pgwire

type AuthConn interface {
	// SendAuthRequest send a request for authentication information. After
	// calling this, the authenticator needs to call GetPwdData() quickly, as the
	// connection's goroutine will be blocked on providing us the requested data.
	SendAuthRequest(authType int32, data []byte) error
	// GetPwdData returns authentication info that was previously requested with
	// SendAuthRequest. The call blocks until such data is available.
	// An error is returned if the client connection dropped or if the client
	// didn't respect the protocol. After an error has been returned, GetPwdData()
	// cannot be called any more.
	GetPwdData() ([]byte, error)
	// AuthOK declares that authentication succeeded and provides a
	// unqualifiedIntSizer, to be returned by authenticator.authResult(). Future
	// authenticator.sendPwdData() calls fail.
	AuthOK(unqualifiedIntSizer)
	// AuthFail declares that authentication has failed and provides an error to
	// be returned by authenticator.authResult(). Future
	// authenticator.sendPwdData() calls fail. The error has already been written
	// to the client connection.
	AuthFail(err error)
	// Logf logs a message on the authentication log, if auth logs
	// are enabled.
	Logf(ctx context.Context, format string, args ...interface{})
}

type AuthMethod func(
	ctx context.Context,
	c AuthConn,
	tlsState tls.ConnectionState,
	pwRetrieveFn PasswordRetrievalFn,
	pwValidUntilFn PasswordValidUntilFn,
	execCfg *sql.ExecutorConfig,
	entry *hba.Entry,
) (security.UserAuthHook, error)

type PasswordRetrievalFn = func(context.Context) ([]byte, error)

type PasswordValidUntilFn = func(context.Context) (*ast.DTimestamp, error)