_data($user, 1)) {
+	    $cfg->remove_user($user);
+	}
+    }
+
+    return $cfg;
+}
+
+my sub write_tfa_conf : prototype($$$) {
+    my ($filename, $fh, $cfg) = @_;
+
+    chmod(0600, $fh);
+
+    PVE::Tools::safe_print($filename, $fh, $cfg->SUPER::write());
+}
+
+PVE::INotify::register_file($inotify_file_id, $config_filename,
+			    \&read_tfa_conf,
+			    \&write_tfa_conf,
+			    undef,
+			    always_call_parser => 1,
+			    # the parser produces a rust TfaConfig object,
+			    # Clone::clone would break this
+			    noclone => 1);
+
+1;
-- 
2.30.2