/packages/backend/services/workspace/create_user.go at a1e1be482eeb00e7ca300e97730a692f96dd2a92

// SPDX-FileCopyrightText: 2025 Shota FUJI <pockawoooh@gmail.com>
// SPDX-License-Identifier: AGPL-3.0-only

package workspace

import (
	"context"
	"crypto/rand"
	"slices"
	"strings"

	"connectrpc.com/connect"
	"github.com/google/uuid"
	"google.golang.org/protobuf/proto"

	eventV1 "pocka.jp/x/yamori/proto/go/backend/events/v1"
	"pocka.jp/x/yamori/proto/go/backend/workspace/v1/types"
	errorV1 "pocka.jp/x/yamori/proto/go/error/v1"
	workspaceV2 "pocka.jp/x/yamori/proto/go/workspace/v2"

	"pocka.jp/x/yamori/backend/core/event"
	"pocka.jp/x/yamori/backend/core/projection"
	workspaceEvent "pocka.jp/x/yamori/backend/events/workspace"
)

func createUserSystemError(message string) *connect.Response[workspaceV2.CreateUserResponse] {
	return connect.NewResponse(&workspaceV2.CreateUserResponse{
		Result: &workspaceV2.CreateUserResponse_SystemError{
			SystemError: &errorV1.SystemError{
				Message: proto.String(message),
			},
		},
	})
}

func createUserAuthError() *connect.Response[workspaceV2.CreateUserResponse] {
	return connect.NewResponse(&workspaceV2.CreateUserResponse{
		Result: &workspaceV2.CreateUserResponse_AuthenticationError{
			AuthenticationError: &errorV1.AuthenticationError{},
		},
	})
}

func createUserPermError() *connect.Response[workspaceV2.CreateUserResponse] {
	return connect.NewResponse(&workspaceV2.CreateUserResponse{
		Result: &workspaceV2.CreateUserResponse_PermissionError{
			PermissionError: &errorV1.PermissionError{},
		},
	})
}

func (s *Service) CreateUser(
	ctx context.Context,
	req *connect.Request[workspaceV2.CreateUserRequest],
) (*connect.Response[workspaceV2.CreateUserResponse], error) {
	logger := s.core.Logger.With(
		"service", "yamori.workspace.v2.WorkspaceService",
		"method", "CreateUser",
	)

	header := req.Header()
	token, err := s.core.LoadTokenFromCookie(&header)
	if err != nil || token == nil {
		return createUserAuthError(), nil
	}

	tx, err := s.core.DB.Begin()
	if err != nil {
		logger.Error("Failed to begin transaction", "error", err)
		return createUserSystemError("Database error"), nil
	}
	defer tx.Rollback()

	users, err := projection.GetUsers(tx)
	if err != nil {
		logger.Error("Failed to read users projection", "error", err)
		return createUserSystemError("Database error"), nil
	}

	secret, err := projection.GetLoginJwtSecret(tx)
	if err != nil {
		logger.Error("Failed to read login_jwt_secret projection", "error", err)
		return createUserSystemError("Database error"), nil
	}

	if err := event.UpdateProjections(tx, users, secret); err != nil {
		logger.Error("Failed to update projections", "error", err)
		return createUserSystemError("Database error"), nil
	}

	user, err := token.FindUser(secret, users)
	if err != nil {
		logger.Warn("Malformed token found", "error", err)

		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_AuthenticationError{
				AuthenticationError: &errorV1.AuthenticationError{},
			},
		}), nil
	}

	name := req.Msg.GetName()
	if name == "" {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_MissingFieldError{
				MissingFieldError: &errorV1.MissingFieldError{
					Path: proto.String("name"),
				},
			},
		}), nil
	}

	if strings.Trim(name, " \r\n\t") != name {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_NameSurroundedBySpaces{
				NameSurroundedBySpaces: "Name cannot contain space, CR, LF, Tab",
			},
		}), nil
	}

	displayName := strings.Trim(req.Msg.GetDisplayName(), " \r\n\t")
	if displayName == "" {
		displayName = name
	}

	password := req.Msg.GetPassword()
	if password == "" {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_MissingFieldError{
				MissingFieldError: &errorV1.MissingFieldError{
					Path: proto.String("password"),
				},
			},
		}), nil
	}

	if len(password) <= 8 {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_PasswordLessThanBytes{
				PasswordLessThanBytes: 8,
			},
		}), nil
	}

	requiredPerm := types.Permission_PERMISSION_ADD_REGULAR_USER
	if req.Msg.GetIsAdmin() {
		requiredPerm = types.Permission_PERMISSION_ADD_ADMIN_USER
	}

	if !slices.Contains(user.Permissions, requiredPerm) {
		return createUserPermError(), nil
	}

	for _, u := range users.Projection.Users {
		if u.GetName() == name {
			return connect.NewResponse(&workspaceV2.CreateUserResponse{
				Result: &workspaceV2.CreateUserResponse_DuplicatedName{
					DuplicatedName: name,
				},
			}), nil
		}
	}

	id, err := uuid.NewRandom()
	if err != nil {
		logger.Error("Failed to generate UUID", "error", err)
		return createUserSystemError("Unable to issue a new ID"), nil
	}

	keyID := make([]byte, 32)
	rand.Read(keyID)

	err = event.AppendEvents(tx, []*eventV1.Event{
		workspaceEvent.CreateUser(id.String(), name, displayName, keyID),
		workspaceEvent.ConfigurePasswordLogin(id.String(), password),
	})
	if err != nil {
		logger.Error("Failed to append user creation events", "error", err)
		return createUserSystemError("Database error"), nil
	}

	if req.Msg.GetIsAdmin() {
		err := event.AppendEvents(tx, []*eventV1.Event{
			workspaceEvent.GrantAdminAccess(id.String()),
		})
		if err != nil {
			logger.Error("Failed to append adming grant events", "error", err)
			return createUserSystemError("Database error"), nil
		}
	} else {
		permissions := make([]types.Permission, 0, 32)

		if req.Msg.Permissions != nil {
			if req.Msg.Permissions.GetCanAddUser() {
				// ユーザ追加権限はここに来ている時点で持っているためチェックは不要。
				permissions = append(permissions, types.Permission_PERMISSION_ADD_REGULAR_USER)
			}

			if req.Msg.Permissions.GetCanDeleteRegularUser() {
				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_DELETE_REGULAR_USER) {
					return createUserPermError(), nil
				}

				permissions = append(permissions, types.Permission_PERMISSION_DELETE_REGULAR_USER)
			}

			if req.Msg.Permissions.GetCanReadOtherUserProfile() {
				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_READ_REGULAR_USER_PROFILE) {
					return createUserPermError(), nil
				}

				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_READ_ADMIN_USER_PROFILE) {
					return createUserPermError(), nil
				}

				permissions = append(
					permissions,
					types.Permission_PERMISSION_READ_REGULAR_USER_PROFILE,
					types.Permission_PERMISSION_READ_ADMIN_USER_PROFILE,
				)
			}

			if req.Msg.Permissions.GetCanUpdateOtherRegularUserProfile() {
				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_UPDATE_REGULAR_USER_PROFILE) {
					return createUserPermError(), nil
				}

				permissions = append(permissions, types.Permission_PERMISSION_UPDATE_REGULAR_USER_PROFILE)
			}

			if req.Msg.Permissions.GetCanUpdateSelfProfile() {
				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_UPDATE_SELF_PROFILE) {
					return createUserPermError(), nil
				}

				permissions = append(permissions, types.Permission_PERMISSION_UPDATE_SELF_PROFILE)
			}

			if req.Msg.Permissions.GetCanUpdateOtherRegularUserLoginMethod() {
				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_UPDATE_REGULAR_USER_LOGIN_METHOD) {
					return createUserPermError(), nil
				}

				permissions = append(
					permissions,
					types.Permission_PERMISSION_UPDATE_REGULAR_USER_LOGIN_METHOD,
				)
			}

			if req.Msg.Permissions.GetCanUpdateWorkspace() {
				if !slices.Contains(user.Permissions, types.Permission_PERMISSION_EDIT_WORKSPACE_PROFILE) {
					return createUserPermError(), nil
				}

				permissions = append(permissions, types.Permission_PERMISSION_EDIT_WORKSPACE_PROFILE)
			}
		}

		err := event.AppendEvents(tx, []*eventV1.Event{
			workspaceEvent.GrantPermission(id.String(), permissions),
		})
		if err != nil {
			logger.Error("Failed to append a permissions grant event", "error", err)
			return createUserSystemError("Database error"), nil
		}
	}

	if err := event.UpdateProjections(tx, users); err != nil {
		logger.Error("Failed to update users projection", "error", err)
		return createUserSystemError("Database error"), nil
	}

	if err := tx.Commit(); err != nil {
		logger.Error("Failed to commit transaction", "error", err)
		return createUserSystemError("Database error"), nil
	}

	for _, u := range users.Projection.Users {
		if u.GetId() == id.String() {
			logger.Debug("Created a new user", "id", id.String())

			return connect.NewResponse(&workspaceV2.CreateUserResponse{
				Result: &workspaceV2.CreateUserResponse_Ok{
					Ok: projectionUserToMessage(u),
				},
			}), nil
		}
	}

	logger.Error(
		"Creation of user succeeded, but the user does not exist in projection",
		"id",
		id.String(),
	)

	return createUserSystemError("Database error"), nil
}