611f736088
- Add password_reset_required column (migration 004) + repository support - auth.Service.ChangePassword verifies current, hashes new, clears flag, emits PasswordChange audit events for success and failure - Bootstrap: when no ORCHESTRAD_BOOTSTRAP_PASSWORD[_FILE] is set, seed admin/admin with password_reset_required=true and log a one-time warn banner; env/file-supplied passwords keep the flag clear - Expose passwordResetRequired in UserInfo / /auth/me / login response - POST /api/v1/auth/change-password behind the authenticated group - Frontend: /change-password page + ChangePasswordForm, AuthLogin and RequireAuth bounce any other route to it while the flag is set - Docs: DesignSpecification 8.6/8.8 and Template 7.6/7.7 rewritten, Trusted Proxy renumbered to 7.8 in the template, acceptance items updated to match the new default-credential behavior
133 lines
3.2 KiB
Go
133 lines
3.2 KiB
Go
// Package models defines domain models for the application
|
|
package models
|
|
|
|
import "time"
|
|
|
|
// User represents a system user
|
|
type User struct {
|
|
ID string
|
|
Username string
|
|
Email *string
|
|
PasswordHash *string
|
|
DisplayName *string
|
|
IsActive bool
|
|
IsOIDCUser bool
|
|
OIDCProviderID *string
|
|
OIDCSubject *string
|
|
LastLoginUTC *time.Time
|
|
CreatedUTC time.Time
|
|
UpdatedUTC time.Time
|
|
DeletedUTC *time.Time
|
|
PasswordResetRequired bool
|
|
Roles []Role
|
|
}
|
|
|
|
// Role represents a system role for RBAC
|
|
type Role struct {
|
|
ID string
|
|
Name string
|
|
Description *string
|
|
IsSystemRole bool
|
|
CreatedUTC time.Time
|
|
UpdatedUTC time.Time
|
|
}
|
|
|
|
// Session represents a user session
|
|
type Session struct {
|
|
ID string
|
|
UserID string
|
|
TokenHash string
|
|
ExpiresUTC time.Time
|
|
CreatedUTC time.Time
|
|
RevokedUTC *time.Time
|
|
}
|
|
|
|
// APIKey represents an API key for programmatic access
|
|
type APIKey struct {
|
|
ID string
|
|
UserID string
|
|
Name string
|
|
KeyPrefix string
|
|
KeyHash string
|
|
ExpiresUTC *time.Time
|
|
IsEnabled bool
|
|
LastUsedUTC *time.Time
|
|
CreatedUTC time.Time
|
|
RevokedUTC *time.Time
|
|
}
|
|
|
|
// OIDCProvider represents an OIDC identity provider configuration
|
|
type OIDCProvider struct {
|
|
ID string
|
|
Name string
|
|
DisplayName string
|
|
IssuerURL string
|
|
ClientID string
|
|
ClientSecretEncrypted string
|
|
Scopes string
|
|
IsEnabled bool
|
|
AutoCreateUsers bool
|
|
DefaultRoleID *string
|
|
CreatedUTC time.Time
|
|
UpdatedUTC time.Time
|
|
DeletedUTC *time.Time
|
|
}
|
|
|
|
// Credential represents a stored credential for AD connections
|
|
type Credential struct {
|
|
ID string
|
|
Name string
|
|
Description *string
|
|
CredentialType string
|
|
Username *string
|
|
EncryptedSecret *string
|
|
IsEnabled bool
|
|
LastTestedUTC *time.Time
|
|
LastTestResult *string
|
|
CreatedUTC time.Time
|
|
UpdatedUTC time.Time
|
|
DeletedUTC *time.Time
|
|
}
|
|
|
|
// ADConnection represents an Active Directory connection configuration
|
|
type ADConnection struct {
|
|
ID string
|
|
Name string
|
|
Description *string
|
|
IsEnabled bool
|
|
Hosts string
|
|
Port int
|
|
UseTLS bool
|
|
UseStartTLS bool
|
|
AllowInvalidCerts bool
|
|
RootDN string
|
|
BindDN *string
|
|
CredentialID *string
|
|
DefaultSearchScope string
|
|
TimeoutSeconds int
|
|
PagingEnabled bool
|
|
PageSize int
|
|
LastTestedUTC *time.Time
|
|
LastTestResult *string
|
|
CreatedUTC time.Time
|
|
UpdatedUTC time.Time
|
|
DeletedUTC *time.Time
|
|
}
|
|
|
|
// Schedule represents a reusable schedule definition
|
|
type Schedule struct {
|
|
ID string
|
|
Name string
|
|
Description *string
|
|
IsEnabled bool
|
|
ScheduleKind string
|
|
EasyIntervalValue *int
|
|
EasyIntervalUnit *string
|
|
CronExpression *string
|
|
TimezoneMode string
|
|
NextRunUTC *time.Time
|
|
CreatedUTC time.Time
|
|
UpdatedUTC time.Time
|
|
DeletedUTC *time.Time
|
|
}
|