eb931bf1c6
Add Session model, SessionService, and SessionRepository to track user login sessions and enable token revocation on auth-critical events. - Introduce explicit TokenType (access/refresh) in JWT claims to prevent refresh token misuse via access token endpoints - Add SessionID field to JWT claims, enabling stateless JWT validation against revoked sessions - Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline that validates token type, account status, and session validity - Implement session revocation on password change, reset, user ban/inactive, and explicit logout - Add Principal cache with active invalidation for banned/role-changed users - Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID is conversation participant via GetParticipantStrict - Add group member visibility checks: announcements, group info, member list now require group membership - Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher with globMatch; user_roles table is single source of truth for roles - Add migration logic to clean legacy casbin g rules and migrate old p rules from path-style to admin/<domain> resource naming
23 lines
687 B
Go
23 lines
687 B
Go
package auth
|
|
|
|
import "with_you/internal/cache"
|
|
|
|
// InvalidatePrincipalCache 失效用户的 Principal 缓存。
|
|
//
|
|
// 供角色变更、账户状态变更、登出等场景调用：让 RequireAuth 在下一次请求
|
|
// 重新从 IDP 加载用户与角色。键定义在本包以避免 service → middleware 的包循环。
|
|
func InvalidatePrincipalCache(cch cache.Cache, userID string) {
|
|
if cch == nil || userID == "" {
|
|
return
|
|
}
|
|
cch.Delete(PrincipalCacheKey(userID))
|
|
}
|
|
|
|
// InvalidateSessionCache 失效会话有效性缓存。
|
|
func InvalidateSessionCache(cch cache.Cache, sessionID string) {
|
|
if cch == nil || sessionID == "" {
|
|
return
|
|
}
|
|
cch.Delete(SessionCacheKey(sessionID))
|
|
}
|