NEXUS-1: Initial commit of Nexus

internal/models/session.go

@@ -0,0 +1,49 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// Session represents an authenticated user session.
+type Session struct {
+	ID           uuid.UUID  `json:"id"`
+	UserID       uuid.UUID  `json:"user_id"`
+	TokenHash    string     `json:"-"`
+	RefreshToken string     `json:"-"`
+	IPAddress    string     `json:"ip_address"`
+	UserAgent    string     `json:"user_agent"`
+	ExpiresAt    time.Time  `json:"expires_at"`
+	RevokedAt    *time.Time `json:"revoked_at,omitempty"`
+	CreatedAt    time.Time  `json:"created_at"`
+}
+
+// ConnectedApp represents an external tool integrated via SSO.
+// These are the "spokes" of the Nexus hub.
+type ConnectedApp struct {
+	ID               uuid.UUID `json:"id"`
+	Name             string    `json:"name"`
+	Slug             string    `json:"slug"`
+	Description      string    `json:"description,omitempty"`
+	HomepageURL      string    `json:"homepage_url"`
+	SSOCallbackURL   string    `json:"sso_callback_url"`
+	ClientID         string    `json:"client_id"`
+	ClientSecretHash string    `json:"-"`
+	Active           bool      `json:"active"`
+	CreatedAt        time.Time `json:"created_at"`
+	UpdatedAt        time.Time `json:"updated_at"`
+}
+
+// AuditLog records a security-relevant event for compliance and debugging.
+type AuditLog struct {
+	ID        uuid.UUID `json:"id"`
+	UserID    uuid.UUID `json:"user_id,omitempty"`
+	Action    string    `json:"action"`
+	Resource  string    `json:"resource"`
+	IPAddress string    `json:"ip_address"`
+	UserAgent string    `json:"user_agent"`
+	Metadata  string    `json:"metadata,omitempty"` // JSON-encoded extra context
+	CreatedAt time.Time `json:"created_at"`
+}
+

internal/models/user.go

@@ -0,0 +1,56 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// User represents an identity in the Nexus Control Panel.
+// It is the single source of truth for all connected tools.
+type User struct {
+	ID             uuid.UUID  `json:"id"`
+	Email          string     `json:"email"`
+	DisplayName    string     `json:"display_name"`
+	PasswordHash   string     `json:"-"` // never serialized
+	MFAEnabled     bool       `json:"mfa_enabled"`
+	MFASecret      string     `json:"-"` // never serialized
+	EmailVerified  bool       `json:"email_verified"`
+	Active         bool       `json:"active"`
+	LastLoginAt    *time.Time `json:"last_login_at,omitempty"`
+	CreatedAt      time.Time  `json:"created_at"`
+	UpdatedAt      time.Time  `json:"updated_at"`
+}
+
+// Role represents a named set of permissions.
+type Role struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description,omitempty"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+// UserRole associates a user with a role.
+type UserRole struct {
+	UserID    uuid.UUID `json:"user_id"`
+	RoleID    uuid.UUID `json:"role_id"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// Permission defines a granular action that can be allowed or denied.
+type Permission struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	Resource    string    `json:"resource"`
+	Action      string    `json:"action"`
+	Description string    `json:"description,omitempty"`
+}
+
+// RolePermission associates a role with a permission.
+type RolePermission struct {
+	RoleID       uuid.UUID `json:"role_id"`
+	PermissionID uuid.UUID `json:"permission_id"`
+	CreatedAt    time.Time `json:"created_at"`
+}
+