//go:build openbsd && cgo

package bsdauth

/*
#cgo CFLAGS: -DOPENBSD
#cgo LDFLAGS: -lutil
#include <stdlib.h>
#include <sys/types.h>
#include <login_cap.h>
#include <bsd_auth.h>

// Tiny wrapper to keep the cgo call site clean.
static int go_auth_userokay(const char *name, const char *style, const char *atype, const char *password) {
    return auth_userokay((char*)name, (char*)style, (char*)atype, (char*)password);
}
*/
import "C"
import (
	"errors"
	"unsafe"
)

// Authenticate verifies a username and password using OpenBSD’s BSD Authentication subsystem.
// `atype` identifies the service name (e.g., "auth-myapp").
// `style` is left empty to use the system default style from login.conf.
func Authenticate(username, password, atype string) (bool, error) {
	if username == "" {
		return false, errors.New("bsdauth: empty username")
	}
	if atype == "" {
		atype = "auth-myapp"
	}

	cUser := C.CString(username)
	cPass := C.CString(password)
	cType := C.CString(atype)
	var cStyle *C.char = nil // default style from login.conf
	defer func() {
		C.free(unsafe.Pointer(cUser))
		C.free(unsafe.Pointer(cPass))
		C.free(unsafe.Pointer(cType))
	}()

	ok := C.go_auth_userokay(cUser, cStyle, cType, cPass)
	return ok != 0, nil
}