Janady13/missionmatch / internal/modules/org/settings_handler.go

1package org 2 3// THE SETTINGS SURFACE, and the reason it lives beside branding rather than in a module of its own: this is 4// the same authority (org.settings.write, held by the owner) over the same subject (how this organization 5// works), and splitting it would have meant a second module importing the first for no gain. 6// 7// TWO AUDIENCES, TWO ROUTES, AND THE DIFFERENCE IS LOAD BEARING. 8// 9// GET /org/settings is the ADMINISTRATOR'S view: every configured value, gated on org.settings.write. It 10// still contains no credential, because the settings type cannot hold one. 11// 12// GET /org/policy is EVERY USER'S view, gated only on being able to read a candidate. It returns no settings 13// at all. It returns the ANSWERS, already computed for the caller: may I see rates, may I see who else is 14// working this. The interface needs those answers to render, and handing a recruiter the whole configuration 15// so their browser can work it out would both leak how the organization is set up and put the decision on 16// the client, where it is advice rather than enforcement. The server decides; the client is told. 17 18import ( 19 "context" 20 "encoding/json" 21 "errors" 22 "fmt" 23 "net/http" 24 "strings" 25 "time" 26 27 "github.com/go-chi/chi/v5" 28 "github.com/google/uuid" 29 "github.com/jackc/pgx/v5" 30 "github.com/shopspring/decimal" 31 32 "github.com/missionworkforce/missionmatch/internal/platform/audit" 33 "github.com/missionworkforce/missionmatch/internal/platform/mailer" 34 "github.com/missionworkforce/missionmatch/internal/platform/orgsettings" 35 "github.com/missionworkforce/missionmatch/internal/platform/security" 36 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 37) 38 39// SettingsHandler serves the settings surface. store may be nil on a node built without it, in which case 40// every route reports itself unavailable rather than pretending to save. 41type SettingsHandler struct { 42 db *tenant.DB 43 store *orgsettings.Store 44 aud *audit.Writer 45} 46 47func NewSettingsHandler(db *tenant.DB, store *orgsettings.Store, aud *audit.Writer) *SettingsHandler { 48 return &SettingsHandler{db: db, store: store, aud: aud} 49} 50 51func (h *SettingsHandler) Routes(r chi.Router) { 52 r.With(security.RequireCapability(security.CapCandidateRead)).Get("/org/policy", h.policy) 53 r.With(security.RequireCapability(security.CapOrgSettings)).Get("/org/settings", h.get) 54 r.With(security.RequireCapability(security.CapOrgSettings)).Patch("/org/settings", h.patch) 55 r.With(security.RequireCapability(security.CapOrgSettings)).Put("/org/settings/email/password", h.putPassword) 56 r.With(security.RequireCapability(security.CapOrgSettings)).Delete("/org/settings/email/password", h.deletePassword) 57 r.With(security.RequireCapability(security.CapOrgSettings)).Post("/org/settings/email/test", h.testEmail) 58} 59 60func (h *SettingsHandler) get(w http.ResponseWriter, r *http.Request) { 61 if h.store == nil { 62 writeErr(w, http.StatusServiceUnavailable, "settings are unavailable on this node") 63 return 64 } 65 st, err := h.store.Load(r.Context()) 66 if err != nil { 67 writeErr(w, http.StatusInternalServerError, "could not read settings") 68 return 69 } 70 writeJSON(w, http.StatusOK, map[string]any{ 71 "settings": st, 72 // Told plainly, so an administrator is not asked to type a password this node cannot store. 73 "secret_storage_available": h.store.SealAvailable(), 74 }) 75} 76 77// policyResponse is what the interface renders against. Every field is a decision already made for THIS 78// caller, never a setting they could reinterpret. 79type policyResponse struct { 80 CanSeeRates bool `json:"can_see_rates"` 81 CanSeeMargins bool `json:"can_see_margins"` 82 CanSeeContacts bool `json:"can_see_contacts"` 83 CanSeeWorkOf bool `json:"can_see_work_of_others"` 84 ShowPresence bool `json:"show_activity_presence"` 85 ClaimRequired bool `json:"claim_required"` 86 ClaimExpiryHrs int `json:"claim_expiry_hours"` 87 EmailDelivery bool `json:"email_delivery_enabled"` 88 // NoticeRequired says the organization refuses to score a candidate with no automated decision notice on 89 // file. Every role is told, because it is a recruiter who meets the refusal and a recruiter who has to 90 // know why before they meet it rather than after. 91 NoticeRequired bool `json:"aedt_notice_required"` 92 // TimeZone comes from organizations.time_zone, the column that has held it since migration 0057 and 93 // already decides what "today" means for the task queue. It is reported here so a screen rendering a 94 // deadline does not have to ask a second endpoint for it. 95 TimeZone string `json:"time_zone"` 96 // RecordScope is the caller's RESOLVED scope, not the organization's setting. The interface uses it to 97 // explain a short list honestly, so a recruiter sees "showing your records" rather than concluding the 98 // bench is empty. 99 RecordScope string `json:"record_scope"` 100} 101 102func (h *SettingsHandler) policy(w http.ResponseWriter, r *http.Request) { 103 if h.store == nil { 104 writeErr(w, http.StatusServiceUnavailable, "settings are unavailable on this node") 105 return 106 } 107 p, ok := tenant.UserFromContext(r.Context()) 108 if !ok { 109 writeErr(w, http.StatusForbidden, "no principal") 110 return 111 } 112 st, err := h.store.Load(r.Context()) 113 if err != nil { 114 writeErr(w, http.StatusInternalServerError, "could not read settings") 115 return 116 } 117 orgTimeZone := "America/New_York" 118 _ = h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 119 return tx.QueryRow(ctx, `SELECT time_zone FROM organizations LIMIT 1`).Scan(&orgTimeZone) 120 }) 121 role := security.Role(p.Role) 122 writeJSON(w, http.StatusOK, policyResponse{ 123 CanSeeRates: security.CanSeeField(role, st.RateVisibility), 124 CanSeeMargins: security.CanSeeField(role, st.MarginVisibility), 125 CanSeeContacts: security.CanSeeField(role, st.ContactVisibility), 126 CanSeeWorkOf: security.CanSeeOthersWork(role, st.WorkVisibility), 127 ShowPresence: st.ShowActivityPresence, 128 ClaimRequired: st.ClaimRequired, 129 ClaimExpiryHrs: st.ClaimExpiryHours, 130 EmailDelivery: st.EmailDeliveryEnabled && st.SMTPVerifiedAt != nil, 131 TimeZone: orgTimeZone, 132 RecordScope: string(security.ResolveRecordScope(role, st.StaffRecordScope, st.ManagerRecordScope)), 133 NoticeRequired: st.AEDTNoticeRequired, 134 }) 135} 136 137// patchRequest mirrors orgsettings.Update with JSON tags. Pointers throughout, so a field the administrator 138// did not touch is absent rather than zero, and a partial save cannot blank a colleague's setting. 139type patchRequest struct { 140 EmailDeliveryEnabled *bool `json:"email_delivery_enabled"` 141 EmailFromAddress *string `json:"email_from_address"` 142 EmailFromName *string `json:"email_from_name"` 143 EmailReplyTo *string `json:"email_reply_to"` 144 SMTPHost *string `json:"smtp_host"` 145 SMTPPort *int `json:"smtp_port"` 146 SMTPUsername *string `json:"smtp_username"` 147 SMTPSecurity *string `json:"smtp_security"` 148 149 WorkVisibility *string `json:"work_visibility"` 150 ShowActivityPresence *bool `json:"show_activity_presence"` 151 ClaimRequired *bool `json:"claim_required"` 152 ClaimExpiryHours *int `json:"claim_expiry_hours"` 153 154 RateVisibility *string `json:"rate_visibility"` 155 MarginVisibility *string `json:"margin_visibility"` 156 ContactVisibility *string `json:"contact_visibility"` 157 158 StaffRecordScope *string `json:"staff_record_scope"` 159 ManagerRecordScope *string `json:"manager_record_scope"` 160 UnownedRecordsVisible *bool `json:"unowned_records_visible"` 161 162 InviteExpiryHours *int `json:"invite_expiry_hours"` 163 DefaultInviteRole *string `json:"default_invite_role"` 164 165 // DefaultBurdenPct arrives as a STRING, never a JSON number, for the same reason every other rate in this 166 // product does: a wrap that round tripped through a float does not reconcile with an invoice. 167 // 168 // The double pointer is what carries the three meanings. Field absent, so the outer pointer is nil, means 169 // leave the wrap alone. Field present as JSON null, so the outer is set and the inner is nil, means clear 170 // it. Field present as a string sets it. Without the distinction, clearing and not touching look identical 171 // on the wire and an owner cannot remove a wrap they entered by mistake. 172 DefaultBurdenPct *string `json:"default_burden_pct"` 173 // AEDTNoticeRequired refuses to score a candidate with no automated decision notice on file. 174 AEDTNoticeRequired *bool `json:"aedt_notice_required"` 175 // defaultBurdenPresent records whether the KEY appeared at all, which a *string cannot express: a JSON null 176 // and an absent key both decode to nil. UnmarshalJSON below is the only place it is set. 177 defaultBurdenPresent bool 178} 179 180// UnmarshalJSON exists ONLY to tell an absent default_burden_pct apart from an explicit null. 181// 182// encoding/json decodes both to a nil pointer, and the two mean opposite things here: one leaves the 183// organization's wrap untouched, the other erases it and takes every margin in the product with it. A settings 184// PATCH that sends a subset of fields, which is the normal case and is what the interface does, would 185// otherwise clear the wrap on every unrelated save. 186func (p *patchRequest) UnmarshalJSON(b []byte) error { 187 type raw patchRequest 188 var r raw 189 if err := json.Unmarshal(b, &r); err != nil { 190 return err 191 } 192 var keys map[string]json.RawMessage 193 if err := json.Unmarshal(b, &keys); err != nil { 194 return err 195 } 196 *p = patchRequest(r) 197 _, p.defaultBurdenPresent = keys["default_burden_pct"] 198 return nil 199} 200 201func (p patchRequest) toUpdate() orgsettings.Update { 202 return orgsettings.Update{ 203 EmailDeliveryEnabled: p.EmailDeliveryEnabled, 204 EmailFromAddress: p.EmailFromAddress, 205 EmailFromName: p.EmailFromName, 206 EmailReplyTo: p.EmailReplyTo, 207 SMTPHost: p.SMTPHost, 208 SMTPPort: p.SMTPPort, 209 SMTPUsername: p.SMTPUsername, 210 SMTPSecurity: p.SMTPSecurity, 211 WorkVisibility: p.WorkVisibility, 212 ShowActivityPresence: p.ShowActivityPresence, 213 ClaimRequired: p.ClaimRequired, 214 ClaimExpiryHours: p.ClaimExpiryHours, 215 RateVisibility: p.RateVisibility, 216 MarginVisibility: p.MarginVisibility, 217 ContactVisibility: p.ContactVisibility, 218 StaffRecordScope: p.StaffRecordScope, 219 ManagerRecordScope: p.ManagerRecordScope, 220 UnownedRecordsVisible: p.UnownedRecordsVisible, 221 InviteExpiryHours: p.InviteExpiryHours, 222 DefaultInviteRole: p.DefaultInviteRole, 223 DefaultBurdenPct: p.burdenUpdate(), 224 AEDTNoticeRequired: p.AEDTNoticeRequired, 225 } 226} 227 228// burdenUpdate turns the wire shape into the three state update the store expects. A malformed number is 229// deliberately NOT handled here: it becomes a nil inner pointer, which would read as a clear. parseBurden 230// below is called first by the handler so a bad string is refused with a field name rather than silently 231// erasing the wrap. 232func (p patchRequest) burdenUpdate() **decimal.Decimal { 233 if !p.defaultBurdenPresent { 234 return nil 235 } 236 var inner *decimal.Decimal 237 if p.DefaultBurdenPct != nil && strings.TrimSpace(*p.DefaultBurdenPct) != "" { 238 if d, err := decimal.NewFromString(strings.TrimSpace(*p.DefaultBurdenPct)); err == nil { 239 inner = &d 240 } 241 } 242 return &inner 243} 244 245// parseBurden reports whether the supplied wrap is a number at all, so the handler can refuse a typo with the 246// offending field named rather than treating it as a request to clear the wrap. 247func (p patchRequest) parseBurden() error { 248 if !p.defaultBurdenPresent || p.DefaultBurdenPct == nil { 249 return nil 250 } 251 v := strings.TrimSpace(*p.DefaultBurdenPct) 252 if v == "" { 253 return nil 254 } 255 if _, err := decimal.NewFromString(v); err != nil { 256 return fmt.Errorf("that is not a number, a 35 percent wrap is written 0.35") 257 } 258 return nil 259} 260 261func (h *SettingsHandler) patch(w http.ResponseWriter, r *http.Request) { 262 if h.store == nil { 263 writeErr(w, http.StatusServiceUnavailable, "settings are unavailable on this node") 264 return 265 } 266 var in patchRequest 267 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10)).Decode(&in); err != nil { 268 writeErr(w, http.StatusBadRequest, "invalid body") 269 return 270 } 271 // A MALFORMED WRAP IS REFUSED BEFORE IT CAN READ AS A CLEAR. burdenUpdate turns an unparseable string into 272 // a nil inner pointer, which the store treats as "erase the wrap", so a typo would silently remove the 273 // organization's cost basis and turn every margin in the product back into a spread. Checking first means 274 // the owner gets the field name and the wrap survives. 275 if err := in.parseBurden(); err != nil { 276 writeJSON(w, http.StatusUnprocessableEntity, 277 map[string]string{"error": err.Error(), "field": "default_burden_pct"}) 278 return 279 } 280 u := in.toUpdate() 281 if field, err := u.Validate(); err != nil { 282 writeJSON(w, http.StatusUnprocessableEntity, map[string]string{"error": err.Error(), "field": field}) 283 return 284 } 285 actor := actorUUID(r.Context()) 286 287 var after orgsettings.Settings 288 err := h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 289 before, e := h.store.LoadTx(ctx, tx) 290 if e != nil { 291 return e 292 } 293 after, e = h.store.Save(ctx, tx, u, actor) 294 if e != nil { 295 return e 296 } 297 // AUDITED WITH BEFORE AND AFTER, because these settings decide who can see pay data and whose activity 298 // is visible to whom. A change to rate_visibility is a permission change, and permission changes are 299 // exactly what the audit rule names. 300 if h.aud != nil { 301 b, _ := json.Marshal(before) 302 a, _ := json.Marshal(after) 303 return h.aud.OnTx(ctx, tx, audit.Event{ 304 Action: "org.settings.updated", ActorUserID: &actor, 305 EntityType: "org_settings", OldValues: b, NewValues: a, 306 IPAddress: r.Header.Get("X-Forwarded-For"), UserAgent: r.UserAgent(), 307 }) 308 } 309 return nil 310 }) 311 if err != nil { 312 writeErr(w, http.StatusInternalServerError, "could not save settings") 313 return 314 } 315 writeJSON(w, http.StatusOK, map[string]any{"settings": after}) 316} 317 318func (h *SettingsHandler) putPassword(w http.ResponseWriter, r *http.Request) { 319 if h.store == nil { 320 writeErr(w, http.StatusServiceUnavailable, "settings are unavailable on this node") 321 return 322 } 323 if !h.store.SealAvailable() { 324 // A HONEST 503. The alternative, storing it unprotected or dropping it silently, are both worse than 325 // telling the administrator that this node cannot hold a secret yet. 326 writeErr(w, http.StatusServiceUnavailable, 327 "this node cannot store a secret because no organization secret key is configured, contact your operator") 328 return 329 } 330 var in struct { 331 Password string `json:"password"` 332 } 333 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<10)).Decode(&in); err != nil { 334 writeErr(w, http.StatusBadRequest, "invalid body") 335 return 336 } 337 if strings.TrimSpace(in.Password) == "" { 338 writeJSON(w, http.StatusUnprocessableEntity, 339 map[string]string{"error": "a password is [credential removed], use DELETE to remove the stored one", "field": "password"}) 340 return 341 } 342 actor := actorUUID(r.Context()) 343 err := h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 344 if e := h.store.PutSecret(ctx, tx, orgsettings.SecretSMTPPassword, in.Password, actor); e != nil { 345 return e 346 } 347 // Storing a new password invalidates any previous proof that mail worked, for the same reason changing 348 // the host does. 349 if e := h.store.MarkAttemptFailed(ctx, tx, "the mail password changed, send a test message to verify it", "", ""); e != nil { 350 return e 351 } 352 if h.aud != nil { 353 // NAME ONLY. The audit trail records that a mail credential was set, never any part of it. 354 body, _ := json.Marshal(map[string]any{"secret": orgsettings.SecretSMTPPassword}) 355 return h.aud.OnTx(ctx, tx, audit.Event{ 356 Action: "org.secret.set", ActorUserID: &actor, 357 EntityType: "org_secret", EntityID: orgsettings.SecretSMTPPassword, NewValues: body, 358 IPAddress: r.Header.Get("X-Forwarded-For"), UserAgent: r.UserAgent(), 359 }) 360 } 361 return nil 362 }) 363 if err != nil { 364 if errors.Is(err, orgsettings.ErrSealUnavailable) { 365 writeErr(w, http.StatusServiceUnavailable, "secret storage is not configured on this node") 366 return 367 } 368 writeErr(w, http.StatusInternalServerError, "could not store the mail password") 369 return 370 } 371 writeJSON(w, http.StatusOK, map[string]any{ 372 "stored": true, 373 "note": "the password is [credential removed] at rest and is never returned, send a test message to verify it works", 374 }) 375} 376 377func (h *SettingsHandler) deletePassword(w http.ResponseWriter, r *http.Request) { 378 if h.store == nil { 379 writeErr(w, http.StatusServiceUnavailable, "settings are unavailable on this node") 380 return 381 } 382 actor := actorUUID(r.Context()) 383 err := h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 384 if e := h.store.DeleteSecret(ctx, tx, orgsettings.SecretSMTPPassword); e != nil { 385 return e 386 } 387 // Removing the credential stops delivery. Leaving delivery enabled against a credential that no longer 388 // exists would queue invites into a failure nobody is watching. 389 if e := h.store.MarkAttemptFailed(ctx, tx, "the mail password was removed", "", ""); e != nil { 390 return e 391 } 392 if h.aud != nil { 393 body, _ := json.Marshal(map[string]any{"secret": orgsettings.SecretSMTPPassword}) 394 return h.aud.OnTx(ctx, tx, audit.Event{ 395 Action: "org.secret.removed", ActorUserID: &actor, 396 EntityType: "org_secret", EntityID: orgsettings.SecretSMTPPassword, OldValues: body, 397 IPAddress: r.Header.Get("X-Forwarded-For"), UserAgent: r.UserAgent(), 398 }) 399 } 400 return nil 401 }) 402 if err != nil { 403 writeErr(w, http.StatusInternalServerError, "could not remove the mail password") 404 return 405 } 406 writeJSON(w, http.StatusOK, map[string]any{"removed": true}) 407} 408 409// testEmail is the ONLY way smtp_verified_at is ever set, and it sends to the administrator's OWN address, 410// never to one supplied in the request. That is deliberate: a test endpoint that accepts a recipient is an 411// open relay wearing a settings screen, letting any authenticated tenant admin send mail from this platform 412// to anybody they choose. 413func (h *SettingsHandler) testEmail(w http.ResponseWriter, r *http.Request) { 414 if h.store == nil { 415 writeErr(w, http.StatusServiceUnavailable, "settings are unavailable on this node") 416 return 417 } 418 actor := actorUUID(r.Context()) 419 420 var cfg mailer.Config 421 var recipient string 422 err := h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 423 st, e := h.store.LoadTx(ctx, tx) 424 if e != nil { 425 return e 426 } 427 if st.SMTPHost == "" || st.SMTPPort == 0 || st.EmailFromAddress == "" { 428 return errNotConfigured 429 } 430 pw, e := h.store.OpenSecret(ctx, tx, orgsettings.SecretSMTPPassword) 431 if e != nil && !errors.Is(e, orgsettings.ErrNoSecret) { 432 return e 433 } 434 if st.SMTPUsername != "" && errors.Is(e, orgsettings.ErrNoSecret) { 435 return errNoPassword 436 } 437 cfg = mailer.Config{ 438 Host: st.SMTPHost, Port: st.SMTPPort, Username: st.SMTPUsername, Password: pw, 439 Security: st.SMTPSecurity, From: st.EmailFromAddress, FromName: st.EmailFromName, 440 ReplyTo: st.EmailReplyTo, 441 } 442 return tx.QueryRow(ctx, `SELECT email FROM users WHERE id = $1`, actor).Scan(&recipient) 443 }) 444 if err != nil { 445 switch { 446 case errors.Is(err, errNotConfigured): 447 writeJSON(w, http.StatusUnprocessableEntity, 448 map[string]string{"error": "configure a mail host, port and sender address first", "field": "smtp_host"}) 449 case errors.Is(err, errNoPassword): 450 writeJSON(w, http.StatusUnprocessableEntity, 451 map[string]string{"error": "a username is set but no password is [credential removed]", "field": "password"}) 452 default: 453 writeErr(w, http.StatusInternalServerError, "could not read the mail configuration") 454 } 455 return 456 } 457 458 ctx, cancel := context.WithTimeout(r.Context(), 45*time.Second) 459 defer cancel() 460 sendErr := mailer.Send(ctx, cfg, mailer.Message{ 461 To: recipient, 462 Subject: "missionMATCH test message", 463 Body: "This is a test from missionMATCH.\r\n\r\n" + 464 "Your organization's mail settings are working. Invitations and notifications will now be sent " + 465 "from " + cfg.From + " using your own mail server.\r\n\r\n" + 466 "If you did not request this, someone with administrator access to your missionMATCH account " + 467 "changed the mail settings.\r\n", 468 }) 469 470 // The outcome is recorded either way, in its own transaction, so a failed send still leaves the 471 // administrator an error they can act on rather than a screen that simply did nothing. 472 _ = h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 473 if sendErr != nil { 474 return h.store.MarkAttemptFailed(ctx, tx, sendErr.Error(), cfg.Username, cfg.Password) 475 } 476 return h.store.MarkVerified(ctx, tx) 477 }) 478 if h.aud != nil { 479 outcome := "sent" 480 if sendErr != nil { 481 outcome = "failed" 482 } 483 body, _ := json.Marshal(map[string]any{"outcome": outcome, "host": cfg.Host}) 484 _ = h.db.RunInTenantTx(r.Context(), func(ctx context.Context, tx pgx.Tx) error { 485 return h.aud.OnTx(ctx, tx, audit.Event{ 486 Action: "org.email.test", ActorUserID: &actor, EntityType: "org_settings", 487 NewValues: body, IPAddress: r.Header.Get("X-Forwarded-For"), UserAgent: r.UserAgent(), 488 }) 489 }) 490 } 491 if sendErr != nil { 492 // The transport's own words, scrubbed of the credentials, because "could not send mail" sends an 493 // administrator to a support queue while "no such host" sends them to their typo. 494 writeJSON(w, http.StatusBadGateway, map[string]string{ 495 "error": redactFor(sendErr.Error(), cfg.Username, cfg.Password), 496 }) 497 return 498 } 499 writeJSON(w, http.StatusOK, map[string]any{ 500 "sent": true, "to": recipient, 501 "note": "mail delivery is now verified, switch on email_delivery_enabled to send invitations this way", 502 }) 503} 504 505var ( 506 errNotConfigured = errors.New("mail is not configured") 507 errNoPassword = [credential removed]"no mail password stored") 508) 509 510// redactFor mirrors the scrubbing applied before the message is stored, so the value returned over the API 511// and the value written to the column are the same scrubbed text. 512func redactFor(s, username, password string) string { 513 for _, secret := range []string{password, username} { 514 if len(secret) >= 4 { 515 s = strings.ReplaceAll(s, secret, "[redacted]") 516 } 517 } 518 return s 519} 520 521func actorUUID(ctx context.Context) uuid.UUID { 522 p, ok := tenant.UserFromContext(ctx) 523 if !ok { 524 return uuid.Nil 525 } 526 id, err := uuid.Parse(p.UserID) 527 if err != nil { 528 return uuid.Nil 529 } 530 return id 531} 532