rogee
aeddedf2a3
Restructure the monorepo into clear top-level directories: - backend/: Go module root (cmd, internal, pkg, configs, migrations, docs/swagger, scripts, tests, go.mod, Makefile, .air.toml) - deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd - docs/: project documentation + reports/ (moved from repo root) - AGENTS.md: new AI coding-agent guide at repo root Update all references to the new layout: - Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root) - docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile, env_file ../../.env, volume mounts ../../backend:/app - deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile - CI: working-directory: backend for go commands, file deploy/docker/Dockerfile, coverage path backend/coverage.out, health_check backend/scripts/ - backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../ - README: architecture tree, quickstart, config paths updated Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh, gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to preserve history. Build, vet, SQLite tests, and docker compose config verified.
53 lines
2.9 KiB
Go
53 lines
2.9 KiB
Go
package model
|
|
|
|
// Reference: M13 §2 — SSO Session model
|
|
// Tracks a user's SSO session across the system for single sign-on and single logout.
|
|
// An SSO session is created when a user authenticates via SAML/OAuth and persists
|
|
// until the user explicitly logs out or the session expires.
|
|
// This enables: (1) SSO — one login grants access to all accounts for that user,
|
|
// (2) SLO — logout terminates all active sessions across all accounts,
|
|
// (3) audit — track when/where a user authenticated and from which IdP.
|
|
|
|
import (
|
|
"time"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// SSOSession represents an active SSO session for a user.
|
|
type SSOSession struct {
|
|
ID uint `gorm:"primaryKey" json:"id"`
|
|
UserID uint `gorm:"not null;index" json:"user_id"`
|
|
SessionID string `gorm:"size:255;not null;uniqueIndex" json:"session_id"` // unique SSO session identifier
|
|
Provider string `gorm:"size:50;not null" json:"provider"` // saml, google, github
|
|
IdPEntityID string `gorm:"size:512" json:"idp_entity_id,omitempty"` // SAML IdP entity ID (for SAML sessions)
|
|
NameID string `gorm:"size:512" json:"name_id,omitempty"` // SAML NameID from the assertion
|
|
AccountID uint `gorm:"not null;index" json:"account_id"` // account context for this session
|
|
Role string `gorm:"size:50" json:"role"` // role in the account
|
|
AccessToken string `gorm:"size:512" json:"-"` // issued JWT access token (not exposed via API)
|
|
RefreshToken string `gorm:"size:512" json:"-"` // issued JWT refresh token (not exposed via API)
|
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
|
ExpiresAt time.Time `gorm:"not null;index" json:"expires_at"` // session expiry time
|
|
LastSeenAt time.Time `gorm:"autoUpdateTime" json:"last_seen_at"` // last activity timestamp
|
|
EndedAt *time.Time `json:"ended_at,omitempty"` // when session was terminated (SLO or explicit logout)
|
|
Status string `gorm:"size:20;not null;default:active" json:"status"` // active, terminated, expired
|
|
DeletedAt gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`
|
|
|
|
// Relations
|
|
User User `gorm:"foreignKey:UserID" json:"user,omitempty"`
|
|
Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
|
|
}
|
|
|
|
func (SSOSession) TableName() string { return "sso_sessions" }
|
|
|
|
// IsActive returns whether the SSO session is still valid.
|
|
func (s *SSOSession) IsActive() bool {
|
|
return s.Status == "active" && s.EndedAt == nil && s.ExpiresAt.After(time.Now())
|
|
}
|
|
|
|
// Terminate marks the SSO session as terminated (for SLO).
|
|
func (s *SSOSession) Terminate() {
|
|
now := time.Now()
|
|
s.Status = "terminated"
|
|
s.EndedAt = &now
|
|
} |