| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Command.Input; |
| | | 3 | | using ArturRios.Heimdall.Command.Output; |
| | | 4 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 5 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 6 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 7 | | using ArturRios.Heimdall.Shared.Services; |
| | | 8 | | using ArturRios.Mediator.Command.Interfaces; |
| | | 9 | | using ArturRios.Output; |
| | | 10 | | using Microsoft.EntityFrameworkCore; |
| | | 11 | | |
| | | 12 | | namespace ArturRios.Heimdall.Command.Handlers; |
| | | 13 | | |
| | | 14 | | /// <summary> |
| | | 15 | | /// Handles <see cref="AddScopeOwnerCommand" /> (UC-21, FR-SC-08/FR-SC-09): verifies the target |
| | | 16 | | /// scope exists and is active (AF-21a), enforces scope ownership for a Scope Admin actor |
| | | 17 | | /// (AF-21c), verifies the named person is an existing, non-deleted <c>ScopeAdmin</c> or |
| | | 18 | | /// <c>SystemAdmin</c> (AF-21b), then links them to the scope with a <c>SCOPE_OWNER</c> row — |
| | | 19 | | /// serving a person who already owns it as an idempotent no-op (AF-21d). A System Admin actor |
| | | 20 | | /// bypasses the ownership check. All failures are returned as errors on the |
| | | 21 | | /// <see cref="DataOutput{T}" /> rather than thrown. |
| | | 22 | | /// </summary> |
| | 23 | 23 | | public class AddScopeOwnerCommandHandler( |
| | 23 | 24 | | IAsyncReadOnlyRepository<Scope, long> scopeReader, |
| | 23 | 25 | | IAsyncReadOnlyRepository<Person, long> personReader, |
| | 23 | 26 | | IAsyncRepository<Person, long> personWriter, |
| | 23 | 27 | | IScopeOwnershipChecker scopeOwnership) |
| | | 28 | | : ICommandHandlerAsync<AddScopeOwnerCommand, AddScopeOwnerCommandOutput> |
| | | 29 | | { |
| | | 30 | | public async Task<DataOutput<AddScopeOwnerCommandOutput?>> HandleAsync(AddScopeOwnerCommand command, CancellationTok |
| | | 31 | | { |
| | 23 | 32 | | var output = DataOutput<AddScopeOwnerCommandOutput?>.New; |
| | | 33 | | |
| | | 34 | | // AF-21a (UC-21 step 2): the target scope must exist and not be logically deleted — the |
| | | 35 | | // alternative flow names both conditions as one outcome, so the filter answers for both. |
| | 23 | 36 | | var scope = await scopeReader.Query() |
| | 23 | 37 | | .FirstOrDefaultAsync(x => x.PublicId == command.ScopeId && !x.IsDeleted); |
| | | 38 | | |
| | 23 | 39 | | if (scope is null) |
| | | 40 | | { |
| | 4 | 41 | | return output.WithError(PersonMessages.ScopeNotFound); |
| | | 42 | | } |
| | | 43 | | |
| | | 44 | | // AF-21c: a Scope Admin actor may only act on a scope they own; a System Admin bypasses. |
| | | 45 | | // Checked before the person is looked up so a caller who fails here learns nothing about |
| | | 46 | | // which person ids exist or what roles they hold. |
| | 19 | 47 | | if (!await scopeOwnership.ActorMayManageScopeAsync(command.ActingRole, command.ActingPersonId, scope.Id)) |
| | | 48 | | { |
| | 3 | 49 | | return output.WithError(PersonMessages.NotScopeOwner); |
| | | 50 | | } |
| | | 51 | | |
| | | 52 | | // AF-21b (UC-21 step 3): the person must exist, not be logically deleted, and hold an |
| | | 53 | | // administrator role — ScopeAdmin or SystemAdmin (FR-SC-08). A deleted person can no longer |
| | | 54 | | // authenticate, so an ownership granted to them could never be exercised. All three |
| | | 55 | | // conditions share one answer, so the endpoint cannot be used to tell an unknown id from a |
| | | 56 | | // User. The ownership rows are included because adding to that collection is how the join |
| | | 57 | | // row gets written below. |
| | 16 | 58 | | var person = await personReader.Query() |
| | 16 | 59 | | .Include(x => x.ScopeOwnerships) |
| | 16 | 60 | | .FirstOrDefaultAsync(x => |
| | 16 | 61 | | x.PublicId == command.PersonId && !x.IsDeleted && |
| | 16 | 62 | | (x.RoleId == (long)Roles.ScopeAdmin || x.RoleId == (long)Roles.SystemAdmin)); |
| | | 63 | | |
| | 16 | 64 | | if (person is null) |
| | | 65 | | { |
| | 6 | 66 | | return output.WithError(PersonMessages.PersonNotValidScopeAdmin); |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | // AF-21d: already an owner, so there is nothing to write — UC-21 step 4 calls the insert a |
| | | 70 | | // no-op in that case. Writing anyway would violate the (ScopeId, PersonId) composite key. |
| | 13 | 71 | | if (person.ScopeOwnerships.Any(ownership => ownership.ScopeId == scope.Id)) |
| | | 72 | | { |
| | 2 | 73 | | return output |
| | 2 | 74 | | .WithData(new AddScopeOwnerCommandOutput |
| | 2 | 75 | | { |
| | 2 | 76 | | ScopeId = scope.PublicId, PersonId = person.PublicId, AlreadyOwner = true |
| | 2 | 77 | | }) |
| | 2 | 78 | | .WithMessage(PersonMessages.AlreadyScopeOwner); |
| | | 79 | | } |
| | | 80 | | |
| | | 81 | | // UC-21 step 4: insert the SCOPE_OWNER row. ScopeOwner is a join entity with no repository of |
| | | 82 | | // its own, so the row is written through the person aggregate — the symmetric operation to |
| | | 83 | | // UC-08 clearing ScopeOwnerships to delete rows. FR-PE-11 needs no guard here: the person is |
| | | 84 | | // already an administrator and this only ever increases the scopes they own. |
| | 8 | 85 | | person.ScopeOwnerships.Add(new ScopeOwner { ScopeId = scope.Id, PersonId = person.Id }); |
| | | 86 | | |
| | 8 | 87 | | var update = await personWriter.UpdateAsync(person); |
| | | 88 | | |
| | 8 | 89 | | if (!update.Success) |
| | | 90 | | { |
| | 0 | 91 | | return output.WithErrors(update.Errors); |
| | | 92 | | } |
| | | 93 | | |
| | | 94 | | // UC-21 step 5. |
| | 8 | 95 | | return output |
| | 8 | 96 | | .WithData(new AddScopeOwnerCommandOutput |
| | 8 | 97 | | { |
| | 8 | 98 | | ScopeId = scope.PublicId, PersonId = person.PublicId, AlreadyOwner = false |
| | 8 | 99 | | }) |
| | 8 | 100 | | .WithMessage(PersonMessages.ScopeOwnerAddedSuccessfully); |
| | 23 | 101 | | } |
| | | 102 | | } |