| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 3 | | using ArturRios.Heimdall.Query.Input; |
| | | 4 | | using ArturRios.Heimdall.Query.Output; |
| | | 5 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 6 | | using ArturRios.Heimdall.Shared.Services; |
| | | 7 | | using ArturRios.Mediator.Query.Interfaces; |
| | | 8 | | using ArturRios.Output; |
| | | 9 | | using FluentValidation; |
| | | 10 | | using Microsoft.EntityFrameworkCore; |
| | | 11 | | |
| | | 12 | | namespace ArturRios.Heimdall.Query.Handlers; |
| | | 13 | | |
| | | 14 | | /// <summary> |
| | | 15 | | /// Handles <see cref="ListScopePersonsQuery" /> (UC-07, FR-PE-04): lists the <c>User</c> persons |
| | | 16 | | /// of a scope with pagination and optional name/email filters, excluding logically deleted |
| | | 17 | | /// persons unless explicitly requested (FR-PE-08). A missing or logically deleted scope is AF-07a |
| | | 18 | | /// (<c>ScopeNotFound</c>); an actor who does not own the scope is AF-07b (<c>NotScopeOwner</c>). |
| | | 19 | | /// A System Admin bypasses the ownership check. |
| | | 20 | | /// </summary> |
| | 37 | 21 | | public class ListScopePersonsQueryHandler( |
| | 37 | 22 | | IAsyncReadOnlyRepository<Scope, long> scopeReader, |
| | 37 | 23 | | IAsyncReadOnlyRepository<Person, long> personReader, |
| | 37 | 24 | | IScopeOwnershipChecker scopeOwnership, |
| | 37 | 25 | | IValidator<ListScopePersonsQuery> validator) |
| | | 26 | | : IPaginatedQueryHandlerAsync<ListScopePersonsQuery, PersonOutput> |
| | | 27 | | { |
| | | 28 | | public async Task<PaginatedOutput<PersonOutput>> HandleAsync(ListScopePersonsQuery query, CancellationToken cancella |
| | | 29 | | { |
| | 37 | 30 | | var output = PaginatedOutput<PersonOutput>.New; |
| | | 31 | | |
| | | 32 | | // NFR-10: page number/size bounds and filter length, validated before any query runs. |
| | 37 | 33 | | var validation = await validator.ValidateAsync(query, cancellationToken); |
| | | 34 | | |
| | 37 | 35 | | if (!validation.IsValid) |
| | | 36 | | { |
| | 0 | 37 | | return output.WithErrors(validation.Errors.Select(failure => failure.ErrorMessage)); |
| | | 38 | | } |
| | | 39 | | |
| | | 40 | | // AF-07a: the target scope must exist and not be logically deleted. |
| | 37 | 41 | | var scope = await scopeReader.Query() |
| | 37 | 42 | | .FirstOrDefaultAsync(x => x.PublicId == query.ScopeId && !x.IsDeleted, cancellationToken); |
| | | 43 | | |
| | 37 | 44 | | if (scope is null) |
| | | 45 | | { |
| | 3 | 46 | | return output.WithError(PersonMessages.ScopeNotFound); |
| | | 47 | | } |
| | | 48 | | |
| | | 49 | | // AF-07b: a Scope Admin may only read a scope they own; a System Admin bypasses. |
| | 34 | 50 | | if (!await scopeOwnership.ActorMayManageScopeAsync( |
| | 34 | 51 | | query.ActingRole, query.ActingPersonId, scope.Id, cancellationToken)) |
| | | 52 | | { |
| | 3 | 53 | | return output.WithError(PersonMessages.NotScopeOwner); |
| | | 54 | | } |
| | | 55 | | |
| | 31 | 56 | | var persons = personReader.Query() |
| | 31 | 57 | | .Where(x => x.ScopeMembership != null && x.ScopeMembership.ScopeId == scope.Id); |
| | | 58 | | |
| | | 59 | | // NFR-24: a restricted identity is withheld from tenant-facing listings, whatever |
| | | 60 | | // IncludeDeleted says — the two states are independent. Not hidden from everyone: the |
| | | 61 | | // subject's own export still returns it, and a System Admin resolving the dispute can still |
| | | 62 | | // reach it by id. But a scope's administrator working through their user list has no |
| | | 63 | | // business acting on a record whose processing is suspended. |
| | 31 | 64 | | persons = persons.Where(x => x.ProcessingRestrictedAt == null); |
| | | 65 | | |
| | 31 | 66 | | if (!query.IncludeDeleted) |
| | | 67 | | { |
| | 30 | 68 | | persons = persons.Where(x => !x.IsDeleted); |
| | | 69 | | } |
| | | 70 | | |
| | 31 | 71 | | if (!string.IsNullOrWhiteSpace(query.Name)) |
| | | 72 | | { |
| | 2 | 73 | | var name = query.Name.ToLower(); |
| | 2 | 74 | | persons = persons.Where(x => x.Name.ToLower().Contains(name)); |
| | | 75 | | } |
| | | 76 | | |
| | 31 | 77 | | if (!string.IsNullOrWhiteSpace(query.Email)) |
| | | 78 | | { |
| | 1 | 79 | | var email = query.Email.ToLower(); |
| | 1 | 80 | | persons = persons.Where(x => x.Email.ToLower().Contains(email)); |
| | | 81 | | } |
| | | 82 | | |
| | | 83 | | // FR-PE-19, as in ListScopeOwners: a Scope Admin sees only the ownerships of scopes they own |
| | | 84 | | // too, a System Admin all of them. A User owns no scope (FR-SC-08), so this normally trims |
| | | 85 | | // nothing; it is applied so the projection cannot say more than the rule allows. |
| | 31 | 86 | | var visibleScopeIds = await OwnedScopeVisibility.ScopesVisibleToAsync( |
| | 31 | 87 | | personReader, query.ActingRole, query.ActingPersonId, cancellationToken); |
| | 31 | 88 | | var seesEveryOwnership = visibleScopeIds is null; |
| | 31 | 89 | | var visible = visibleScopeIds ?? []; |
| | | 90 | | |
| | 31 | 91 | | var projected = persons.Select(x => new PersonOutput |
| | 31 | 92 | | { |
| | 31 | 93 | | Id = x.PublicId, |
| | 31 | 94 | | Name = x.Name, |
| | 31 | 95 | | Email = x.Email, |
| | 31 | 96 | | Role = (int)x.RoleId, |
| | 31 | 97 | | EmailVerified = x.EmailVerified, |
| | 31 | 98 | | TwoFactorEnabled = x.TwoFactorAuth != null && x.TwoFactorAuth.IsActive, |
| | 31 | 99 | | IsDeleted = x.IsDeleted, |
| | 31 | 100 | | ScopeId = x.ScopeMembership != null ? x.ScopeMembership.Scope.PublicId : null, |
| | 31 | 101 | | OwnedScopeIds = x.ScopeOwnerships |
| | 31 | 102 | | .Where(ownership => seesEveryOwnership || visible.Contains(ownership.ScopeId)) |
| | 31 | 103 | | .Select(ownership => ownership.Scope.PublicId) |
| | 31 | 104 | | .ToList(), |
| | 31 | 105 | | CreatedAt = x.CreatedAt, |
| | 31 | 106 | | UpdatedAt = x.UpdatedAt |
| | 31 | 107 | | }); |
| | | 108 | | |
| | | 109 | | // Ordered by name with the public identifier as a tiebreaker, then paginated over that |
| | | 110 | | // ordering rather than handing PaginateAsync a sort key of its own. |
| | | 111 | | // |
| | | 112 | | // Name is not unique, and PostgreSQL gives no ordering guarantee between rows whose sort key |
| | | 113 | | // ties — each page is a separate query, free to break the tie differently. Two people called |
| | | 114 | | // "Ana Silva" straddling a page boundary could therefore appear on both pages while somebody |
| | | 115 | | // else appeared on neither. The tiebreaker makes the total order deterministic, so paging |
| | | 116 | | // through a list sees every row exactly once. |
| | 31 | 117 | | var ordered = projected.OrderBy(x => x.Name).ThenBy(x => x.Id); |
| | | 118 | | |
| | 31 | 119 | | var page = await ordered.PaginateAsync(query.PageNumber, query.PageSize, orderBy: null, cancellationToken: cance |
| | | 120 | | |
| | 31 | 121 | | return page.WithMessage(PersonMessages.PersonsRetrievedSuccessfully); |
| | 37 | 122 | | } |
| | | 123 | | } |