| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Command.Input; |
| | | 3 | | using ArturRios.Heimdall.Command.Output; |
| | | 4 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 5 | | using ArturRios.Heimdall.Domain.Persistence; |
| | | 6 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 7 | | using ArturRios.Heimdall.Shared.Services; |
| | | 8 | | using ArturRios.Mediator.Command.Interfaces; |
| | | 9 | | using ArturRios.Output; |
| | | 10 | | using FluentValidation; |
| | | 11 | | using Microsoft.EntityFrameworkCore; |
| | | 12 | | |
| | | 13 | | namespace ArturRios.Heimdall.Command.Handlers; |
| | | 14 | | |
| | | 15 | | /// <summary> |
| | | 16 | | /// Handles <see cref="SetGoogleSignInCommand" /> (UC-24, FR-GO-01/FR-GO-02): validates that the |
| | | 17 | | /// request said which value to set (AF-24c), verifies the target scope exists and is active (AF-24a), |
| | | 18 | | /// enforces scope ownership for a Scope Admin actor (AF-24b), then writes the scope's |
| | | 19 | | /// <c>GoogleSignInEnabled</c> flag and returns the updated scope. A System Admin actor bypasses |
| | | 20 | | /// the ownership check. All failures are returned as errors on the <see cref="DataOutput{T}" /> |
| | | 21 | | /// rather than thrown, using the canonical <see cref="ScopeMessages" /> so the response resolver |
| | | 22 | | /// can pick the matching status code. |
| | | 23 | | /// </summary> |
| | 21 | 24 | | public class SetGoogleSignInCommandHandler( |
| | 21 | 25 | | IValidator<SetGoogleSignInCommand> validator, |
| | 21 | 26 | | IAsyncReadOnlyRepository<Scope, long> scopeReader, |
| | 21 | 27 | | IAtomicWrites atomicWrites, |
| | 21 | 28 | | IScopeOwnershipChecker scopeOwnership) |
| | | 29 | | : ICommandHandlerAsync<SetGoogleSignInCommand, SetGoogleSignInCommandOutput> |
| | | 30 | | { |
| | | 31 | | public async Task<DataOutput<SetGoogleSignInCommandOutput?>> HandleAsync(SetGoogleSignInCommand command, Cancellatio |
| | | 32 | | { |
| | 21 | 33 | | var output = DataOutput<SetGoogleSignInCommandOutput?>.New; |
| | | 34 | | |
| | | 35 | | // AF-24c (UC-24 step 2, NFR-10): the request must state which value to set. Enabled is |
| | | 36 | | // nullable precisely so this check is possible — a plain bool would bind a body omitting the |
| | | 37 | | // field to false, turning a malformed request into the destructive half of the toggle. |
| | 21 | 38 | | var validation = await validator.ValidateAsync(command); |
| | | 39 | | |
| | 21 | 40 | | if (!validation.IsValid) |
| | | 41 | | { |
| | 4 | 42 | | return output.WithErrors(validation.Errors.Select(failure => failure.ErrorMessage)); |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | // AF-24a (UC-24 step 3): the target scope must exist and not be logically deleted — the |
| | | 46 | | // alternative flow names both conditions as one outcome, so the filter answers for both. |
| | 19 | 47 | | var scope = await scopeReader.Query() |
| | 19 | 48 | | .FirstOrDefaultAsync(x => x.PublicId == command.Id && !x.IsDeleted); |
| | | 49 | | |
| | 19 | 50 | | if (scope is null) |
| | | 51 | | { |
| | 4 | 52 | | return output.WithError(ScopeMessages.ScopeNotFound); |
| | | 53 | | } |
| | | 54 | | |
| | | 55 | | // AF-24b (UC-24 step 4): a Scope Admin actor may only act on a scope they own; a System Admin |
| | | 56 | | // bypasses. Checked before anything is written, so a refused caller leaves no trace. |
| | 15 | 57 | | if (!await scopeOwnership.ActorMayManageScopeAsync(command.ActingRole, command.ActingPersonId, scope.Id)) |
| | | 58 | | { |
| | 3 | 59 | | return output.WithError(ScopeMessages.NotScopeOwner); |
| | | 60 | | } |
| | | 61 | | |
| | | 62 | | // Owner PublicIds for the response. A projection over the navigation (no Include needed), |
| | | 63 | | // which EF translates to a join and the in-memory fake evaluates directly. |
| | 12 | 64 | | var ownerIds = await scopeReader.Query() |
| | 12 | 65 | | .Where(x => x.PublicId == command.Id) |
| | 12 | 66 | | .SelectMany(x => x.Owners.Select(owner => owner.Person.PublicId)) |
| | 12 | 67 | | .ToListAsync(); |
| | | 68 | | |
| | | 69 | | // UC-24 step 5: write the flag and stamp UpdatedAt (no DB trigger maintains it). Written |
| | | 70 | | // unconditionally: PUT is idempotent by contract and UC-24 defines no alternative flow for a |
| | | 71 | | // request that asks for the value the scope already holds. The flag alone, and only while the |
| | | 72 | | // scope is not deleted (#205): a save of the copy read above would write the scope's other |
| | | 73 | | // columns back as read — its name, the other settings, and the deletion flag, reviving a scope |
| | | 74 | | // deleted since. One deleted since is answered as AF-24a. |
| | 12 | 75 | | if (!await atomicWrites.TrySetGoogleSignInAsync(scope, command.Enabled!.Value, DateTime.UtcNow)) |
| | | 76 | | { |
| | 1 | 77 | | return output.WithError(ScopeMessages.ScopeNotFound); |
| | | 78 | | } |
| | | 79 | | |
| | | 80 | | // UC-24 step 6: return the updated scope. |
| | 11 | 81 | | return output |
| | 11 | 82 | | .WithData(new SetGoogleSignInCommandOutput |
| | 11 | 83 | | { |
| | 11 | 84 | | Id = scope.PublicId, |
| | 11 | 85 | | Name = scope.Name, |
| | 11 | 86 | | Description = scope.Description, |
| | 11 | 87 | | GoogleSignInEnabled = scope.GoogleSignInEnabled, |
| | 11 | 88 | | EmailVerificationUrl = scope.EmailVerificationUrl, |
| | 11 | 89 | | PasswordResetUrl = scope.PasswordResetUrl, |
| | 11 | 90 | | OwnerIds = ownerIds, |
| | 11 | 91 | | CreatedAt = scope.CreatedAt, |
| | 11 | 92 | | UpdatedAt = scope.UpdatedAt |
| | 11 | 93 | | }) |
| | 11 | 94 | | .WithMessage(ScopeMessages.GoogleSignInUpdatedSuccessfully); |
| | 21 | 95 | | } |
| | | 96 | | } |