From 17bcf4b5b9a6bc68c69b559a0d8d0a32dc4ec69a Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Sun, 26 Jul 2026 12:52:15 +0100 Subject: [PATCH] feat(shared): auth_source constants and hq_user_id on User Nothing writes them yet. They land now so phases 2 and 3 do not require a second rebuild of every service that consumes the shared module. Co-Authored-By: Claude Opus 5 --- server/internal/models/user.go | 6 ++++++ shared/models/user.go | 18 ++++++++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/server/internal/models/user.go b/server/internal/models/user.go index 6c5a8e5..3e80ec0 100644 --- a/server/internal/models/user.go +++ b/server/internal/models/user.go @@ -10,4 +10,10 @@ const ( RoleMember = shared.RoleMember ) +const ( + AuthLocal = shared.AuthLocal + AuthOIDC = shared.AuthOIDC + AuthHQ = shared.AuthHQ +) + func ValidRole(role string) bool { return shared.ValidRole(role) } diff --git a/shared/models/user.go b/shared/models/user.go index 1e62040..56aecba 100644 --- a/shared/models/user.go +++ b/shared/models/user.go @@ -20,6 +20,17 @@ func ValidRole(role string) bool { return false } +// Auth sources. A user's auth_source says who owns the row. +const ( + AuthLocal = "local" + AuthOIDC = "oidc" + // AuthHQ marks a user projected from a Vantage HQ account. Its role, + // password and existence are owned by HQ, and the instance API refuses to + // change any of them locally — a role editable in two places is a role with + // two answers. + AuthHQ = "hq" +) + type User struct { ID bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"` UserID string `bson:"user_id" json:"user_id"` @@ -28,6 +39,9 @@ type User struct { PasswordHash string `bson:"password_hash,omitempty" json:"-"` Role string `bson:"role" json:"role"` AuthSource string `bson:"auth_source" json:"auth_source"` - CreatedAt time.Time `bson:"created_at" json:"created_at"` - LastLogin *time.Time `bson:"last_login,omitempty" json:"last_login,omitempty"` + // HQUserID is the customer_users.user_id this row was projected from, + // absent on locally-created users. + HQUserID string `bson:"hq_user_id,omitempty" json:"hq_user_id,omitempty"` + CreatedAt time.Time `bson:"created_at" json:"created_at"` + LastLogin *time.Time `bson:"last_login,omitempty" json:"last_login,omitempty"` }