etalon
c1cc781279
- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params - token-bucket rate limiting (10/15min per IP+email) on login/register - opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all - CSRF double-submit cookie/header on authenticated mutations - bootstrap admin from env with forced first-login password change - requireAuth/requireRole middleware with disabled-account enforcement - OIDC code flow with PKCE: lazy discovery, account linking only on verified email, auto-created developer accounts - unit tests (RBAC matrix, CSRF, password, rate limiter) + integration suite covering the full auth matrix incl. an in-test fake IdP Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
565 B
Go
19 lines
565 B
Go
package domain
|
|
|
|
import "time"
|
|
|
|
// Session is an opaque server-side session (§4.8). The random token is the
|
|
// document id; the Mongo TTL index on expiresAt reaps stale rows.
|
|
type Session struct {
|
|
Token string `bson:"_id"`
|
|
UserID string `bson:"userId"`
|
|
CreatedAt time.Time `bson:"createdAt"`
|
|
ExpiresAt time.Time `bson:"expiresAt"`
|
|
RefreshedAt time.Time `bson:"refreshedAt"`
|
|
IP string `bson:"ip"`
|
|
UA string `bson:"ua"`
|
|
}
|
|
|
|
// SessionTTL is the sliding session lifetime (§7).
|
|
const SessionTTL = 30 * 24 * time.Hour
|