single db with prefixes, dump/restore, blacklisting on user deletion

pkg/server/context.go

@@ -15,6 +15,7 @@ import (
 const (
 	userClaim    = "user"
 	adminClaim   = "admin"
+	createdClaim = "created"
 	sharedClaim  = "shared"
 	sectionClaim = "section"
 	titleClaim   = "title"
@@ -40,8 +41,13 @@ func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Con
 			if err = s.JWT.Verify(t); err != nil {
 				log.Println("VerifyToken:", err)
 			} else {
-				ctx.Token = *t
-				return
+				if !s.DB.LockedOut(t.Claims.GetString(userClaim), t.Claims.GetString(createdClaim)) {
+					ctx.Token = *t
+					return
+				}
+				if err = s.JWT.Invalidate(t); err != nil {
+					log.Println("Invalidate:", err)
+				}
 			}
 		}
 	}

pkg/server/handler.go

@@ -100,7 +100,7 @@ func loginHandler(ctx *Context) {
 			ctx.Error(err)
 			return
 		}
-		ctx.SetCookie(jwt.Claims{userClaim: u.Username, adminClaim: u.Admin})
+		ctx.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin})
 		ctx.Redirect(core.IndexURI, 302)
 	}
 }
@@ -195,6 +195,13 @@ func pageHandler(ctx *Context) {
 			return
 		}
 		user = t.Claims.GetString(sharedClaim)
+		if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(createdClaim)) {
+			if err = ctx.Srv.JWT.Invalidate(t); err != nil {
+				log.Println("Invalidate:", err)
+			}
+			ctx.NotFound()
+			return
+		}
 		section = t.Claims.GetString(sectionClaim)
 		title = t.Claims.GetString(titleClaim)
 		ctx.Data.Key = key
@@ -259,6 +266,7 @@ func pageShareHandler(ctx *Context) {
 		}
 		t := jwt.NewToken(map[string]interface{}{
 			sharedClaim:  user,
+			createdClaim: ctx.Token.Claims.GetString(createdClaim),
 			sectionClaim: section,
 			titleClaim:   title,
 			jwt.ExpClaim: jwt.NewExp(d),

pkg/server/server.go

@@ -56,11 +56,11 @@ func (s *HTTPServer) Start() (err error) {
 	if s.Secret != "" {
 		buf = bytes.NewBufferString(s.Secret)
 	}
-	s.JWT, err = jwt.New(jwt.DefaultExpiry, jwt.NewMemBlacklist(), buf)
+	s.DB, err = db.New(s.DataDir)
 	if err != nil {
 		return
 	}
-	s.DB, err = db.New(s.DataDir)
+	s.JWT, err = jwt.New(jwt.DefaultExpiry, s.DB, buf)
 	if err != nil {
 		return
 	}