| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Command.Input; |
| | | 3 | | using ArturRios.Heimdall.Command.Output; |
| | | 4 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 5 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 6 | | using ArturRios.Heimdall.Domain.Persistence; |
| | | 7 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 8 | | using ArturRios.Mediator.Command.Interfaces; |
| | | 9 | | using ArturRios.Output; |
| | | 10 | | using Microsoft.EntityFrameworkCore; |
| | | 11 | | |
| | | 12 | | namespace ArturRios.Heimdall.Command.Handlers; |
| | | 13 | | |
| | | 14 | | /// <summary> |
| | | 15 | | /// Handles <see cref="RestrictProcessingCommand" /> (UC-44): suspends processing of the |
| | | 16 | | /// caller's own identity without deleting anything (GDPR Art. 18, LGPD Art. 18 III–IV). All |
| | | 17 | | /// failures are returned as errors on the <see cref="DataOutput{T}" /> rather than thrown. |
| | | 18 | | /// </summary> |
| | | 19 | | /// <remarks> |
| | | 20 | | /// <para> |
| | | 21 | | /// <b>Why this is not the deletion flag.</b> `IsDeleted` means the identity is on its way |
| | | 22 | | /// out: it is excluded from reads, it cascades through UC-04, and NFR-20 eventually |
| | | 23 | | /// anonymises it. A restriction means the opposite — the record is disputed and must be |
| | | 24 | | /// preserved exactly as it stands while that is resolved. Reusing the flag would set an |
| | | 25 | | /// erasure clock running on data the subject has specifically asked be kept. |
| | | 26 | | /// </para> |
| | | 27 | | /// <para> |
| | | 28 | | /// <b>No credential is required, unlike UC-42.</b> Erasure is irreversible, so it demands |
| | | 29 | | /// proof the person is present. A restriction destroys nothing and is liftable, and the |
| | | 30 | | /// subject asking for one may be doing so precisely because they believe the account is |
| | | 31 | | /// compromised — demanding the password of somebody in that position would be the wrong way |
| | | 32 | | /// round. |
| | | 33 | | /// </para> |
| | | 34 | | /// </remarks> |
| | 16 | 35 | | public class RestrictProcessingCommandHandler( |
| | 16 | 36 | | IAsyncReadOnlyRepository<Person, long> personReader, |
| | 16 | 37 | | IAsyncReadOnlyRepository<GoogleUser, long> googleUserReader, |
| | 16 | 38 | | IAtomicWrites atomicWrites) |
| | | 39 | | : ICommandHandlerAsync<RestrictProcessingCommand, RestrictProcessingCommandOutput> |
| | | 40 | | { |
| | | 41 | | public async Task<DataOutput<RestrictProcessingCommandOutput?>> HandleAsync(RestrictProcessingCommand command, Cance |
| | | 42 | | { |
| | 16 | 43 | | var output = DataOutput<RestrictProcessingCommandOutput?>.New; |
| | | 44 | | |
| | | 45 | | // AF-44b. Art. 18(1) is exhaustive: a restriction rests on one of its four grounds or it is |
| | | 46 | | // not a restriction under the article. |
| | 16 | 47 | | if (!Enum.IsDefined((RestrictionGrounds)command.Ground)) |
| | | 48 | | { |
| | 4 | 49 | | return output.WithError(ErasureMessages.RestrictionGroundUnknown); |
| | | 50 | | } |
| | | 51 | | |
| | 12 | 52 | | var restrictedAt = DateTime.UtcNow; |
| | | 53 | | |
| | | 54 | | // The lookups omit !IsDeleted deliberately: a suspended identity may still contest the |
| | | 55 | | // accuracy of what is held about it, and Art. 18 does not require the account to be in good |
| | | 56 | | // standing. What it must not be is anonymised, and an anonymised record cannot authenticate. |
| | 12 | 57 | | var person = await personReader.Query() |
| | 12 | 58 | | .FirstOrDefaultAsync(x => x.PublicId == command.ActingPersonId); |
| | | 59 | | |
| | 12 | 60 | | if (person is not null) |
| | | 61 | | { |
| | 8 | 62 | | if (person.ProcessingRestrictedAt is not null) |
| | | 63 | | { |
| | 2 | 64 | | return output.WithError(ErasureMessages.ProcessingAlreadyRestricted); |
| | | 65 | | } |
| | | 66 | | |
| | | 67 | | // A targeted write of the restriction's columns alone (#237), and only while there is |
| | | 68 | | // none: a restriction imposed since the read stands, and this one is refused as the |
| | | 69 | | // check above would have refused it. |
| | 6 | 70 | | return await atomicWrites.TryRestrictProcessingAsync(person, command.Ground, restrictedAt) |
| | 6 | 71 | | ? Restricted(output, person.PublicId, restrictedAt, command.Ground) |
| | 6 | 72 | | : output.WithError(ErasureMessages.ProcessingAlreadyRestricted); |
| | | 73 | | } |
| | | 74 | | |
| | 4 | 75 | | var googleUser = await googleUserReader.Query() |
| | 4 | 76 | | .FirstOrDefaultAsync(x => x.PublicId == command.ActingPersonId); |
| | | 77 | | |
| | 4 | 78 | | if (googleUser is null) |
| | | 79 | | { |
| | 1 | 80 | | return output.WithError(ErasureMessages.NotEligible); |
| | | 81 | | } |
| | | 82 | | |
| | 3 | 83 | | if (googleUser.ProcessingRestrictedAt is not null) |
| | | 84 | | { |
| | 0 | 85 | | return output.WithError(ErasureMessages.ProcessingAlreadyRestricted); |
| | | 86 | | } |
| | | 87 | | |
| | | 88 | | // As for a person (#205): the restriction's columns alone, and only while there is none. |
| | 3 | 89 | | return await atomicWrites.TryRestrictProcessingAsync(googleUser, command.Ground, restrictedAt) |
| | 3 | 90 | | ? Restricted(output, googleUser.PublicId, restrictedAt, command.Ground) |
| | 3 | 91 | | : output.WithError(ErasureMessages.ProcessingAlreadyRestricted); |
| | 16 | 92 | | } |
| | | 93 | | |
| | | 94 | | private static DataOutput<RestrictProcessingCommandOutput?> Restricted( |
| | | 95 | | DataOutput<RestrictProcessingCommandOutput?> output, Guid id, DateTime at, int ground) => |
| | 7 | 96 | | output |
| | 7 | 97 | | .WithData(new RestrictProcessingCommandOutput { Id = id, RestrictedAt = at, Ground = ground }) |
| | 7 | 98 | | .WithMessage(ErasureMessages.ProcessingRestricted); |
| | | 99 | | } |