Feat(BE-69,70,71,72,73): crud and integration sso with lti, revoke_token

internal/modules/sso/session/revocation.go

@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -87,6 +88,54 @@ func (s *RevocationStore) IsRevoked(ctx context.Context, fingerprint string) (bo
 	return exists > 0, nil
 }
 
+// MarkUserLogout stores the timestamp of the last forced logout for the given user.
+func (s *RevocationStore) MarkUserLogout(ctx context.Context, userID uint, at time.Time) error {
+	if s == nil || s.redis == nil {
+		return errors.New("revocation store redis client not initialised")
+	}
+	if userID == 0 {
+		return errors.New("invalid user id")
+	}
+	key := s.userLogoutKey(userID)
+	return s.redis.Set(ctx, key, at.UTC().Format(time.RFC3339Nano), 0).Err()
+}
+
+// ClearUserLogout removes any stored forced logout marker for the given user.
+func (s *RevocationStore) ClearUserLogout(ctx context.Context, userID uint) error {
+	if s == nil || s.redis == nil {
+		return errors.New("revocation store redis client not initialised")
+	}
+	if userID == 0 {
+		return errors.New("invalid user id")
+	}
+	key := s.userLogoutKey(userID)
+	return s.redis.Del(ctx, key).Err()
+}
+
+// UserLogoutTime returns the timestamp of the last forced logout for the given user.
+func (s *RevocationStore) UserLogoutTime(ctx context.Context, userID uint) (time.Time, error) {
+	var zero time.Time
+	if s == nil || s.redis == nil {
+		return zero, errors.New("revocation store redis client not initialised")
+	}
+	if userID == 0 {
+		return zero, errors.New("invalid user id")
+	}
+	key := s.userLogoutKey(userID)
+	value, err := s.redis.Get(ctx, key).Result()
+	if err != nil {
+		if errors.Is(err, redis.Nil) {
+			return zero, nil
+		}
+		return zero, err
+	}
+	ts, err := time.Parse(time.RFC3339Nano, value)
+	if err != nil {
+		return zero, err
+	}
+	return ts, nil
+}
+
 func (s *RevocationStore) keyFor(fingerprint string) string {
 	prefix := s.prefix
 	if prefix == "" {
@@ -95,6 +144,14 @@ func (s *RevocationStore) keyFor(fingerprint string) string {
 	return prefix + ":" + fingerprint
 }
 
+func (s *RevocationStore) userLogoutKey(userID uint) string {
+	prefix := s.prefix
+	if prefix == "" {
+		prefix = "sso:blacklist"
+	}
+	return prefix + ":user-logout:" + strconv.FormatUint(uint64(userID), 10)
+}
+
 // TokenFingerprint hashes token material before persisting it to the blacklist.
 func TokenFingerprint(token string) string {
 	token = strings.TrimSpace(token)