Janady13/missionmatch / internal/modules/auth/profile.go

1package auth 2 3import ( 4 "context" 5 "encoding/json" 6 "errors" 7 "fmt" 8 "strings" 9 10 "github.com/google/uuid" 11 "github.com/jackc/pgx/v5" 12 13 "github.com/missionworkforce/missionmatch/internal/platform/audit" 14 "github.com/missionworkforce/missionmatch/internal/platform/security" 15 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 16) 17 18// Self service profile and tenant name editing, amendment 6 decisions 4 and 5, Track U items 2 and 3. 19// 20// The defect this closes: full_name was written once at invite acceptance and never again, by anyone. There 21// was no self service endpoint and no administrative one either, so a trivial personal edit had no path at 22// all and escalated to the top of the ladder, where it still failed. Two writes fix it, and they are 23// deliberately separate because they answer to different rules: 24// 25// UpdateOwnProfile anyone, on THEMSELVES only. No capability needed, because editing your own name is 26// not an act of authority. The subject is taken from the session, never from the body, 27// so it cannot be pointed at another account. 28// UpdateUserProfile admin and above, on someone they OUTRANK, within their own tenant. This is the 29// client facing fix, so an admin can correct a colleague's name today. 30// 31// Both audit as identity change events, and both are bounded by the same length caps the schema enforces. 32 33// The package already declares ErrNotFound; a user in another tenant is indistinguishable from one that 34// does not exist, which is the intent. 35 36// ErrOutranked is returned when an actor tries to edit someone at or above their own rank. It is the same 37// separation of duties that governs role changes: nobody edits a peer's or a superior's identity. 38var ErrOutranked = errors.New("auth: you may only edit a user you outrank") 39 40const ( 41 maxNameLen = 120 42 maxTitleLen = 120 43 maxPhoneLen = 40 44) 45 46// ProfileInput carries the editable profile fields. A nil pointer leaves the column unchanged, so a caller 47// sends only what it means to change and an omitted field is never silently blanked. 48type ProfileInput struct { 49 FullName *string `json:"full_name"` 50 Title *string `json:"title"` 51 Phone *string `json:"phone"` 52} 53 54// Profile is the app facing view of an identity. 55type Profile struct { 56 ID string `json:"id"` 57 Email string `json:"email"` 58 FullName string `json:"full_name"` 59 Title string `json:"title"` 60 Phone string `json:"phone"` 61 Role string `json:"role"` 62 Status string `json:"status"` 63} 64 65// UpdateOwnProfile edits the CALLER's own identity. The subject is the session's user id, never a value 66// from the request, so this endpoint cannot be aimed at another account no matter what the body says. 67func (s *Service) UpdateOwnProfile(ctx context.Context, userID, orgID string, in ProfileInput) (Profile, error) { 68 return s.writeProfile(ctx, userID, orgID, userID, in, "identity.profile.self_updated") 69} 70 71// UpdateUserProfile edits ANOTHER user's identity within the actor's tenant. The caller must hold 72// user.role.change (admin and above) and must outrank the target, both enforced here rather than only in 73// the UI, so an API caller is bound by the same ceiling as a button. 74func (s *Service) UpdateUserProfile(ctx context.Context, actorID, actorRole, orgID, targetID string, in ProfileInput) (Profile, error) { 75 targetRole, err := s.roleOf(ctx, targetID, orgID) 76 if err != nil { 77 return Profile{}, err 78 } 79 if !security.OutRanks(security.Role(actorRole), security.Role(targetRole)) { 80 return Profile{}, ErrOutranked 81 } 82 return s.writeProfile(ctx, actorID, orgID, targetID, in, "identity.profile.admin_updated") 83} 84 85// writeProfile is the one write both paths share, so the validation, the audit shape, and the returned view 86// cannot drift between self service and administrative editing. 87func (s *Service) writeProfile(ctx context.Context, actorID, orgID, targetID string, in ProfileInput, action string) (Profile, error) { 88 sets := make([]string, 0, 3) 89 args := make([]any, 0, 5) 90 add := func(col string, v string, max int, label string) error { 91 v = strings.TrimSpace(v) 92 if len(v) > max { 93 return fmt.Errorf("%s exceeds %d characters", label, max) 94 } 95 args = append(args, v) 96 sets = append(sets, fmt.Sprintf("%s = $%d", col, len(args))) 97 return nil 98 } 99 if in.FullName != nil { 100 if strings.TrimSpace(*in.FullName) == "" { 101 return Profile{}, errors.New("full_name cannot be empty") 102 } 103 if err := add("full_name", *in.FullName, maxNameLen, "full_name"); err != nil { 104 return Profile{}, err 105 } 106 } 107 if in.Title != nil { 108 if err := add("title", *in.Title, maxTitleLen, "title"); err != nil { 109 return Profile{}, err 110 } 111 } 112 if in.Phone != nil { 113 if err := add("phone", *in.Phone, maxPhoneLen, "phone"); err != nil { 114 return Profile{}, err 115 } 116 } 117 if len(sets) == 0 { 118 return s.getProfile(ctx, targetID, orgID) 119 } 120 sets = append(sets, "updated_at = now()") 121 args = append(args, targetID, orgID) 122 q := `UPDATE users SET ` + strings.Join(sets, ", ") + 123 fmt.Sprintf(" WHERE id = $%d AND organization_id = $%d", len(args)-1, len(args)) + 124 ` RETURNING id::text, email, full_name, title, phone, role, status` 125 126 // The write runs INSIDE a tenant transaction, so app.current_org_id is set for it. 127 // 128 // This is not belt and braces, it is the difference between working and not. users carries FORCED row 129 // level security, so the same statement on a bare pool connection with no org GUC matches ZERO rows and 130 // the caller sees "user not found" for a user that plainly exists, on their own account. The explicit 131 // organization_id predicate in the WHERE clause looks like it is doing the scoping, and it is not: RLS 132 // filters the row out before the predicate is ever considered. Proven on staging, where PATCH /me/profile 133 // answered 404 for the signed in user until this ran in a transaction. 134 // 135 // The org is the one already validated onto the context by the session middleware, never a request value. 136 var p Profile 137 if err := s.deps.DB.RunInTenantTx(tenant.WithOrg(ctx, orgID), func(ctx context.Context, tx pgx.Tx) error { 138 return tx.QueryRow(ctx, q, args...).Scan(&p.ID, &p.Email, &p.FullName, &p.Title, &p.Phone, &p.Role, &p.Status) 139 }); err != nil { 140 return Profile{}, ErrNotFound 141 } 142 143 // Identity changes are audited as their own event class. The new values are recorded so a later reader 144 // can see WHAT the identity became; the actor and the subject are both named, which is what makes an 145 // administrative edit distinguishable from a self edit in the trail. 146 nv, _ := json.Marshal(map[string]any{ 147 "subject_user_id": p.ID, "full_name": p.FullName, "title": p.Title, "phone": p.Phone, 148 }) 149 actor, perr := uuid.Parse(actorID) 150 ev := audit.Event{Action: action, EntityType: "user", EntityID: p.ID, NewValues: nv} 151 if perr == nil { 152 ev.ActorUserID = &actor 153 } 154 if s.deps.Audit != nil { 155 _ = s.deps.Audit.System(ctx, ev) 156 } 157 return p, nil 158} 159 160// getProfile and roleOf read the same RLS protected table as the write, so they run in a tenant 161// transaction for the same reason: without the org GUC they return no rows and report a real user as 162// missing. 163func (s *Service) getProfile(ctx context.Context, userID, orgID string) (Profile, error) { 164 var p Profile 165 err := s.deps.DB.RunInTenantTx(tenant.WithOrg(ctx, orgID), func(ctx context.Context, tx pgx.Tx) error { 166 return tx.QueryRow(ctx, 167 `SELECT id::text, email, full_name, title, phone, role, status FROM users WHERE id=$1 AND organization_id=$2`, 168 userID, orgID).Scan(&p.ID, &p.Email, &p.FullName, &p.Title, &p.Phone, &p.Role, &p.Status) 169 }) 170 if err != nil { 171 return Profile{}, ErrNotFound 172 } 173 return p, nil 174} 175 176func (s *Service) roleOf(ctx context.Context, userID, orgID string) (string, error) { 177 var role string 178 err := s.deps.DB.RunInTenantTx(tenant.WithOrg(ctx, orgID), func(ctx context.Context, tx pgx.Tx) error { 179 return tx.QueryRow(ctx, `SELECT role FROM users WHERE id=$1 AND organization_id=$2`, userID, orgID).Scan(&role) 180 }) 181 if err != nil { 182 return "", ErrNotFound 183 } 184 return role, nil 185} 186