0.5.0

internal/master/auth_store.go

@@ -0,0 +1,78 @@
+package master
+
+import (
+	"strings"
+	"time"
+
+	"github.com/example/sessionguard/internal/model"
+)
+
+// authSessionStore adapts the Master's existing persistent control-plane store
+// to the auth package. Auth session mutations are rare (login/logout/revoke), so
+// persisting the small map alongside control-plane state avoids a separate
+// database dependency while verification itself stays read-only and cheap.
+type authSessionStore struct{ s *store }
+
+func (r authSessionStore) PutAuthSession(sess model.AuthSession) error {
+	r.s.mu.Lock()
+	defer r.s.mu.Unlock()
+	if r.s.data.AuthSessions == nil {
+		r.s.data.AuthSessions = map[string]model.AuthSession{}
+	}
+	r.s.data.AuthSessions[sess.TokenHash] = sess
+	return r.s.saveLocked()
+}
+
+func (r authSessionStore) GetAuthSession(hash string) (model.AuthSession, bool) {
+	r.s.mu.RLock()
+	defer r.s.mu.RUnlock()
+	sess, ok := r.s.data.AuthSessions[hash]
+	if !ok || (!sess.ExpiresAt.IsZero() && time.Now().UTC().After(sess.ExpiresAt)) {
+		return model.AuthSession{}, false
+	}
+	return sess, true
+}
+
+func (r authSessionStore) DeleteAuthSession(hash string) error {
+	r.s.mu.Lock()
+	defer r.s.mu.Unlock()
+	if _, ok := r.s.data.AuthSessions[hash]; !ok {
+		return nil
+	}
+	delete(r.s.data.AuthSessions, hash)
+	return r.s.saveLocked()
+}
+
+func (r authSessionStore) RevokeAuthSessions(sid, sub string) (int, error) {
+	sid = strings.TrimSpace(sid)
+	sub = strings.TrimSpace(sub)
+	r.s.mu.Lock()
+	defer r.s.mu.Unlock()
+	n := 0
+	for h, sess := range r.s.data.AuthSessions {
+		if (sid != "" && sess.SID == sid) || (sub != "" && sess.Subject == sub) {
+			delete(r.s.data.AuthSessions, h)
+			n++
+		}
+	}
+	if n == 0 {
+		return 0, nil
+	}
+	return n, r.s.saveLocked()
+}
+
+func (r authSessionStore) CleanupAuthSessions(now time.Time) error {
+	r.s.mu.Lock()
+	defer r.s.mu.Unlock()
+	changed := false
+	for h, sess := range r.s.data.AuthSessions {
+		if !sess.ExpiresAt.IsZero() && !now.Before(sess.ExpiresAt) {
+			delete(r.s.data.AuthSessions, h)
+			changed = true
+		}
+	}
+	if !changed {
+		return nil
+	}
+	return r.s.saveLocked()
+}