| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 3 | | using ArturRios.Heimdall.Query.Input; |
| | | 4 | | using ArturRios.Heimdall.Query.Output; |
| | | 5 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 6 | | using ArturRios.Heimdall.Shared.Services; |
| | | 7 | | using ArturRios.Mediator.Query.Interfaces; |
| | | 8 | | using ArturRios.Output; |
| | | 9 | | using FluentValidation; |
| | | 10 | | using Microsoft.EntityFrameworkCore; |
| | | 11 | | |
| | | 12 | | namespace ArturRios.Heimdall.Query.Handlers; |
| | | 13 | | |
| | | 14 | | /// <summary> |
| | | 15 | | /// Handles <see cref="ListScopePermissionsQuery" /> (UC-32, FR-SP-05): lists a scope's |
| | | 16 | | /// permissions with pagination and an optional name filter, excluding logically deleted |
| | | 17 | | /// permissions unless explicitly requested (FR-SP-09). A System Admin sees every permission in |
| | | 18 | | /// the scope; any other actor must own the scope. A missing or logically deleted scope reuses |
| | | 19 | | /// AF-31a (<c>ScopeNotFound</c>); an actor who does not own the scope is AF-32e |
| | | 20 | | /// (<c>NotScopeOwner</c>). A scope permission has no owner of its own, so unlike applications |
| | | 21 | | /// there is no per-owner narrowing — owning the scope is the whole of the rule. |
| | | 22 | | /// </summary> |
| | 21 | 23 | | public class ListScopePermissionsQueryHandler( |
| | 21 | 24 | | IAsyncReadOnlyRepository<Scope, long> scopeReader, |
| | 21 | 25 | | IAsyncReadOnlyRepository<ScopePermission, long> permissionReader, |
| | 21 | 26 | | IScopeOwnershipChecker scopeOwnership, |
| | 21 | 27 | | IValidator<ListScopePermissionsQuery> validator) |
| | | 28 | | : IPaginatedQueryHandlerAsync<ListScopePermissionsQuery, ScopePermissionOutput> |
| | | 29 | | { |
| | | 30 | | public async Task<PaginatedOutput<ScopePermissionOutput>> HandleAsync(ListScopePermissionsQuery query, CancellationT |
| | | 31 | | { |
| | 21 | 32 | | var output = PaginatedOutput<ScopePermissionOutput>.New; |
| | | 33 | | |
| | | 34 | | // NFR-10: page number/size bounds and filter length, validated before any query runs. |
| | 21 | 35 | | var validation = await validator.ValidateAsync(query); |
| | | 36 | | |
| | 21 | 37 | | if (!validation.IsValid) |
| | | 38 | | { |
| | 0 | 39 | | return output.WithErrors(validation.Errors.Select(failure => failure.ErrorMessage)); |
| | | 40 | | } |
| | | 41 | | |
| | | 42 | | // AF-31a (reused): the target scope must exist and not be logically deleted. |
| | 21 | 43 | | var scope = await scopeReader.Query() |
| | 21 | 44 | | .FirstOrDefaultAsync(x => x.PublicId == query.ScopeId && !x.IsDeleted); |
| | | 45 | | |
| | 21 | 46 | | if (scope is null) |
| | | 47 | | { |
| | 4 | 48 | | return output.WithError(ScopePermissionMessages.ScopeNotFound); |
| | | 49 | | } |
| | | 50 | | |
| | | 51 | | // AF-32e: a Scope Admin may only list a scope they own; a System Admin bypasses inside the |
| | | 52 | | // checker. The gate is not redundant with the empty-page outcome: without it, an actor |
| | | 53 | | // probing an unrelated scope would get an empty 200, indistinguishable from a scope that is |
| | | 54 | | // genuinely empty. |
| | 17 | 55 | | if (!await scopeOwnership.ActorMayManageScopeAsync(query.ActingRole, query.ActingPersonId, scope.Id)) |
| | | 56 | | { |
| | 3 | 57 | | return output.WithError(ScopePermissionMessages.NotScopeOwner); |
| | | 58 | | } |
| | | 59 | | |
| | 14 | 60 | | var permissions = permissionReader.Query().Where(x => x.ScopeId == scope.Id); |
| | | 61 | | |
| | | 62 | | // FR-SP-09: logically deleted permissions are excluded unless explicitly requested. |
| | 14 | 63 | | if (!query.IncludeDeleted) |
| | | 64 | | { |
| | 12 | 65 | | permissions = permissions.Where(x => !x.IsDeleted); |
| | | 66 | | } |
| | | 67 | | |
| | | 68 | | // Compared case-insensitively (LOWER() in SQL), as every name filter in this codebase is. |
| | 14 | 69 | | if (!string.IsNullOrWhiteSpace(query.Name)) |
| | | 70 | | { |
| | 2 | 71 | | var name = query.Name.ToLower(); |
| | 2 | 72 | | permissions = permissions.Where(x => x.Name.ToLower().Contains(name)); |
| | | 73 | | } |
| | | 74 | | |
| | 14 | 75 | | var projected = permissions.Select(x => new ScopePermissionOutput |
| | 14 | 76 | | { |
| | 14 | 77 | | Id = x.PublicId, |
| | 14 | 78 | | Name = x.Name, |
| | 14 | 79 | | Description = x.Description, |
| | 14 | 80 | | IncludeAsJwtClaim = x.IncludeAsJwtClaim, |
| | 14 | 81 | | ScopeId = x.Scope.PublicId, |
| | 14 | 82 | | IsDeleted = x.IsDeleted, |
| | 14 | 83 | | CreatedAt = x.CreatedAt, |
| | 14 | 84 | | UpdatedAt = x.UpdatedAt |
| | 14 | 85 | | }); |
| | | 86 | | |
| | | 87 | | // Ordered by name with the public identifier as a tiebreaker, then paginated over that |
| | | 88 | | // ordering rather than handing PaginateAsync a sort key of its own. |
| | | 89 | | // |
| | | 90 | | // Name is not unique, and PostgreSQL gives no ordering guarantee between rows whose sort key |
| | | 91 | | // ties — each page is a separate query, free to break the tie differently. Two people called |
| | | 92 | | // "Ana Silva" straddling a page boundary could therefore appear on both pages while somebody |
| | | 93 | | // else appeared on neither. The tiebreaker makes the total order deterministic, so paging |
| | | 94 | | // through a list sees every row exactly once. |
| | 14 | 95 | | var ordered = projected.OrderBy(x => x.Name).ThenBy(x => x.Id); |
| | | 96 | | |
| | 14 | 97 | | var page = await ordered.PaginateAsync(query.PageNumber, query.PageSize, orderBy: null); |
| | | 98 | | |
| | 14 | 99 | | return page.WithMessage(ScopePermissionMessages.ScopePermissionsRetrievedSuccessfully); |
| | 21 | 100 | | } |
| | | 101 | | } |