sso_secret_file=$werc_root/etc/misaki_sso.secret

fn misaki_sso_auth {
	if(! ~ $#logged_user 0 || ~ $"HTTP_X_AUTH_USER '')
		ssoskip=yes
	if not if(! test -s $sso_secret_file)
		dprint 'misaki-sso: secret file missing/empty: '^$sso_secret_file
	if not {
		sso_u=$"HTTP_X_AUTH_USER
		sso_exp=$"HTTP_X_AUTH_EXP
		if(! echo -n $sso_u | grep -s '^[a-zA-Z0-9_-]+$')
			dprint 'misaki-sso: bad X-Auth-User: '^$"sso_u
		if not if(! echo -n $sso_exp | grep -s '^[0-9]+$')
			dprint 'misaki-sso: missing/non-numeric X-Auth-Exp ('^$"sso_exp^') - is auth_secret set in misaki?'
		if not if(! test $sso_exp -gt `{date -n})
			dprint 'misaki-sso: expired token for '^$sso_u
		if not {
			sso_want=`{echo -n 'v1:'^$sso_u^':'^$sso_exp | openssl dgst -sha256 -hmac `{cat $sso_secret_file} -binary | openssl base64 -A | tr '+/' '-_' | tr -d '='}
			if(~ $"sso_want '')
				dprint 'misaki-sso: empty HMAC - is openssl installed?'
			if not if(! ~ $"HTTP_X_AUTH_SIG $sso_want)
				dprint 'misaki-sso: signature mismatch for '^$sso_u^''
			if not {
				logged_user=$sso_u
				logged_password=()
				dprint 'misaki-sso: authenticated '^$sso_u
			}
		}
	}
}

fn misaki-sso_init { misaki_sso_auth }

misaki_sso_auth