add pbs-style TFA API implementation

[pve-access-control.git] / src / PVE / AccessControl.pm

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index c3d3d160a393abafefceea0da7e8c03785079167..fd803684f06b9f458ff2e3eac969b537bf00f404 100644 (file)
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -77,6 +77,17 @@ sub lock_user_config {
     }
 }
 
+sub lock_tfa_config {
+    my ($code, $errmsg) = @_;
+
+    my $res = cfs_lock_file("priv/tfa.cfg", undef, $code);
+    if (my $err = $@) {
+       $errmsg ? die "$errmsg: $err" : die $err;
+    }
+
+    return $res;
+}
+
 my $cache_read_key = sub {
     my ($type) = @_;
 
@@ -1720,6 +1731,10 @@ my $USER_CONTROLLED_TFA_TYPES = {
     oath => 1,
 };
 
+sub assert_new_tfa_config_available() {
+    # FIXME: Assert cluster-wide new-tfa-config support!
+}
+
 sub user_get_tfa : prototype($$$) {
     my ($username, $realm, $new_format) = @_;