/packages/backend/services/workspace/workspace.go at a20b03988c69917c26b409ac4af559c24f894131

// SPDX-FileCopyrightText: 2025 Shota FUJI <pockawoooh@gmail.com>
// SPDX-License-Identifier: AGPL-3.0-only

package workspace

import (
	"bytes"
	"context"
	"crypto/rand"
	"net/http"
	"strings"

	"connectrpc.com/connect"
	"github.com/google/uuid"
	"google.golang.org/protobuf/proto"

	"pocka.jp/x/yamori/backend/core"
	"pocka.jp/x/yamori/backend/core/event"
	"pocka.jp/x/yamori/backend/core/projection"
	"pocka.jp/x/yamori/backend/crypto"
	eventV1 "pocka.jp/x/yamori/proto/go/backend/events/v1"
	workspaceEvent "pocka.jp/x/yamori/proto/go/backend/events/workspace/v1"
	errorV1 "pocka.jp/x/yamori/proto/go/error/v1"
	workspaceV2 "pocka.jp/x/yamori/proto/go/workspace/v2"
	workspaceV2connect "pocka.jp/x/yamori/proto/go/workspace/v2/v2connect"
)

type Service struct {
	core *core.Core
}

func New(core *core.Core) *Service {
	return &Service{core: core}
}

func (s *Service) Login(
	ctx context.Context,
	req *connect.Request[workspaceV2.LoginRequest],
) (*connect.Response[workspaceV2.LoginResponse], error) {
	return connect.NewResponse(&workspaceV2.LoginResponse{
		Result: &workspaceV2.LoginResponse_SystemError{
			SystemError: &errorV1.SystemError{
				Message: proto.String("Not Implemented"),
			},
		},
	}), nil
}

func (s *Service) Logout(
	ctx context.Context,
	req *connect.Request[workspaceV2.LogoutRequest],
) (*connect.Response[workspaceV2.LogoutResponse], error) {
	res := workspaceV2.LogoutResponse{
		SystemError: &errorV1.SystemError{
			Message: proto.String("Not Implemented"),
		},
	}

	return connect.NewResponse(&res), nil
}

func (s *Service) Get(
	ctx context.Context,
	req *connect.Request[workspaceV2.GetRequest],
) (*connect.Response[workspaceV2.GetResponse], error) {
	res := workspaceV2.GetResponse{
		Result: &workspaceV2.GetResponse_SystemError{
			SystemError: &errorV1.SystemError{
				Message: proto.String("Not Implemented"),
			},
		},
	}

	return connect.NewResponse(&res), nil
}

func (s *Service) Update(
	ctx context.Context,
	req *connect.Request[workspaceV2.UpdateRequest],
) (*connect.Response[workspaceV2.UpdateResponse], error) {
	res := workspaceV2.UpdateResponse{
		Result: &workspaceV2.UpdateResponse_SystemError{
			SystemError: &errorV1.SystemError{
				Message: proto.String("Not Implemented"),
			},
		},
	}

	return connect.NewResponse(&res), nil
}

// TODO: 通常の追加フローも書く
func (s *Service) CreateUser(
	ctx context.Context,
	req *connect.Request[workspaceV2.CreateUserRequest],
) (*connect.Response[workspaceV2.CreateUserResponse], error) {
	name := req.Msg.GetName()
	if name == "" {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_MissingFieldError{
				MissingFieldError: &errorV1.MissingFieldError{
					Path: proto.String("name"),
				},
			},
		}), nil
	}

	// TODO: SystemError 以外にする
	if strings.Trim(name, " \r\n\t") != name {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_SystemError{
				SystemError: &errorV1.SystemError{
					Message: proto.String("Name cannot have heading or trailing spaces"),
				},
			},
		}), nil
	}

	displayName := strings.Trim(req.Msg.GetDisplayName(), " \r\n\t")
	if displayName == "" {
		displayName = name
	}

	password := req.Msg.GetPassword()
	if password == "" {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_MissingFieldError{
				MissingFieldError: &errorV1.MissingFieldError{
					Path: proto.String("password"),
				},
			},
		}), nil
	}

	// TODO: SystemError 以外にする
	if len(password) <= 8 {
		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_SystemError{
				SystemError: &errorV1.SystemError{
					Message: proto.String("Password has to be longer than or equals to 8 bytes"),
				},
			},
		}), nil
	}

	// TODO: チェックが煩雑なので CreateUser と別のエンドポイントにする
	initialAdminPassword := req.Msg.GetInitialAdminPassword()
	if initialAdminPassword != "" {
		tx, err := s.core.DB.Begin()
		if err != nil {
			return nil, err
		}
		defer tx.Rollback()

		ws, err := projection.GetWorkspace(tx)
		if err != nil {
			return nil, err
		}

		pw, err := projection.GetAdminCreationPassword(tx)
		if err != nil {
			return nil, err
		}

		if err := event.UpdateProjections(tx, ws, pw); err != nil {
			return nil, err
		}

		if pw.Projection.Password == nil {
			tx.Commit()
			return connect.NewResponse(&workspaceV2.CreateUserResponse{
				Result: &workspaceV2.CreateUserResponse_AuthenticationError{
					AuthenticationError: &errorV1.AuthenticationError{},
				},
			}), nil
		}

		hash := crypto.HashPassword([]byte(initialAdminPassword), pw.Projection.Password.Salt)
		if !bytes.Equal(hash, pw.Projection.Password.Hash) {
			return connect.NewResponse(&workspaceV2.CreateUserResponse{
				Result: &workspaceV2.CreateUserResponse_AuthenticationError{
					AuthenticationError: &errorV1.AuthenticationError{},
				},
			}), nil
		}

		id, err := uuid.NewRandom()
		if err != nil {
			return nil, err
		}

		keyID := make([]byte, 32)
		rand.Read(keyID)

		pwHash, pwSalt := crypto.SaltAndHashPassword([]byte(req.Msg.GetPassword()))

		err = event.AppendEvents(tx, []*eventV1.Event{
			{
				Event: &eventV1.Event_WorkspaceEvent{
					WorkspaceEvent: &workspaceEvent.Event{
						Event: &workspaceEvent.Event_AdminCreationPasswordExpired{
							AdminCreationPasswordExpired: &workspaceEvent.AdminCreationPasswordExpired{},
						},
					},
				},
			},
			{
				Event: &eventV1.Event_WorkspaceEvent{
					WorkspaceEvent: &workspaceEvent.Event{
						Event: &workspaceEvent.Event_UserCreated{
							UserCreated: &workspaceEvent.UserCreated{
								Id:          proto.String(id.String()),
								Name:        proto.String(name),
								DisplayName: proto.String(displayName),
								KeyId:       keyID,
							},
						},
					},
				},
			},
			{
				Event: &eventV1.Event_WorkspaceEvent{
					WorkspaceEvent: &workspaceEvent.Event{
						Event: &workspaceEvent.Event_AdminAccessGranted{
							AdminAccessGranted: &workspaceEvent.AdminAccessGranted{
								UserId: proto.String(id.String()),
							},
						},
					},
				},
			},
			{
				Event: &eventV1.Event_WorkspaceEvent{
					WorkspaceEvent: &workspaceEvent.Event{
						Event: &workspaceEvent.Event_PasswordLoginConfigured{
							PasswordLoginConfigured: &workspaceEvent.PasswordLoginConfigured{
								UserId:       proto.String(id.String()),
								PasswordHash: pwHash,
								PasswordSalt: pwSalt,
							},
						},
					},
				},
			},
		})
		if err != nil {
			return nil, err
		}

		if err := tx.Commit(); err != nil {
			return nil, err
		}

		return connect.NewResponse(&workspaceV2.CreateUserResponse{
			Result: &workspaceV2.CreateUserResponse_Ok{
				Ok: nil,
			},
		}), nil
	}

	res := workspaceV2.CreateUserResponse{
		Result: &workspaceV2.CreateUserResponse_SystemError{
			SystemError: &errorV1.SystemError{
				Message: proto.String("Not Implemented"),
			},
		},
	}

	return connect.NewResponse(&res), nil
}

func (s *Service) Register(mux *http.ServeMux) {
	path, handler := workspaceV2connect.NewWorkspaceServiceHandler(s)

	mux.Handle(path, handler)
}