tenseleyflow/shithub / 85f1131

Browse files

Add PAT audit actions, reserve 'tokens' segment, add Session.Recent2FAAt for recent-auth gate

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
85f113195a1e21016d03bb9c8ebf1307023f21a2
Parents
5e04699
Tree
e72f214

4 changed files

StatusFile+-
M internal/auth/audit/audit.go 2 0
M internal/auth/reserved.go 1 0
M internal/auth/session/session.go 1 0
M internal/meta/sqlc/models.go 14 0
internal/auth/audit/audit.gomodified
@@ -42,6 +42,8 @@ const (
4242
 	ActionAccountSuspended     Action = "account_suspended"
4343
 	ActionSSHKeyAdded          Action = "ssh_key_added"
4444
 	ActionSSHKeyDeleted        Action = "ssh_key_deleted"
45
+	ActionPATCreated           Action = "pat_created"
46
+	ActionPATRevoked           Action = "pat_revoked"
4547
 )
4648
4749
 // Target is a typed target-type constant.
internal/auth/reserved.gomodified
@@ -78,6 +78,7 @@ var reservedNames = map[string]struct{}{
7878
 	"public":        {},
7979
 	"private":       {},
8080
 	"keys":          {},
81
+	"tokens":        {},
8182
 	"shithub":       {},
8283
 	"shithubd":      {},
8384
 	"shithubbot":    {},
internal/auth/session/session.gomodified
@@ -30,6 +30,7 @@ const DefaultMaxAge = 30 * 24 * time.Hour
3030
 type Session struct {
3131
 	UserID       int64             `json:"uid,omitempty"`
3232
 	Pre2FAUserID int64             `json:"p2,omitempty"` // set after password OK, before TOTP step
33
+	Recent2FAAt  int64             `json:"r2,omitempty"` // unix-seconds of last successful 2FA challenge
3334
 	CSRFToken    string            `json:"csrf,omitempty"`
3435
 	Theme        string            `json:"theme,omitempty"`
3536
 	Flashes      []string          `json:"flashes,omitempty"`
internal/meta/sqlc/models.gomodified
@@ -103,6 +103,20 @@ type UserSshKey struct {
103103
 	CreatedAt         pgtype.Timestamptz
104104
 }
105105
106
+type UserToken struct {
107
+	ID          int64
108
+	UserID      int64
109
+	Name        string
110
+	TokenHash   []byte
111
+	TokenPrefix string
112
+	Scopes      []string
113
+	ExpiresAt   pgtype.Timestamptz
114
+	LastUsedAt  pgtype.Timestamptz
115
+	LastUsedIp  *netip.Addr
116
+	RevokedAt   pgtype.Timestamptz
117
+	CreatedAt   pgtype.Timestamptz
118
+}
119
+
106120
 type UserTotp struct {
107121
 	ID              int64
108122
 	UserID          int64