From 590af894ef342bc561aa703745b22b3ab2abbe58 Mon Sep 17 00:00:00 2001
From: Wolfgang Bumiller <w.bumiller@proxmox.com>
Date: Fri, 26 May 2023 12:19:55 +0200
Subject: [PATCH] pve: enable tfa lockout, add api_unlock_tfa method

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
---
 pve-rs/src/tfa.rs | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pve-rs/src/tfa.rs b/pve-rs/src/tfa.rs
index aab7f2e..e879cec 100644
--- a/pve-rs/src/tfa.rs
+++ b/pve-rs/src/tfa.rs
@@ -484,6 +484,14 @@ mod export {
             Err(methods::EntryNotFound) => bail!("no such entry"),
         }
     }
+
+    #[export]
+    fn api_unlock_tfa(#[try_from_ref] this: &Tfa, userid: &str) -> Result<bool, Error> {
+        Ok(methods::unlock_tfa(
+            &mut this.inner.lock().unwrap(),
+            userid,
+        )?)
+    }
 }
 
 /// Version 1 format of `/etc/pve/priv/tfa.cfg`
@@ -993,9 +1001,8 @@ impl proxmox_tfa::api::OpenUserChallengeData for UserAccess {
         }
     }
 
-    /// TODO: Enable this once we can consider most clusters to support the new format.
     fn enable_lockout(&self) -> bool {
-        false
+        true
     }
 }