Janady13/missionmatch / internal/modules/auth/service_users.go

1package auth 2 3import ( 4 "context" 5 "errors" 6 7 "github.com/google/uuid" 8 "github.com/jackc/pgx/v5" 9 "github.com/jackc/pgx/v5/pgconn" 10 11 "github.com/missionworkforce/missionmatch/internal/platform/audit" 12 "github.com/missionworkforce/missionmatch/internal/platform/security" 13 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 14) 15 16// ErrEmailInUse is returned when an invite targets an email that already exists (global uniqueness). 17var ErrEmailInUse = errors.New("auth: email already in use") 18 19// targetUser is the org scoped view of a user read inside a tenant tx. Because the read runs under 20// RLS, a row only comes back when the target is in the actor's org, which is the same org proof. 21type targetUser struct { 22 id uuid.UUID 23 email string 24 role string 25 status string 26} 27 28// Invite creates an invited user in the actor's org and a one time activation token. The capability 29// (user.invite) is enforced by middleware; the separation of duties bound (invited role strictly 30// below the actor) is enforced here. 31func (s *Service) Invite(ctx context.Context, in InviteInput, ip, ua string) (InviteResult, error) { 32 if _, err := s.db(); err != nil { 33 return InviteResult{}, err 34 } 35 actor, ok := tenant.UserFromContext(ctx) 36 if !ok { 37 return InviteResult{}, ErrForbidden 38 } 39 org, ok := tenant.OrgFromContext(ctx) 40 if !ok { 41 return InviteResult{}, tenant.ErrNoTenant 42 } 43 if !security.ValidRole(security.Role(in.Role)) || !security.CanInvite(security.Role(actor.Role), security.Role(in.Role)) { 44 // Record the over authority attempt in the org's own audit trail (in tenant), matching the 45 // ChangeRole denial, so a privilege escalation attempt is visible to the org, not only the 46 // platform NULL org log. 47 _ = s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 48 return s.auditTx(ctx, tx, actor, audit.Event{ 49 Action: "authz.deny", EntityType: "capability", EntityID: "user.invite", 50 IPAddress: ip, UserAgent: ua, NewValues: reasonJSON("invited role not below actor")}) 51 }) 52 return InviteResult{}, ErrForbidden 53 } 54 token, tokenHash, err := security.NewSessionToken() 55 if err != nil { 56 return InviteResult{}, err 57 } 58 var newUserID uuid.UUID 59 err = s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 60 e := tx.QueryRow(ctx, 61 `INSERT INTO users (organization_id, email, full_name, role, status) 62 VALUES (NULLIF(current_setting('app.current_org_id', true), '')::uuid, $1, $2, $3, 'invited') 63 RETURNING id`, in.Email, in.FullName, in.Role).Scan(&newUserID) 64 if isUniqueViolation(e) { 65 return ErrEmailInUse 66 } 67 if e != nil { 68 return e 69 } 70 if _, e := tx.Exec(ctx, `SELECT auth_create_invite($1,$2,$3,$4,$5,$6,$7)`, 71 mustUUID(org), in.Email, newUserID, tokenHash, in.Role, s.deps.InviteSeconds, mustUUID(actor.UserID)); e != nil { 72 return e 73 } 74 return s.auditTx(ctx, tx, actor, audit.Event{Action: "user.invite.created", EntityType: "user", EntityID: newUserID.String(), IPAddress: ip, UserAgent: ua}) 75 }) 76 if err != nil { 77 return InviteResult{}, err 78 } 79 return InviteResult{Token: token, UserID: newUserID.String()}, nil 80} 81 82// AcceptInvite redeems an invite or activation token and sets the password. With MFA required it 83// issues an auth_pending session so the new user proceeds to MFA enrollment; with MFA disabled for a 84// pilot it issues an active session directly. It is public and token keyed. 85func (s *Service) AcceptInvite(ctx context.Context, in AcceptInput, ip, ua string) (LoginResult, error) { 86 db, err := s.db() 87 if err != nil { 88 return LoginResult{}, err 89 } 90 hash, ver, err := s.deps.Hasher.Hash(in.Password) 91 if err != nil { 92 return LoginResult{}, err // includes ErrPasswordTooLong 93 } 94 var userID, orgID uuid.UUID 95 err = db.QueryRow(ctx, `SELECT user_id, organization_id FROM auth_accept_invite($1,$2,$3)`, 96 security.HashSessionToken(in.Token), hash, ver).Scan(&userID, &orgID) 97 if errors.Is(err, pgx.ErrNoRows) { 98 return LoginResult{}, ErrInvalidCredentials // invalid, expired, used, or a mismatched invite 99 } 100 if err != nil { 101 return LoginResult{}, err 102 } 103 token, tokenHash, err := security.NewSessionToken() 104 if err != nil { 105 return LoginResult{}, err 106 } 107 if err := s.createInitialSession(ctx, db, tokenHash, userID, orgID, ip, ua); err != nil { 108 return LoginResult{}, err 109 } 110 _ = s.deps.Audit.System(ctx, audit.Event{Action: "user.invite.accepted", ActorUserID: &userID, IPAddress: ip, UserAgent: ua}) 111 return LoginResult{Token: token, MFAEnrolled: false, MFARequired: !s.deps.MFADisabled}, nil 112} 113 114// ReissueRecovery issues a fresh single use activation link for a target user after proving same org 115// membership through an RLS scoped read. The target redeems it to set a new password. This is the 116// admin recovery path; public self serve forgot password is [credential removed] to sub phase 2.9. 117func (s *Service) ReissueRecovery(ctx context.Context, targetID string, ip, ua string) (InviteResult, error) { 118 if _, err := s.db(); err != nil { 119 return InviteResult{}, err 120 } 121 actor, ok := tenant.UserFromContext(ctx) 122 if !ok { 123 return InviteResult{}, ErrForbidden 124 } 125 org, ok := tenant.OrgFromContext(ctx) 126 if !ok { 127 return InviteResult{}, tenant.ErrNoTenant 128 } 129 token, tokenHash, err := security.NewSessionToken() 130 if err != nil { 131 return InviteResult{}, err 132 } 133 var target targetUser 134 err = s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 135 t, e := readTarget(ctx, tx, targetID) 136 if e != nil { 137 return e 138 } 139 target = t 140 if !security.OutRanks(security.Role(actor.Role), security.Role(t.role)) { 141 return ErrForbidden 142 } 143 if _, e := tx.Exec(ctx, `SELECT auth_create_invite($1,$2,$3,$4,$5,$6,$7)`, 144 mustUUID(org), t.email, t.id, tokenHash, t.role, s.deps.InviteSeconds, mustUUID(actor.UserID)); e != nil { 145 return e 146 } 147 return s.auditTx(ctx, tx, actor, audit.Event{Action: "user.recovery.reissued", EntityType: "user", EntityID: t.id.String(), IPAddress: ip, UserAgent: ua}) 148 }) 149 if err != nil { 150 return InviteResult{}, err 151 } 152 return InviteResult{Token: token, UserID: target.id.String()}, nil 153} 154 155// ChangeRole sets a target user's role, enforcing that the actor outranks both the current and the 156// new role and never changes their own role. Because no role outranks owner, owner accounts cannot be 157// demoted or promoted to through the API; owner replacement is a migrator operation. It revokes the 158// target's sessions so a downgrade cannot ride an old elevated session. 159func (s *Service) ChangeRole(ctx context.Context, targetID string, in RoleChangeInput, ip, ua string) error { 160 if _, err := s.db(); err != nil { 161 return err 162 } 163 actor, ok := tenant.UserFromContext(ctx) 164 if !ok { 165 return ErrForbidden 166 } 167 if actor.UserID == targetID { 168 return ErrForbidden // no self role change 169 } 170 if !security.ValidRole(security.Role(in.Role)) { 171 return ErrBadRequest 172 } 173 return s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 174 t, e := readTarget(ctx, tx, targetID) 175 if e != nil { 176 return e 177 } 178 if !security.OutRanks(security.Role(actor.Role), security.Role(t.role)) || 179 !security.OutRanks(security.Role(actor.Role), security.Role(in.Role)) { 180 _ = s.auditTx(ctx, tx, actor, audit.Event{Action: "authz.deny", EntityType: "user", EntityID: t.id.String(), IPAddress: ip, UserAgent: ua, NewValues: reasonJSON("role change above authority")}) 181 return ErrForbidden 182 } 183 if _, e := tx.Exec(ctx, `UPDATE users SET role = $1, updated_at = now() WHERE id = $2`, in.Role, t.id); e != nil { 184 return e 185 } 186 if _, e := tx.Exec(ctx, `SELECT auth_revoke_user_sessions($1,$2)`, t.id, nil); e != nil { 187 return e 188 } 189 return s.auditTx(ctx, tx, actor, audit.Event{ 190 Action: "authz.permission.change", EntityType: "user", EntityID: t.id.String(), 191 OldValues: reasonRole(t.role), NewValues: reasonRole(in.Role), IPAddress: ip, UserAgent: ua}) 192 }) 193} 194 195// ChangeStatus enables or disables a target user. Disabling revokes the target's sessions. 196func (s *Service) ChangeStatus(ctx context.Context, targetID string, in StatusChangeInput, ip, ua string) error { 197 if _, err := s.db(); err != nil { 198 return err 199 } 200 actor, ok := tenant.UserFromContext(ctx) 201 if !ok { 202 return ErrForbidden 203 } 204 if actor.UserID == targetID { 205 return ErrForbidden 206 } 207 if in.Status != "active" && in.Status != "disabled" { 208 return ErrBadRequest 209 } 210 return s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 211 t, e := readTarget(ctx, tx, targetID) 212 if e != nil { 213 return e 214 } 215 if !security.OutRanks(security.Role(actor.Role), security.Role(t.role)) { 216 return ErrForbidden 217 } 218 if _, e := tx.Exec(ctx, `UPDATE users SET status = $1, updated_at = now() WHERE id = $2`, in.Status, t.id); e != nil { 219 return e 220 } 221 action := "user.enabled" 222 if in.Status == "disabled" { 223 action = "user.disabled" 224 if _, e := tx.Exec(ctx, `SELECT auth_revoke_user_sessions($1,$2)`, t.id, nil); e != nil { 225 return e 226 } 227 } 228 return s.auditTx(ctx, tx, actor, audit.Event{Action: action, EntityType: "user", EntityID: t.id.String(), IPAddress: ip, UserAgent: ua}) 229 }) 230} 231 232// ResetMFA clears a target user's MFA (admin path), after proving same org and that the actor 233// outranks the target. The target must re enroll on next login. The target's sessions are revoked. 234func (s *Service) ResetMFA(ctx context.Context, targetID string, ip, ua string) error { 235 if _, err := s.db(); err != nil { 236 return err 237 } 238 actor, ok := tenant.UserFromContext(ctx) 239 if !ok { 240 return ErrForbidden 241 } 242 if actor.UserID == targetID { 243 return ErrForbidden // no self reset; an admin only resets a user they outrank, matching ChangeRole and ChangeStatus 244 } 245 return s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 246 t, e := readTarget(ctx, tx, targetID) 247 if e != nil { 248 return e 249 } 250 if !security.OutRanks(security.Role(actor.Role), security.Role(t.role)) { 251 return ErrForbidden 252 } 253 if _, e := tx.Exec(ctx, `SELECT auth_mfa_reset($1)`, t.id); e != nil { 254 return e 255 } 256 if _, e := tx.Exec(ctx, `SELECT auth_revoke_user_sessions($1,$2)`, t.id, nil); e != nil { 257 return e 258 } 259 return s.auditTx(ctx, tx, actor, audit.Event{Action: "auth.mfa.reset", EntityType: "user", EntityID: t.id.String(), IPAddress: ip, UserAgent: ua}) 260 }) 261} 262 263// SessionInfo returns the SPA view of the current authenticated session. 264func (s *Service) SessionInfo(ctx context.Context) (SessionInfo, error) { 265 if _, err := s.db(); err != nil { 266 return SessionInfo{}, err 267 } 268 p, ok := tenant.UserFromContext(ctx) 269 if !ok { 270 return SessionInfo{}, ErrForbidden 271 } 272 org, _ := tenant.OrgFromContext(ctx) 273 info := SessionInfo{UserID: p.UserID, OrgID: org, Role: p.Role} 274 err := s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 275 return tx.QueryRow(ctx, `SELECT mfa_enrolled FROM users WHERE id = $1`, mustUUID(p.UserID)).Scan(&info.MFAEnrolled) 276 }) 277 return info, err 278} 279 280// ListUsers returns the org's users (RLS scoped). Gated on RequireRole(admin) at the route. 281func (s *Service) ListUsers(ctx context.Context) ([]UserSummary, error) { 282 if _, err := s.db(); err != nil { 283 return nil, err 284 } 285 var out []UserSummary 286 err := s.deps.DB.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 287 rows, e := tx.Query(ctx, `SELECT id, email, full_name, role, status, mfa_enrolled FROM users ORDER BY created_at DESC, id DESC LIMIT 500`) 288 if e != nil { 289 return e 290 } 291 defer rows.Close() 292 for rows.Next() { 293 var u UserSummary 294 var id uuid.UUID 295 if e := rows.Scan(&id, &u.Email, &u.FullName, &u.Role, &u.Status, &u.MFAEnrolled); e != nil { 296 return e 297 } 298 u.ID = id.String() 299 out = append(out, u) 300 } 301 return rows.Err() 302 }) 303 return out, err 304} 305 306// auditSessionRejected records a probing or stale token attempt against a non empty session cookie. It 307// returns the write error so the caller can surface it; the request is denied regardless, but the 308// audit failure must not vanish silently (the module's fail closed audit contract). 309func (s *Service) auditSessionRejected(ctx context.Context, ip, ua string) error { 310 return s.deps.Audit.System(ctx, audit.Event{Action: "auth.session.rejected", IPAddress: ip, UserAgent: ua}) 311} 312 313// readTarget reads a user inside the tenant tx. RLS scopes it to the actor's org, so a not found row 314// proves the target is in another org (or does not exist): the same org check is the read itself. 315func readTarget(ctx context.Context, tx pgx.Tx, id string) (targetUser, error) { 316 uid := mustUUID(id) 317 var t targetUser 318 err := tx.QueryRow(ctx, `SELECT id, email, role, status FROM users WHERE id = $1`, uid).Scan(&t.id, &t.email, &t.role, &t.status) 319 if errors.Is(err, pgx.ErrNoRows) { 320 return targetUser{}, ErrNotFound 321 } 322 return t, err 323} 324 325func (s *Service) auditTx(ctx context.Context, tx pgx.Tx, actor tenant.Principal, e audit.Event) error { 326 id := mustUUID(actor.UserID) 327 e.ActorUserID = &id 328 return s.deps.Audit.OnTx(ctx, tx, e) 329} 330 331func isUniqueViolation(err error) bool { 332 var pgErr *pgconn.PgError 333 return errors.As(err, &pgErr) && pgErr.Code == "23505" 334} 335