| | | 1 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 2 | | using Microsoft.EntityFrameworkCore; |
| | | 3 | | using Microsoft.EntityFrameworkCore.Metadata; |
| | | 4 | | using Microsoft.EntityFrameworkCore.Metadata.Builders; |
| | | 5 | | |
| | | 6 | | namespace ArturRios.Heimdall.Data.EntityMaps; |
| | | 7 | | |
| | | 8 | | internal static class GoogleUserDbMap |
| | | 9 | | { |
| | | 10 | | public static void Configure(this EntityTypeBuilder<GoogleUser> googleUser) |
| | | 11 | | { |
| | 4 | 12 | | googleUser.ToTable("google_user"); |
| | | 13 | | |
| | 4 | 14 | | googleUser.HasKey(x => x.Id); |
| | | 15 | | |
| | 4 | 16 | | googleUser.Property(x => x.PublicId).IsRequired(); |
| | 4 | 17 | | googleUser.HasIndex(x => x.PublicId).IsUnique(); |
| | | 18 | | |
| | 4 | 19 | | googleUser.Property(x => x.GoogleId).IsRequired(); |
| | | 20 | | |
| | 4 | 21 | | googleUser.Property(x => x.Email).IsRequired(); |
| | | 22 | | |
| | 4 | 23 | | googleUser.Property(x => x.EmailVerified).HasDefaultValue(false); |
| | 4 | 24 | | googleUser.Property(x => x.IsDeleted).HasDefaultValue(false); |
| | | 25 | | |
| | | 26 | | // NFR-20's retention window is measured from DeletedAt, so the anonymisation pass reads it |
| | | 27 | | // on every run: indexed, and filtered to the rows that can possibly be due, which is a small |
| | | 28 | | // fraction of the table. |
| | 4 | 29 | | googleUser.Property(x => x.DeletedAt); |
| | 4 | 30 | | googleUser.Property(x => x.DeletionKind); |
| | 4 | 31 | | googleUser.Property(x => x.AnonymisedAt); |
| | | 32 | | |
| | | 33 | | // NFR-23: the basis is required and defaults to Unrecorded, so a row can never be silent |
| | | 34 | | // about it — a null would be indistinguishable from "nobody has looked at this yet". |
| | 4 | 35 | | googleUser.Property(x => x.LegalBasis).HasDefaultValue(0); |
| | 4 | 36 | | googleUser.Property(x => x.PrivacyNoticeVersion); |
| | 4 | 37 | | googleUser.Property(x => x.BasisRecordedAt); |
| | | 38 | | |
| | | 39 | | // NFR-24: indexed because every listing filters on it, and the restricted set is a small |
| | | 40 | | // fraction of the table. |
| | 4 | 41 | | googleUser.Property(x => x.ProcessingRestrictedAt); |
| | 4 | 42 | | googleUser.Property(x => x.RestrictionGround); |
| | 4 | 43 | | googleUser.Property(x => x.RestrictionLiftNotifiedAt); |
| | | 44 | | |
| | 4 | 45 | | googleUser.HasIndex(x => x.ProcessingRestrictedAt) |
| | 4 | 46 | | .HasFilter("processing_restricted_at IS NOT NULL"); |
| | | 47 | | |
| | 4 | 48 | | googleUser.HasIndex(x => x.DeletedAt) |
| | 4 | 49 | | .HasFilter("is_deleted = true AND anonymised_at IS NULL"); |
| | | 50 | | |
| | | 51 | | // The lifecycle columns, as for a person (#237, #205): whether the Google User is deleted, asked |
| | | 52 | | // to be erased, restricted or anonymised. Each changes only through a targeted, conditional write |
| | | 53 | | // in AtomicWrites, so a whole-row save of a copy read before the change — a sign-in's refresh |
| | | 54 | | // racing a deletion, say, or a deletion racing a restriction — cannot put the old state back. |
| | 4 | 55 | | IgnoredAfterInsert(googleUser.Property(x => x.IsDeleted)); |
| | 4 | 56 | | IgnoredAfterInsert(googleUser.Property(x => x.DeletedAt)); |
| | 4 | 57 | | IgnoredAfterInsert(googleUser.Property(x => x.DeletionKind)); |
| | 4 | 58 | | IgnoredAfterInsert(googleUser.Property(x => x.ErasureRequestedAt)); |
| | 4 | 59 | | IgnoredAfterInsert(googleUser.Property(x => x.ErasureDueAt)); |
| | 4 | 60 | | IgnoredAfterInsert(googleUser.Property(x => x.ErasureBlockedReason)); |
| | 4 | 61 | | IgnoredAfterInsert(googleUser.Property(x => x.ProcessingRestrictedAt)); |
| | 4 | 62 | | IgnoredAfterInsert(googleUser.Property(x => x.RestrictionGround)); |
| | 4 | 63 | | IgnoredAfterInsert(googleUser.Property(x => x.RestrictionLiftNotifiedAt)); |
| | 4 | 64 | | IgnoredAfterInsert(googleUser.Property(x => x.AnonymisedAt)); |
| | | 65 | | |
| | 4 | 66 | | googleUser.Property(x => x.CreatedAt).HasDefaultValueSql("now()"); |
| | 4 | 67 | | googleUser.Property(x => x.UpdatedAt).HasDefaultValueSql("now()"); |
| | | 68 | | |
| | | 69 | | // GoogleId (Google's 'sub' claim) is unique within the scope (FR-GO-08). |
| | 4 | 70 | | googleUser.HasIndex(x => new { x.ScopeId, x.GoogleId }).IsUnique(); |
| | | 71 | | |
| | | 72 | | // Email is unique within the scope among Google Users (FR-GO-07), case-insensitively — the |
| | | 73 | | // application compares addresses with LOWER(), so an index over the raw column would accept |
| | | 74 | | // a pair the handler had already refused and enforce a rule nobody wrote. The expression |
| | | 75 | | // form is applied in the migration's raw SQL: EF cannot model an index over an expression, |
| | | 76 | | // so this call reserves the name and the migration replaces its definition. |
| | | 77 | | // |
| | | 78 | | // The joint uniqueness with User persons' emails spans two tables and cannot be a unique |
| | | 79 | | // index at all; it stays in the application layer (CreateUserCommandHandler, |
| | | 80 | | // UpdatePersonCommandHandler, GoogleSignInCommandHandler). |
| | 4 | 81 | | googleUser.HasIndex(x => new { x.ScopeId, x.Email }) |
| | 4 | 82 | | .IsUnique() |
| | 4 | 83 | | .HasDatabaseName("ix_google_user_scope_id_email"); |
| | | 84 | | |
| | | 85 | | // A Google User belongs to exactly one scope (FR-GO-06); hard-deleting the scope cascades |
| | | 86 | | // to its Google Users (NFR-14). |
| | 4 | 87 | | googleUser.HasOne(x => x.Scope) |
| | 4 | 88 | | .WithMany(s => s.GoogleUsers) |
| | 4 | 89 | | .HasForeignKey(x => x.ScopeId) |
| | 4 | 90 | | .IsRequired() |
| | 4 | 91 | | .OnDelete(DeleteBehavior.Cascade); |
| | 4 | 92 | | } |
| | | 93 | | |
| | | 94 | | private static void IgnoredAfterInsert<T>(PropertyBuilder<T> property) => |
| | 40 | 95 | | property.Metadata.SetAfterSaveBehavior(PropertySaveBehavior.Ignore); |
| | | 96 | | } |