fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/persistence/repositories/revokedSessionRepository.go

@@ -0,0 +1,39 @@
+package persistence
+
+import (
+	domainSession "RenewCMS/internal/domain/session"
+	"RenewCMS/internal/infrastructure/persistence/mappers"
+	entity "RenewCMS/internal/infrastructure/persistence/models"
+	"time"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type RevokedSessionRepository struct {
+	db *gorm.DB
+}
+
+func NewRevokedSessionRepository(db *gorm.DB) *RevokedSessionRepository {
+	return &RevokedSessionRepository{db}
+}
+
+func (s *RevokedSessionRepository) Revoke(revocation domainSession.Revocation) error {
+	model := mappers.RevokedSessionToModel(revocation)
+	return s.db.Clauses(clause.OnConflict{DoNothing: true}).Create(&model).Error
+}
+
+func (s *RevokedSessionRepository) IsRevoked(id string) (bool, error) {
+	var count int64
+	if err := s.db.Model(&entity.RevokedSession{}).Where("id = ?", id).Count(&count).Error; err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
+func (s *RevokedSessionRepository) DeleteExpired(now time.Time) (int, error) {
+	result := s.db.Where("expires_at <= ?", now.UTC()).Delete(&entity.RevokedSession{})
+	return int(result.RowsAffected), result.Error
+}
+
+var _ domainSession.Repository = &RevokedSessionRepository{}