pptx704
42af7c4357
User authentication moves from short-lived JWT bearer tokens to opaque session cookies (wrenn_sid) backed by a Postgres sessions table and a Redis hot cache. Browsers get a paired wrenn_csrf cookie; all mutating requests must echo it via X-CSRF-Token (double-submit). - New pkg/auth/session service: issue/revoke, idle (6h) + absolute (24h) lifetimes, switch-team rotation, RevokeAllForUser on password events, per-user listing for self-service. - Middleware: requireSession + requireCSRF replace requireJWT and the WS first-message JWT exchange. SSE/WS endpoints rely on the cookie flowing on the upgrade — SSE ticket store deleted. - API keys (wrn_<32hex>) remain for SDK/server use; capsule routes accept either via requireSessionOrAPIKey. - Host-agent JWTs (signed by JWT_SECRET) are unchanged — that channel is wrenn-cp ↔ wrenn-agent and unrelated to user identity. - Frontend client drops bearer-token plumbing, sends credentials and the CSRF header on every mutating call. - OpenAPI + dashboard host-registration docs updated.
29 lines
841 B
SQL
29 lines
841 B
SQL
-- name: InsertSession :one
|
|
INSERT INTO sessions (id, user_id, team_id, csrf_token, user_agent, ip_address, expires_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7)
|
|
RETURNING *;
|
|
|
|
-- name: GetSession :one
|
|
SELECT * FROM sessions WHERE id = $1;
|
|
|
|
-- name: TouchSession :exec
|
|
UPDATE sessions SET last_seen_at = NOW() WHERE id = $1;
|
|
|
|
-- name: UpdateSessionTeam :exec
|
|
UPDATE sessions SET team_id = $2 WHERE id = $1;
|
|
|
|
-- name: DeleteSession :exec
|
|
DELETE FROM sessions WHERE id = $1;
|
|
|
|
-- name: DeleteSessionForUser :exec
|
|
DELETE FROM sessions WHERE id = $1 AND user_id = $2;
|
|
|
|
-- name: ListSessionsByUserID :many
|
|
SELECT * FROM sessions WHERE user_id = $1 ORDER BY last_seen_at DESC;
|
|
|
|
-- name: DeleteSessionsByUserID :many
|
|
DELETE FROM sessions WHERE user_id = $1 RETURNING id;
|
|
|
|
-- name: DeleteExpiredSessions :exec
|
|
DELETE FROM sessions WHERE expires_at < NOW();
|