AuthRequestor: Add NewAutoAuthRequestor

auth_requestor.go

@@ -21,6 +21,7 @@ package secboot
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 )
@@ -81,6 +82,20 @@ const (
 	UserAuthResultInvalidFormat
 )
 
+var ErrAuthRequestorNotAvailable = errors.New("the auth requestor is not available")
+
+// AuthRequestorStringer is used by the some implementation of [AuthRequestor] to
+// obtain translated strings.
+type AuthRequestorStringer interface {
+	// RequestUserCredentialString returns messages used by RequestUserCredential. The
+	// name is a string supplied via the WithAuthRequestorUserVisibleName option, and the
+	// path is the storage container path.
+	RequestUserCredentialString(name, path string, authTypes UserAuthType) (string, error)
+
+	// NotifyUserAuthResultString returns messages used by NotifyUserAuthResult.
+	NotifyUserAuthResultString(name, path string, result UserAuthResult, authTypes, exhaustedAuthTypes UserAuthType) (string, error)
+}
+
 // AuthRequestor is an interface for requesting credentials.
 type AuthRequestor interface {
 	// RequestUserCredential is used to request a user credential that is

auth_requestor_auto.go

@@ -0,0 +1,96 @@
+// -*- Mode: Go; indent-tabs-mode: t -*-
+
+/*
+ * Copyright (C) 2026 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+package secboot
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+)
+
+var (
+	newPlymouthAuthRequestor = NewPlymouthAuthRequestor
+	newSystemdAuthRequestor  = NewSystemdAuthRequestor
+)
+
+type autoAuthRequestor struct {
+	requestors []AuthRequestor
+	lastUsed   AuthRequestor
+}
+
+func (r *autoAuthRequestor) RequestUserCredential(ctx context.Context, name, path string, authTypes UserAuthType) (string, UserAuthType, error) {
+	for _, req := range r.requestors {
+		switch cred, credType, err := req.RequestUserCredential(ctx, name, path, authTypes); {
+		case err == nil:
+			r.lastUsed = req
+			fallthrough
+		case !errors.Is(err, ErrAuthRequestorNotAvailable):
+			return cred, credType, err
+		}
+	}
+
+	return "", 0, ErrAuthRequestorNotAvailable
+}
+
+func (r *autoAuthRequestor) NotifyUserAuthResult(ctx context.Context, result UserAuthResult, authTypes, exhaustedAuthTypes UserAuthType) error {
+	if r.lastUsed == nil {
+		return errors.New("no user credential requested yet")
+	}
+	return r.lastUsed.NotifyUserAuthResult(ctx, result, authTypes, exhaustedAuthTypes)
+}
+
+// NewAutoAuthRequestor creates an implementation of AuthRequestor that automatically
+// selects the first available implementation in the following order:
+// - Plymouth.
+// - systemd-ask-password.
+//
+// The caller supplies an implementation of AuthRequestorStringer that returns messages.
+// The console argument is used by the systemd-ask-password implementation of
+// [AuthRequestor.NotifyUserAuthResult] where result is not [UserAuthResultSuccess]. If not
+// provided, it defaults to [os.Stderr].
+func NewAutoAuthRequestor(stderr io.Writer, stringer AuthRequestorStringer) (AuthRequestor, error) {
+	var requestors []AuthRequestor
+	switch ply, err := newPlymouthAuthRequestor(stringer); {
+	case errors.Is(err, ErrAuthRequestorNotAvailable):
+		// ignore
+	case err != nil:
+		return nil, fmt.Errorf("cannot create Plymouth AuthRequestor: %w", err)
+	default:
+		requestors = append(requestors, ply)
+	}
+
+	switch sd, err := newSystemdAuthRequestor(stderr, func(name, path string, authTypes UserAuthType) (string, error) {
+		return stringer.RequestUserCredentialString(name, path, authTypes)
+	}); {
+	case errors.Is(err, ErrAuthRequestorNotAvailable):
+		// ignore
+	case err != nil:
+		return nil, fmt.Errorf("cannot create systemd AuthRequestor: %w", err)
+	default:
+		requestors = append(requestors, sd)
+	}
+
+	if len(requestors) == 0 {
+		return nil, ErrAuthRequestorNotAvailable
+	}
+
+	return &autoAuthRequestor{requestors: requestors}, nil
+}