#!perl -w

=head1 NAME

auth_flat_file - simple CRAM MD5 auth plugin using a flat password file

=head1 SYNOPSIS

in config/plugins:

  auth/auth_flat_file

in config/flat_auth_pw

  username1:password1
  username2:password2
  ...

=head1 DESCRIPTION

This plugin implements a very simple authentication plugin using a flat password
file containing username and password separated by colons.

Note that this plugin enforces the use of a full email address (including
@domain) as the username. There's no particular reason for this so feel free
to modify the code to suit your setup.

The password is stored on disk unencrypted, however authentication uses a HMAC
algorithm so no password is transfered in the clear.

=cut

use strict;
use warnings;

use Qpsmtpd::Auth;
use Qpsmtpd::Constants;

sub register {
    my ( $self, $qp ) = @_;

    $self->register_hook('auth-plain',    'auth_flat_file');
    $self->register_hook('auth-login',    'auth_flat_file');
    $self->register_hook('auth-cram-md5', 'auth_flat_file');
}

sub auth_flat_file {
    my ( $self, $transaction, $method, $user, $passClear, $passHash, $ticket ) =
      @_;

    if ( ! defined $passClear && ! defined $passHash ) {
        $self->log(LOGINFO, "fail: missing password");
        return ( DENY, "authflat - missing password" );
    }

    my ( $pw_name, $pw_domain ) = split '@', lc($user);

    unless ( defined $pw_domain ) {
        $self->log(LOGINFO, "fail: missing domain");
        return DECLINED;
    }

    my ($auth_line) = grep {/^$pw_name\@$pw_domain:/} $self->qp->config('flat_auth_pw');

    if ( ! defined $auth_line) {
        $self->log(LOGINFO, "fail: no such user: $user");
        return DECLINED;
    }

    my ($auth_user, $auth_pass) = split(/:/, $auth_line, 2);

    # at this point we can assume the user name matched
    return Qpsmtpd::Auth::validate_password( $self,
            src_clear     => $auth_pass,
            src_crypt     => undef,
            attempt_clear => $passClear,
            attempt_hash  => $passHash,
            method        => $method,
            ticket        => $ticket,
            deny          => DENY,
        );
}