github-ops
491 lines
13 KiB
Rust
491 lines
13 KiB
Rust
use super::*;
|
|
use time::OffsetDateTime;
|
|
|
|
impl PostgresRegistry {
|
|
pub async fn upsert_bootstrap_user(
|
|
&self,
|
|
email: &str,
|
|
display_name: &str,
|
|
password_hash: &str,
|
|
) -> Result<UserId, RegistryError> {
|
|
let user_id = format!("user_{}", uuid::Uuid::now_v7().simple());
|
|
let row = sqlx::query!(
|
|
"insert into users (
|
|
id,
|
|
email,
|
|
display_name,
|
|
password_hash,
|
|
status,
|
|
created_at
|
|
) values (
|
|
$1, $2, $3, $4, 'active', now()
|
|
)
|
|
on conflict (email) do update
|
|
set display_name = excluded.display_name,
|
|
password_hash = excluded.password_hash,
|
|
status = 'active'
|
|
returning id",
|
|
user_id,
|
|
email,
|
|
display_name,
|
|
password_hash,
|
|
)
|
|
.fetch_one(&self.pool)
|
|
.await?;
|
|
|
|
Ok(UserId::new(row.id))
|
|
}
|
|
|
|
pub async fn ensure_membership(
|
|
&self,
|
|
workspace_id: &WorkspaceId,
|
|
user_id: &UserId,
|
|
role: MembershipRole,
|
|
) -> Result<(), RegistryError> {
|
|
sqlx::query(
|
|
"insert into memberships (
|
|
workspace_id,
|
|
user_id,
|
|
role,
|
|
created_at
|
|
) values (
|
|
$1, $2, $3, now()
|
|
)
|
|
on conflict (workspace_id, user_id) do update
|
|
set role = excluded.role",
|
|
)
|
|
.bind(workspace_id.as_str())
|
|
.bind(user_id.as_str())
|
|
.bind(serialize_enum_text(&role, "role")?)
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn get_auth_user_by_email(
|
|
&self,
|
|
email: &str,
|
|
) -> Result<Option<AuthUserRecord>, RegistryError> {
|
|
let row = sqlx::query!(
|
|
"select
|
|
id,
|
|
email,
|
|
display_name,
|
|
password_hash as \"password_hash!\",
|
|
status,
|
|
created_at as \"created_at!: OffsetDateTime\"
|
|
from users
|
|
where email = $1
|
|
limit 1",
|
|
email,
|
|
)
|
|
.fetch_optional(&self.pool)
|
|
.await?;
|
|
|
|
row.map(|row| {
|
|
Ok(AuthUserRecord {
|
|
user: User {
|
|
id: UserId::new(row.id),
|
|
email: row.email,
|
|
display_name: row.display_name,
|
|
status: deserialize_enum_text(&row.status, "status")?,
|
|
created_at: row.created_at,
|
|
},
|
|
password_hash: row.password_hash,
|
|
})
|
|
})
|
|
.transpose()
|
|
}
|
|
|
|
pub async fn get_auth_user_by_id(
|
|
&self,
|
|
user_id: &UserId,
|
|
) -> Result<Option<AuthUserRecord>, RegistryError> {
|
|
let row = sqlx::query!(
|
|
"select
|
|
id,
|
|
email,
|
|
display_name,
|
|
password_hash as \"password_hash!\",
|
|
status,
|
|
created_at as \"created_at!: OffsetDateTime\"
|
|
from users
|
|
where id = $1
|
|
limit 1",
|
|
user_id.as_str(),
|
|
)
|
|
.fetch_optional(&self.pool)
|
|
.await?;
|
|
|
|
row.map(|row| {
|
|
Ok(AuthUserRecord {
|
|
user: User {
|
|
id: UserId::new(row.id),
|
|
email: row.email,
|
|
display_name: row.display_name,
|
|
status: deserialize_enum_text(&row.status, "status")?,
|
|
created_at: row.created_at,
|
|
},
|
|
password_hash: row.password_hash,
|
|
})
|
|
})
|
|
.transpose()
|
|
}
|
|
|
|
pub async fn update_user_profile(
|
|
&self,
|
|
user_id: &UserId,
|
|
email: &str,
|
|
display_name: &str,
|
|
) -> Result<User, RegistryError> {
|
|
let row = sqlx::query!(
|
|
"update users
|
|
set email = $2,
|
|
display_name = $3
|
|
where id = $1
|
|
returning
|
|
id,
|
|
email,
|
|
display_name,
|
|
status,
|
|
created_at as \"created_at!: OffsetDateTime\"",
|
|
user_id.as_str(),
|
|
email,
|
|
display_name,
|
|
)
|
|
.fetch_one(&self.pool)
|
|
.await
|
|
.map_err(|error| map_user_update_error(error, user_id, email))?;
|
|
|
|
build_user(
|
|
row.id,
|
|
row.email,
|
|
row.display_name,
|
|
row.status,
|
|
row.created_at,
|
|
)
|
|
}
|
|
|
|
pub async fn update_user_password(
|
|
&self,
|
|
user_id: &UserId,
|
|
password_hash: &str,
|
|
) -> Result<(), RegistryError> {
|
|
let result = sqlx::query(
|
|
"update users
|
|
set password_hash = $2
|
|
where id = $1",
|
|
)
|
|
.bind(user_id.as_str())
|
|
.bind(password_hash)
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
if result.rows_affected() == 0 {
|
|
return Err(RegistryError::UserNotFound {
|
|
user_id: user_id.as_str().to_owned(),
|
|
});
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn create_user_session(
|
|
&self,
|
|
session_id: &UserSessionId,
|
|
user_id: &UserId,
|
|
current_workspace_id: Option<&WorkspaceId>,
|
|
secret_hash: &str,
|
|
expires_at: &OffsetDateTime,
|
|
) -> Result<(), RegistryError> {
|
|
sqlx::query(
|
|
"insert into user_sessions (
|
|
id,
|
|
user_id,
|
|
current_workspace_id,
|
|
secret_hash,
|
|
status,
|
|
expires_at,
|
|
last_seen_at,
|
|
created_at
|
|
) values (
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
'active',
|
|
$5::timestamptz,
|
|
now(),
|
|
now()
|
|
)",
|
|
)
|
|
.bind(session_id.as_str())
|
|
.bind(user_id.as_str())
|
|
.bind(current_workspace_id.map(|id| id.as_str()))
|
|
.bind(secret_hash)
|
|
.bind(*expires_at)
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn get_user_session(
|
|
&self,
|
|
session_id: &UserSessionId,
|
|
secret_hash: &str,
|
|
) -> Result<Option<SessionRecord>, RegistryError> {
|
|
let row = sqlx::query!(
|
|
"select
|
|
s.id,
|
|
s.user_id,
|
|
s.current_workspace_id,
|
|
u.email,
|
|
u.display_name,
|
|
u.status,
|
|
u.created_at as \"created_at!: OffsetDateTime\"
|
|
from user_sessions s
|
|
join users u on u.id = s.user_id
|
|
where s.id = $1
|
|
and s.secret_hash = $2
|
|
and s.status = 'active'
|
|
and s.expires_at > now()
|
|
limit 1",
|
|
session_id.as_str(),
|
|
secret_hash,
|
|
)
|
|
.fetch_optional(&self.pool)
|
|
.await?;
|
|
|
|
let Some(row) = row else {
|
|
return Ok(None);
|
|
};
|
|
|
|
let user_id = UserId::new(row.user_id);
|
|
let user = User {
|
|
id: user_id.clone(),
|
|
email: row.email,
|
|
display_name: row.display_name,
|
|
status: deserialize_enum_text(&row.status, "status")?,
|
|
created_at: row.created_at,
|
|
};
|
|
let memberships = self.list_workspaces_for_user(&user_id).await?;
|
|
let stored_workspace_id = row.current_workspace_id.map(WorkspaceId::new);
|
|
let current_workspace_id = stored_workspace_id
|
|
.filter(|workspace_id| {
|
|
memberships
|
|
.iter()
|
|
.any(|membership| membership.workspace.id == *workspace_id)
|
|
})
|
|
.or_else(|| {
|
|
memberships
|
|
.first()
|
|
.map(|membership| membership.workspace.id.clone())
|
|
});
|
|
|
|
Ok(Some(SessionRecord {
|
|
session_id: UserSessionId::new(row.id),
|
|
user,
|
|
memberships,
|
|
current_workspace_id,
|
|
}))
|
|
}
|
|
|
|
pub async fn touch_user_session(
|
|
&self,
|
|
session_id: &UserSessionId,
|
|
) -> Result<(), RegistryError> {
|
|
sqlx::query(
|
|
"update user_sessions
|
|
set last_seen_at = now()
|
|
where id = $1",
|
|
)
|
|
.bind(session_id.as_str())
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn revoke_user_session(
|
|
&self,
|
|
session_id: &UserSessionId,
|
|
) -> Result<(), RegistryError> {
|
|
sqlx::query(
|
|
"update user_sessions
|
|
set status = 'revoked'
|
|
where id = $1",
|
|
)
|
|
.bind(session_id.as_str())
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn set_user_session_current_workspace(
|
|
&self,
|
|
session_id: &UserSessionId,
|
|
workspace_id: &WorkspaceId,
|
|
) -> Result<(), RegistryError> {
|
|
sqlx::query(
|
|
"update user_sessions
|
|
set current_workspace_id = $2
|
|
where id = $1",
|
|
)
|
|
.bind(session_id.as_str())
|
|
.bind(workspace_id.as_str())
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn user_has_workspace_access(
|
|
&self,
|
|
user_id: &UserId,
|
|
workspace_id: &WorkspaceId,
|
|
) -> Result<bool, RegistryError> {
|
|
let row = sqlx::query!(
|
|
"select exists(
|
|
select 1
|
|
from memberships
|
|
where user_id = $1
|
|
and workspace_id = $2
|
|
) as \"allowed!\"",
|
|
user_id.as_str(),
|
|
workspace_id.as_str(),
|
|
)
|
|
.fetch_one(&self.pool)
|
|
.await?;
|
|
|
|
Ok(row.allowed)
|
|
}
|
|
|
|
pub async fn save_auth_profile(
|
|
&self,
|
|
request: SaveAuthProfileRequest<'_>,
|
|
) -> Result<(), RegistryError> {
|
|
sqlx::query(
|
|
"insert into auth_profiles (
|
|
id,
|
|
workspace_id,
|
|
name,
|
|
kind,
|
|
config_json,
|
|
created_at,
|
|
updated_at
|
|
) values ($1, $2, $3, $4, $5, $6::timestamptz, $7::timestamptz)
|
|
on conflict(id) do update set
|
|
workspace_id = excluded.workspace_id,
|
|
name = excluded.name,
|
|
kind = excluded.kind,
|
|
config_json = excluded.config_json,
|
|
updated_at = excluded.updated_at",
|
|
)
|
|
.bind(request.profile.id.as_str())
|
|
.bind(request.workspace_id.as_str())
|
|
.bind(&request.profile.name)
|
|
.bind(serialize_enum_text(&request.profile.kind, "kind")?)
|
|
.bind(Json(serialize_json_value(&request.profile.config)?))
|
|
.bind(request.profile.created_at)
|
|
.bind(request.profile.updated_at)
|
|
.execute(&self.pool)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn get_auth_profile(
|
|
&self,
|
|
workspace_id: &WorkspaceId,
|
|
auth_profile_id: &crank_core::AuthProfileId,
|
|
) -> Result<Option<AuthProfile>, RegistryError> {
|
|
let row = sqlx::query!(
|
|
"select
|
|
id,
|
|
workspace_id,
|
|
name,
|
|
kind,
|
|
config_json,
|
|
created_at as \"created_at!: OffsetDateTime\",
|
|
updated_at as \"updated_at!: OffsetDateTime\"
|
|
from auth_profiles
|
|
where workspace_id = $1 and id = $2",
|
|
workspace_id.as_str(),
|
|
auth_profile_id.as_str(),
|
|
)
|
|
.fetch_optional(&self.pool)
|
|
.await?;
|
|
|
|
row.map(|row| {
|
|
build_auth_profile(
|
|
row.id,
|
|
row.workspace_id,
|
|
row.name,
|
|
row.kind,
|
|
row.config_json,
|
|
row.created_at,
|
|
row.updated_at,
|
|
)
|
|
})
|
|
.transpose()
|
|
}
|
|
|
|
pub async fn list_auth_profiles(
|
|
&self,
|
|
workspace_id: &WorkspaceId,
|
|
) -> Result<Vec<AuthProfile>, RegistryError> {
|
|
let rows = sqlx::query!(
|
|
"select
|
|
id,
|
|
workspace_id,
|
|
name,
|
|
kind,
|
|
config_json,
|
|
created_at as \"created_at!: OffsetDateTime\",
|
|
updated_at as \"updated_at!: OffsetDateTime\"
|
|
from auth_profiles
|
|
where workspace_id = $1
|
|
order by name asc",
|
|
workspace_id.as_str(),
|
|
)
|
|
.fetch_all(&self.pool)
|
|
.await?;
|
|
|
|
rows.into_iter()
|
|
.map(|row| {
|
|
build_auth_profile(
|
|
row.id,
|
|
row.workspace_id,
|
|
row.name,
|
|
row.kind,
|
|
row.config_json,
|
|
row.created_at,
|
|
row.updated_at,
|
|
)
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
pub async fn list_auth_profiles_referencing_secret(
|
|
&self,
|
|
workspace_id: &WorkspaceId,
|
|
secret_id: &SecretId,
|
|
) -> Result<Vec<AuthProfile>, RegistryError> {
|
|
let profiles = self.list_auth_profiles(workspace_id).await?;
|
|
|
|
Ok(profiles
|
|
.into_iter()
|
|
.filter(|profile| {
|
|
profile
|
|
.config
|
|
.secret_ids()
|
|
.into_iter()
|
|
.any(|candidate| candidate == secret_id)
|
|
})
|
|
.collect())
|
|
}
|
|
}
|