mirror of
https://github.com/grafana/grafana.git
synced 2025-07-29 04:32:08 +08:00
bd7850853e
* initial from poc changes * wip * Remove public external session service * Update swagger * Fix merge * Cleanup * Add backgroud service for cleanup * Add auth_module to user_external_session * Add tests for token revocation functions * Add secret migration capabilities for user_external_session fields * Cleanup, refactor to address feedback * Fix test
58 lines
1.3 KiB
Go
58 lines
1.3 KiB
Go
package usertoken
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
var ErrInvalidSessionToken = errors.New("invalid session token")
|
|
|
|
type TokenRevokedError struct {
|
|
UserID int64
|
|
TokenID int64
|
|
MaxConcurrentSessions int64
|
|
}
|
|
|
|
func (e *TokenRevokedError) Error() string {
|
|
return fmt.Sprintf("%s: user token revoked", ErrInvalidSessionToken)
|
|
}
|
|
|
|
func (e *TokenRevokedError) Unwrap() error { return ErrInvalidSessionToken }
|
|
|
|
// UserToken represents a user token
|
|
type UserToken struct {
|
|
Id int64
|
|
UserId int64
|
|
ExternalSessionId int64
|
|
AuthToken string
|
|
PrevAuthToken string
|
|
UserAgent string
|
|
ClientIp string
|
|
AuthTokenSeen bool
|
|
SeenAt int64
|
|
RotatedAt int64
|
|
CreatedAt int64
|
|
UpdatedAt int64
|
|
RevokedAt int64
|
|
UnhashedToken string
|
|
}
|
|
|
|
const UrgentRotateTime = 1 * time.Minute
|
|
|
|
func (t *UserToken) NeedsRotation(rotationInterval time.Duration) bool {
|
|
rotatedAt := time.Unix(t.RotatedAt, 0)
|
|
if !t.AuthTokenSeen {
|
|
return rotatedAt.Before(time.Now().Add(-UrgentRotateTime))
|
|
}
|
|
|
|
return rotatedAt.Before(time.Now().Add(-rotationInterval))
|
|
}
|
|
|
|
const rotationLeeway = 5 * time.Second
|
|
|
|
func (t *UserToken) NextRotation(rotationInterval time.Duration) time.Time {
|
|
rotatedAt := time.Unix(t.RotatedAt, 0)
|
|
return rotatedAt.Add(rotationInterval - rotationLeeway)
|
|
}
|