mrhid6andClaude Opus 5
17bcf4b5b9
Nothing writes them yet. They land now so phases 2 and 3 do not require a second rebuild of every service that consumes the shared module. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.4 KiB
Go
48 lines
1.4 KiB
Go
package models
|
|
|
|
import (
|
|
"time"
|
|
|
|
"go.mongodb.org/mongo-driver/v2/bson"
|
|
)
|
|
|
|
const (
|
|
RoleOwner = "owner"
|
|
RoleAdmin = "admin"
|
|
RoleMember = "member"
|
|
)
|
|
|
|
func ValidRole(role string) bool {
|
|
switch role {
|
|
case RoleOwner, RoleAdmin, RoleMember:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// Auth sources. A user's auth_source says who owns the row.
|
|
const (
|
|
AuthLocal = "local"
|
|
AuthOIDC = "oidc"
|
|
// AuthHQ marks a user projected from a Vantage HQ account. Its role,
|
|
// password and existence are owned by HQ, and the instance API refuses to
|
|
// change any of them locally — a role editable in two places is a role with
|
|
// two answers.
|
|
AuthHQ = "hq"
|
|
)
|
|
|
|
type User struct {
|
|
ID bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
|
|
UserID string `bson:"user_id" json:"user_id"`
|
|
InstanceID string `bson:"instance_id" json:"instance_id"`
|
|
Email string `bson:"email" json:"email"`
|
|
PasswordHash string `bson:"password_hash,omitempty" json:"-"`
|
|
Role string `bson:"role" json:"role"`
|
|
AuthSource string `bson:"auth_source" json:"auth_source"`
|
|
// HQUserID is the customer_users.user_id this row was projected from,
|
|
// absent on locally-created users.
|
|
HQUserID string `bson:"hq_user_id,omitempty" json:"hq_user_id,omitempty"`
|
|
CreatedAt time.Time `bson:"created_at" json:"created_at"`
|
|
LastLogin *time.Time `bson:"last_login,omitempty" json:"last_login,omitempty"`
|
|
}
|