53 lines
2.2 KiB
Go
53 lines
2.2 KiB
Go
package validator
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"browser.local/platform/domain"
|
|
)
|
|
|
|
func ValidateAuthSessionRecord(session domain.AuthSessionRecord) error {
|
|
var violations []string
|
|
violations = appendRequired(violations, "id", session.ID)
|
|
violations = appendRequired(violations, "userId", session.UserID)
|
|
violations = appendRequired(violations, "tokenHash", session.TokenHash)
|
|
if len(strings.TrimSpace(session.TokenHash)) != 64 {
|
|
violations = append(violations, "tokenHash must be a SHA-256 verifier")
|
|
}
|
|
if session.Status != domain.AuthSessionStatusActive && session.Status != domain.AuthSessionStatusRevoked {
|
|
violations = append(violations, "status is invalid")
|
|
}
|
|
if session.Generation <= 0 {
|
|
violations = append(violations, "generation must be positive")
|
|
}
|
|
if session.IssuedAt.IsZero() || session.ExpiresAt.IsZero() || !session.ExpiresAt.After(session.IssuedAt) {
|
|
violations = append(violations, "session expiry must be after issue time")
|
|
}
|
|
if session.Status == domain.AuthSessionStatusRevoked && session.RevokedAt.IsZero() {
|
|
violations = append(violations, "revokedAt is required for revoked sessions")
|
|
}
|
|
return finish(violations)
|
|
}
|
|
|
|
func ValidateRunControlSession(session domain.RunControlSession) error {
|
|
var violations []string
|
|
violations = appendRequired(violations, "runEndpointId", session.RunEndpointID)
|
|
violations = appendRequired(violations, "sessionTokenHash", session.SessionTokenHash)
|
|
if len(strings.TrimSpace(session.SessionTokenHash)) != 64 {
|
|
violations = append(violations, "sessionTokenHash must be a SHA-256 verifier")
|
|
}
|
|
if session.Status != domain.AuthSessionStatusActive && session.Status != domain.AuthSessionStatusRevoked {
|
|
violations = append(violations, "status is invalid")
|
|
}
|
|
if session.Generation <= 0 {
|
|
violations = append(violations, "generation must be positive")
|
|
}
|
|
if session.CreatedAt.IsZero() || session.ExpiresAt.IsZero() || !session.ExpiresAt.After(session.CreatedAt) {
|
|
violations = append(violations, "session expiry must be after creation time")
|
|
}
|
|
if session.Status == domain.AuthSessionStatusRevoked && session.RevokedAt.IsZero() {
|
|
violations = append(violations, "revokedAt is required for revoked sessions")
|
|
}
|
|
return finish(violations)
|
|
}
|