| | | 1 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 2 | | using Microsoft.EntityFrameworkCore; |
| | | 3 | | using Microsoft.EntityFrameworkCore.Metadata; |
| | | 4 | | using Microsoft.EntityFrameworkCore.Metadata.Builders; |
| | | 5 | | |
| | | 6 | | namespace ArturRios.Heimdall.Data.EntityMaps; |
| | | 7 | | |
| | | 8 | | internal static class PersonDbMap |
| | | 9 | | { |
| | | 10 | | public static void Configure(this EntityTypeBuilder<Person> person) |
| | | 11 | | { |
| | 3 | 12 | | person.ToTable("person"); |
| | | 13 | | |
| | 3 | 14 | | person.HasKey(x => x.Id); |
| | | 15 | | |
| | 3 | 16 | | person.Property(x => x.PublicId).IsRequired(); |
| | 3 | 17 | | person.HasIndex(x => x.PublicId).IsUnique(); |
| | | 18 | | |
| | 3 | 19 | | person.Property(x => x.Name).IsRequired(); |
| | | 20 | | |
| | 3 | 21 | | person.Property(x => x.Email).IsRequired(); |
| | | 22 | | |
| | | 23 | | // Email uniqueness is conditional (FR-PE-09), and its two halves differ in whether a unique |
| | | 24 | | // index can express them at all. |
| | | 25 | | // |
| | | 26 | | // The admin half — unique system-wide across live ScopeAdmins and SystemAdmins — reads only |
| | | 27 | | // columns of this table, so it is a partial unique index over LOWER(email), created in raw |
| | | 28 | | // SQL by the AddPersonEmailUniqueness migration (EF models neither an expression index nor |
| | | 29 | | // one filtered on a role set). It is the real enforcement: the application's check-then- |
| | | 30 | | // insert cannot be, since two concurrent creates both read "free" before either writes. |
| | | 31 | | // |
| | | 32 | | // The User half — unique per scope — is now a partial unique index too, created by the |
| | | 33 | | // AddPersonScopeId migration over (scope_id, LOWER(email)) WHERE role_id = 3 AND |
| | | 34 | | // is_deleted = false. It reads the scope from Person.ScopeId, the copy of SCOPE_USER's |
| | | 35 | | // ScopeId that exists for exactly this purpose: the relationship itself is still SCOPE_USER, |
| | | 36 | | // but an index has to be written over one table's columns, and every other column the rule |
| | | 37 | | // needs already lives here. The condition matches the application's check term for term, so |
| | | 38 | | // the rule did not change — only who is able to enforce it under concurrency. |
| | | 39 | | // |
| | | 40 | | // This non-unique index remains for lookup speed: UC-11 and UC-12 both resolve a person by |
| | | 41 | | // address on every call. |
| | 3 | 42 | | person.HasIndex(x => x.Email); |
| | | 43 | | |
| | 3 | 44 | | person.Property(x => x.PasswordHash).IsRequired(); |
| | 3 | 45 | | person.Property(x => x.Salt).IsRequired(); |
| | | 46 | | |
| | 3 | 47 | | person.Property(x => x.IsDeleted).HasDefaultValue(false); |
| | | 48 | | |
| | | 49 | | // NFR-20's retention window is measured from DeletedAt, so the anonymisation pass reads it |
| | | 50 | | // on every run: indexed, and filtered to the rows that can possibly be due, which is a small |
| | | 51 | | // fraction of the table. |
| | 3 | 52 | | person.Property(x => x.DeletedAt); |
| | 3 | 53 | | person.Property(x => x.DeletionKind); |
| | 3 | 54 | | person.Property(x => x.AnonymisedAt); |
| | | 55 | | |
| | | 56 | | // NFR-23: the basis is required and defaults to Unrecorded, so a row can never be silent |
| | | 57 | | // about it — a null would be indistinguishable from "nobody has looked at this yet". |
| | 3 | 58 | | person.Property(x => x.LegalBasis).HasDefaultValue(0); |
| | 3 | 59 | | person.Property(x => x.PrivacyNoticeVersion); |
| | 3 | 60 | | person.Property(x => x.BasisRecordedAt); |
| | | 61 | | |
| | | 62 | | // NFR-24: indexed because every listing filters on it, and the restricted set is a small |
| | | 63 | | // fraction of the table. |
| | 3 | 64 | | person.Property(x => x.ProcessingRestrictedAt); |
| | 3 | 65 | | person.Property(x => x.RestrictionGround); |
| | 3 | 66 | | person.Property(x => x.RestrictionLiftNotifiedAt); |
| | | 67 | | |
| | 3 | 68 | | person.HasIndex(x => x.ProcessingRestrictedAt) |
| | 3 | 69 | | .HasFilter("processing_restricted_at IS NOT NULL"); |
| | | 70 | | |
| | 3 | 71 | | person.HasIndex(x => x.DeletedAt) |
| | 3 | 72 | | .HasFilter("is_deleted = true AND anonymised_at IS NULL"); |
| | 3 | 73 | | person.Property(x => x.EmailVerified).HasDefaultValue(false); |
| | | 74 | | |
| | | 75 | | // FR-AU-11: the database fills the stamp for a row inserted without one, as the migration |
| | | 76 | | // filled the rows that predate it. After insert a whole-row save ignores it: only the |
| | | 77 | | // targeted write in AtomicWrites replaces it, so a save of a copy read before a rotation |
| | | 78 | | // cannot write the revoked stamp back. |
| | 3 | 79 | | person.Property(x => x.SecurityStamp) |
| | 3 | 80 | | .IsRequired() |
| | 3 | 81 | | .HasDefaultValueSql("gen_random_uuid()") |
| | 3 | 82 | | .Metadata.SetAfterSaveBehavior(PropertySaveBehavior.Ignore); |
| | | 83 | | |
| | | 84 | | // FR-AU-12 and FR-AU-13: the two per-account factor budgets. Like the stamp, written only by |
| | | 85 | | // the targeted writes in AtomicWrites. A whole-row save of a copy read before a failure was |
| | | 86 | | // counted — a name change, say, sent alongside a guess — would otherwise put the count, the |
| | | 87 | | // lock or the pause back as that copy read it. |
| | 3 | 88 | | IgnoredAfterInsert(person.Property(x => x.FailedSecondFactorAttempts)); |
| | 3 | 89 | | IgnoredAfterInsert(person.Property(x => x.SecondFactorLockedOutUntil)); |
| | 3 | 90 | | IgnoredAfterInsert(person.Property(x => x.SecondFactorLockouts)); |
| | 3 | 91 | | IgnoredAfterInsert(person.Property(x => x.FailedReauthenticationAttempts)); |
| | 3 | 92 | | IgnoredAfterInsert(person.Property(x => x.ReauthenticationWindowStartedAt)); |
| | 3 | 93 | | IgnoredAfterInsert(person.Property(x => x.ReauthenticationPausedUntil)); |
| | | 94 | | |
| | | 95 | | // FR-PR-03 and FR-PR-08: the password hash and salt, for the reason the stamp is. Set at |
| | | 96 | | // insert; after that only the targeted writes in AtomicWrites change them — a reset and |
| | | 97 | | // anonymisation — so a whole-row save of a copy read before a reset, an administrator's |
| | | 98 | | // edit racing the person's own reset for one, cannot put the old password back. |
| | 3 | 99 | | IgnoredAfterInsert(person.Property(x => x.PasswordHash)); |
| | 3 | 100 | | IgnoredAfterInsert(person.Property(x => x.Salt)); |
| | | 101 | | |
| | | 102 | | // FR-PE-16: the account-email budget, for the same reason — a whole-row save of a copy read |
| | | 103 | | // before a send was reserved would hand the day's allowance back. |
| | 3 | 104 | | IgnoredAfterInsert(person.Property(x => x.AccountEmailsSent)); |
| | 3 | 105 | | IgnoredAfterInsert(person.Property(x => x.AccountEmailWindowEndsAt)); |
| | 3 | 106 | | IgnoredAfterInsert(person.Property(x => x.AccountEmailLastSentAt)); |
| | | 107 | | |
| | | 108 | | // Deliberately not a foreign key and not a navigation. It carries no relationship of its own |
| | | 109 | | // — SCOPE_USER is the relationship, and mapping this as a second one would give EF two ways |
| | | 110 | | // to describe the same association and two chances to disagree. It is a value the per-scope |
| | | 111 | | // uniqueness index is written over, kept in step by the handlers that write the membership. |
| | 3 | 112 | | person.Property(x => x.ScopeId); |
| | | 113 | | |
| | 3 | 114 | | person.Property(x => x.CreatedAt).HasDefaultValueSql("now()"); |
| | 3 | 115 | | person.Property(x => x.UpdatedAt).HasDefaultValueSql("now()"); |
| | | 116 | | |
| | | 117 | | // Role classifies Person (FR-RO-01). Roles are reference data, so deletion is restricted. |
| | 3 | 118 | | person.HasOne(x => x.Role) |
| | 3 | 119 | | .WithMany(r => r.Persons) |
| | 3 | 120 | | .HasForeignKey(x => x.RoleId) |
| | 3 | 121 | | .IsRequired() |
| | 3 | 122 | | .OnDelete(DeleteBehavior.Restrict); |
| | 3 | 123 | | } |
| | | 124 | | |
| | | 125 | | private static void IgnoredAfterInsert<T>(PropertyBuilder<T> property) => |
| | 33 | 126 | | property.Metadata.SetAfterSaveBehavior(PropertySaveBehavior.Ignore); |
| | | 127 | | } |