//! PAM password verification for the current `$USER`, used by the polkit agent.

pub fn verify_password(password: &str) -> bool {
    let user = std::env::var("USER").unwrap_or_default();
    if user.is_empty() {
        return false;
    }

    // Use PAM for authentication (unix_chkpwd protocol changed in PAM 1.7+)
    match pam::Authenticator::with_password("login") {
        Ok(mut auth) => {
            auth.get_handler().set_credentials(&user, password);
            auth.authenticate().is_ok()
        }
        Err(e) => {
            tracing::error!("Failed to create PAM authenticator: {:?}", e);
            false
        }
    }
}
