mrleo1nidandClaude Opus 5.5
f075863f15
- /admin/users: list with search, role filter and cursor pages; create with a one-time temporary password; rename, change role, block; reset password; delete - every change is checked against the role policy, a forbidden field rejects the whole patch; the last active admin is locked in the transaction and cannot be demoted, blocked or deleted - role change and blocking revoke access tokens at once; blocking and password reset also end all sessions - /admin/audit: newest-first journal with actor names - path and query parameter errors are problem+json now Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
118 lines
3.6 KiB
Go
118 lines
3.6 KiB
Go
// Package auth — пользователи, вход, токены, политика прав (docs/auth-and-roles.md).
|
|
package auth
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// Role — роль пользователя.
|
|
type Role string
|
|
|
|
// Роли по возрастанию прав.
|
|
const (
|
|
RoleUser Role = "user"
|
|
RoleModerator Role = "moderator"
|
|
RoleAdmin Role = "admin"
|
|
)
|
|
|
|
// Valid сообщает, известна ли роль.
|
|
func (r Role) Valid() bool { return r == RoleUser || r == RoleModerator || r == RoleAdmin }
|
|
|
|
// ClientType — тип клиента, от него зависит доставка refresh-токена.
|
|
type ClientType string
|
|
|
|
// Типы клиентов.
|
|
const (
|
|
ClientWeb ClientType = "web"
|
|
ClientAndroid ClientType = "android"
|
|
)
|
|
|
|
// Valid сообщает, известен ли тип клиента.
|
|
func (c ClientType) Valid() bool { return c == ClientWeb || c == ClientAndroid }
|
|
|
|
// UIPrefs — настройки интерфейса пользователя (users.ui_prefs). Пустые поля — значения по умолчанию клиента.
|
|
type UIPrefs struct {
|
|
Theme *string `json:"theme,omitempty"`
|
|
WaveVariant *string `json:"wave_variant,omitempty"`
|
|
WebPlayer *string `json:"web_player,omitempty"`
|
|
MobilePlayer *string `json:"mobile_player,omitempty"`
|
|
Ambient *bool `json:"ambient,omitempty"`
|
|
CrossfadeS *int `json:"crossfade_s,omitempty"`
|
|
Normalize *bool `json:"normalize,omitempty"`
|
|
}
|
|
|
|
// User — учётная запись.
|
|
type User struct {
|
|
ID uuid.UUID
|
|
Username string
|
|
DisplayName *string
|
|
PasswordHash string
|
|
Role Role
|
|
Locale string
|
|
UIPrefs UIPrefs
|
|
MustChangePassword bool
|
|
MustChangeCredentials bool
|
|
IsBlocked bool
|
|
TokenVersion int
|
|
FailedLoginCount int
|
|
LockedUntil *time.Time
|
|
CreatedAt time.Time
|
|
LastLoginAt *time.Time
|
|
}
|
|
|
|
// RefreshToken — строка refresh_tokens. Сам токен в БД не хранится, только SHA-256.
|
|
type RefreshToken struct {
|
|
ID uuid.UUID
|
|
UserID uuid.UUID
|
|
FamilyID uuid.UUID
|
|
FamilyStartedAt time.Time
|
|
TokenHash []byte
|
|
DeviceName *string
|
|
ClientType ClientType
|
|
CreatedAt time.Time
|
|
ExpiresAt time.Time
|
|
UsedAt *time.Time
|
|
RevokedAt *time.Time
|
|
}
|
|
|
|
// Session — активная семья refresh-токенов (одно устройство).
|
|
type Session struct {
|
|
ID uuid.UUID // family_id
|
|
DeviceName *string
|
|
ClientType ClientType
|
|
CreatedAt time.Time // начало семьи (вход)
|
|
LastUsedAt time.Time // последняя ротация
|
|
}
|
|
|
|
// Principal — аутентифицированный пользователь запроса (из access-токена и актуальной строки users).
|
|
type Principal struct {
|
|
UserID uuid.UUID
|
|
Role Role
|
|
SessionID uuid.UUID
|
|
MustChangePassword bool
|
|
MustChangeCredentials bool
|
|
}
|
|
|
|
// AuditRecord — прочитанная запись audit_log с логином автора.
|
|
type AuditRecord struct {
|
|
ID uuid.UUID
|
|
ActorID *uuid.UUID
|
|
ActorUsername *string
|
|
Action string
|
|
TargetType *string
|
|
TargetID *uuid.UUID
|
|
Payload map[string]any
|
|
CreatedAt time.Time
|
|
}
|
|
|
|
// AuditEntry — запись audit_log.
|
|
type AuditEntry struct {
|
|
ActorID *uuid.UUID
|
|
Action string
|
|
TargetType string
|
|
TargetID *uuid.UUID
|
|
Payload map[string]any
|
|
}
|