c3712dc0d4
classes.RevokeUserAccess stamps users.tokens_valid_after (whole seconds) and revokes the users' personal API tokens; DeactivateUsers and BanUsers call it for every selected user. Restore and unban revive nothing, and a deactivated user who signs in again gets a fresh working token. POST /refresh now loads the token's subject after bouncer.Refresh and refuses a missing, deactivated or banned user and a token issued before tokens_valid_after with the existing 401 body; a refused refresh stamps no last_seen. Suspension is deliberately not checked.
70 lines
2.4 KiB
Go
70 lines
2.4 KiB
Go
package classes
|
|
|
|
import (
|
|
"git.golem15.com/golem15/sm-user-plugin/models"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// CreatedEventName is the festival name of CreatedEvent (D-13 / RESEARCH A6).
|
|
const CreatedEventName = "user.Created"
|
|
|
|
// DeletingEventName is the festival name of DeletingEvent (D-13 / RESEARCH A6).
|
|
const DeletingEventName = "user.Deleting"
|
|
|
|
// DeactivatingEventName is the festival name of DeactivatingEvent.
|
|
const DeactivatingEventName = "user.Deactivating"
|
|
|
|
// GetApiArrayEvent is the fire-and-collect payload other plugins extend.
|
|
type GetApiArrayEvent struct {
|
|
User *models.User
|
|
data map[string]any
|
|
}
|
|
|
|
// Collected returns the map listeners merge into the user payload.
|
|
func (e *GetApiArrayEvent) Collected() map[string]any {
|
|
if e.data == nil {
|
|
e.data = map[string]any{}
|
|
}
|
|
return e.data
|
|
}
|
|
|
|
// RegisterEvent is fired after a user row is created (Winter's
|
|
// golem15.user.register).
|
|
type RegisterEvent struct {
|
|
User *models.User
|
|
// Payload is a copy of the register input, mirroring the data array
|
|
// Winter passes with golem15.user.register, so a listener can read
|
|
// extra keys a client sent (an invitation token, for example).
|
|
// password and password_confirmation are never included, in plaintext
|
|
// or hashed. Listeners must treat it as read-only input.
|
|
Payload map[string]any
|
|
}
|
|
|
|
// CreatedEvent fires from every user create path (API register and admin
|
|
// create) so listeners can run inside the same write, including handle
|
|
// generation (D-13, D-15). Tx is the create transaction when there is one.
|
|
type CreatedEvent struct {
|
|
User *models.User
|
|
Tx *gorm.DB
|
|
}
|
|
|
|
// DeletingEvent fires from FormAfterDelete before ForceDeleteCleanup /
|
|
// unscoped delete, inside the same transaction, so listeners (chatchannels
|
|
// GDPR) can sever rows before the user row is gone (D-13, T-19-07).
|
|
type DeletingEvent struct {
|
|
User *models.User
|
|
Tx *gorm.DB
|
|
}
|
|
|
|
// DeactivatingEvent fires after a user is soft-deleted (deactivated, the
|
|
// PHP $user->delete()) by the admin deactivate action, inside the same
|
|
// transaction, so listeners can revoke what a deactivated account must not
|
|
// keep (OAuth grants, for example) while leaving what a restore needs. The
|
|
// user's session JWTs and personal API tokens are already revoked when it
|
|
// fires (DeactivateUsers calls RevokeUserAccess). A listener error rolls the
|
|
// deactivation back.
|
|
type DeactivatingEvent struct {
|
|
User *models.User
|
|
Tx *gorm.DB
|
|
}
|