| | | 1 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 2 | | using Microsoft.EntityFrameworkCore; |
| | | 3 | | using Microsoft.EntityFrameworkCore.Metadata; |
| | | 4 | | using Microsoft.EntityFrameworkCore.Metadata.Builders; |
| | | 5 | | |
| | | 6 | | namespace ArturRios.Heimdall.Data.EntityMaps; |
| | | 7 | | |
| | | 8 | | internal static class PersonDbMap |
| | | 9 | | { |
| | | 10 | | public static void Configure(this EntityTypeBuilder<Person> person) |
| | | 11 | | { |
| | 4 | 12 | | person.ToTable("person"); |
| | | 13 | | |
| | 4 | 14 | | person.HasKey(x => x.Id); |
| | | 15 | | |
| | 4 | 16 | | person.Property(x => x.PublicId).IsRequired(); |
| | 4 | 17 | | person.HasIndex(x => x.PublicId).IsUnique(); |
| | | 18 | | |
| | 4 | 19 | | person.Property(x => x.Name).IsRequired(); |
| | | 20 | | |
| | 4 | 21 | | person.Property(x => x.Email).IsRequired(); |
| | | 22 | | |
| | | 23 | | // Email uniqueness is conditional (FR-PE-09), and its two halves differ in whether a unique |
| | | 24 | | // index can express them at all. |
| | | 25 | | // |
| | | 26 | | // The admin half — unique system-wide across live ScopeAdmins and SystemAdmins — reads only |
| | | 27 | | // columns of this table, so it is a partial unique index over LOWER(email), created in raw |
| | | 28 | | // SQL by the AddPersonEmailUniqueness migration (EF models neither an expression index nor |
| | | 29 | | // one filtered on a role set). It is the real enforcement: the application's check-then- |
| | | 30 | | // insert cannot be, since two concurrent creates both read "free" before either writes. |
| | | 31 | | // |
| | | 32 | | // The User half — unique per scope — is now a partial unique index too, created by the |
| | | 33 | | // AddPersonScopeId migration over (scope_id, LOWER(email)) WHERE role_id = 3 AND |
| | | 34 | | // is_deleted = false. It reads the scope from Person.ScopeId, the copy of SCOPE_USER's |
| | | 35 | | // ScopeId that exists for exactly this purpose: the relationship itself is still SCOPE_USER, |
| | | 36 | | // but an index has to be written over one table's columns, and every other column the rule |
| | | 37 | | // needs already lives here. The condition matches the application's check term for term, so |
| | | 38 | | // the rule did not change — only who is able to enforce it under concurrency. |
| | | 39 | | // |
| | | 40 | | // Lookup by address is served by ix_person_lower_email over LOWER(email), created by the |
| | | 41 | | // AddPersonLowerEmailIndex migration (#207). Login, password recovery, registration and Google |
| | | 42 | | // sign-in all compare LOWER(email) and deliberately leave out is_deleted, so neither a plain |
| | | 43 | | // index on the column nor the partial unique indexes above (they require is_deleted = false) |
| | | 44 | | // can serve them. Like those, it is raw SQL, which EF cannot express, so it is not mapped here. |
| | | 45 | | |
| | 4 | 46 | | person.Property(x => x.PasswordHash).IsRequired(); |
| | 4 | 47 | | person.Property(x => x.Salt).IsRequired(); |
| | | 48 | | |
| | 4 | 49 | | person.Property(x => x.IsDeleted).HasDefaultValue(false); |
| | | 50 | | |
| | | 51 | | // NFR-20's retention window is measured from DeletedAt, so the anonymisation pass reads it |
| | | 52 | | // on every run: indexed, and filtered to the rows that can possibly be due, which is a small |
| | | 53 | | // fraction of the table. |
| | 4 | 54 | | person.Property(x => x.DeletedAt); |
| | 4 | 55 | | person.Property(x => x.DeletionKind); |
| | 4 | 56 | | person.Property(x => x.AnonymisedAt); |
| | | 57 | | |
| | | 58 | | // NFR-23: the basis is required and defaults to Unrecorded, so a row can never be silent |
| | | 59 | | // about it — a null would be indistinguishable from "nobody has looked at this yet". |
| | 4 | 60 | | person.Property(x => x.LegalBasis).HasDefaultValue(0); |
| | 4 | 61 | | person.Property(x => x.PrivacyNoticeVersion); |
| | 4 | 62 | | person.Property(x => x.BasisRecordedAt); |
| | | 63 | | |
| | | 64 | | // NFR-24: indexed because every listing filters on it, and the restricted set is a small |
| | | 65 | | // fraction of the table. |
| | 4 | 66 | | person.Property(x => x.ProcessingRestrictedAt); |
| | 4 | 67 | | person.Property(x => x.RestrictionGround); |
| | 4 | 68 | | person.Property(x => x.RestrictionLiftNotifiedAt); |
| | | 69 | | |
| | 4 | 70 | | person.HasIndex(x => x.ProcessingRestrictedAt) |
| | 4 | 71 | | .HasFilter("processing_restricted_at IS NOT NULL"); |
| | | 72 | | |
| | 4 | 73 | | person.HasIndex(x => x.DeletedAt) |
| | 4 | 74 | | .HasFilter("is_deleted = true AND anonymised_at IS NULL"); |
| | 4 | 75 | | person.Property(x => x.EmailVerified).HasDefaultValue(false); |
| | | 76 | | |
| | | 77 | | // FR-AU-11: the database fills the stamp for a row inserted without one, as the migration |
| | | 78 | | // filled the rows that predate it. After insert a whole-row save ignores it: only the |
| | | 79 | | // targeted write in AtomicWrites replaces it, so a save of a copy read before a rotation |
| | | 80 | | // cannot write the revoked stamp back. |
| | 4 | 81 | | person.Property(x => x.SecurityStamp) |
| | 4 | 82 | | .IsRequired() |
| | 4 | 83 | | .HasDefaultValueSql("gen_random_uuid()") |
| | 4 | 84 | | .Metadata.SetAfterSaveBehavior(PropertySaveBehavior.Ignore); |
| | | 85 | | |
| | | 86 | | // FR-AU-12 and FR-AU-13: the two per-account factor budgets. Like the stamp, written only by |
| | | 87 | | // the targeted writes in AtomicWrites. A whole-row save of a copy read before a failure was |
| | | 88 | | // counted — a name change, say, sent alongside a guess — would otherwise put the count, the |
| | | 89 | | // lock or the pause back as that copy read it. |
| | 4 | 90 | | IgnoredAfterInsert(person.Property(x => x.FailedSecondFactorAttempts)); |
| | 4 | 91 | | IgnoredAfterInsert(person.Property(x => x.SecondFactorLockedOutUntil)); |
| | 4 | 92 | | IgnoredAfterInsert(person.Property(x => x.SecondFactorLockouts)); |
| | 4 | 93 | | IgnoredAfterInsert(person.Property(x => x.FailedReauthenticationAttempts)); |
| | 4 | 94 | | IgnoredAfterInsert(person.Property(x => x.ReauthenticationWindowStartedAt)); |
| | 4 | 95 | | IgnoredAfterInsert(person.Property(x => x.ReauthenticationPausedUntil)); |
| | | 96 | | |
| | | 97 | | // FR-PR-03 and FR-PR-08: the password hash and salt, for the reason the stamp is. Set at |
| | | 98 | | // insert; after that only the targeted writes in AtomicWrites change them — a reset and |
| | | 99 | | // anonymisation — so a whole-row save of a copy read before a reset, an administrator's |
| | | 100 | | // edit racing the person's own reset for one, cannot put the old password back. |
| | 4 | 101 | | IgnoredAfterInsert(person.Property(x => x.PasswordHash)); |
| | 4 | 102 | | IgnoredAfterInsert(person.Property(x => x.Salt)); |
| | | 103 | | |
| | | 104 | | // FR-PE-16: the account-email budget, for the same reason — a whole-row save of a copy read |
| | | 105 | | // before a send was reserved would hand the day's allowance back. |
| | 4 | 106 | | IgnoredAfterInsert(person.Property(x => x.AccountEmailsSent)); |
| | 4 | 107 | | IgnoredAfterInsert(person.Property(x => x.AccountEmailWindowEndsAt)); |
| | 4 | 108 | | IgnoredAfterInsert(person.Property(x => x.AccountEmailLastSentAt)); |
| | | 109 | | |
| | | 110 | | // The lifecycle columns, for the same reason again (#237): who the person is to the system — |
| | | 111 | | // their role and scope, whether their address is verified, locked out, restricted, deleted, |
| | | 112 | | // asked to be erased or anonymised — and the address itself. Each changes only through a |
| | | 113 | | // targeted, conditional write in AtomicWrites, so a whole-row save of a copy read before |
| | | 114 | | // the change — a name edit racing a deletion, say, or an ownership grant racing a |
| | | 115 | | // restriction — cannot put the old state back. What a whole-row save still writes is the |
| | | 116 | | // plain profile: the name, the recorded basis and notice version, and UpdatedAt. |
| | 4 | 117 | | IgnoredAfterInsert(person.Property(x => x.Email)); |
| | 4 | 118 | | IgnoredAfterInsert(person.Property(x => x.EmailVerified)); |
| | 4 | 119 | | IgnoredAfterInsert(person.Property(x => x.RoleId)); |
| | 4 | 120 | | IgnoredAfterInsert(person.Property(x => x.ScopeId)); |
| | 4 | 121 | | IgnoredAfterInsert(person.Property(x => x.FailedLoginAttempts)); |
| | 4 | 122 | | IgnoredAfterInsert(person.Property(x => x.LockedOutUntil)); |
| | 4 | 123 | | IgnoredAfterInsert(person.Property(x => x.IsDeleted)); |
| | 4 | 124 | | IgnoredAfterInsert(person.Property(x => x.DeletedAt)); |
| | 4 | 125 | | IgnoredAfterInsert(person.Property(x => x.DeletionKind)); |
| | 4 | 126 | | IgnoredAfterInsert(person.Property(x => x.ErasureRequestedAt)); |
| | 4 | 127 | | IgnoredAfterInsert(person.Property(x => x.ErasureDueAt)); |
| | 4 | 128 | | IgnoredAfterInsert(person.Property(x => x.ErasureBlockedReason)); |
| | 4 | 129 | | IgnoredAfterInsert(person.Property(x => x.ProcessingRestrictedAt)); |
| | 4 | 130 | | IgnoredAfterInsert(person.Property(x => x.RestrictionGround)); |
| | 4 | 131 | | IgnoredAfterInsert(person.Property(x => x.RestrictionLiftNotifiedAt)); |
| | 4 | 132 | | IgnoredAfterInsert(person.Property(x => x.AnonymisedAt)); |
| | | 133 | | |
| | | 134 | | // Deliberately not a foreign key and not a navigation. It carries no relationship of its own |
| | | 135 | | // — SCOPE_USER is the relationship, and mapping this as a second one would give EF two ways |
| | | 136 | | // to describe the same association and two chances to disagree. It is a value the per-scope |
| | | 137 | | // uniqueness index is written over, kept in step by the handlers that write the membership. |
| | 4 | 138 | | person.Property(x => x.ScopeId); |
| | | 139 | | |
| | 4 | 140 | | person.Property(x => x.CreatedAt).HasDefaultValueSql("now()"); |
| | 4 | 141 | | person.Property(x => x.UpdatedAt).HasDefaultValueSql("now()"); |
| | | 142 | | |
| | | 143 | | // Role classifies Person (FR-RO-01). Roles are reference data, so deletion is restricted. |
| | 4 | 144 | | person.HasOne(x => x.Role) |
| | 4 | 145 | | .WithMany(r => r.Persons) |
| | 4 | 146 | | .HasForeignKey(x => x.RoleId) |
| | 4 | 147 | | .IsRequired() |
| | 4 | 148 | | .OnDelete(DeleteBehavior.Restrict); |
| | 4 | 149 | | } |
| | | 150 | | |
| | | 151 | | private static void IgnoredAfterInsert<T>(PropertyBuilder<T> property) => |
| | 108 | 152 | | property.Metadata.SetAfterSaveBehavior(PropertySaveBehavior.Ignore); |
| | | 153 | | } |