auth

type AuthContext struct {
	Request       *radius.Request
	Response      *radius.Packet
	User          *domain.RadiusUser
	Nas           *domain.NetNas
	VendorRequest interface{}
	IsMacAuth     bool                   // whether this is MAC authentication
	Metadata      map[string]interface{} // Additional metadata
}

type BaseGuard struct{}

type Guard interface {
	// Name returns the guard name
	Name() string

	// OnError is called when an error occurs during authentication.
	// It can return a new error to abort the flow.
	// Deprecated: Use OnAuthError for more control over error handling flow.
	OnError(ctx context.Context, authCtx *AuthContext, stage string, err error) error

	// OnAuthError is called when an error occurs during authentication.
	// It provides more control over how errors are handled via GuardResult.
	// If not implemented (returns nil result), falls back to OnError behavior.
	//
	// Parameters:
	//   - ctx: Context for cancellation and deadlines
	//   - authCtx: Authentication context with request details
	//   - stage: The pipeline stage where the error occurred
	//   - err: The original error
	//
	// Returns:
	//   - *GuardResult: How to handle the error, or nil to use OnError fallback
	OnAuthError(ctx context.Context, authCtx *AuthContext, stage string, err error) *GuardResult
}

type GuardAction int

type GuardResult struct {
	Action GuardAction // What action to take
	Err    error       // The error to use (may be modified, wrapped, or new)
}

type PasswordValidator interface {
	// Name returns the validator name (pap, chap, mschap, eap-md5, etc.)
	Name() string

	// CanHandle determines whether this validator can handle the request
	CanHandle(ctx *AuthContext) bool

	// Validate performs password validation
	Validate(ctx context.Context, authCtx *AuthContext, password string) error
}

type PolicyChecker interface {
	// Name returns the checker's name
	Name() string

	// Check executes the profile check
	Check(ctx context.Context, authCtx *AuthContext) error

	// Order returns the execution order (lower digits run first)
	Order() int
}

type ResponseEnhancer interface {
	// Name returns the enhancer name
	Name() string

	// Enhance augments the response (e.g., add vendor attributes)
	Enhance(ctx context.Context, authCtx *AuthContext) error
}