Squid
463aa9a7a3
Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.
78 lines
2.0 KiB
Go
78 lines
2.0 KiB
Go
package settings
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
)
|
|
|
|
// MaxAuthAuditEvents is the retention cap for auth-audit.json.
|
|
const MaxAuthAuditEvents = 1000
|
|
|
|
// LoadAuthAudit reads and parses auth-audit.json from dir.
|
|
func LoadAuthAudit(dir string) (AuthAuditStore, error) {
|
|
path := filepath.Join(dir, AuthAuditFileName)
|
|
payload, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return AuthAuditStore{}, err
|
|
}
|
|
|
|
var store AuthAuditStore
|
|
if err := json.Unmarshal(payload, &store); err != nil {
|
|
return AuthAuditStore{}, fmt.Errorf("parse auth audit: %w", err)
|
|
}
|
|
if store.Events == nil {
|
|
store.Events = []AuthAuditEvent{}
|
|
}
|
|
return store, nil
|
|
}
|
|
|
|
// LoadAuthAuditOrEmpty returns an empty store when auth-audit.json is missing.
|
|
func LoadAuthAuditOrEmpty(dir string) (AuthAuditStore, error) {
|
|
store, err := LoadAuthAudit(dir)
|
|
if err != nil {
|
|
if errors.Is(err, os.ErrNotExist) {
|
|
return AuthAuditStore{Events: []AuthAuditEvent{}}, nil
|
|
}
|
|
return AuthAuditStore{}, err
|
|
}
|
|
return store, nil
|
|
}
|
|
|
|
// SaveAuthAudit writes auth-audit.json to dir with mode 0640.
|
|
func SaveAuthAudit(dir string, store AuthAuditStore) error {
|
|
if err := ensureConfigDir(dir); err != nil {
|
|
return err
|
|
}
|
|
if store.Events == nil {
|
|
store.Events = []AuthAuditEvent{}
|
|
}
|
|
|
|
payload, err := json.MarshalIndent(store, "", " ")
|
|
if err != nil {
|
|
return fmt.Errorf("encode auth audit: %w", err)
|
|
}
|
|
payload = append(payload, '\n')
|
|
|
|
path := filepath.Join(dir, AuthAuditFileName)
|
|
if err := os.WriteFile(path, payload, 0o640); err != nil {
|
|
return fmt.Errorf("write auth audit: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// AppendAuthAuditEvent appends event and trims to MaxAuthAuditEvents (newest kept).
|
|
func AppendAuthAuditEvent(dir string, event AuthAuditEvent) error {
|
|
store, err := LoadAuthAuditOrEmpty(dir)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
store.Events = append(store.Events, event)
|
|
if len(store.Events) > MaxAuthAuditEvents {
|
|
store.Events = store.Events[len(store.Events)-MaxAuthAuditEvents:]
|
|
}
|
|
return SaveAuthAudit(dir, store)
|
|
}
|