| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Command.Input; |
| | | 3 | | using ArturRios.Heimdall.Command.Output; |
| | | 4 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 5 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 6 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 7 | | using ArturRios.Heimdall.Shared.Services; |
| | | 8 | | using ArturRios.Mediator.Command.Interfaces; |
| | | 9 | | using ArturRios.Output; |
| | | 10 | | using Microsoft.EntityFrameworkCore; |
| | | 11 | | |
| | | 12 | | namespace ArturRios.Heimdall.Command.Handlers; |
| | | 13 | | |
| | | 14 | | /// <summary> |
| | | 15 | | /// Handles <see cref="PromoteScopeUserCommand" /> (UC-23, FR-SC-08/FR-SC-13/FR-RO-03): verifies |
| | | 16 | | /// the target scope exists and is active (AF-23a), enforces scope ownership for a Scope Admin |
| | | 17 | | /// actor (AF-23c), refuses a person who already holds <c>ScopeAdmin</c> (AF-23d), verifies the |
| | | 18 | | /// named person is a non-deleted <c>User</c> of that scope (AF-23b), then promotes them — role to |
| | | 19 | | /// <c>ScopeAdmin</c>, <c>SCOPE_USER</c> row removed, <c>SCOPE_OWNER</c> row added — in one write, |
| | | 20 | | /// so FR-PE-11 is never observably violated. A System Admin actor bypasses the ownership check. |
| | | 21 | | /// All failures are returned as errors on the <see cref="DataOutput{T}" /> rather than thrown. |
| | | 22 | | /// </summary> |
| | 28 | 23 | | public class PromoteScopeUserCommandHandler( |
| | 28 | 24 | | IAsyncReadOnlyRepository<Scope, long> scopeReader, |
| | 28 | 25 | | IAsyncReadOnlyRepository<Person, long> personReader, |
| | 28 | 26 | | IAsyncRepository<Person, long> personWriter, |
| | 28 | 27 | | IScopeOwnershipChecker scopeOwnership) |
| | | 28 | | : ICommandHandlerAsync<PromoteScopeUserCommand, PromoteScopeUserCommandOutput> |
| | | 29 | | { |
| | | 30 | | public async Task<DataOutput<PromoteScopeUserCommandOutput?>> HandleAsync(PromoteScopeUserCommand command, Cancellat |
| | | 31 | | { |
| | 28 | 32 | | var output = DataOutput<PromoteScopeUserCommandOutput?>.New; |
| | | 33 | | |
| | | 34 | | // AF-23a (UC-23 step 2): the target scope must exist and not be logically deleted — the |
| | | 35 | | // alternative flow names both conditions as one outcome, so the filter answers for both. |
| | 28 | 36 | | var scope = await scopeReader.Query() |
| | 28 | 37 | | .FirstOrDefaultAsync(x => x.PublicId == command.ScopeId && !x.IsDeleted); |
| | | 38 | | |
| | 28 | 39 | | if (scope is null) |
| | | 40 | | { |
| | 4 | 41 | | return output.WithError(PersonMessages.ScopeNotFound); |
| | | 42 | | } |
| | | 43 | | |
| | | 44 | | // AF-23c: a Scope Admin actor may only act on a scope they own; a System Admin bypasses. |
| | | 45 | | // Checked before the person is looked up so a caller who fails here learns nothing about |
| | | 46 | | // which person ids exist, what roles they hold, or which scope they belong to. |
| | 24 | 47 | | if (!await scopeOwnership.ActorMayManageScopeAsync(command.ActingRole, command.ActingPersonId, scope.Id)) |
| | | 48 | | { |
| | 3 | 49 | | return output.WithError(PersonMessages.NotScopeOwner); |
| | | 50 | | } |
| | | 51 | | |
| | | 52 | | // The person must exist and not be logically deleted (AF-23b): a deleted person can no longer |
| | | 53 | | // authenticate, so the ownership granted could never be exercised. Both scope navigations are |
| | | 54 | | // included because severing one and adding to the other is how the join rows move below. |
| | 21 | 55 | | var person = await personReader.Query() |
| | 21 | 56 | | .Include(x => x.ScopeMembership) |
| | 21 | 57 | | .Include(x => x.ScopeOwnerships) |
| | 21 | 58 | | .FirstOrDefaultAsync(x => x.PublicId == command.PersonId && !x.IsDeleted); |
| | | 59 | | |
| | 21 | 60 | | if (person is null) |
| | | 61 | | { |
| | 4 | 62 | | return output.WithError(PersonMessages.PersonNotScopeUser); |
| | | 63 | | } |
| | | 64 | | |
| | | 65 | | // AF-23d: a person who already holds ScopeAdmin has nothing to be promoted to. Checked before |
| | | 66 | | // AF-23b because such a person also satisfies "not a User of that scope" — the more specific |
| | | 67 | | // flow has to win, or AF-23d would be unreachable. |
| | 17 | 68 | | if (person.RoleId == (long)Roles.ScopeAdmin) |
| | | 69 | | { |
| | 3 | 70 | | return output.WithError(PersonMessages.AlreadyScopeAdmin); |
| | | 71 | | } |
| | | 72 | | |
| | | 73 | | // AF-23b (UC-23 step 3): the person must be a User *of this scope*. An unknown id, a User of |
| | | 74 | | // another scope, and a System Admin all answer alike, so the endpoint cannot be used to probe |
| | | 75 | | // which persons exist or where they belong. |
| | 14 | 76 | | if (person.RoleId != (long)Roles.User || |
| | 14 | 77 | | person.ScopeMembership is null || |
| | 14 | 78 | | person.ScopeMembership.ScopeId != scope.Id) |
| | | 79 | | { |
| | 3 | 80 | | return output.WithError(PersonMessages.PersonNotScopeUser); |
| | | 81 | | } |
| | | 82 | | |
| | | 83 | | // FR-PE-09: the promotion moves the address from the scope's User namespace into the |
| | | 84 | | // system-wide admin namespace, where it must be unique. Compared case-insensitively |
| | | 85 | | // (LOWER() in SQL) and ignoring logically deleted admins, as UC-06 path c does. |
| | 11 | 86 | | var email = person.Email.ToLower(); |
| | | 87 | | |
| | 11 | 88 | | var emailTaken = await personReader.Query().AnyAsync(other => |
| | 11 | 89 | | other.Id != person.Id && !other.IsDeleted && other.Email.ToLower() == email && |
| | 11 | 90 | | (other.RoleId == (long)Roles.SystemAdmin || other.RoleId == (long)Roles.ScopeAdmin)); |
| | | 91 | | |
| | 11 | 92 | | if (emailTaken) |
| | | 93 | | { |
| | 2 | 94 | | return output.WithError(PersonMessages.EmailAlreadyExists); |
| | | 95 | | } |
| | | 96 | | |
| | | 97 | | // UC-23 steps 4-5, in one write. Neither join entity has a repository of its own, so both |
| | | 98 | | // rows move through the person aggregate: severing the required ScopeMembership deletes the |
| | | 99 | | // SCOPE_USER row (as UC-08's role change does) and adding to ScopeOwnerships writes the |
| | | 100 | | // SCOPE_OWNER row (as UC-21 does). UpdatedAt is stamped by hand — no trigger maintains it. |
| | 9 | 101 | | person.RoleId = (long)Roles.ScopeAdmin; |
| | 9 | 102 | | person.ScopeMembership = null; |
| | 9 | 103 | | person.ScopeId = null; |
| | 9 | 104 | | person.ScopeOwnerships.Add(new ScopeOwner { ScopeId = scope.Id, PersonId = person.Id }); |
| | 9 | 105 | | person.UpdatedAt = DateTime.UtcNow; |
| | | 106 | | |
| | 9 | 107 | | var update = await personWriter.UpdateAsync(person); |
| | | 108 | | |
| | 9 | 109 | | if (!update.Success) |
| | | 110 | | { |
| | 0 | 111 | | return output.WithErrors(update.Errors); |
| | | 112 | | } |
| | | 113 | | |
| | | 114 | | // UC-23 step 6: return the updated person. The scope just granted is the whole of what they |
| | | 115 | | // own — they were a User, and a User owns no scope (FR-SC-08, FR-PE-11). |
| | 9 | 116 | | return output |
| | 9 | 117 | | .WithData(new PromoteScopeUserCommandOutput |
| | 9 | 118 | | { |
| | 9 | 119 | | Id = person.PublicId, |
| | 9 | 120 | | Name = person.Name, |
| | 9 | 121 | | Email = person.Email, |
| | 9 | 122 | | Role = (int)Roles.ScopeAdmin, |
| | 9 | 123 | | EmailVerified = person.EmailVerified, |
| | 9 | 124 | | OwnedScopeIds = [scope.PublicId], |
| | 9 | 125 | | CreatedAt = person.CreatedAt, |
| | 9 | 126 | | UpdatedAt = person.UpdatedAt |
| | 9 | 127 | | }) |
| | 9 | 128 | | .WithMessage(PersonMessages.ScopeUserPromotedSuccessfully); |
| | 28 | 129 | | } |
| | | 130 | | } |