changing layout

cmd/server/main.go

@@ -8,52 +8,25 @@ import (
 	"net/http"
 
 	"github.com/example/cms/internal/config"
-	"github.com/example/cms/internal/identity"
 	"github.com/example/cms/internal/repository"
+	"github.com/example/cms/internal/security"
 	"github.com/example/cms/internal/service"
 	"github.com/example/cms/internal/web"
 	"github.com/pressly/goose/v3"
 	"github.com/pressly/goose/v3/database"
 	"gorm.io/driver/postgres"
-	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 )
 
-//go:embed migrations/admin/*.sql migrations/postgres/*.sql
+//go:embed migrations/postgres/*.sql
 var migrations embed.FS
 
 func main() {
-	cfg, err := config.Load()
-	if err != nil {
-		log.Fatal(err)
-	}
-	adminDB, err := gorm.Open(sqlite.Open(cfg.AdminDatabaseURL), &gorm.Config{})
-	if err != nil {
-		log.Fatal(err)
-	}
+	cfg := config.Load()
 	applicationDB, err := gorm.Open(postgres.Open(cfg.ApplicationDatabaseURL), &gorm.Config{})
 	if err != nil {
 		log.Fatal(err)
 	}
-	adminSQLDB, err := adminDB.DB()
-	if err != nil {
-		log.Fatal(err)
-	}
-	adminMigrations, err := fs.Sub(migrations, "migrations/admin")
-	if err != nil {
-		log.Fatal(err)
-	}
-	adminStore, err := database.NewStore(goose.DialectSQLite3, "goose_admin_db_version")
-	if err != nil {
-		log.Fatal(err)
-	}
-	adminProvider, err := goose.NewProvider("", adminSQLDB, adminMigrations, goose.WithStore(adminStore))
-	if err != nil {
-		log.Fatal(err)
-	}
-	if _, err = adminProvider.Up(context.Background()); err != nil {
-		log.Fatal(err)
-	}
 	applicationSQLDB, err := applicationDB.DB()
 	if err != nil {
 		log.Fatal(err)
@@ -73,17 +46,10 @@ func main() {
 	if _, err = applicationProvider.Up(context.Background()); err != nil {
 		log.Fatal(err)
 	}
-	auth := service.NewAuthServiceWithSeparateSessions(
-		repository.NewUserRepository(applicationDB),
-		repository.NewAdminRepository(adminDB),
-		repository.NewSessionRepository(applicationDB),
-		repository.NewSessionRepository(adminDB),
-		cfg.SessionTTL,
-	)
-	content := service.NewContentService(repository.NewContentRepository(applicationDB), auth)
-	google := identity.GoogleProvider{ClientID: cfg.GoogleClientID, ClientSecret: cfg.GoogleClientSecret, RedirectURL: cfg.GoogleRedirectURL}
+	content := service.NewContentService(repository.NewContentRepository(applicationDB))
+	sso := security.NewSSOTokenVerifier(cfg.SSOHeader, cfg.SSOToken, cfg.SSOCookie)
 	log.Printf("CMS listening on %s", cfg.HTTPAddr)
-	if err = http.ListenAndServe(cfg.HTTPAddr, web.NewHandlerWithContent(auth, google, content).Routes(cfg.AllowedOrigins)); err != nil {
+	if err = http.ListenAndServe(cfg.HTTPAddr, web.NewHandler(content, sso).Routes(cfg.AllowedOrigins)); err != nil {
 		log.Fatal(err)
 	}
 }

cmd/server/migrations/admin/001_init.sql

@@ -1,7 +0,0 @@
--- +goose Up
-CREATE TABLE IF NOT EXISTS admins (id INTEGER PRIMARY KEY AUTOINCREMENT, email TEXT NOT NULL UNIQUE, name TEXT NOT NULL DEFAULT '', created_at DATETIME NOT NULL);
-CREATE TABLE IF NOT EXISTS sessions (id INTEGER PRIMARY KEY AUTOINCREMENT, token TEXT NOT NULL UNIQUE, user_id INTEGER, admin_id INTEGER REFERENCES admins(id), expires_at DATETIME NOT NULL, created_at DATETIME NOT NULL);
-CREATE INDEX IF NOT EXISTS idx_sessions_expires_at ON sessions(expires_at);
--- +goose Down
-DROP TABLE IF EXISTS sessions;
-DROP TABLE IF EXISTS admins;

cmd/server/migrations/postgres/004_sso.sql

@@ -0,0 +1,35 @@
+-- +goose Up
+-- The CMS no longer stores identities: the upstream SSO proxy owns them.
+ALTER TABLE content DROP COLUMN IF EXISTS created_by;
+ALTER TABLE content DROP COLUMN IF EXISTS updated_by;
+ALTER TABLE content_history DROP COLUMN IF EXISTS actor_id;
+ALTER TABLE content_history DROP COLUMN IF EXISTS actor_admin_id;
+DROP TABLE IF EXISTS sessions;
+DROP TABLE IF EXISTS users;
+
+-- +goose Down
+CREATE TABLE IF NOT EXISTS users (
+    id BIGSERIAL PRIMARY KEY,
+    email TEXT NOT NULL,
+    name TEXT NOT NULL DEFAULT '',
+    provider TEXT NOT NULL,
+    provider_subject TEXT NOT NULL,
+    role TEXT NOT NULL DEFAULT '',
+    editor BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email ON users(email);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_users_provider_subject ON users(provider, provider_subject);
+CREATE TABLE IF NOT EXISTS sessions (
+    id BIGSERIAL PRIMARY KEY,
+    token TEXT NOT NULL UNIQUE,
+    user_id BIGINT REFERENCES users(id),
+    admin_id BIGINT,
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires_at ON sessions(expires_at);
+ALTER TABLE content ADD COLUMN IF NOT EXISTS created_by BIGINT REFERENCES users(id);
+ALTER TABLE content ADD COLUMN IF NOT EXISTS updated_by BIGINT REFERENCES users(id);
+ALTER TABLE content_history ADD COLUMN IF NOT EXISTS actor_id BIGINT REFERENCES users(id);
+ALTER TABLE content_history ADD COLUMN IF NOT EXISTS actor_admin_id BIGINT;