1package signin
 2
 3import (
 4	"errors"
 5	"net/http"
 6
 7	"tug/internal/transport/web"
 8)
 9
10func (l login) proof(r *http.Request, state string) string {
11	return l.rp.LoginProof(r, state)
12}
13
14func (l login) Resume(w http.ResponseWriter, r *http.Request, state string) (string, error) {
15	old := l.proof(r, state)
16	if old == "" {
17		return l.establishClaim(w, r, state)
18	}
19	claim, err := l.v.Claim(r.Context(), state, old)
20	if err != nil {
21		if errors.Is(err, web.ErrLoginElsewhere) || errors.Is(err, web.ErrLoginExpired) {
22			l.rp.ClearLogin(w, state)
23		}
24		return "", err
25	}
26	target, err := l.resume(w, r, claim)
27	if claim.Silent && (errors.Is(err, web.ErrNoSession) || errors.Is(err, web.ErrLoginRequired)) {
28		target, err = l.v.LoginRequired(r.Context(), state, claim.Proof)
29	}
30	if err == nil {
31		l.rp.ClearLogin(w, state)
32	}
33	return target, err
34}
35
36func (l login) establishClaim(w http.ResponseWriter, r *http.Request, state string) (string, error) {
37	if web.IsLoginClaim(r) {
38		target, silent, err := l.v.LoginRequiredUnclaimed(r.Context(), state)
39		if err != nil {
40			return "", err
41		}
42		if !silent {
43			return "", web.ErrLoginCookie
44		}
45		return target, nil
46	}
47	req, err := l.v.Unclaimed(r.Context(), state)
48	if err != nil {
49		return "", err
50	}
51	_, session := l.rp.SessionSecret(r)
52	browser := ensureBrowser(w, r)
53	if !l.rp.SetLogin(w, r, state, l.rp.LoginProofFor(state, browser), req.Expiry, !req.Silent && !session) {
54		return "", web.ErrLoginExpired
55	}
56	return "", web.ErrLoginClaim
57}