54 lines
3.0 KiB
Go
54 lines
3.0 KiB
Go
package model
|
|
|
|
// Reference: M13 §2 — SSO Session model
|
|
// Tracks a user's SSO session across the system for single sign-on and single logout.
|
|
// An SSO session is created when a user authenticates via SAML/OAuth and persists
|
|
// until the user explicitly logs out or the session expires.
|
|
// This enables: (1) SSO — one login grants access to all accounts for that user,
|
|
// (2) SLO — logout terminates all active sessions across all accounts,
|
|
// (3) audit — track when/where a user authenticated and from which IdP.
|
|
|
|
import (
|
|
"time"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// SSOSession represents an active SSO session for a user.
|
|
type SSOSession struct {
|
|
ID uint `gorm:"primaryKey" json:"id"`
|
|
UserID uint `gorm:"not null;index" json:"user_id"`
|
|
SessionID string `gorm:"size:255;not null;uniqueIndex" json:"session_id"` // unique SSO session identifier
|
|
Provider string `gorm:"size:50;not null" json:"provider"` // saml, google, github
|
|
IdPEntityID string `gorm:"column:idp_entity_id;size:512" json:"idp_entity_id,omitempty"` // SAML IdP entity ID (for SAML sessions)
|
|
NameID string `gorm:"size:512" json:"name_id,omitempty"` // SAML NameID from the assertion
|
|
AccountID uint `gorm:"not null;index" json:"account_id"` // account context for this session
|
|
Role string `gorm:"size:50" json:"role"` // role in the account
|
|
AccessToken string `gorm:"size:512" json:"-"` // issued JWT access token (not exposed via API)
|
|
RefreshToken string `gorm:"size:512" json:"-"` // issued JWT refresh token (not exposed via API)
|
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
|
ExpiresAt time.Time `gorm:"not null;index" json:"expires_at"` // session expiry time
|
|
LastSeenAt time.Time `gorm:"autoUpdateTime" json:"last_seen_at"` // last activity timestamp
|
|
EndedAt *time.Time `json:"ended_at,omitempty"` // when session was terminated (SLO or explicit logout)
|
|
Status string `gorm:"size:20;not null;default:active" json:"status"` // active, terminated, expired
|
|
DeletedAt gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`
|
|
|
|
// Relations
|
|
User User `gorm:"foreignKey:UserID" json:"user,omitempty"`
|
|
Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
|
|
}
|
|
|
|
func (SSOSession) TableName() string { return "sso_sessions" }
|
|
|
|
// IsActive returns whether the SSO session is still valid.
|
|
func (s *SSOSession) IsActive() bool {
|
|
return s.Status == "active" && s.EndedAt == nil && s.ExpiresAt.After(time.Now())
|
|
}
|
|
|
|
// Terminate marks the SSO session as terminated (for SLO).
|
|
func (s *SSOSession) Terminate() {
|
|
now := time.Now()
|
|
s.Status = "terminated"
|
|
s.EndedAt = &now
|
|
}
|