Skip to main content

squigit_auth/security/
reveal.rs

1// Copyright 2026 a7mddra
2// SPDX-License-Identifier: Apache-2.0
3
4use chrono::{Duration, Utc};
5use squigit_storage::ProfileStore;
6
7use crate::Result;
8
9const REVEAL_GRACE_SECONDS: i64 = 600;
10
11#[derive(Debug, Clone, Copy, PartialEq, Eq)]
12pub enum RevealAuthResult {
13    Authorized,
14    RequiresOsAuth,
15    RequiresCaptcha,
16}
17
18pub fn check_reveal_authorization(store: &ProfileStore) -> Result<RevealAuthResult> {
19    if let Some(ts) = store.get_last_trusted_reveal()? {
20        if Utc::now().signed_duration_since(ts) < Duration::seconds(REVEAL_GRACE_SECONDS) {
21            return Ok(RevealAuthResult::Authorized);
22        }
23    }
24
25    if cfg!(target_os = "macos") || cfg!(target_os = "windows") {
26        Ok(RevealAuthResult::RequiresOsAuth)
27    } else {
28        Ok(RevealAuthResult::RequiresCaptcha)
29    }
30}