fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/useCases/EnforceRetention.go

@@ -0,0 +1,61 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/invite"
+	"RenewCMS/internal/domain/retention"
+	"RenewCMS/internal/domain/session"
+	"RenewCMS/internal/domain/user"
+	"time"
+)
+
+type EnforceRetentionUseCase struct {
+	users    user.Repository
+	invites  invite.Repository
+	sessions session.Repository
+}
+
+func NewEnforceRetentionUseCase(users user.Repository, invites invite.Repository, sessions session.Repository) *EnforceRetentionUseCase {
+	return &EnforceRetentionUseCase{users, invites, sessions}
+}
+
+func (e *EnforceRetentionUseCase) Tick(now time.Time) (retention.Result, error) {
+	var result retention.Result
+	var err error
+
+	if result.RevokedSessions, err = e.sessions.DeleteExpired(now); err != nil {
+		return result, err
+	}
+	if result.UnverifiedUsers, err = e.deleteStaleUnverifiedUsers(now); err != nil {
+		return result, err
+	}
+	result.Invites, err = e.deleteStaleInvites(now)
+	return result, err
+}
+
+func (e *EnforceRetentionUseCase) deleteStaleUnverifiedUsers(now time.Time) (int, error) {
+	removed := 0
+	for _, candidate := range e.users.GetAll() {
+		if !candidate.IsStaleUnverifiedAt(now) {
+			continue
+		}
+		if err := e.users.Delete(candidate.ID); err != nil {
+			return removed, err
+		}
+		removed++
+	}
+	return removed, nil
+}
+
+func (e *EnforceRetentionUseCase) deleteStaleInvites(now time.Time) (int, error) {
+	removed := 0
+	for _, candidate := range e.invites.GetAll() {
+		if !candidate.IsStaleAt(now) {
+			continue
+		}
+		if err := e.invites.Delete(candidate.ID); err != nil {
+			return removed, err
+		}
+		removed++
+	}
+	return removed, nil
+}