A Trussed API extension for authentication.

This crate contains an API extension for Trussed, AuthExtension. The extension currently provides basic PIN handling with retry counters. Applications can access it using the AuthClient trait.

Examples

use heapless_bytes::Bytes;
use trussed_auth::{AuthClient, PinId};
use trussed_core::syscall;

#[repr(u8)]
enum Pin {
    User = 0,
}

impl From<Pin> for PinId {
    fn from(pin: Pin) -> Self {
        (pin as u8).into()
    }
}

fn authenticate_user<C: AuthClient>(client: &mut C, pin: Option<&[u8]>) -> bool {
    if !syscall!(client.has_pin(Pin::User)).has_pin {
        // no PIN set
        return true;
    }
    let Some(pin) = pin else {
        // PIN is set but not provided
        return false;
    };
    let Ok(pin) = Bytes::from_slice(pin) else {
        // provided PIN is too long
        return false;
    };
    // check PIN
    syscall!(client.check_pin(Pin::User, pin)).success
}