| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Command.Input; |
| | | 3 | | using ArturRios.Heimdall.Command.Output; |
| | | 4 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 5 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 6 | | using ArturRios.Heimdall.Domain.Persistence; |
| | | 7 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 8 | | using ArturRios.Heimdall.Shared.Services; |
| | | 9 | | using ArturRios.Mediator.Command.Interfaces; |
| | | 10 | | using ArturRios.Output; |
| | | 11 | | using Microsoft.EntityFrameworkCore; |
| | | 12 | | |
| | | 13 | | namespace ArturRios.Heimdall.Command.Handlers; |
| | | 14 | | |
| | | 15 | | /// <summary> |
| | | 16 | | /// Handles <see cref="DeleteGoogleUserCommand" /> (UC-28, FR-GO-15): locates the Google User |
| | | 17 | | /// inside the addressed scope (AF-28a), enforces the scope-ownership rule (AF-28c), serves an |
| | | 18 | | /// already-deleted record as an idempotent no-op (AF-28b), and otherwise sets |
| | | 19 | | /// <c>IsDeleted = true</c> and stamps <c>UpdatedAt</c>. Nothing cascades — see the remarks. All |
| | | 20 | | /// failures are returned as errors on the <see cref="DataOutput{T}" /> rather than thrown. |
| | | 21 | | /// </summary> |
| | | 22 | | /// <remarks> |
| | | 23 | | /// <para> |
| | | 24 | | /// The shape of <see cref="DeleteApplicationCommandHandler" />, differing in step 2 only. |
| | | 25 | | /// UC-19 compares the application's <em>owner</em>, because owning a scope is not grounds to |
| | | 26 | | /// delete another owner's application; a Google User has no owner, only a scope (FR-GO-06), |
| | | 27 | | /// and UC-28 names "a System Admin, or an owner of the Google User's scope" — which is |
| | | 28 | | /// exactly what <see cref="IScopeOwnershipChecker" /> decides. |
| | | 29 | | /// </para> |
| | | 30 | | /// <para> |
| | | 31 | | /// Nothing cascades because there is nothing to cascade to. A Google User can own no |
| | | 32 | | /// application — FR-AP-03 restricts that to a <c>ScopeAdmin</c> who owns the scope, and a |
| | | 33 | | /// Google User is always <c>User</c>-equivalent (FR-GO-04) — and it holds no password reset |
| | | 34 | | /// or email verification tokens, since authentication is delegated to Google. |
| | | 35 | | /// </para> |
| | | 36 | | /// <para> |
| | | 37 | | /// The flag this sets is already honoured everywhere it matters: UC-25 refuses to |
| | | 38 | | /// authenticate a deleted Google User (AF-25d), UC-26 refuses their sign-out (AF-26a), and |
| | | 39 | | /// UC-27 hides them from default reads (FR-GO-17). |
| | | 40 | | /// </para> |
| | | 41 | | /// </remarks> |
| | 18 | 42 | | public class DeleteGoogleUserCommandHandler( |
| | 18 | 43 | | IAsyncReadOnlyRepository<GoogleUser, long> googleUserReader, |
| | 18 | 44 | | IAtomicWrites atomicWrites, |
| | 18 | 45 | | IScopeOwnershipChecker scopeOwnership) |
| | | 46 | | : ICommandHandlerAsync<DeleteGoogleUserCommand, DeleteGoogleUserCommandOutput> |
| | | 47 | | { |
| | | 48 | | public async Task<DataOutput<DeleteGoogleUserCommandOutput?>> HandleAsync(DeleteGoogleUserCommand command, Cancellat |
| | | 49 | | { |
| | 18 | 50 | | var output = DataOutput<DeleteGoogleUserCommandOutput?>.New; |
| | | 51 | | |
| | | 52 | | // AF-28a: the Google User must exist inside the addressed scope. The lookup deliberately omits |
| | | 53 | | // the !IsDeleted filter UC-27's default read applies, so an already-deleted record is found |
| | | 54 | | // and served idempotently by AF-28b below rather than reported as not found — without that, |
| | | 55 | | // AF-28b could never fire. The route's scopeId qualifies it: a Google User that belongs to |
| | | 56 | | // another scope is not the resource this path addresses. |
| | 18 | 57 | | var googleUser = await googleUserReader.Query() |
| | 18 | 58 | | .FirstOrDefaultAsync(x => x.PublicId == command.Id && x.Scope.PublicId == command.ScopeId); |
| | | 59 | | |
| | 18 | 60 | | if (googleUser is null) |
| | | 61 | | { |
| | 4 | 62 | | return output.WithError(GoogleUserMessages.GoogleUserNotFound); |
| | | 63 | | } |
| | | 64 | | |
| | | 65 | | // AF-28c (UC-28 step 2): a System Admin may delete any Google User; a Scope Admin only those |
| | | 66 | | // of the scopes they own — which is what the checker decides, along with its guard that a |
| | | 67 | | // logically deleted actor owns nothing. Runs before AF-28b so an already-deleted Google User |
| | | 68 | | // cannot be used to probe for records outside the caller's reach. |
| | 14 | 69 | | if (!await scopeOwnership.ActorMayManageScopeAsync( |
| | 14 | 70 | | command.ActingRole, command.ActingPersonId, googleUser.ScopeId)) |
| | | 71 | | { |
| | 3 | 72 | | return output.WithError(GoogleUserMessages.NotAuthorizedToDeleteGoogleUser); |
| | | 73 | | } |
| | | 74 | | |
| | | 75 | | // AF-28b: already deleted — whether directly or by UC-04's cascade from its scope — so there |
| | | 76 | | // is nothing to write. UpdatedAt is left alone: the row already carries the requested state, |
| | | 77 | | // and re-stamping it would misreport when the deletion happened. |
| | 11 | 78 | | if (googleUser.IsDeleted) |
| | | 79 | | { |
| | 2 | 80 | | return output |
| | 2 | 81 | | .WithData(new DeleteGoogleUserCommandOutput { Id = googleUser.PublicId, AlreadyDeleted = true }) |
| | 2 | 82 | | .WithMessage(GoogleUserMessages.GoogleUserDeletedSuccessfully); |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | // UC-28 step 3: flip the flag and stamp UpdatedAt (no DB trigger maintains it). |
| | | 86 | | // DeletedAt and DeletionKind are stamped for NFR-20, for the reasons given in |
| | | 87 | | // DeletePersonCommandHandler: the anonymisation window is measured from the deletion, and |
| | | 88 | | // UpdatedAt would restart it on any later write. |
| | | 89 | | // |
| | | 90 | | // A targeted write of those four columns alone (#205), and only while the Google User is live: |
| | | 91 | | // a restriction made since the read stands beside the deletion, and a deletion made since — the |
| | | 92 | | // subject's own erasure request, say — stands as it was, answered as AF-28b. |
| | 9 | 93 | | if (!await atomicWrites.TryMarkDeletedAsync(googleUser, DeletionKinds.Administrative, DateTime.UtcNow)) |
| | | 94 | | { |
| | 2 | 95 | | return output |
| | 2 | 96 | | .WithData(new DeleteGoogleUserCommandOutput { Id = googleUser.PublicId, AlreadyDeleted = true }) |
| | 2 | 97 | | .WithMessage(GoogleUserMessages.GoogleUserDeletedSuccessfully); |
| | | 98 | | } |
| | | 99 | | |
| | | 100 | | // UC-28 step 4. |
| | 7 | 101 | | return output |
| | 7 | 102 | | .WithData(new DeleteGoogleUserCommandOutput { Id = googleUser.PublicId, AlreadyDeleted = false }) |
| | 7 | 103 | | .WithMessage(GoogleUserMessages.GoogleUserDeletedSuccessfully); |
| | 18 | 104 | | } |
| | | 105 | | } |