paliad/internal/services/user_service.go

package services

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"strings"

	"github.com/google/uuid"
	"github.com/jmoiron/sqlx"

	"mgit.msbls.de/m/patholo/internal/models"
	"mgit.msbls.de/m/patholo/internal/offices"
)

// Sentinel errors returned by UserService.
var (
	// ErrUserAlreadyOnboarded is returned when POST /api/onboarding is called
	// for a paliad.users row that already exists (409 Conflict on the wire).
	ErrUserAlreadyOnboarded = errors.New("user already onboarded")
	// ErrAdminBootstrapOnly signals an attempt to self-assign the 'admin' role
	// when other paliad.users rows already exist. Only the very first user can
	// bootstrap themselves as admin (403 Forbidden on the wire).
	ErrAdminBootstrapOnly = errors.New("admin role reserved for the first user")
)

// UserService reads paliad.users. Writes happen via the Phase D onboarding
// endpoint and are not exposed here yet.
type UserService struct {
	db *sqlx.DB
}

// NewUserService wires the service to the pool.
func NewUserService(db *sqlx.DB) *UserService {
	return &UserService{db: db}
}

const userColumns = `id, email, display_name, office, practice_group, role, dezernat,
	created_at, updated_at`

// GetByID returns the user row, or (nil, nil) if the user hasn't completed
// onboarding yet. Real errors bubble up.
func (s *UserService) GetByID(ctx context.Context, id uuid.UUID) (*models.User, error) {
	var u models.User
	err := s.db.GetContext(ctx, &u,
		`SELECT `+userColumns+` FROM paliad.users WHERE id = $1`, id)
	if errors.Is(err, sql.ErrNoRows) {
		return nil, nil
	}
	if err != nil {
		return nil, fmt.Errorf("get user: %w", err)
	}
	return &u, nil
}

// CreateUserInput is the payload for the onboarding flow (POST /api/onboarding).
type CreateUserInput struct {
	DisplayName string  `json:"display_name"`
	Office      string  `json:"office"`
	Role        string  `json:"role"`
	Dezernat    *string `json:"dezernat,omitempty"`
}

// Create inserts the paliad.users row for the authenticated user. The caller
// owns the (id, email) pair — they come from the verified JWT claims, never
// from the request body, which prevents a user from creating a row for a
// different auth.uid().
//
// Role is free-form text (German firms have many titles beyond the original
// four-value enum). The DB CHECK only requires non-empty. The one exception
// is 'admin', which is reserved: only allowed when the paliad.users table is
// empty (bootstrap admin). Subsequent users who ask for 'admin' are rejected
// — an existing admin must promote them via SQL / future admin UI.
//
// Returns ErrUserAlreadyOnboarded if the row exists (callers map to 409).
func (s *UserService) Create(ctx context.Context, id uuid.UUID, email string, input CreateUserInput) (*models.User, error) {
	displayName := strings.TrimSpace(input.DisplayName)
	if displayName == "" {
		return nil, fmt.Errorf("display_name is required")
	}
	if !offices.IsValid(input.Office) {
		return nil, fmt.Errorf("invalid office %q", input.Office)
	}
	role := strings.TrimSpace(input.Role)
	if role == "" {
		return nil, fmt.Errorf("role is required")
	}

	var dezernat *string
	if input.Dezernat != nil {
		trimmed := strings.TrimSpace(*input.Dezernat)
		if trimmed != "" {
			dezernat = &trimmed
		}
	}

	tx, err := s.db.BeginTxx(ctx, nil)
	if err != nil {
		return nil, fmt.Errorf("begin tx: %w", err)
	}
	defer tx.Rollback()

	// Refuse a second row for the same auth.uid(). The PRIMARY KEY would also
	// catch this, but we want a typed error (not a raw pq unique-violation).
	var exists bool
	if err := tx.GetContext(ctx, &exists,
		`SELECT EXISTS (SELECT 1 FROM paliad.users WHERE id = $1)`, id); err != nil {
		return nil, fmt.Errorf("check existing user: %w", err)
	}
	if exists {
		return nil, ErrUserAlreadyOnboarded
	}

	// Admin bootstrap gate: only allow 'admin' when no other users exist yet.
	// Under Postgres' default READ COMMITTED isolation, two concurrent
	// first-logins both asking for 'admin' could both see count=0 and both
	// succeed. A transaction-scoped advisory lock serialises the check+insert
	// so only one bootstrap can win; the lock is auto-released on commit or
	// rollback. The constant is arbitrary but stable — every admin-bootstrap
	// tx takes the same lock.
	if role == "admin" {
		if _, err := tx.ExecContext(ctx,
			`SELECT pg_advisory_xact_lock(7346298141)`); err != nil {
			return nil, fmt.Errorf("lock for admin bootstrap: %w", err)
		}
		var count int
		if err := tx.GetContext(ctx, &count,
			`SELECT count(*) FROM paliad.users`); err != nil {
			return nil, fmt.Errorf("count users: %w", err)
		}
		if count > 0 {
			return nil, ErrAdminBootstrapOnly
		}
	}

	// practice_group is intentionally left NULL — the column is retained for
	// future use but no longer collected at onboarding (m, 2026-04-18: every
	// Paliad user is in patent practice, so the field carried no signal).
	if _, err := tx.ExecContext(ctx,
		`INSERT INTO paliad.users (id, email, display_name, office, role, dezernat)
		 VALUES ($1, $2, $3, $4, $5, $6)`,
		id, email, displayName, input.Office, role, dezernat,
	); err != nil {
		return nil, fmt.Errorf("insert user: %w", err)
	}

	if err := tx.Commit(); err != nil {
		return nil, fmt.Errorf("commit create user: %w", err)
	}

	return s.GetByID(ctx, id)
}

// List returns all users (used by collaborator-picker in Phase D).
func (s *UserService) List(ctx context.Context) ([]models.User, error) {
	var users []models.User
	if err := s.db.SelectContext(ctx, &users,
		`SELECT `+userColumns+`
		   FROM paliad.users
		  ORDER BY display_name, email`); err != nil {
		return nil, fmt.Errorf("list users: %w", err)
	}
	return users, nil
}