Calcium-Ion
31d70fca39
* refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app
52 lines
1.5 KiB
Go
52 lines
1.5 KiB
Go
package service
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/QuantumNous/new-api/common"
|
|
"github.com/QuantumNous/new-api/model"
|
|
)
|
|
|
|
const authArtifactCleanupInterval = time.Hour
|
|
|
|
// StartAuthArtifactCleanup removes expired dashboard Sessions and old
|
|
// one-time authentication flows. Only the master instance performs cleanup.
|
|
func StartAuthArtifactCleanup() {
|
|
if !common.IsMasterNode {
|
|
return
|
|
}
|
|
go func() {
|
|
cleanupAuthArtifacts()
|
|
ticker := time.NewTicker(authArtifactCleanupInterval)
|
|
defer ticker.Stop()
|
|
for range ticker.C {
|
|
cleanupAuthArtifacts()
|
|
}
|
|
}()
|
|
}
|
|
|
|
func cleanupAuthArtifacts() {
|
|
now := time.Now()
|
|
count, err := model.CountUserSessionsCreatedSince(0, now.Add(-time.Hour).Unix())
|
|
if err != nil {
|
|
common.SysError("failed to count hourly user session issuance: " + err.Error())
|
|
} else if count > int64(common.UserSessionHourlyAlertThreshold) {
|
|
common.SysError(fmt.Sprintf(
|
|
"hourly user session issuance exceeded alert threshold: count=%d threshold=%d window_seconds=%d",
|
|
count,
|
|
common.UserSessionHourlyAlertThreshold,
|
|
int64(time.Hour/time.Second),
|
|
))
|
|
}
|
|
if err := model.DeleteExpiredUserSessions(now.Unix()); err != nil {
|
|
common.SysError("failed to delete expired user sessions: " + err.Error())
|
|
}
|
|
if err := model.DeleteOldRevokedUserSessions(now.Unix()); err != nil {
|
|
common.SysError("failed to delete old revoked user sessions: " + err.Error())
|
|
}
|
|
if err := model.DeleteExpiredAuthFlows(now); err != nil {
|
|
common.SysError("failed to delete expired authentication flows: " + err.Error())
|
|
}
|
|
}
|